admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

search name consistency

Browse Source
This commit is contained in:
bpatel
2020-04-15 11:44:39 -07:00
parent 2492d2ede5
commit 330c7aaaf2
4 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/kubernetes_aws_scan_fingerprint.yml
+3 -3
View File
@@ -32,8 +32,8 @@ eli5: In this search we can detect unauthenticated web requests against an EKS c
entities:
- k8s_cluster_name
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. The threshold value should be tuned to your environment.
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudWatch
inputs.
id: 294c4686-63dd-4fe6-93a2-ca807626704a
known_false_positives: Not all unauthenticated requests are malicious, but frequency, UA and source IPs will provide context.
maintainers:
@@ -48,7 +48,7 @@ mappings:
mitre_technique_id:
- T1190
modification_date: '2020-03-24'
name: Amazon EKS Kubernetes cluster fingerprint scan detection
name: Amazon EKS Kubernetes cluster scan detection
original_authors:
- company: Splunk
email: rsoto@splunk.com
detections/kubernetes_gcp_scan_fingerprint_attack.yml
+1 -1
View File
@@ -46,7 +46,7 @@ mappings:
mitre_technique_id:
- T1190
modification_date: '2020-03-24'
name: GCP Kubernetes cluster fingerprint scan/attack detection
name: GCP Kubernetes cluster scan detection
original_authors:
- company: Splunk
email: rsoto@splunk.com
detections/kubernetes_pods_aws_scan_fingerprint.yml
+1 -1
View File
@@ -46,7 +46,7 @@ mappings:
mitre_technique_id:
- T1190
modification_date: '2020-03-24'
name: Amazon EKS Kubernetes Pod fingerprint scan detection
name: Amazon EKS Kubernetes Pod scan detection
original_authors:
- company: Splunk
email: rsoto@splunk.com
stories/kubernetes_scan.yml
+3 -3
View File
@@ -5,13 +5,13 @@ creation_date: '2020-03-24'
description: This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
detections:
- detection_id: db5957ec-0144-4c56-b512-9dccbe7a2d26
name: GCP Kubernetes cluster fingerprint scan/attack detection
name: GCP Kubernetes cluster scan detection
type: splunk
- detection_id: 294c4686-63dd-4fe6-93a2-ca807626704a
name: Detect Amazon EKS cluster fingerprint scan
name: Amazon EKS Kubernetes cluster scan detection
type: splunk
- detection_id: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002
name: Amazon EKS Kubernetes Pod fingerprint scan detection
name: Amazon EKS Kubernetes Pod scan detection
type: splunk
id: a9ef59cf-e981-4e66-9eef-bb049f695c09
maintainers: