admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

bug fix

Browse Source
This commit is contained in:
Patrick Bareiss
2024-12-12 16:46:10 +01:00
parent e82847c3c3
commit 8d5165ac31
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/asl_aws_create_policy_version_to_allow_all_resources..yml → detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml
View File
detections/cloud/asl_aws_credential_access_rds_password_reset.yml
+4 -4
View File
@@ -13,12 +13,12 @@ known_false_positives: Users may genuinely reset the RDS password.
references:
- https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
drilldown_searches:
- name: View the detection results for - "$database_id$"
search: '%original_detection_search% | search database_id = "$database_id$"'
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search database_id = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$database_id$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$database_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
tags: