admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inCloud Provisioning Activity From Previously Unseen Country

Browse Source
This commit is contained in:
root
2020-12-01 20:38:45 +00:00
parent cc1b0aa291
commit 69a1c028bf
1 changed files with 23 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+23 -21
View File
@@ -2,30 +2,30 @@ name: Cloud Provisioning Activity From Previously Unseen Country
id: 94994255-3acf-4213-9b3f-0494df03bb31
version: 1
date: '2020-10-09'
description: 'This search looks for cloud provisioning activities from previously unseen
description: This search looks for cloud provisioning activities from previously unseen
countries. Provisioning activities are defined broadly as any event that runs or
creates something.'
how_to_implement: You must be ingesting your cloud infrastructure logs from your
cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial`
to build the initial table of source IP address, geographic locations, and times. You must also enable the second
baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and
to age out old data. You can adjust the time window for this search by updating the
`previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by
customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
creates something.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
locations, and times. You must also enable the second baseline search `Previously
Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date
and to age out old data. You can adjust the time window for this search by updating
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter`
macro.
type: ESCU
references: []
author: Rico Valdez, Bhavin Patel, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")`
| iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data
| eventstats max(enough_data) as enough_data
| where enough_data=1
| eval firstTimeSeenCountry=min(firstTimeSeen)
| where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h")
| table firstTime, src, Country, user, object, command
| `cloud_provisioning_activity_from_previously_unseen_country_filter`
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country
OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
| `security_content_ctime(firstTime)`'
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
@@ -52,4 +52,6 @@ tags:
risk_score: 5
risk_object_type: user
risk_object: user
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json