adding empty keys to the ymls

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -55,7 +55,27 @@ tags:
   impact: 30
   confidence: 50
   # (impact * confidence)/100
-  risk_score: 15
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   context:
   - Source:Cloud Data
   - Stage:Recon

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -56,4 +56,44 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_create_policy_version_to_allow_all_resources.yml

@@ -54,5 +54,25 @@ tags:
   - requestParameters.userName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_createaccesskey.yml

@@ -51,5 +51,25 @@ tags:
   - requestParameters.userName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_createloginprofile.yml

@@ -53,5 +53,25 @@ tags:
   - requestParameters.userName
   risk_object: src_ip
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -59,5 +59,25 @@ tags:
   - Authentication.src
   risk_object: user
   risk_object_type: user
-  risk_score: 15
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

@@ -49,5 +49,25 @@ tags:
   - userIdentity.principalId
   risk_object: userIdentity.principalId
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml

@@ -46,4 +46,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/aws_excessive_security_scanning.yml

@@ -49,5 +49,25 @@ tags:
   - userIdentity.arn
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_iam_accessdenied_discovery_events.yml

@@ -46,5 +46,25 @@ tags:
   - userIdentity.type
   risk_object: src_ip
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: access

detections/cloud/aws_iam_assume_role_policy_brute_force.yml

@@ -51,5 +51,25 @@ tags:
   - requestParameters.policyName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: access

detections/cloud/aws_iam_delete_policy.yml

@@ -48,5 +48,25 @@ tags:
   - requestParameters.policyArn
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: access

detections/cloud/aws_iam_failure_group_deletion.yml

@@ -48,5 +48,25 @@ tags:
   - requestParameters.groupName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: identity

detections/cloud/aws_iam_successful_group_deletion.yml

@@ -47,5 +47,25 @@ tags:
   - requestParameters.groupName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: identity

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -60,4 +60,24 @@ tags:
   risk_object: userName
   risk_object_type: user
   risk_score: 10
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -52,4 +52,24 @@ tags:
   risk_object: userName
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_saml_access_by_provider_user_and_principal.yml

@@ -54,4 +54,24 @@ tags:
   risk_object: recipientAccountId
   risk_object_type: other
   risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/aws_saml_update_identity_provider.yml

@@ -48,5 +48,25 @@ tags:
   - userIdentity.principalId
   risk_object: sourceIPAddress
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/aws_setdefaultpolicyversion.yml

@@ -54,5 +54,25 @@ tags:
   - eventSource
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/aws_updateloginprofile.yml

@@ -51,5 +51,25 @@ tags:
   - requestParameters.userName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -54,4 +54,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -50,5 +50,25 @@ tags:
   - All_Changes.vendor_region
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -56,5 +56,25 @@ tags:
   - All_Changes.user
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -51,5 +51,25 @@ tags:
   - All_Changes.user
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -51,5 +51,25 @@ tags:
   - All_Changes.user
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -54,4 +54,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 10
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -69,4 +69,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 10
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -69,4 +69,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -68,4 +68,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -69,4 +69,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: endpoint

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -55,4 +55,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 30
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -64,4 +64,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -64,4 +64,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -64,4 +64,24 @@ tags:
   risk_object: user
   risk_object_type: user
   risk_score: 5
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/detect_new_open_s3_buckets.yml

@@ -56,5 +56,25 @@ tags:
   - permission
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml

@@ -60,5 +60,25 @@ tags:
   - bucketName
   risk_object: src
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

@@ -48,5 +48,25 @@ tags:
   - dest
   risk_object: dest
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: network

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -48,5 +48,25 @@ tags:
   - ResultStatus
   risk_object: dest
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_added_service_principal.yml

@@ -51,5 +51,25 @@ tags:
   - ActorIpAddress
   risk_object: ActorIpAddress
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -54,5 +54,25 @@ tags:
   - action
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_disable_mfa.yml

@@ -44,5 +44,25 @@ tags:
   - ResultStatus
   risk_object: dest
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -44,5 +44,25 @@ tags:
   - user
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_excessive_sso_logon_errors.yml

@@ -44,5 +44,25 @@ tags:
   - UserId
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_new_federated_domain_added.yml

@@ -51,5 +51,25 @@ tags:
   - UserKey
   risk_object: UserId
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_pst_export_alert.yml

@@ -45,5 +45,25 @@ tags:
   - Operation
   risk_object: Source
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_suspicious_admin_email_forwarding.yml

@@ -44,5 +44,25 @@ tags:
   - Parameters
   risk_object: src_user
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_suspicious_rights_delegation.yml

@@ -43,5 +43,25 @@ tags:
   - Parameters
   risk_object: user
   risk_object_type: user
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat

detections/cloud/o365_suspicious_user_email_forwarding.yml

@@ -44,5 +44,25 @@ tags:
   - Parameters
   risk_object: ForwardingSmtpAddress
   risk_object_type: system
-  risk_score: 20
+  risk_score: 25
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source: Cloud Data
+  - Scope: Internal, External, Inbound, Outbound, Local, Network
+  - Outcome: Blocked, Allowed
+  - Stage: Recon, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command And Control
+  - Rares: Rare Process, Rare Device, Rare Domain, Rare Network, Rare Location
+  - Other: Policy Violation
+
+  message: 
+  observable:
+  - name: 
+    type: Other, Unknown, Device, Container, Endpoint, Hostname, IP Address, User, Username,Email, Email Address , URL , URL Domain, File , File Name ,File Hash ,Process ,Process Name, Location
+
+    role:
+    - Other, Unknown, Actor, Target, Attacker, Victim, Parent Process, Child Process, Known Bad, Data Loss
+
   security_domain: threat