admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

minor

Browse Source
This commit is contained in:
bpatel
2021-01-13 15:49:03 -08:00
parent 24128d4982
commit acd855474b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+1 -1
View File
@@ -7,7 +7,7 @@ description: This search looks for CloudTrail events wherein a console login eve
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement:You must install and configure the Splunk Add-on for AWS (version
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen
IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update`