admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding spl updates

Browse Source
This commit is contained in:
patel-bhavin
2021-07-27 13:57:33 -07:00
parent 0d8da0488e
commit bf6804cef7
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+1 -1
View File
@@ -7,7 +7,7 @@ type: batch
datamodel: []
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket over the aws cli.
search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
search: '`cloudtrail` eventSource="s3.amazonaws.com" userAgent=aws-cli* eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control
detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: This search looks for fast execution of processes used for system n
configuration discovery on the endpoint.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name
max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name
Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools`
| transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime