From 5164df6a2c9cd927e40ec5b1ada04f3fa68ecc60 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Feb 2022 14:06:13 -0800
Subject: [PATCH] Debugging cloud search

---
 .../cloud_instance_modified_with_previously_unseen_user.yml   | 2 +-
 ...usly_seen_cloud_instance_modifications_by_user_initial.yml | 4 ++--
 ...ously_seen_cloud_instance_modifications_by_user_update.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
index da2a51b79e..9e865bf809 100644
--- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
@@ -10,7 +10,7 @@ description: This search looks for cloud instances being modified by users who h
   not previously modified them.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
   latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
-  as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
+  as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=firewall
   All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
   | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW
   firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
diff --git a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
index 4e696ae8fc..8db490e0d5 100644
--- a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
+++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
@@ -9,8 +9,8 @@ datamodel:
 description: This search builds a table of previously seen users that have modified
   a cloud instance.
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
-  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
-  c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats
+  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=firewall
+  All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats
   min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <=
   relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
diff --git a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
index 2de6509394..69fe4ce3c7 100644
--- a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
+++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search updates a table of previously seen Cloud Instance modifications
   that have been made by a user
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
-  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
+  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=firewall
   All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
   | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats
   min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user |