mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
David Dorsey
15 lines
641 B
YAML
15 lines
641 B
YAML
name: Verify Enough Cloud Instance Data Exists
|
|
id: 05f4b370-4653-4c00-8b32-841ff76d8e2a
|
|
version: 1
|
|
date: '2020-08-20'
|
|
description: Checks to see if enough time has passed for behavorial based searches
|
|
how_to_implement: None
|
|
type: ESCU
|
|
references: []
|
|
author: David Dorsey, Splunk
|
|
search: '| tstats earliest(_time) as longEnough from datamodel=Change where All_Changes.All_Changes.object_category=instance | eval filter="*" | eval enough_data=if(longEnough < relative_time(now(), "-14d"), 1, 0) | table filter, enough_data | outputlookup cloud_instances_enough_data'
|
|
known_false_positives: None
|
|
tags:
|
|
analytics_story:
|
|
- Cloud Cryptomining
|