admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
018caf3f69ca45aca7ec96d19963dcf2bc8b33ec
splunk-security_content/detections/cloud
T
History
Marc Schwede 63dcb7f00f Update o365_excessive_authentication_failures_alert.yml 
rename syntax adjusted
later needed lastTime included
2022-03-01 14:04:36 +01:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
abnormally_high_number_of_cloud_security_group_api_calls.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
amazon_eks_kubernetes_activity_by_src_ip.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_create_policy_version_to_allow_all_resources.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_createaccesskey.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_createloginprofile.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_cross_account_activity_from_previously_unseen_account.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_ecr_container_scanning_findings_high.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_ecr_container_scanning_findings_low_informational_unknown.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_ecr_container_scanning_findings_medium.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_ecr_container_upload_outside_business_hours.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_ecr_container_upload_unknown_user.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_excessive_security_scanning.yml
Minor updates to fixed searches.
2022-02-15 09:47:36 -08:00
aws_iam_accessdenied_discovery_events.yml
Added detection testing service results inAWS IAM AccessDenied Discovery Events
2021-11-12 19:26:05 +00:00
aws_iam_assume_role_policy_brute_force.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_iam_delete_policy.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_iam_failure_group_deletion.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_iam_successful_group_deletion.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_investigate_security_hub_alerts_by_dest.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_investigate_user_activities_by_accesskeyid.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_investigate_user_activities_by_arn.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_network_access_control_list_created_with_all_open_ports.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_network_access_control_list_deleted.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_network_acl_details_from_id.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_network_interface_details_via_resourceid.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_s3_bucket_details_via_bucketname.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_saml_access_by_provider_user_and_principal.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_saml_update_identity_provider.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
aws_setdefaultpolicyversion.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
aws_updateloginprofile.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
baseline_of_blocked_outbound_traffic_from_aws.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_cloud_infrastructure_api_calls_per_user.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_cloud_instances_destroyed.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_cloud_instances_launched.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_cloud_security_group_api_calls_per_user.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_network_acl_activity_by_arn.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_s3_bucket_deletion_activity_by_arn.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
baseline_of_security_group_activity_by_arn.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
circle_ci_disable_security_job.yml
updating docs and package bits [ci skip]
2021-09-27 18:54:15 +00:00
circle_ci_disable_security_step.yml
updating docs and package bits [ci skip]
2021-09-27 18:54:15 +00:00
cloud_api_calls_from_previously_unseen_user_roles.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_compute_instance_created_by_previously_unseen_user.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_compute_instance_created_in_previously_unused_region.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_compute_instance_created_with_previously_unseen_image.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_instance_modified_with_previously_unseen_user.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_provisioning_from_previously_unseen_city.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_provisioning_from_previously_unseen_country.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_provisioning_from_previously_unseen_ip_address.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
cloud_provisioning_from_previously_unseen_region.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
correlation_by_repository_and_risk.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
correlation_by_user_and_risk.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
create_a_list_of_approved_aws_service_accounts.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
detect_aws_console_login_by_new_user.yml
test:updated ymls
2021-12-15 21:15:02 +05:30
detect_aws_console_login_by_user_from_new_city.yml
test:updated ymls
2021-12-15 21:15:02 +05:30
detect_aws_console_login_by_user_from_new_country.yml
test:updated ymls
2021-12-15 21:15:02 +05:30
detect_aws_console_login_by_user_from_new_region.yml
test:updated ymls
2021-12-15 21:15:02 +05:30
detect_new_open_s3_buckets_over_aws_cli.yml
Branch was auto-updated.
2021-07-28 19:22:22 +00:00
detect_new_open_s3_buckets.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
detect_shared_ec2_snapshot.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
gcp_kubernetes_activity_by_src_ip.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_all_aws_activity_from_city.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_all_aws_activity_from_country.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_all_aws_activity_from_ip_address.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_all_aws_activity_from_region.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_ec2_instance_details_by_instanceid.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_ec2_launch_details.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
github_commit_changes_in_master.yml
errors and text updates
2021-10-12 13:02:16 -07:00
github_commit_in_develop.yml
errors and text updates
2021-10-12 13:02:16 -07:00
github_dependabot_alert.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
github_pull_request_from_unknown_user.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
gsuite_drive_share_in_external_email.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
gsuite_email_suspicious_attachment.yml
Branch was auto-updated.
2021-10-12 13:10:59 -07:00
gsuite_email_suspicious_subject_with_attachment.yml
Branch was auto-updated.
2021-10-12 13:10:59 -07:00
gsuite_email_with_known_abuse_web_service_link.yml
Branch was auto-updated.
2021-10-12 13:10:59 -07:00
gsuite_outbound_email_with_attachment_to_external_domain.yml
Branch was auto-updated.
2021-10-12 13:10:59 -07:00
gsuite_suspicious_shared_file_name.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
investigate_aws_activities_via_region_name.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_aws_user_activities_by_user_field.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_okta_activity_by_app.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_okta_activity_by_ip_address.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_user_activities_in_okta.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
kubernetes_nginx_ingress_lfi.yml
updating docs and package bits [ci skip]
2021-09-27 18:54:15 +00:00
kubernetes_nginx_ingress_rfi.yml
updating docs and package bits [ci skip]
2021-09-27 18:54:15 +00:00
kubernetes_scanner_image_pulling.yml
updating docs and package bits [ci skip]
2021-09-27 18:54:15 +00:00
o365_add_app_role_assignment_grant_user.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
o365_added_service_principal.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
o365_bypass_mfa_via_trusted_ip.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
o365_disable_mfa.yml
test:removed cim version
2022-02-08 12:05:05 +05:30
o365_excessive_authentication_failures_alert.yml
Update o365_excessive_authentication_failures_alert.yml
2022-03-01 14:04:36 +01:00
o365_excessive_sso_logon_errors.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
o365_new_federated_domain_added.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
o365_pst_export_alert.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
o365_suspicious_admin_email_forwarding.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
o365_suspicious_rights_delegation.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
o365_suspicious_user_email_forwarding.yml
CARS_UPDATE_MITRE_ID_B1
2021-10-11 11:03:20 +02:00
previously_seen_aws_cross_account_activity_initial.yml
revert
2021-09-15 15:48:01 -07:00
previously_seen_aws_cross_account_activity_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_aws_cross_account_activity.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_aws_regions.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_api_calls_per_user_role_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_api_calls_per_user_role_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_compute_creations_by_user_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_compute_creations_by_user_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_compute_images_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_compute_images_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_compute_instance_types_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_compute_instance_types_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_instance_modifications_by_user_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_instance_modifications_by_user_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_provisioning_activity_sources_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_provisioning_activity_sources_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_regions_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_cloud_regions_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_ec2_modifications_by_user.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_s3_bucket_access_by_remote_ip.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_users_in_cloudtrail_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_users_in_cloudtrail_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00