From 3e420d4cf587994dcae4de88ba00a9aeed8f5452 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Tue, 15 Sep 2020 10:30:02 -0500 Subject: [PATCH] Changed object to object_id --- ...cloud_provisioning_from_previously_unseen_ip_address.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud_provisioning_from_previously_unseen_ip_address.yml index 13b1076c62..0754030e49 100644 --- a/detections/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -15,15 +15,15 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your type: ESCU references: [] author: Rico Valdez, Splunk -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success - by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` + by All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), "`previously_unseen_cloud_provisioning_activity_window`") - | table firstTime, src, user, object, command + | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`' known_false_positives: "This is a strictly behavioral search, so we define \"false\ \ positive\" slightly differently. Every time this fires, it will accurately reflect\