diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 8b6d910d1e..9475fcad55 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -23,7 +23,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index 85c5cf21f8..e069f8de60 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -22,7 +22,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 552014e94a..cd17a1880e 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -19,14 +19,14 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner | `gsuite_drive_share_in_external_email_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: network admin or normal user may share files to customer and external team. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 90 context: - Source:Endpoint @@ -46,7 +46,7 @@ tags: - name: parameters.owner type: User role: - - attacker + - Attacker - name: email type: User role: diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 5bf5875a1f..9c9133fe0b 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -28,7 +28,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 70 context: - Source:Endpoint diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index 43da966e82..1472fa6c77 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -35,7 +35,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index 9ed9c63dd0..bbfe333ea6 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -26,7 +26,7 @@ references: - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index c3792b9f3f..c8c2b596d6 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -27,7 +27,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 30 context: - Source:Endpoint diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 13bb20d2aa..d55a4bab94 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit | `gsuite_suspicious_shared_file_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search references: @@ -32,7 +32,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 70 context: diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml index e800aef9d9..b7008f38b2 100644 --- a/stories/dev_sec_ops.yml +++ b/stories/dev_sec_ops.yml @@ -14,7 +14,7 @@ narrative: DevSecOps is a collaborative framework, which thinks about applicatio references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: - analytic_story: DevSecOps + analytic_story: Dev Sec Ops category: - Cloud Security product: