From e61e35c3f606431064ef38b9404f44da8f16b566 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 18 Mar 2022 16:10:52 -0700 Subject: [PATCH] In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated. --- ...lly_high_number_of_cloud_infrastructure_api_calls.test.yml | 2 +- ...lly_high_number_of_cloud_security_group_api_calls.test.yml | 2 +- ...s_account_activity_from_previously_unseen_account.test.yml | 4 ++-- ...cloud_api_calls_from_previously_unseen_user_roles.test.yml | 4 ++-- ...ompute_instance_created_by_previously_unseen_user.test.yml | 4 ++-- ...pute_instance_created_in_previously_unused_region.test.yml | 4 ++-- ...ute_instance_created_with_previously_unseen_image.test.yml | 4 ++-- ...ance_created_with_previously_unseen_instance_type.test.yml | 4 ++-- ...oud_instance_modified_with_previously_unseen_user.test.yml | 4 ++-- .../cloud_provisioning_from_previously_unseen_city.test.yml | 4 ++-- ...cloud_provisioning_from_previously_unseen_country.test.yml | 4 ++-- ...ud_provisioning_from_previously_unseen_ip_address.test.yml | 4 ++-- .../cloud_provisioning_from_previously_unseen_region.test.yml | 4 ++-- tests/cloud/detect_aws_console_login_by_new_user.test.yml | 4 ++-- .../detect_aws_console_login_by_user_from_new_city.test.yml | 4 ++-- ...detect_aws_console_login_by_user_from_new_country.test.yml | 4 ++-- .../detect_aws_console_login_by_user_from_new_region.test.yml | 4 ++-- 17 files changed, 32 insertions(+), 32 deletions(-) diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml index fae6763b30..290bc2758d 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now baselines: - name: Baseline Of Cloud Infrastructure API Calls Per User - file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml + file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml index 91188972e6..0f73d485d2 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now baselines: - name: Baseline Of Cloud Security Group API Calls Per User - file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml + file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml index 2c03b8db04..5213f6b857 100644 --- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml +++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen AWS Cross Account Activity - Initial - file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml + file: baselines/previously_seen_aws_cross_account_activity___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen AWS Cross Account Activity - Update - file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml + file: baselines/previously_seen_aws_cross_account_activity___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml index 0124df4117..1554b96ffa 100644 --- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml +++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud API Calls Per User Role - Initial - file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml + file: baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud API Calls Per User Role - Update - file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml + file: baselines/previously_seen_cloud_api_calls_per_user_role___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml index 65a2e8624f..f52b12aa01 100644 --- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Compute Creations By User - Initial - file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml + file: baselines/previously_seen_cloud_compute_creations_by_user___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Compute Creations By User - Update - file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml + file: baselines/previously_seen_cloud_compute_creations_by_user___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml index d91095aff0..9964e1d82b 100644 --- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml +++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Regions - Initial - file: detections/cloud/previously_seen_cloud_regions_initial.yml + file: baselines/previously_seen_cloud_regions___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Regions - Update - file: detections/cloud/previously_seen_cloud_regions_update.yml + file: baselines/previously_seen_cloud_regions___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml index 50115a04bf..bcb75a79e1 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Compute Images - Initial - file: detections/cloud/previously_seen_cloud_compute_images_initial.yml + file: baselines/previously_seen_cloud_compute_images___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Compute Images - Update - file: detections/cloud/previously_seen_cloud_compute_images_update.yml + file: baselines/previously_seen_cloud_compute_images___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml index b72e7d26aa..27e1083bf4 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Compute Instance Types - Initial - file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml + file: baselines/previously_seen_cloud_compute_instance_types___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Compute Instance Types - Update - file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml + file: baselines/previously_seen_cloud_compute_instance_types___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml index b2f6d85aaf..c5998f919f 100644 --- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Instance Modifications By User - Initial - file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml + file: baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Instance Modifications By User - Update - file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml + file: baselines/previously_seen_cloud_instance_modifications_by_user___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml index 5e1d145109..e1d4a7e3cd 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml index 3d3b73b3f7..9b32c57e92 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml index a8e77d70c8..22095ed888 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml index c483e82604..9f5969eb7d 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml + file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml index ad1cb98bea..3ef59ba1c6 100644 --- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml +++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml + file: baselines/previously_seen_users_in_cloudtrail___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Users In Cloudtrail - Update - file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml + file: baselines/previously_seen_users_in_cloudtrail___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml index bbec97937b..72ca7c23c9 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml + file: baselines/previously_seen_users_in_cloudtrail___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Users In Cloudtrail - Update - file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml + file: baselines/previously_seen_users_in_cloudtrail___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml index 8e4e13e7bc..72cf23e6e2 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml + file: baselines/previously_seen_users_in_cloudtrail___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Users In Cloudtrail - Update - file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml + file: baselines/previously_seen_users_in_cloudtrail___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml index b494592421..23eb695f11 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: now baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml + file: baselines/previously_seen_users_in_cloudtrail___initial.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d - name: Previously Seen Users In Cloudtrail - Update - file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml + file: baselines/previously_seen_users_in_cloudtrail___update.yml pass_condition: '| stats count | where count > 0' earliest_time: -30d latest_time: -1d