admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

work in progress file

Browse Source
This commit is contained in:
Rico Valdez
2020-08-18 17:01:29 -06:00
parent 0328c2d98f
commit fb00fffd3f
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_cloud_provisioning_from_previously_unseen_country___dm.yml
+12
View File
@@ -25,6 +25,18 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time,
user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`'
search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run*
OR eventName=Create*) | iplocation sourceIPAddress | search Country=* | stats earliest(_time)
as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country
| inputlookup append=t previously_seen_provisioning_activity_src.csv | stats min(firstTime)
as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country
| outputlookup previously_seen_provisioning_activity_src.csv | stats min(firstTime)
as firstTime max(lastTime) as lastTime by sourceIPAddress | eval newIP=if(firstTime
>= relative_time(now(), "-70m@m"), 1, 0) | where newIP=1 | table sourceIPAddress]
| spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table
_time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`'
search: '| tstats min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) from datmodel=Change where
(All_Changes.action=started OR All_Changes.action=created) All_Changes.object_category=instance by All_Changes.src