From 637ec487dfd0e2ac8e459a7e575ed4be72e4bba6 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 3 Sep 2020 11:30:09 -0700 Subject: [PATCH] risk validation --- bin/validate.py | 8 ++++---- .../abnormally_high_aws_instances_launched_by_user.yml | 3 +++ 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 85e3aee770..7819a8d9fc 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -134,17 +134,17 @@ def validate_standard_fields(object, uuids): if not isinstance(v, int): errors.append("ERROR: risk_score not integer value for object: %s" % v) risk_object_type = ["user","system", "other"] + if k == 'risk_object_type': - if not any(s in v for s in risk_object_type): - errors.append("ERROR: risk_object_type can only contain user,system, other: %s" % v) + if v not in risk_object_type: + errors.append("ERROR: risk_object_type can only contain user, system, other: %s" % v) + if k == 'risk_object': try: v.encode('ascii') except UnicodeEncodeError: errors.append("ERROR: risk_object not ascii for object: %s" % v) - - return errors, uuids diff --git a/detections/abnormally_high_aws_instances_launched_by_user.yml b/detections/abnormally_high_aws_instances_launched_by_user.yml index 39ed7fb4f8..ce28e4f2a1 100644 --- a/detections/abnormally_high_aws_instances_launched_by_user.yml +++ b/detections/abnormally_high_aws_instances_launched_by_user.yml @@ -37,3 +37,6 @@ tags: - DE.AE security_domain: network asset_type: AWS Instance + risk_score: 40 + risk_object_type: user + risk_object: userName