From 0748b5e8eeed5d117f3f2bbfeecd5f0737c496d3 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Wed, 9 Sep 2020 01:00:45 -0500 Subject: [PATCH] bug fixes --- baselines/baseline_of_cloud_instances_destroyed.yml | 2 +- baselines/baseline_of_cloud_instances_launched.yml | 2 +- detections/abnormally_high_cloud_instances_destroyed.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/baselines/baseline_of_cloud_instances_destroyed.yml b/baselines/baseline_of_cloud_instances_destroyed.yml index d468240a9c..afb6a6c6f5 100644 --- a/baselines/baseline_of_cloud_instances_destroyed.yml +++ b/baselines/baseline_of_cloud_instances_destroyed.yml @@ -22,7 +22,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi author: David Dorsey, Splunk search: '| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted - AND All_Changes.status=success AND All_Changes.object_category=instance `excessive_cloud_instances_deleted_input_filter` + AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) diff --git a/baselines/baseline_of_cloud_instances_launched.yml b/baselines/baseline_of_cloud_instances_launched.yml index 5b678701cb..d49d4441d9 100644 --- a/baselines/baseline_of_cloud_instances_launched.yml +++ b/baselines/baseline_of_cloud_instances_launched.yml @@ -22,7 +22,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi author: David Dorsey, Splunk search: '| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) - AND All_Changes.status=success AND All_Changes.object_category=instance `excessive_cloud_instances_input_filter` + AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) diff --git a/detections/abnormally_high_cloud_instances_destroyed.yml b/detections/abnormally_high_cloud_instances_destroyed.yml index fdcc0ec6ac..a07255cae3 100644 --- a/detections/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/abnormally_high_cloud_instances_destroyed.yml @@ -11,7 +11,7 @@ type: ESCU references: [] author: David Dorsey, Splunk search: '| tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where - (All_Changes.action=created) + All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`