diff --git a/baselines/previously_seen_aws_cross_account_activity___dm.yml b/baselines/previously_seen_aws_cross_account_activity___dm.yml index e6c357f0c0..9dd203ce9f 100644 --- a/baselines/previously_seen_aws_cross_account_activity___dm.yml +++ b/baselines/previously_seen_aws_cross_account_activity___dm.yml @@ -14,6 +14,6 @@ author: Rico Valdez, Splunk search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity" tags: analytics_story: - - Suspicious Cloud Authentication Activity + - Suspicious Cloud Authentication Activities detections: - AWS Cross Account Activity From Previously Unseen Account - DM diff --git a/stories/suspicious_cloud_auth.yml b/stories/suspicious_cloud_authentication_activities.yml similarity index 91% rename from stories/suspicious_cloud_auth.yml rename to stories/suspicious_cloud_authentication_activities.yml index 102c4c25de..97ad1588bc 100644 --- a/stories/suspicious_cloud_auth.yml +++ b/stories/suspicious_cloud_authentication_activities.yml @@ -1,5 +1,5 @@ -name: Suspicious Cloud Authentication Activity +name: Suspicious Cloud Authentication Activities id: 6380ebbb-55c5-4fce-b754-01fd565fb73c version: 1 date: '2020-06-04' @@ -19,7 +19,7 @@ references: - https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/ - https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html tags: - analytics_story: Suspicious Cloud Authentication Activity + analytics_story: Suspicious Cloud Authentication Activities usecase: Security Monitoring category: - Cloud Security