admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed validate script errors

Browse Source
This commit is contained in:
David Dorsey
2020-08-26 23:50:25 -05:00
parent 0c7efecd12
commit 0b9dd4ca9b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/abnormally_high_cloud_instances_destroyed.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: '| tstats count as instances_destroyed values(All_Changes.object_id) as
| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
| eval distance_from_threshold = instances_launched - expected_upper_threshold
| table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id
| 'abnormally_high_number_of_cloud_instances_destroyed_filter'
| `abnormally_high_number_of_cloud_instances_destroyed_filter`'
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
out service accounts from the output. Always verify if this search alerted on a