From c10d11aa9426f724514be46a2c06dd554851c2e2 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 18 Aug 2021 12:57:22 +0200
Subject: [PATCH 1/5] AWS ECR detections

---
 ...s_ecr_container_scanning_findings_high.yml | 52 +++++++++++++++++++
 ...ing_findings_low_informational_unknown.yml | 52 +++++++++++++++++++
 ...ecr_container_scanning_findings_medium.yml | 52 +++++++++++++++++++
 stories/devsecops.yml                         | 25 +++++++++
 ..._container_scanning_findings_high.test.yml | 13 +++++
 ...indings_low_informational_unknown.test.yml | 13 +++++
 ...ontainer_scanning_findings_medium.test.yml | 13 +++++
 7 files changed, 220 insertions(+)
 create mode 100644 detections/cloud/aws_ecr_container_scanning_findings_high.yml
 create mode 100644 detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
 create mode 100644 detections/cloud/aws_ecr_container_scanning_findings_medium.yml
 create mode 100644 stories/devsecops.yml
 create mode 100644 tests/cloud/aws_ecr_container_scanning_findings_high.test.yml
 create mode 100644 tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
 create mode 100644 tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
new file mode 100644
index 0000000000..e040a4524b
--- /dev/null
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -0,0 +1,52 @@
+name: AWS ECR Container Scanning Findings High
+id: 62721bd2-1d82-4623-b6e6-aac170014423
+version: 1
+date: '2021-08-17'
+author: Patrick Bareiss, Splunk
+type: TTP
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
+  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com command=DescribeImageScanFindings 
+  | spath path=responseElements.imageScanFindings.findings{} output=findings 
+  | mvexpand findings | spath input=findings| search severity=HIGH
+  | rename name as finding_name, description as finding_description, 
+  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
+  | eval finding = finding_name.", ".finding_description
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_scanning_findings_high_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+tags:
+  analytic_story:
+  - DevSecOps
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities with severity high found in repository $repositoryName$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repositoryName
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  risk_score: 49
+  security_domain: network
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
new file mode 100644
index 0000000000..c1b95e5aab
--- /dev/null
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -0,0 +1,52 @@
+name: AWS ECR Container Scanning Findings Low Informational Unknwon
+id: cbc95e44-7c22-443f-88fd-0424478f5589
+version: 1
+date: '2021-08-17'
+author: Patrick Bareiss, Splunk
+type: Hunting
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
+  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com command=DescribeImageScanFindings 
+  | spath path=responseElements.imageScanFindings.findings{} output=findings 
+  | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
+  | rename name as finding_name, description as finding_description, 
+  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
+  | eval finding = finding_name.", ".finding_description
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+tags:
+  analytic_story:
+  - DevSecOps
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities with severity high found in repository $repositoryName$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repositoryName
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  risk_score: 49
+  security_domain: network
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
new file mode 100644
index 0000000000..2d8d497dfa
--- /dev/null
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -0,0 +1,52 @@
+name: AWS ECR Container Scanning Findings Medium
+id: cbc95e44-7c22-443f-88fd-0424478f5589
+version: 1
+date: '2021-08-17'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
+  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com command=DescribeImageScanFindings 
+  | spath path=responseElements.imageScanFindings.findings{} output=findings 
+  | mvexpand findings | spath input=findings| search severity=MEDIUM
+  | rename name as finding_name, description as finding_description, 
+  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
+  | eval finding = finding_name.", ".finding_description
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `aws_ecr_container_scanning_findings_medium_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+tags:
+  analytic_story:
+  - DevSecOps
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities with severity high found in repository $repositoryName$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repositoryName
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  risk_score: 49
+  security_domain: network
diff --git a/stories/devsecops.yml b/stories/devsecops.yml
new file mode 100644
index 0000000000..628ce56623
--- /dev/null
+++ b/stories/devsecops.yml
@@ -0,0 +1,25 @@
+name: DevSecOps
+id: 0ca8c38e-631e-4b81-940c-f9c5450ce41e
+version: 1
+date: '2021-08-18'
+author: Patrick Bareiss, Splunk
+description: This story is focused around detecting attacks on a DevSecOps lifeccycle which
+  consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+narrative: DevSecOps is a collaborative framework, which thinks about application and infrastructure 
+  security from the start. This means that security tools are part of the continuous integration and 
+  continuous deployment pipeline. In this analytics story, we focused on detections around the tools
+  used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI
+  as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as
+  Semgrep and Kube-Hunter.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story: DevSecOps
+  category:
+  - Cloud Security
+  product:
+  - Splunk Security Analytics for AWS
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring
diff --git a/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml
new file mode 100644
index 0000000000..280378e738
--- /dev/null
+++ b/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml
@@ -0,0 +1,13 @@
+name: AWS ECR Container Scanning Findings High Unit Test
+tests:
+- name: AWS ECR Container Scanning Findings High
+  file: cloud/aws_ecr_container_scanning_findings_high.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_scanning_findings_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True
diff --git a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
new file mode 100644
index 0000000000..460db8416c
--- /dev/null
+++ b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
@@ -0,0 +1,13 @@
+name: AWS ECR Container Scanning Findings Low Informational Unknwon Unit Test
+tests:
+- name: AWS ECR Container Scanning Findings Low Informational Unknwon
+  file: cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_scanning_findings_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True
diff --git a/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml
new file mode 100644
index 0000000000..fab2e48453
--- /dev/null
+++ b/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml
@@ -0,0 +1,13 @@
+name: AWS ECR Container Scanning Findings Medium Unit Test
+tests:
+- name: AWS ECR Container Scanning Findings Medium
+  file: cloud/aws_ecr_container_scanning_findings_medium.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_ecr_scanning_findings_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

From 51967d9f89909f78432aa2964b768260a6d060b3 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 18 Aug 2021 13:00:09 +0200
Subject: [PATCH 2/5] AWS ECR detections

---
 ...cr_container_scanning_findings_low_informational_unknown.yml | 2 +-
 detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index c1b95e5aab..0181748e1f 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -1,4 +1,4 @@
-name: AWS ECR Container Scanning Findings Low Informational Unknwon
+name: AWS ECR Container Scanning Findings Low Informational Unknown
 id: cbc95e44-7c22-443f-88fd-0424478f5589
 version: 1
 date: '2021-08-17'
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index 2d8d497dfa..b84d644ffb 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -1,5 +1,5 @@
 name: AWS ECR Container Scanning Findings Medium
-id: cbc95e44-7c22-443f-88fd-0424478f5589
+id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
 version: 1
 date: '2021-08-17'
 author: Patrick Bareiss, Splunk

From 1cae8496525b99893778814072e48c7355bfe66d Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 18 Aug 2021 13:04:30 +0200
Subject: [PATCH 3/5] AWS ECR detections

---
 .../aws_ecr_container_scanning_findings_high.yml      | 11 ++++++++++-
 ...er_scanning_findings_low_informational_unknown.yml | 11 ++++++++++-
 .../aws_ecr_container_scanning_findings_medium.yml    | 11 ++++++++++-
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index e040a4524b..78e25836f9 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
   You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-search: '`cloudtrail` eventSource=ecr.amazonaws.com command=DescribeImageScanFindings 
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
   | spath path=responseElements.imageScanFindings.findings{} output=findings 
   | mvexpand findings | spath input=findings| search severity=HIGH
   | rename name as finding_name, description as finding_description, 
@@ -48,5 +48,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - eventSource
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
   risk_score: 49
   security_domain: network
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index 0181748e1f..0dc1364bc5 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -7,7 +7,7 @@ type: Hunting
 datamodel: []
 description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
   You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-search: '`cloudtrail` eventSource=ecr.amazonaws.com command=DescribeImageScanFindings 
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
   | spath path=responseElements.imageScanFindings.findings{} output=findings 
   | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
   | rename name as finding_name, description as finding_description, 
@@ -48,5 +48,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - eventSource
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
   risk_score: 49
   security_domain: network
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index b84d644ffb..ebc62fcf7e 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel: []
 description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
   You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-search: '`cloudtrail` eventSource=ecr.amazonaws.com command=DescribeImageScanFindings 
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
   | spath path=responseElements.imageScanFindings.findings{} output=findings 
   | mvexpand findings | spath input=findings| search severity=MEDIUM
   | rename name as finding_name, description as finding_description, 
@@ -48,5 +48,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - eventSource
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
+  - user
+  - userName
+  - src_ip
   risk_score: 49
   security_domain: network

From 2075f8a9fd575b757a255922d61943da7d31cc2b Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 18 Aug 2021 14:07:45 +0200
Subject: [PATCH 4/5] AWS ECR detections

---
 detections/cloud/aws_ecr_container_scanning_findings_high.yml   | 2 +-
 ...cr_container_scanning_findings_low_informational_unknown.yml | 2 +-
 detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 2 +-
 stories/{devsecops.yml => dev_sec_ops.yml}                      | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)
 rename stories/{devsecops.yml => dev_sec_ops.yml} (98%)

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index 78e25836f9..5b605d72e7 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -23,7 +23,7 @@ references:
 - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   asset_type: AWS Account
   cis20:
   - CIS 13
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index 0dc1364bc5..bbe2146e41 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -23,7 +23,7 @@ references:
 - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   asset_type: AWS Account
   cis20:
   - CIS 13
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index ebc62fcf7e..28d4565ff0 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -23,7 +23,7 @@ references:
 - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   asset_type: AWS Account
   cis20:
   - CIS 13
diff --git a/stories/devsecops.yml b/stories/dev_sec_ops.yml
similarity index 98%
rename from stories/devsecops.yml
rename to stories/dev_sec_ops.yml
index 628ce56623..610df19978 100644
--- a/stories/devsecops.yml
+++ b/stories/dev_sec_ops.yml
@@ -1,4 +1,4 @@
-name: DevSecOps
+name: Dev Sec Ops
 id: 0ca8c38e-631e-4b81-940c-f9c5450ce41e
 version: 1
 date: '2021-08-18'

From 3270cdc014dd8b4b6939bbd73f8878b766dc2de8 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 18 Aug 2021 14:53:28 +0200
Subject: [PATCH 5/5] aws ecr dataset

---
 stories/dev_sec_ops.yml                                          | 1 -
 tests/cloud/aws_ecr_container_scanning_findings_high.test.yml    | 1 -
 ...ontainer_scanning_findings_low_informational_unknown.test.yml | 1 -
 tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml  | 1 -
 4 files changed, 4 deletions(-)

diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml
index 610df19978..ccc8d0b06e 100644
--- a/stories/dev_sec_ops.yml
+++ b/stories/dev_sec_ops.yml
@@ -18,7 +18,6 @@ tags:
   category:
   - Cloud Security
   product:
-  - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
diff --git a/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml
index 280378e738..05ddd52af6 100644
--- a/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml
+++ b/tests/cloud/aws_ecr_container_scanning_findings_high.test.yml
@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: True
diff --git a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
index 460db8416c..9b7fd42bcd 100644
--- a/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
+++ b/tests/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: True
diff --git a/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml b/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml
index fab2e48453..5ee08601b9 100644
--- a/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml
+++ b/tests/cloud/aws_ecr_container_scanning_findings_medium.test.yml
@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: True