admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #345 from splunk/CRL-1727_detection_bug_issue_343

Browse Source 
fixing issue #343
This commit is contained in:
Jose Enrique Hernandez
2020-02-03 17:36:49 -05:00
committed by GitHub
parent 70a3aa3841 2b6db17c99
commit 667ac3ffa3
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_activity_in_new_region.yml
+9 -7
View File
@@ -32,13 +32,15 @@ detect:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
search: sourcetype=aws:cloudtrail earliest=-1h StartInstances | stats earliest(_time)
as earliest latest(_time) as latest by awsRegion| inputlookup append=t previously_seen_aws_regions.csv
| stats min(earliest) as earliest max(latest) as latest by awsRegion | outputlookup
previously_seen_aws_regions.csv | eval regionStatus=if(earliest >= relative_time(now(),
"-1d@d"), "Instance Started in a New Region","Previously Seen Region") | convert
security_content_ctime(earliest) security_content_ctime(latest) | where regionStatus="Instance Started in a
New Region"
search: sourcetype=aws:cloudtrail earliest=-1h StartInstances
| stats earliest(_time) as earliest latest(_time) as latest by awsRegion
| inputlookup append=t previously_seen_aws_regions.csv
| stats min(earliest) as earliest max(latest) as latest by awsRegion
| outputlookup previously_seen_aws_regions.csv
| eval regionStatus=if(earliest >= relative_time(now(),"-1d@d"), "Instance Started in a New Region","Previously Seen Region")
| `security_content_ctime(earliest)`
| `security_content_ctime(latest)`
| where regionStatus="Instance Started in a New Region"
suppress:
suppress_fields: awsRegion
suppress_period: 14400s