bpatel 8d12500905 adding risk and product tags

2021-03-23 15:03:02 -07:00

..

abnormally_high_number_of_cloud_infrastructure_api_calls.yml

WIP

2021-03-10 14:44:44 +01:00

abnormally_high_number_of_cloud_security_group_api_calls.yml

WIP

2021-03-10 14:44:44 +01:00

aws_create_policy_version_to_allow_all_resources.yml

updates

2021-03-23 13:12:47 -07:00

aws_createaccesskey.yml

updates

2021-03-23 13:12:47 -07:00

aws_createloginprofile.yml

updates

2021-03-23 13:12:47 -07:00

aws_cross_account_activity_from_previously_unseen_account.yml

WIP

2021-03-10 14:44:44 +01:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

aws_detect_users_with_kms_keys_performing_encryption_s3.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

aws_network_access_control_list_created_with_all_open_ports.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

aws_network_access_control_list_deleted.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

aws_saml_access_by_provider_user_and_principal.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

aws_saml_update_identity_provider.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

aws_setdefaultpolicyversion.yml

updates

2021-03-23 13:12:47 -07:00

aws_updateloginprofile.yml

updates

2021-03-23 13:12:47 -07:00

cloud_api_calls_from_previously_unseen_user_roles.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_compute_instance_created_by_previously_unseen_user.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_compute_instance_created_in_previously_unused_region.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_compute_instance_created_with_previously_unseen_image.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_compute_instance_created_with_previously_unseen_instance_type.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_instance_modified_with_previously_unseen_user.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_provisioning_from_previously_unseen_city.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_provisioning_from_previously_unseen_country.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_provisioning_from_previously_unseen_ip_address.yml

WIP

2021-03-10 14:44:44 +01:00

cloud_provisioning_from_previously_unseen_region.yml

WIP

2021-03-10 14:44:44 +01:00

detect_aws_console_login_by_new_user.yml

WIP

2021-03-10 14:44:44 +01:00

detect_aws_console_login_by_user_from_new_city.yml

WIP

2021-03-10 14:44:44 +01:00

detect_aws_console_login_by_user_from_new_country.yml

WIP

2021-03-10 14:44:44 +01:00

detect_aws_console_login_by_user_from_new_region.yml

WIP

2021-03-10 14:44:44 +01:00

detect_new_open_s3_buckets_over_aws_cli.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

detect_new_open_s3_buckets.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_add_app_role_assignment_grant_user.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_added_service_principal.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_bypass_mfa_via_trusted_ip.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_disable_mfa.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_excessive_authentication_failures_alert.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_excessive_sso_logon_errors.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_new_federated_domain_added.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_pst_export_alert.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_suspicious_admin_email_forwarding.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_suspicious_rights_delegation.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00

o365_suspicious_user_email_forwarding.yml

adding risk and product tags

2021-03-23 15:03:02 -07:00