From 631daa4ff6910109605300e5e178a47e8888e70b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 11 Nov 2022 13:50:35 -0800 Subject: [PATCH] spl update --- .../cloud/aws_ecr_container_upload_outside_business_hours.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 3112a1769d..dc44dc9450 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -9,7 +9,7 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it. search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 - OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.* + OR date_hour<8 OR date_wday=saturday OR date_wday=sunday | rename requestParameters.* as * | rename repositoryName AS image | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity