admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-05-16 15:09:34 -04:00
committed by GitHub
parent 8c38ccc728 154894dab9
commit b981245621
2 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/templates/transforms.j2
+10 -10
View File
@@ -1,34 +1,34 @@
{% for lookup in objects %}
[{{ lookup.name }}]
{% if lookup.filename is defined %}
filename = {{ lookup.filename }}
{% if lookup.filename is defined and lookup.filename != None %}
filename = {{ lookup.filename }}
{% else %}
collection = {{ lookup.collection }}
external_type = kvstore
{% endif %}
{% if lookup.default_match is defined %}
{% if lookup.default_match is defined and lookup.default_match != None %}
default_match = {{ lookup.default_match }}
{% endif %}
{% if lookup.case_sensitive_match is defined %}
{% if lookup.case_sensitive_match is defined and lookup.case_sensitive_match != None %}
case_sensitive_match = {{ lookup.case_sensitive_match }}
{% endif %}
{% if lookup.description is defined %}
{% if lookup.description is defined and lookup.description != None %}
# description = {{ lookup.description }}
{% endif %}
{% if lookup.match_type is defined %}
{% if lookup.match_type is defined and lookup.match_type != None %}
match_type = {{ lookup.match_type }}
{% endif %}
{% if lookup.max_matches is defined %}
{% if lookup.max_matches is defined and lookup.max_matches != None %}
max_matches = {{ lookup.max_matches }}
{% endif %}
{% if lookup.min_matches is defined %}
{% if lookup.min_matches is defined and lookup.min_matches != None %}
min_matches = {{ lookup.min_matches }}
{% endif %}
{% if lookup.fields_list is defined %}
{% if lookup.fields_list is defined and lookup.fields_list != None %}
fields_list = {{ lookup.fields_list }}
{% endif %}
{% if lookup.filter is defined %}
{% if lookup.filter is defined and lookup.filter != None %}
filter = {{ lookup.filter }}
{% endif %}
detections/cloud/detect_aws_console_login_by_new_user.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Detect AWS Console Login by New User
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
version: 1
date: '2020-05-28'
version: 2
date: '2022-05-10'
author: Rico Valdez, Splunk
type: Hunting
datamodel:
@@ -21,8 +21,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this