admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Changed object to object_id

Browse Source
This commit is contained in:
David Dorsey
2020-09-15 10:30:02 -05:00
parent 9b785919de
commit 3e420d4cf5
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud_provisioning_from_previously_unseen_ip_address.yml
+3 -3
View File
@@ -15,15 +15,15 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
type: ESCU
references: []
author: Rico Valdez, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")`
by All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
| iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data
| where enough_data=1
| eval firstTimeSeenSrc=min(firstTimeSeen)
| where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`")
| table firstTime, src, user, object, command
| table firstTime, src, user, object_id, command
| `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`'
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\