Delete Detection Kubernetes AWS detect RBAC authorization by account

detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml

@@ -1,40 +0,0 @@
-name: Kubernetes AWS detect RBAC authorization by account
-id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8
-version: 1
-date: '2020-06-23'
-author: Rod Soto, Splunk
-status: deprecated
-type: Hunting
-description: This search provides information on Kubernetes RBAC authorizations by
-  accounts, this search can be modified by adding top to see both extremes of RBAC
-  by accounts occurrences
-data_source: []
-search: '`aws_cloudwatchlogs_eks` annotations.authorization.k8s.io/reason=* | table
-  sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason | stats
-  count by user.username annotations.authorization.k8s.io/reason | rare user.username
-  annotations.authorization.k8s.io/reason |`kubernetes_aws_detect_rbac_authorization_by_account_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudwatch logs
-known_false_positives: Not all RBAC Authorications are malicious. RBAC authorizations
-  can uncover malicious activity specially if sensitive Roles have been granted.
-references: []
-tags:
-  analytic_story:
-  - Kubernetes Sensitive Role Activity
-  asset_type: AWS EKS Kubernetes cluster
-  confidence: 50
-  impact: 50
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  risk_score: 25
-  security_domain: threat