admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

first 3 detections

Browse Source
This commit is contained in:
patel-bhavin
2021-11-19 11:16:11 -08:00
parent 8ef8da6d06
commit bbc913faaa
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins
| stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user
| stats min(firstTime) AS earliestseen by user City | fields earliestseen user
City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously
Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h")
OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins
| stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen
| stats min(firstTime) AS earliestseen by user Country | fields earliestseen
user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"),
"New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h")
OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins
| stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen
| stats min(firstTime) AS earliestseen by user Region | fields earliestseen
user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New
Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(),
"-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New