admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed All_Changes submodel from

Browse Source 
two detections which use more than one
submodel in Changes.
This commit is contained in:
pyth0n1c
2022-03-09 14:29:25 -08:00
committed by GitHub
parent 02b2a5f85f
commit d652c93878
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
description: This search looks for cloud compute instances being created with previously
unseen image IDs.
search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
| where image_id != "unknown" | lookup previously_seen_cloud_compute_images image_id
as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+1 -1
View File
@@ -8,7 +8,7 @@ datamodel:
- Change
description: Find EC2 instances being created with previously unseen instance types.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
| where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types
instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats