admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-11-15 12:06:50 -08:00
committed by GitHub
parent b0b4d8bd5a 1b3e1e5ab7
commit eb201f5380
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+1 -1
View File
@@ -9,7 +9,7 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
Service (ECR). A upload of a new container is normally done during business hours.
When done outside business hours, we want to take a look into it.
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20
OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.*
OR date_hour<8 OR date_wday=saturday OR date_wday=sunday | rename requestParameters.*
as * | rename repositoryName AS image | eval phase="release" | eval severity="medium"
| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity