mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
84 lines
1.7 KiB
Plaintext
84 lines
1.7 KiB
Plaintext
#############
|
|
# Automatically generated by generator.py in splunk/security_content
|
|
# On Date: 2023-10-18T20:29:18 UTC
|
|
# Author: Splunk Security Research
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
[api_call_by_user_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[cloud_instances_enough_data]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_S3_access_from_remote_ip]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_api_calls_from_user_roles]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_aws_cross_account_activity]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_aws_regions]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_api_calls_per_user_role]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_creations_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_images]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_instance_types]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_instance_modifications_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_provisioning_activity_sources]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_regions]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_gcp_storage_access_from_remote_ip]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_running_windows_services]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_users_console_logins]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[s3_deletion_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[security_group_activity_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[zoom_first_time_child_process]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|