admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

datamodel fix

Browse Source
This commit is contained in:
bpatel
2020-11-16 20:15:36 -08:00
parent 8e5a9e731b
commit 98bcdf47fc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+2 -2
View File
@@ -13,7 +13,7 @@ references: []
author: Rico Valdez, Splunk
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time)
as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change.All_Changes
as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change
where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user
| `drop_dm_object_name("All_Changes")`
| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
| where enough_data=1
| eval firstTimeSeenUser=min(firstTimeSeen)
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
| table firstTime user dest object_id count
| table firstTime user command object_id count
| `security_content_ctime(firstTime)`
| `cloud_instance_modified_by_previously_unseen_user_filter`'