admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Debugging cloud search

Browse Source
This commit is contained in:
pyth0n1c
2022-02-25 14:06:13 -08:00
committed by GitHub
parent e87c2f5ae5
commit 5164df6a2c
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: This search looks for cloud instances being modified by users who h
not previously modified them.
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=firewall
All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
+2 -2
View File
@@ -9,8 +9,8 @@ datamodel:
description: This search builds a table of previously seen users that have modified
a cloud instance.
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats
from datamodel=Change where All_Changes.action=modified All_Changes.change_type=firewall
All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats
min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <=
relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
description: This search updates a table of previously seen Cloud Instance modifications
that have been made by a user
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
from datamodel=Change where All_Changes.action=modified All_Changes.change_type=firewall
All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
| inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats
min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user |