From 2b6db17c994a8c106e36cd3742dfae8c199d9b7e Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 3 Feb 2020 17:10:15 -0500 Subject: [PATCH] fixing issue #343 --- detections/aws_activity_in_new_region.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/detections/aws_activity_in_new_region.yml b/detections/aws_activity_in_new_region.yml index ce8191cefb..0285237a0a 100644 --- a/detections/aws_activity_in_new_region.yml +++ b/detections/aws_activity_in_new_region.yml @@ -32,13 +32,15 @@ detect: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m - search: sourcetype=aws:cloudtrail earliest=-1h StartInstances | stats earliest(_time) - as earliest latest(_time) as latest by awsRegion| inputlookup append=t previously_seen_aws_regions.csv - | stats min(earliest) as earliest max(latest) as latest by awsRegion | outputlookup - previously_seen_aws_regions.csv | eval regionStatus=if(earliest >= relative_time(now(), - "-1d@d"), "Instance Started in a New Region","Previously Seen Region") | convert - security_content_ctime(earliest) security_content_ctime(latest) | where regionStatus="Instance Started in a - New Region" + search: sourcetype=aws:cloudtrail earliest=-1h StartInstances + | stats earliest(_time) as earliest latest(_time) as latest by awsRegion + | inputlookup append=t previously_seen_aws_regions.csv + | stats min(earliest) as earliest max(latest) as latest by awsRegion + | outputlookup previously_seen_aws_regions.csv + | eval regionStatus=if(earliest >= relative_time(now(),"-1d@d"), "Instance Started in a New Region","Previously Seen Region") + | `security_content_ctime(earliest)` + | `security_content_ctime(latest)` + | where regionStatus="Instance Started in a New Region" suppress: suppress_fields: awsRegion suppress_period: 14400s