Merge pull request #1582 from splunk/devsec_move

devsec_move

detections/cloud/gsuite_drive_share_in_external_email.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-16'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: This search is to detect suspicious google drive or google docs files
   shared outside or externally. This behavior might be a good hunting query to monitor
   exfitration of data made by an attacker or insider to a targetted machine.

detections/cloud/gsuite_email_suspicious_attachment.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-16'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: This search is to detect a suspicious attachment file extension in Gsuite
   email that may related to spear phishing attack. This file type is commonly used
   by malware to lure user to click on it to execute malicious code to compromised

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -4,9 +4,7 @@ version: 1
 date: '2021-08-17'
 author: Teoderick Contreras, Stanislav Miskovic, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
+datamodel: []
 description: This search is to detect a suspicious outbound e-mail from internal email
   to external email domain. This can be a good hunting query to monitor insider or
   outbound email traffic for not common domain e-mail. The idea is to parse the domain

tests/cloud/gsuite_drive_share_in_external_email.test.yml

@@ -1,7 +1,7 @@
 name: Gsuite Drive Share In External Email Unit Test
 tests:
 - name: Gsuite Drive Share In External Email
-  file: endpoint/gsuite_drive_share_in_external_email.yml
+  file: cloud/gsuite_drive_share_in_external_email.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/cloud/gsuite_email_suspicious_attachment.test.yml

@@ -1,7 +1,7 @@
 name: GSuite Email Suspicious Attachment Unit Test
 tests:
 - name: GSuite Email Suspicious Attachment
-  file: endpoint/gsuite_email_suspicious_attachment.yml
+  file: cloud/gsuite_email_suspicious_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/cloud/gsuite_outbound_email_with_attachment_to_external_domain.test.yml

@@ -1,7 +1,7 @@
 name: Gsuite Outbound Email With Attachment To External Domain Unit Test
 tests:
 - name: Gsuite Outbound Email With Attachment To External Domain
-  file: endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml
+  file: cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'