From a5b0e785aefd745dda8adbef508368718c29db82 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 20 May 2021 13:00:47 -0700 Subject: [PATCH] adding risk tags --- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 3 +++ detections/cloud/aws_iam_assume_role_policy_brute_force.yml | 3 +++ detections/cloud/aws_iam_delete_policy.yml | 3 +++ detections/cloud/aws_iam_failure_group_deletion.yml | 3 +++ detections/cloud/aws_iam_successful_group_deletion.yml | 3 +++ 5 files changed, 15 insertions(+) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 5ddb223ebd..ef96015f78 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -44,4 +44,7 @@ tags: - userAgent - errorCode - userIdentity.type + risk_object: src_ip + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 6b27566d71..8dbe65bb13 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -49,4 +49,7 @@ tags: - userAgent - errorCode - requestParameters.policyName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 1bdbeae373..b049e0f898 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -46,4 +46,7 @@ tags: - userAgent - errorCode - requestParameters.policyArn + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 27201dcf6c..0315b7eb6b 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -46,4 +46,7 @@ tags: - userAgent - errorCode - requestParameters.groupName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: identity diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index bd28eddce7..997d2d01d5 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -45,4 +45,7 @@ tags: - userAgent - errorCode - requestParameters.groupName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: identity