From a9c33e7702347aeceee8fff019d93a511caa1723 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 18 Apr 2023 09:53:16 -0700 Subject: [PATCH] fixing observables --- ..._cross_account_activity_from_previously_unseen_account.yml | 4 ++-- .../network/multiple_archive_files_http_post_traffic.yml | 2 +- detections/network/plain_http_post_exfiltrated_data.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index dac9b6a373..6f5650ec52 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -42,8 +42,8 @@ tags: type: Other role: - Attacker - - name: requestedAccountId - type: Other + - name: user + type: User role: - Victim product: diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index feabc206d7..e2683c2744 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -51,7 +51,7 @@ tags: - name: form_data type: Other role: - - Attacker + - Other product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index b8b0b71333..20753d905b 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -41,7 +41,7 @@ tags: - name: form_data type: Other role: - - Attacker + - Other product: - Splunk Enterprise - Splunk Enterprise Security