mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
19 lines
841 B
YAML
19 lines
841 B
YAML
name: Previously Seen Cloud Compute Images
|
|
id: 3782ad10-5ce2-46e2-b9c4-1de9ecd3aecc
|
|
version: 1
|
|
date: '2018-03-12'
|
|
description: This search builds a table of previously seen images used to launch cloud
|
|
compute instances
|
|
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
|
|
and have the Security Research cloud data model installed.
|
|
author: David Dorsey, Splunk
|
|
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Cloud_Infrastructure.Compute
|
|
where Compute.action=run `previously_seen_cloud_compute_image_input_filter` by Compute.image_id
|
|
| `drop_dm_object_name("Compute")` | outputlookup previously_seen_cloud_compute_images
|
|
| stats count'
|
|
tags:
|
|
analytics_story:
|
|
- Cloud Cryptomining
|
|
detections:
|
|
- Cloud Compute Instance Created With Previously Unseen Image
|