admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
63ec24ad568d7e411ff044bc419d62d5bb2e4e08
splunk-security_content/detections/cloud
T
History
P4T12ICK ed2d5c614b Merge branch 'develop' into issue_1101
2021-01-26 09:14:56 +01:00
..
abnormally_high_cloud_instances_destroyed.yml
Merge branch 'develop' into issue_1101
2021-01-26 09:14:56 +01:00
abnormally_high_cloud_instances_launched.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
abnormally_high_number_of_cloud_security_group_api_calls.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
aws_cross_account_activity_from_previously_unseen_account.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
Added detection testing service results inAWS Detect Users creating keys with encrypt policy without MFA
2021-01-11 14:31:23 +00:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
Added detection testing service results inAWS Detect Users with KMS keys performing encryption S3
2021-01-11 14:56:55 +00:00
aws_network_access_control_list_created_with_all_open_ports.yml
Added detection testing service results inAWS Network Access Control List Created with All Open Ports
2021-01-12 10:33:22 +00:00
aws_network_access_control_list_deleted.yml
Added detection testing service results inAWS Network Access Control List Deleted
2021-01-12 10:33:02 +00:00
cloud_api_calls_from_previously_unseen_user_roles.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_compute_instance_created_by_previously_unseen_user.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_compute_instance_created_in_previously_unused_region.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_compute_instance_created_with_previously_unseen_image.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_instance_modified_with_previously_unseen_user.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_provisioning_from_previously_unseen_city.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_provisioning_from_previously_unseen_country.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_provisioning_from_previously_unseen_ip_address.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
cloud_provisioning_from_previously_unseen_region.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
detect_aws_console_login_by_new_user.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
detect_aws_console_login_by_user_from_new_city.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
detect_aws_console_login_by_user_from_new_country.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
detect_aws_console_login_by_user_from_new_region.yml
rename mustang to ssa4aws
2021-01-21 14:31:23 -08:00
detect_gcp_storage_access_from_a_new_ip.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_new_open_gcp_storage_buckets.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_new_open_s3_buckets_over_aws_cli.yml
Added detection testing service results inDetect New Open S3 Buckets over AWS CLI
2021-01-13 13:24:58 +00:00
detect_new_open_s3_buckets.yml
Added detection testing service results inDetect New Open S3 buckets
2021-01-12 14:58:47 +00:00
detect_s3_access_from_a_new_ip.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_s3_bucket_deletion.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_security_hub_alerts_for_user.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
high_number_of_login_failures_from_a_single_source.yml
test push
2020-12-17 12:34:52 -08:00
new_container_uploaded_to_aws_ecr.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
o365_bypass_mfa_via_trusted_ip.yml
Added detection testing service results inO365 Bypass MFA via Trusted IP
2021-01-14 02:45:18 +00:00
o365_disable_mfa.yml
Added detection testing service results inO365 Disable MFA
2020-12-17 10:21:24 +00:00
o365_excessive_authentication_failures_alert.yml
Added detection testing service results inO365 Excessive Authentication Failures Alert
2020-12-17 11:17:16 +00:00
o365_pst_export_alert.yml
Added detection testing service results inO365 PST export alert
2020-12-17 10:56:41 +00:00
o365_suspicious_admin_email_forwarding.yml
Added detection testing service results inO365 Suspicious Admin Email Forwarding
2020-12-16 14:50:54 +00:00
o365_suspicious_rights_delegation.yml
Added detection testing service results inO365 Suspicious Rights Delegation
2020-12-15 15:57:03 +00:00
o365_suspicious_user_email_forwarding.yml
Added detection testing service results inO365 Suspicious User Email Forwarding
2020-12-16 14:25:18 +00:00