From 8d5165ac314d5a4e1bdb77b5fcabc739adaa24e8 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 12 Dec 2024 16:46:10 +0100 Subject: [PATCH] bug fix --- ..._aws_create_policy_version_to_allow_all_resources.yml} | 0 .../asl_aws_credential_access_rds_password_reset.yml | 8 ++++---- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/cloud/{asl_aws_create_policy_version_to_allow_all_resources..yml => asl_aws_create_policy_version_to_allow_all_resources.yml} (100%) diff --git a/detections/cloud/asl_aws_create_policy_version_to_allow_all_resources..yml b/detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml similarity index 100% rename from detections/cloud/asl_aws_create_policy_version_to_allow_all_resources..yml rename to detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml diff --git a/detections/cloud/asl_aws_credential_access_rds_password_reset.yml b/detections/cloud/asl_aws_credential_access_rds_password_reset.yml index 56bddae069..2c9838422d 100644 --- a/detections/cloud/asl_aws_credential_access_rds_password_reset.yml +++ b/detections/cloud/asl_aws_credential_access_rds_password_reset.yml @@ -13,12 +13,12 @@ known_false_positives: Users may genuinely reset the RDS password. references: - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds drilldown_searches: -- name: View the detection results for - "$database_id$" - search: '%original_detection_search% | search database_id = "$database_id$"' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search database_id = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$database_id$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$database_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: