From b7ea8fc27dfda7a6b1d3af7733635104c689d9cf Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 10 May 2022 13:42:19 -0700 Subject: [PATCH 1/2] kvstore bugs --- .../adapter/templates/transforms.j2 | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/transforms.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/transforms.j2 index 576fa8d198..747e2cf081 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/transforms.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/transforms.j2 @@ -1,34 +1,34 @@ {% for lookup in objects %} [{{ lookup.name }}] -{% if lookup.filename is defined %} -filename = {{ lookup.filename }} +{% if lookup.filename is defined and lookup.filename != None %} +filename = {{ lookup.filename }} {% else %} collection = {{ lookup.collection }} external_type = kvstore {% endif %} -{% if lookup.default_match is defined %} +{% if lookup.default_match is defined and lookup.default_match != None %} default_match = {{ lookup.default_match }} {% endif %} -{% if lookup.case_sensitive_match is defined %} +{% if lookup.case_sensitive_match is defined and lookup.case_sensitive_match != None %} case_sensitive_match = {{ lookup.case_sensitive_match }} {% endif %} -{% if lookup.description is defined %} +{% if lookup.description is defined and lookup.description != None %} # description = {{ lookup.description }} {% endif %} -{% if lookup.match_type is defined %} +{% if lookup.match_type is defined and lookup.match_type != None %} match_type = {{ lookup.match_type }} {% endif %} -{% if lookup.max_matches is defined %} +{% if lookup.max_matches is defined and lookup.max_matches != None %} max_matches = {{ lookup.max_matches }} {% endif %} -{% if lookup.min_matches is defined %} +{% if lookup.min_matches is defined and lookup.min_matches != None %} min_matches = {{ lookup.min_matches }} {% endif %} -{% if lookup.fields_list is defined %} +{% if lookup.fields_list is defined and lookup.fields_list != None %} fields_list = {{ lookup.fields_list }} {% endif %} -{% if lookup.filter is defined %} +{% if lookup.filter is defined and lookup.filter != None %} filter = {{ lookup.filter }} {% endif %} From aa13247897e2811ad0d372f0fe2d444eaba98d6c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 10 May 2022 15:25:55 -0700 Subject: [PATCH 2/2] update detection yml --- detections/cloud/detect_aws_console_login_by_new_user.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 2e896238ea..c716c37f3a 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -1,7 +1,7 @@ name: Detect AWS Console Login by New User id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 -version: 1 -date: '2020-05-28' +version: 2 +date: '2022-05-10' author: Rico Valdez, Splunk type: Hunting datamodel: @@ -21,8 +21,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in AWS CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail + in CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. known_false_positives: When a legitimate new user logins for the first time, this