Improved ASL AWS detections

detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml

@@ -15,19 +15,9 @@ description: The following analytic identifies an AWS IAM account with concurren
   to sensitive corporate resources, leading to potential data breaches or further
   exploitation.
 data_source: []
-search: '`amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS
-  Internal" | bin span=5m _time | stats values(src_endpoint.ip) as src_ip dc(src_endpoint.ip)
-  as distinct_ip_count by _time identity.user.credential_uid identity.user.name |
-  where distinct_ip_count > 1 | rename identity.user.name as user | `asl_aws_concurrent_sessions_from_different_ips_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: A user with concurrent sessions from different Ips may also
-  represent the legitimate use of more than one device. Filter as needed and/or customize
-  the threshold to fit your environment.
+search: '`amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal" | bin span=5m _time | stats values(src_endpoint.ip) as src_ip dc(src_endpoint.ip) as distinct_ip_count by _time actor.user.uid | where distinct_ip_count > 1 | rename actor.user.uid as user | `asl_aws_concurrent_sessions_from_different_ips_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
 references:
 - https://attack.mitre.org/techniques/T1185/
 - https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
@@ -69,15 +59,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - src_endpoint.domain
-  - cloud.region
   risk_score: 42
   security_domain: threat
   manual_test: Can't be tested automatically because of time span.

detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml

@@ -13,20 +13,9 @@ description: The following analytic detects AWS `DeleteTrail` events within Clou
   to cover their tracks, making it difficult to trace their activities and investigate
   other potential compromises within the AWS environment.
 data_source: []
-search: '`amazon_security_lake` api.operation=DeleteTrail | fillnull | stats count
-  min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid
-  as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent
-  as user_agent, actor.user.account_uid as aws_account_id   | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudtrail_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has stopped cloudTrail logging. Please investigate this activity.
+search: '`amazon_security_lake` api.operation=DeleteTrail | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudtrail_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudTrail logging. Please investigate this activity.
 references:
 - https://attack.mitre.org/techniques/T1562/008/
 drilldown_searches:
@@ -65,14 +54,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 90
   security_domain: threat
 tests:

detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml

@@ -14,20 +14,9 @@ description: The following analytic detects the deletion of CloudWatch log group
   potentially leading to undetected data breaches or further malicious actions within
   the compromised AWS environment.
 data_source: []
-search: '`amazon_security_lake` api.operation=DeleteLogGroup | fillnull | stats count
-  min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid
-  as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent
-  as user_agent, actor.user.account_uid as aws_account_id   | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
+search: '`amazon_security_lake` api.operation=DeleteLogGroup | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
 references:
 - https://attack.mitre.org/techniques/T1562/008/
 drilldown_searches:

detections/cloud/asl_aws_defense_evasion_impair_security_services.yml

@@ -14,21 +14,9 @@ description: The following analytic detects the deletion of critical AWS Securit
   leading to potential data breaches, unauthorized access, and prolonged persistence
   within the AWS environment.
 data_source: []
-search: '`amazon_security_lake` api.operation IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms")
-  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation
-  actor.user.account_uid actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_impair_security_services_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: While this search has no known false positives, it is possible
-  that it is a legitimate admin activity. Please consider filtering out these noisy
-  events using userAgent, user_arn field names.
+search: '`amazon_security_lake` api.operation IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_impair_security_services_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
 references:
 - https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html
 - https://docs.aws.amazon.com/cli/latest/reference/waf/index.html
@@ -46,14 +34,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 42
   security_domain: threat
 tests:

detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml

@@ -16,20 +16,9 @@ description: The following analytic detects `StopLogging` events within AWS Clou
   significant, as it can severely hamper incident response and forensic investigations
   by obscuring the attacker's actions.
 data_source: []
-search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count
-  min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid
-  as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent
-  as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
+search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
 references:
 - https://attack.mitre.org/techniques/T1562/008/
 drilldown_searches:
@@ -69,14 +58,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 90
   security_domain: threat
 tests:

detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml

@@ -15,20 +15,9 @@ description: The following analytic detects `UpdateTrail` events within AWS Clou
   tactics is significant, potentially allowing malicious activities to proceed without
   being logged, thereby hindering incident response and forensic investigations.
 data_source: []
-search: '`amazon_security_lake` api.operation=UpdateTrail | fillnull | stats count
-  min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid
-  as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent
-  as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has updated cloudtrail logging. Please investigate this activity.
+search: '`amazon_security_lake` api.operation=UpdateTrail | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity.
 references:
 - https://attack.mitre.org/techniques/T1562/008/
 drilldown_searches:
@@ -68,14 +57,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 90
   security_domain: threat
 tests:

detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml

@@ -14,21 +14,9 @@ description: The following analytic detects the upload of new containers to AWS
   and addressing such uploads promptly can mitigate the risk of security incidents
   and their associated impacts.
 data_source: []
-search: '`amazon_security_lake` api.operation=PutImage | eval hour=strftime(time/pow(10,3),
-  "%H"), weekday=strftime(time/pow(10,3), "%A") | where hour >= 20 OR hour < 8 OR
-  weekday=Saturday OR weekday=Sunday | fillnull | stats count min(_time) as firstTime
-  max(_time) as lastTime by api.operation actor.user.account_uid actor.user.name actor.user.uid
-  http_request.user_agent cloud.region | rename actor.user.name as user, cloud.region
-  as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_ecr_container_upload_outside_business_hours_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: When your development is spreaded in different time zones,
-  applying this rule can be difficult.
+search: '`amazon_security_lake` api.operation=PutImage | eval hour=strftime(time/pow(10,3), "%H"), weekday=strftime(time/pow(10,3), "%A") | where hour >= 20 OR hour < 8 OR weekday=Saturday OR weekday=Sunday | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent cloud.region | rename actor.user.uid as user, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_ecr_container_upload_outside_business_hours_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: When your development is spreaded in different time zones, applying this rule can be difficult.
 references:
 - https://attack.mitre.org/techniques/T1204/003/
 drilldown_searches:
@@ -65,16 +53,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 49
   security_domain: network
+  manual_test: Can't be tested automatically because of outside of business hours time
 tests:
 - name: True Positive Test
   attack_data:

detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml

@@ -16,18 +16,8 @@ description: The following analytic detects unauthorized container uploads to AW
   could be significant, compromising the integrity and security of the organization's
   cloud environment.
 data_source: []
-search: '`amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` | stats
-  count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.name actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.name as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_ecr_container_upload_unknown_user_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
+search: '`amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_ecr_container_upload_unknown_user_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: unknown
 references:
 - https://attack.mitre.org/techniques/T1204/003/

detections/cloud/asl_aws_iam_delete_policy.yml

@@ -12,23 +12,9 @@ description: The following analytic identifies when a policy is deleted in AWS.
   critical security policies, potentially leading to privilege escalation or unauthorized
   access to sensitive resources.
 data_source: []
-search: '`amazon_security_lake` api.operation=DeletePolicy | fillnull | stats count
-  min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.name actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.name as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_delete_policy_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: This detection will require tuning to provide high fidelity
-  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
-  or by groups of users. Not every user with AWS access should have permission to
-  delete policies (least privilege). In addition, this may be saved seperately and
-  tuned for failed or success attempts only.
+search: '`amazon_security_lake` api.operation=DeletePolicy | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_delete_policy_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
 references:
 - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
 - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
@@ -44,14 +30,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 10
   security_domain: access
 tests:

detections/cloud/asl_aws_iam_failure_group_deletion.yml

@@ -14,23 +14,9 @@ description: The following analytic detects failed attempts to delete AWS IAM gr
   these attempts allows for timely investigation and mitigation, preventing potential
   impact on the organizations security posture.
 data_source: []
-search: '`amazon_security_lake` api.operation=DeleteGroup api.response.error IN (NoSuchEntityException,DeleteConflictException,
-  AccessDenied) http_request.user_agent!=*.amazonaws.com | fillnull | stats count
-  min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.name actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.name as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_failure_group_deletion_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: This detection will require tuning to provide high fidelity
-  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
-  or by groups of users. Not every user with AWS access should have permission to
-  delete groups (least privilege).
+search: '`amazon_security_lake` api.operation=DeleteGroup status=Failure http_request.user_agent!=*.amazonaws.com | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_failure_group_deletion_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 references:
 - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
 - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
@@ -70,14 +56,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 5
   security_domain: access
 tests:

detections/cloud/asl_aws_iam_successful_group_deletion.yml

@@ -14,18 +14,9 @@ description: The following analytic detects the successful deletion of a group w
   a SOC to prevent the potential impact of an attack, which could include unauthorized
   access to sensitive resources or disruption of AWS environment operations.
 data_source: []
-search: '`amazon_security_lake` api.operation=DeleteGroup status=Success | fillnull
-  | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.name actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.name as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_successful_group_deletion_filter`'
-how_to_implement: You must install the Data Lake Federated Analytics App and ingest
-  the logs into Splunk.
-known_false_positives: This detection will require tuning to provide high fidelity
-  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
-  or by groups of users. Not every user with AWS access should have permission to
-  delete groups (least privilege).
+search: '`amazon_security_lake` api.operation=DeleteGroup status=Success | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_successful_group_deletion_filter`'
+how_to_implement: You must install the Data Lake Federated Analytics App and ingest the logs into Splunk.
+known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 references:
 - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
 - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html

detections/cloud/asl_aws_multi_factor_authentication_disabled.yml

@@ -14,20 +14,9 @@ description: The following analytic detects attempts to disable multi-factor aut
   AWS environment without detection, potentially leading to unauthorized access to
   sensitive resources and prolonged compromise.
 data_source: []
-search: '`amazon_security_lake` (api.operation=DeleteVirtualMFADevice OR api.operation=DeactivateMFADevice)
-  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation
-  actor.user.account_uid actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_multi_factor_authentication_disabled_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: AWS Administrators may disable MFA but it is highly unlikely
-  for this event to occur without prior notice to the company
+search: '`amazon_security_lake` (api.operation=DeleteVirtualMFADevice OR api.operation=DeactivateMFADevice) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_multi_factor_authentication_disabled_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
 references:
 - https://attack.mitre.org/techniques/T1621/
 - https://aws.amazon.com/what-is/mfa/
@@ -70,14 +59,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 64
   security_domain: threat
 tests:

detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml

@@ -14,20 +14,9 @@ description: The following analytic identifies the registration of a new Multi-F
   to secure their access, making it harder to detect and remove their presence from
   the compromised environment.
 data_source: []
-search: '`amazon_security_lake` api.operation=CreateVirtualMFADevice | fillnull |
-  stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.account_uid
-  actor.user.name actor.user.uid http_request.user_agent src_endpoint.ip cloud.region
-  | rename actor.user.name as user, src_endpoint.ip as src_ip, cloud.region as region,
-  http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_new_mfa_method_registered_for_user_filter`'
-how_to_implement: The detection is based on Amazon Security Lake events from Amazon
-  Web Services (AWS), which is a centralized data lake that provides security-related
-  data from AWS services. To use this detection, you must ingest CloudTrail logs from
-  Amazon Security Lake into Splunk. To run this search, ensure that you ingest events
-  using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876)
-  or the Federated Analytics App.
-known_false_positives: Newly onboarded users who are registering an MFA method for
-  the first time will also trigger this detection.
+search: '`amazon_security_lake` api.operation=CreateVirtualMFADevice | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_new_mfa_method_registered_for_user_filter`'
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
 references:
 - https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
 - https://attack.mitre.org/techniques/T1556/
@@ -55,14 +44,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  required_fields:
-  - api.operation
-  - actor.user.account_uid
-  - actor.user.name
-  - actor.user.uid
-  - http_request.user_agent
-  - src_endpoint.ip
-  - cloud.region
   risk_score: 64
   security_domain: identity
 tests: