admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-05-21 00:33:36 +00:00
committed by GitHub
parent 7d7bcb497e 9a2a30ae97
commit 2e335b317d
5 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_iam_accessdenied_discovery_events.yml
+3
View File
@@ -44,4 +44,7 @@ tags:
- userAgent
- errorCode
- userIdentity.type
risk_object: src_ip
risk_object_type: system
risk_score: 20
security_domain: access
detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+3
View File
@@ -49,4 +49,7 @@ tags:
- userAgent
- errorCode
- requestParameters.policyName
risk_object: src
risk_object_type: system
risk_score: 20
security_domain: access
detections/cloud/aws_iam_delete_policy.yml
+3
View File
@@ -46,4 +46,7 @@ tags:
- userAgent
- errorCode
- requestParameters.policyArn
risk_object: src
risk_object_type: system
risk_score: 20
security_domain: access
detections/cloud/aws_iam_failure_group_deletion.yml
+3
View File
@@ -46,4 +46,7 @@ tags:
- userAgent
- errorCode
- requestParameters.groupName
risk_object: src
risk_object_type: system
risk_score: 20
security_domain: identity
detections/cloud/aws_iam_successful_group_deletion.yml
+3
View File
@@ -45,4 +45,7 @@ tags:
- userAgent
- errorCode
- requestParameters.groupName
risk_object: src
risk_object_type: system
risk_score: 20
security_domain: identity