0a6bafbe36
Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 20:33:32 -07:00
7f2f53d0a8
validate fixes
2020-09-15 20:19:45 -07:00
bf143f01e2
cron_schedule fixed
2020-09-15 20:19:45 -07:00
7cefe3179d
Small updates
2020-09-15 20:19:45 -07:00
182c4116c9
tweaks and updates
2020-09-15 20:19:45 -07:00
248c3d412c
latest updates to create in new vendor_region
2020-09-15 20:19:45 -07:00
5fb282681b
loud cloud
2020-09-15 20:19:45 -07:00
934f2ddebc
Translated detections/detect_spike_in_security_group_activity.yml
2020-09-15 20:19:45 -07:00
adeeab0ee8
Updated baseline searches to have correct deployment. Which was also created
2020-09-15 20:19:45 -07:00
483d492405
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-15 20:19:45 -07:00
b5914eacd9
bug fixes
2020-09-15 20:19:45 -07:00
8ffbe56392
Updated MLTK searches based on Peter's work
2020-09-15 20:19:45 -07:00
b62f2a0ba7
Adding cloud NACL deletion detection
2020-09-15 20:19:45 -07:00
017738bd5d
Revert "Converting ACL deletion detection from Cloudtrail to Change DM"
...
Actually will just add this as a new cloud_ detection and leave the old
one in place for now
This reverts commit 3159472018
2020-09-15 20:19:45 -07:00
987a843f9d
Converting ACL deletion detection from Cloudtrail to Change DM
2020-09-15 20:19:45 -07:00
344b61d158
minor naming bug
2020-09-15 20:19:45 -07:00
212338bcc4
adding new stories to response
2020-09-15 20:19:41 -07:00
976971526d
updates to ymls to make sure validate passes
2020-09-15 20:17:49 -07:00
9f8418ee85
fixed validate issues
2020-09-15 20:17:49 -07:00
4af9407d8f
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
ea3f9165ae
Added needed macros and lookups
2020-09-15 20:17:49 -07:00
a65c01dedf
updates for mustang
2020-09-15 20:17:49 -07:00
a679a094df
Updates
2020-09-15 20:17:49 -07:00
c341614465
new files for unblocked searches
2020-09-15 20:17:49 -07:00
101702c623
detection - may still change name
2020-09-15 20:17:49 -07:00
03245f6372
changes for mustang
2020-09-15 20:17:49 -07:00
a2b98fa8f7
Fixed validate script errors
2020-09-15 20:17:49 -07:00
5addb1eca4
Fixed errors found by validate script
2020-09-15 20:17:49 -07:00
79c108b949
Fixed a horrible bug that Patrick introduced in the validate script
2020-09-15 20:17:44 -07:00
4bd7eae3c8
Removed unused file
2020-09-15 20:15:27 -07:00
181f810dbb
Updated cloud instances destroyed to change data model
2020-09-15 20:15:23 -07:00
7d35bc9947
Remove show_options
2020-09-15 09:45:45 -07:00
d7d22e8809
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 10:30:16 -05:00
3e420d4cf5
Changed object to object_id
2020-09-15 10:30:02 -05:00
9f54f90aee
Merge branch 'develop' into TR-41_aws_ec2_mods
2020-09-14 14:12:25 -07:00
1f56396028
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-09-14 14:11:02 -07:00
6fd7b6ef2f
more updates
2020-09-14 14:11:02 -07:00
aedfc4e837
Created manifests for unseen city, region, and country and updated
...
logic to reflect each case
2020-09-14 14:11:02 -07:00
56d0abdc31
Manifest cleanup
2020-09-14 14:11:01 -07:00
2f1f96c804
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-09-14 14:11:01 -07:00
e042b84f82
work in progress file
2020-09-14 14:11:01 -07:00
3c5f75c452
Removed a few API calls that are not really modifications
2020-09-14 14:11:01 -07:00
481fb128c6
new files for translated detections
2020-09-14 14:11:01 -07:00
bb5384564a
new files - not finalized
2020-09-14 14:11:01 -07:00
60456b9e9a
some translated searches for change DM
2020-09-14 14:11:01 -07:00
02ac11cfd8
Merge branch 'develop' into gcpoauth
2020-09-14 13:24:54 -07:00
f1ebf3b8d5
formatting error
2020-09-14 13:23:55 -07:00
52739bc3ab
yml updates
2020-09-14 13:12:51 -07:00
57ee3f98a5
addedref
2020-09-14 15:56:03 -04:00
80e2fd37d6
fixedawsforgcp
2020-09-14 15:33:39 -04:00
jzsplunk