remove k8s from manifest objects

detections/kubernetes_aws_scan_fingerprint.yml

@@ -13,11 +13,11 @@ detect:
   splunk:
     correlation_rule:
       notable:
-        nes_fields: src_ip, k8s_cluster_name, http_user_agent
+        nes_fields: src_ip, cluster_name, http_user_agent
         rule_description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS
         rule_title: Amazon EKS Kubernetes cluster scan detection
       risk:
-        risk_object: k8s_cluster_name
+        risk_object: cluster_name
         risk_object_type:
           - other
         risk_score: 70
@@ -30,7 +30,7 @@ detect:
       search: 'sourcetype="aws:cloudwatchlogs:eks" "user.username"="system:anonymous" userAgent!="AWS Security Scanner" | rename sourceIPs{} as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(source) as cluster_name values(responseStatus.code) values(userAgent) as http_user_agent values(verb) values(requestURI) by src_ip user.username user.groups{} | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`kubernetes_aws_scan_fingerprint_detection`'
 eli5: In this search we can detect unauthenticated web requests against an EKS cluster, by looking at k8s authentication data, user agent and source IPs.
 entities:
-  - k8s_cluster_name
+  - cluster_name
   - src_ip
 how_to_implement:  You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudWatch EKS Logs

detections/kubernetes_gcp_scan_fingerprint_attack.yml

@@ -17,7 +17,7 @@ detect:
         rule_description: Detect scanning attempts against a GCP Kubernetes cluster
         rule_title: GCP Kubernetes cluster scan detection
       risk:
-        risk_object: k8s_cluster_name
+        risk_object: cluster_name
         risk_object_type:
           - other
         risk_score: 70
@@ -27,10 +27,10 @@ detect:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
         latest_time: -10m@m
-      search: sourcetype="google:gcp:pubsub:message" data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" | rename data.protoPayload.requestMetadata.callerIp as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`  | `kubernetes_gcp_scan_fingerprint_detection`
+      search: sourcetype="google:gcp:pubsub:message" data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" | rename data.protoPayload.requestMetadata.callerIp as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | rename data.resource.labels.cluster_name as cluster_name| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`  | `kubernetes_gcp_scan_fingerprint_detection`
 eli5: In this search we can detect unauthenticated web requests and possible attack against a GCP cluster, by looking at k8s authentication data, user agent, source IPs and destionation
 entities:
-  - k8s_cluster_name
+  - cluster_name
   - src_ip
 how_to_implement:  You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs.
 id: db5957ec-0144-4c56-b512-9dccbe7a2d26

detections/kubernetes_pods_aws_scan_fingerprint.yml

@@ -17,7 +17,7 @@ detect:
         rule_description: This search provides detection information on unauthenticated requests against Kubernetes' Pods API
         rule_title: Amazon EKS Kubernetes Pod scan detection
       risk:
-        risk_object: k8s_cluster_name
+        risk_object: cluster_name
         risk_object_type:
           - other
         risk_score: 70
@@ -30,7 +30,7 @@ detect:
       search: sourcetype="aws:cloudwatchlogs:eks" "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" | rename source as cluster_name sourceIPs{} as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(responseStatus.code) values(userAgent) values(verb) values(requestURI) by src_ip cluster_name user.username user.groups{} | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kubernetes_pods_aws_scan_fingerprint_detection`
 eli5: In this search we can detect unauthenticated web requests against an EKS cluster Pod, by looking at k8s authentication data, user agent and source IPs and API direct request.
 entities:
-  - k8s_cluster_name
+  - cluster_name
   - src_ip
 how_to_implement:  You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on forAWS (version 4.4.0 or later), then configure your AWS CloudWatch EKS Logs.Please also customize the `kubernetes_pods_aws_scan_fingerprint_detection` macro to filter out the false positives.
 id: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002

spec/v2/detections.spec.json

@@ -747,7 +747,7 @@
           "dest_user",
           "url",
           "domain",
-          "k8s_cluster_name"
+          "cluster_name"
         ]
       },
       "minItems": 0,