mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
101 lines
2.0 KiB
Plaintext
101 lines
2.0 KiB
Plaintext
#############
|
|
# Automatically generated by 'contentctl build' from
|
|
# https://github.com/splunk/contentctl
|
|
# On Date: 2024-07-01T17:41:43 UTC
|
|
# Author: Splunk Threat Research Team - Splunk
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
[api_call_by_user_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[cloud_instances_enough_data]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[k8s_container_network_io_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[k8s_container_network_io_ratio_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[k8s_process_resource_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[k8s_process_resource_ratio_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_api_calls_from_user_roles]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_aws_cross_account_activity]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_aws_regions]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_api_calls_per_user_role]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_creations_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_images]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_instance_types]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_instance_modifications_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_provisioning_activity_sources]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_regions]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_gcp_storage_access_from_remote_ip]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_running_windows_services]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_S3_access_from_remote_ip]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_users_console_logins]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[s3_deletion_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[security_group_activity_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[zoom_first_time_child_process]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|