admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Accidentally changed detection file

Browse Source 
detections/cloud/aws_excessive_security_scanning.yml.
That file should not have been modified.  Rolling back those
changes.
This commit is contained in:
pyth0n1c
2022-02-15 09:37:52 -08:00
parent 7648c76c0b
commit 77b300ab4e
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_excessive_security_scanning.yml
+5 -6
View File
@@ -9,12 +9,11 @@ description: This search looks for AWS CloudTrail events and analyse the amount
eventNames which starts with Describe by a single user. This indicates that this
user scans the configuration of your AWS cloud environment.
search: '
`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user
| where count > 10
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_excessive_authentication_failures_alert_filter`'
`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* |
stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
values(eventName) as eventName values(src) as src values(userAgent) as userAgent
by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives.