admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

bug fixes

Browse Source
This commit is contained in:
David Dorsey
2020-09-09 01:00:45 -05:00
parent 3697092a4b
commit 0748b5e8ee
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/baseline_of_cloud_instances_destroyed.yml
+1 -1
View File
@@ -22,7 +22,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
author: David Dorsey, Splunk
search: '| tstats count as instances_destroyed from datamodel=Change where
All_Changes.action=deleted
AND All_Changes.status=success AND All_Changes.object_category=instance `excessive_cloud_instances_deleted_input_filter`
AND All_Changes.status=success AND All_Changes.object_category=instance
by _time span=1h
| makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001)
| eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
baselines/baseline_of_cloud_instances_launched.yml
+1 -1
View File
@@ -22,7 +22,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
author: David Dorsey, Splunk
search: '| tstats count as instances_launched from datamodel=Change where
(All_Changes.action=created)
AND All_Changes.status=success AND All_Changes.object_category=instance `excessive_cloud_instances_input_filter`
AND All_Changes.status=success AND All_Changes.object_category=instance
by _time span=1h
| makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001)
| eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
detections/abnormally_high_cloud_instances_destroyed.yml
+1 -1
View File
@@ -11,7 +11,7 @@ type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where
(All_Changes.action=created)
All_Changes.action=deleted
AND All_Changes.status=success AND All_Changes.object_category=instance
by All_Changes.user _time span=1h
| `drop_dm_object_name("All_Changes")`