admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

AWS_IAM_Account_Locking_Playbook

Browse Source
This commit is contained in:
tccontre
2023-05-15 12:12:49 +02:00
parent cd505f88b0
commit dba26e91d1
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/AWS_IAM_Account_Locking.json
+3 -3
View File
@@ -68,7 +68,7 @@
"type": "start",
"warnings": {},
"x": 19.999999999999986,
"y": -1.2789769243681803e-13
"y": -1.9184653865522705e-13
},
"1": {
"data": {
@@ -203,7 +203,7 @@
"errors": {},
"id": "6",
"type": "code",
"userCode": "\n # Write your custom code here...\n username_observables__observable_array = []\n \n for access_key, usrname, creds, req_id, msg, status in zip(disable_user_account_parameter_disable_access_keys, disable_user_account_parameter_username, disable_user_account_parameter_credentials, disable_user_account_result_item_3, disable_user_account_result_message, disable_user_account_result_item_5):\n user_acc_status = {\n \"account_type\": \"AWS IAM Account\",\n \"user\": usrname,\n \"credentials\": creds,\n \"request_id\": req_id,\n \"disable_message\": msg,\n \"disable_status\": status\n }\n\n username_observables__observable_array.append(user_acc_status)\n #phantom.debug(username_observables__observable_array)\n",
"userCode": "\n # Write your custom code here...\n username_observables__observable_array = []\n \n for access_key, usrname, creds, req_id, msg, status in zip(disable_user_account_parameter_disable_access_keys, disable_user_account_parameter_username, disable_user_account_parameter_credentials, disable_user_account_result_item_3, disable_user_account_result_message, disable_user_account_result_item_5):\n user_acc_status = {\n \"type\": \"AWS IAM Account\",\n \"value\": usrname,\n \"credentials\": creds,\n \"request_id\": req_id,\n \"message\": msg,\n \"status\": status\n }\n\n username_observables__observable_array.append(user_acc_status)\n #phantom.debug(username_observables__observable_array)\n",
"warnings": {},
"x": 0,
"y": 680
@@ -273,7 +273,7 @@
"schema": "5.0.9",
"version": "6.0.0.114895"
},
"create_time": "2023-05-08T15:56:32.456950+00:00",
"create_time": "2023-05-15T10:08:37.823546+00:00",
"draft_mode": false,
"labels": [
"*"
playbooks/AWS_IAM_Account_Locking.py
+6 -6
View File
@@ -106,16 +106,16 @@ def username_observables(action=None, success=None, container=None, results=None
for access_key, usrname, creds, req_id, msg, status in zip(disable_user_account_parameter_disable_access_keys, disable_user_account_parameter_username, disable_user_account_parameter_credentials, disable_user_account_result_item_3, disable_user_account_result_message, disable_user_account_result_item_5):
user_acc_status = {
"account_type": "AWS IAM Account",
"user": usrname,
"type": "AWS IAM Account",
"value": usrname,
"credentials": creds,
"request_id": req_id,
"disable_message": msg,
"disable_status": status
"message": msg,
"status": status
}
username_observables__observable_array.append(user_acc_status)
#phantom.debug(username_observables__observable_array)
username_observables__observable_array.append(user_acc_status)
#phantom.debug(username_observables__observable_array)
################################################################################
## Custom Code End
################################################################################