admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update aws_updateloginprofile.yml

Browse Source
This commit is contained in:
Bhavin Patel
2022-03-08 09:24:18 -08:00
committed by GitHub
parent e53e25aee4
commit f79866dca4
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/aws_updateloginprofile.yml
+1 -1
View File
@@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events where a user A who has
in case new victim(user B) has more permissions than old victim(user B)
search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
errorCode = success
| eval match=if(match(userIdentity.userName,requestParameters.userName),0,1)
| eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0)
| search match=0
| stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName