Branch was auto-updated.

detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml

@@ -23,8 +23,7 @@ search: ' `amazon_security_lake` api.operation=DescribeEventAggregates src_endpo
   by _time identity.user.credential_uid identity.user.name
   | where distinct_ip_count > 1 
   | `aws_concurrent_sessions_from_different_ips_filter`'
-how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
-  search works with Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: A user with concurrent sessions from different Ips may also
   represent the legitimate use of more than one device. Filter as needed and/or customize
   the threshold to fit your environment.

detections/cloud/asl_aws_createaccesskey.yml

@@ -27,8 +27,7 @@ search: '`amazon_security_lake` api.operation=CreateAccessKey http_request.user_
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
   |`asl_aws_createaccesskey_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has legitimately created keys for another user.
 references:

detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml

@@ -15,8 +15,7 @@ search: '`amazon_security_lake` api.operation=DeleteTrail
   | stats count min(_time) as firstTime max(_time) as lastTime by identity.user.account_uid identity.user.credential_uid identity.user.name 
   identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudtrail_filter`'
-how_to_implement: You must install Splunk AWS Add on and enable Amazon Security Lake logs in
-  your AWS Environment.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has stopped cloudTrail logging. Please investigate this activity.
 references:

detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml

@@ -15,8 +15,7 @@ search: '`amazon_security_lake` api.operation=DeleteLogGroup
   | stats count min(_time) as firstTime max(_time) as lastTime by identity.user.account_uid identity.user.credential_uid identity.user.name 
   identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`'
-how_to_implement: You must install Splunk AWS Add on and enable Amazon Security Lake logs in
-  your AWS Environment.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
 references:

detections/cloud/asl_aws_defense_evasion_impair_security_services.yml

@@ -17,8 +17,7 @@ search: '`amazon_security_lake` api.operation IN ("DeleteLogStream","DeleteDetec
   identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`|  `asl_aws_defense_evasion_impair_security_services_filter`'
-how_to_implement: You must install Splunk AWS Add on and enable Amazon Security Lake logs in
-  your AWS Environment.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: While this search has no known false positives, it is possible
   that it is a legitimate admin activity. Please consider filtering out these noisy
   events using userAgent, user_arn field names.

detections/cloud/asl_aws_excessive_security_scanning.yml

@@ -14,8 +14,7 @@ search: '`amazon_security_lake` api.operation=Describe* OR api.operation=List* O
   values(src_endpoint.ip) as src_endpoint.ip values(cloud.region) as cloud.region values(identity.user.account_uid) as identity.user.account_uid by identity.user.name 
   | where dc_api_operations > 50 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`|`asl_aws_excessive_security_scanning_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: While this search has no known false positives.
 references:
 - https://github.com/aquasecurity/cloudsploit

detections/cloud/asl_aws_iam_delete_policy.yml

@@ -15,8 +15,7 @@ search: '`amazon_security_lake` api.operation=DeletePolicy | stats count min(_ti
   api.service.name identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type identity.user.uid identity.user.uuid 
   http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `asl_aws_iam_delete_policy_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
-  this data. The search requires Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: This detection will require tuning to provide high fidelity
   detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
   or by groups of users. Not every user with AWS access should have permission to

detections/cloud/asl_aws_multi_factor_authentication_disabled.yml

@@ -19,8 +19,7 @@ search: '`amazon_security_lake` (api.operation=DeleteVirtualMFADevice OR api.ope
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
   | `asl_aws_multi_factor_authentication_disabled_filter`'
-how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search
-  requires Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: AWS Administrators may disable MFA but it is highly unlikely
   for this event to occur without prior notice to the company
 references:

detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml

@@ -15,8 +15,7 @@ search: ' `amazon_security_lake` api.operation=CreateVirtualMFADevice | stats co
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `asl_aws_new_mfa_method_registered_for_user_filter`'
-how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
-  search works with Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: Newly onboarded users who are registering an MFA method for
   the first time will also trigger this detection.
 references:

detections/cloud/asl_aws_password_policy_changes.yml

@@ -18,8 +18,7 @@ search: '`amazon_security_lake` "api.service.name"="iam.amazonaws.com" "api.oper
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`  
   | `asl_aws_password_policy_changes_filter`'
-how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
-  search works with Amazon Security Lake logs.
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has legitimately triggered an AWS audit tool activity which may
   trigger this event.