admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #476 from splunk/aws_cross_account_activity_fix

Browse Source 
minor tweak
This commit is contained in:
Jose Enrique Hernandez
2020-06-18 13:13:30 -04:00
committed by GitHub
parent 8c4fb32882 0b1adabe8f
commit b4664f0f17
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_cross_account_activity_from_previously_unseen_account.yml
+1 -2
View File
@@ -15,8 +15,7 @@ author: David Dorsey, Splunk
search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
| spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
| where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity
| multireport [| stats min(eval(coalesce(firstTime, _time)))
as firstTime max(eval(coalesce(lastTime, _time)))
| multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time)))
as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity
| where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime,
max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime