admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

rename search names

Browse Source
This commit is contained in:
bpatel
2020-06-08 18:57:50 -07:00
parent 23fbecf862
commit f4bc32f336
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/previously_seen_aws_cross_account_activity___dm.yml
+1 -1
View File
@@ -14,6 +14,6 @@ author: Rico Valdez, Splunk
search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity"
tags:
analytics_story:
- Suspicious Cloud Authentication Activity
- Suspicious Cloud Authentication Activities
detections:
- AWS Cross Account Activity From Previously Unseen Account - DM
stories/suspicious_cloud_auth.yml → stories/suspicious_cloud_authentication_activities.yml
+2 -2
View File
@@ -1,5 +1,5 @@
name: Suspicious Cloud Authentication Activity
name: Suspicious Cloud Authentication Activities
id: 6380ebbb-55c5-4fce-b754-01fd565fb73c
version: 1
date: '2020-06-04'
@@ -19,7 +19,7 @@ references:
- https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/
- https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
tags:
analytics_story: Suspicious Cloud Authentication Activity
analytics_story: Suspicious Cloud Authentication Activities
usecase: Security Monitoring
category:
- Cloud Security