admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-21 13:00:40 -07:00
committed by GitHub
parent 0ae53b0fe9 d17851aff8
commit 4a8760a9b3
17 changed files with 32 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
+1 -1
View File
@@ -7,7 +7,7 @@ tests:
latest_time: now
baselines:
- name: Baseline Of Cloud Infrastructure API Calls Per User
file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml
file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
+1 -1
View File
@@ -7,7 +7,7 @@ tests:
latest_time: now
baselines:
- name: Baseline Of Cloud Security Group API Calls Per User
file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml
file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen AWS Cross Account Activity - Initial
file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml
file: baselines/previously_seen_aws_cross_account_activity___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen AWS Cross Account Activity - Update
file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml
file: baselines/previously_seen_aws_cross_account_activity___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud API Calls Per User Role - Initial
file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml
file: baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud API Calls Per User Role - Update
file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml
file: baselines/previously_seen_cloud_api_calls_per_user_role___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Compute Creations By User - Initial
file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
file: baselines/previously_seen_cloud_compute_creations_by_user___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Compute Creations By User - Update
file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
file: baselines/previously_seen_cloud_compute_creations_by_user___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Regions - Initial
file: detections/cloud/previously_seen_cloud_regions_initial.yml
file: baselines/previously_seen_cloud_regions___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Regions - Update
file: detections/cloud/previously_seen_cloud_regions_update.yml
file: baselines/previously_seen_cloud_regions___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Compute Images - Initial
file: detections/cloud/previously_seen_cloud_compute_images_initial.yml
file: baselines/previously_seen_cloud_compute_images___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Compute Images - Update
file: detections/cloud/previously_seen_cloud_compute_images_update.yml
file: baselines/previously_seen_cloud_compute_images___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Compute Instance Types - Initial
file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml
file: baselines/previously_seen_cloud_compute_instance_types___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Compute Instance Types - Update
file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml
file: baselines/previously_seen_cloud_compute_instance_types___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Instance Modifications By User - Initial
file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
file: baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Instance Modifications By User - Update
file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
file: baselines/previously_seen_cloud_instance_modifications_by_user___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/detect_aws_console_login_by_new_user.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
file: baselines/previously_seen_users_in_cloudtrail___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Users In Cloudtrail - Update
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
file: baselines/previously_seen_users_in_cloudtrail___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
file: baselines/previously_seen_users_in_cloudtrail___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Users In Cloudtrail - Update
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
file: baselines/previously_seen_users_in_cloudtrail___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
file: baselines/previously_seen_users_in_cloudtrail___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Users In Cloudtrail - Update
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
file: baselines/previously_seen_users_in_cloudtrail___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: now
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
file: baselines/previously_seen_users_in_cloudtrail___initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d
- name: Previously Seen Users In Cloudtrail - Update
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
file: baselines/previously_seen_users_in_cloudtrail___update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -30d
latest_time: -1d