From 8ebb00bf84bedce37db8dc02f6a2bacde9e403c5 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Tue, 26 May 2020 14:45:34 -0600 Subject: [PATCH] minor tweak --- ...s_cross_account_activity_from_previously_unseen_account.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/aws_cross_account_activity_from_previously_unseen_account.yml index 0856164363..a2e1e47d69 100644 --- a/detections/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/aws_cross_account_activity_from_previously_unseen_account.yml @@ -15,8 +15,7 @@ author: David Dorsey, Splunk search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity - | multireport [| stats min(eval(coalesce(firstTime, _time))) - as firstTime max(eval(coalesce(lastTime, _time))) + | multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime, max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime