admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update aws_cloud_provisioning_from_previously_unseen_ip.yml

Browse Source 
Removed iplocation and Country filter, we are lokking IPs here
This commit is contained in:
carroyod
2020-04-28 13:59:52 +02:00
committed by GitHub
parent b2f81ea4b3
commit 1ac3cc680b
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_cloud_provisioning_from_previously_unseen_ip.yml
+1 -2
View File
@@ -32,8 +32,7 @@ detect:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
search: sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iplocation
sourceIPAddress | search Country=* [search sourcetype=aws:cloudtrail (eventName=Run*
search: sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) [search sourcetype=aws:cloudtrail (eventName=Run*
OR eventName=Create*) | iplocation sourceIPAddress | search Country=* | stats
earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress,
City, Region, Country | inputlookup append=t previously_seen_provisioning_activity_src.csv