Files
splunk-security_content/lookups/api_call_by_user_baseline.yml
Bhavin Patel 6de58bce6a Update api_call_by_user_baseline.yml
latestCount is needed in detection search
2020-08-18 15:28:54 -07:00

6 lines
251 B
YAML

description: A collection that will contain the baseline information for number of
AWS API calls per user
collection: api_call_by_user_baseline
name: api_call_by_user_baseline
fields_list: arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls