admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
690021590a3b9b2a72d760bede040971942f024e
splunk-security_content/detections/cloud
T
History
pyth0n1c 35908f5a30 Removed user from the stats call of this search 
since it does not exist and the field userName
does exist.  And it is likely to have captured
the same data.
2022-06-21 16:25:20 -07:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
Refactored security content
2022-03-09 14:43:09 +01:00
abnormally_high_number_of_cloud_security_group_api_calls.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_create_policy_version_to_allow_all_resources.yml
minor grammar fixes
2022-05-18 12:31:41 -07:00
aws_createaccesskey.yml
Branch was auto-updated.
2022-03-14 10:14:17 -07:00
aws_createloginprofile.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_cross_account_activity_from_previously_unseen_account.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_scanning_findings_high.yml
Removed the field "user" from the stats
2022-06-21 15:45:00 -07:00
aws_ecr_container_scanning_findings_low_informational_unknown.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_scanning_findings_medium.yml
Removed user from the stats call of this search
2022-06-21 16:25:20 -07:00
aws_ecr_container_upload_outside_business_hours.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_upload_unknown_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_excessive_security_scanning.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_accessdenied_discovery_events.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_assume_role_policy_brute_force.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_delete_policy.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_failure_group_deletion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_successful_group_deletion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_lambda_updatefunctioncode.yml
updating docs and package bits [ci skip]
2022-03-03 18:22:29 +00:00
aws_network_access_control_list_created_with_all_open_ports.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_network_access_control_list_deleted.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_saml_access_by_provider_user_and_principal.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_saml_update_identity_provider.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_setdefaultpolicyversion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_updateloginprofile.yml
Branch was auto-updated.
2022-03-14 10:14:17 -07:00
circle_ci_disable_security_job.yml
Refactored security content
2022-03-09 14:43:09 +01:00
circle_ci_disable_security_step.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_api_calls_from_previously_unseen_user_roles.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_by_previously_unseen_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_in_previously_unused_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_with_previously_unseen_image.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_instance_modified_with_previously_unseen_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_city.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_country.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_ip_address.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
correlation_by_repository_and_risk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
correlation_by_user_and_risk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_aws_console_login_by_new_user.yml
update detection yml
2022-05-10 15:25:55 -07:00
detect_aws_console_login_by_user_from_new_city.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_aws_console_login_by_user_from_new_country.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_aws_console_login_by_user_from_new_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_new_open_s3_buckets_over_aws_cli.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_new_open_s3_buckets.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_shared_ec2_snapshot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_actions_disable_security_workflow.yml
github actions detection
2022-04-04 11:08:39 +02:00
github_commit_changes_in_master.yml
improved GitHub detection
2022-04-04 13:23:37 +02:00
github_commit_in_develop.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_dependabot_alert.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_pull_request_from_unknown_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_drive_share_in_external_email.yml
adding insider threat, fixing minor display bug
2022-05-19 21:19:35 -04:00
gsuite_email_suspicious_attachment.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_email_suspicious_subject_with_attachment.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_email_with_known_abuse_web_service_link.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_outbound_email_with_attachment_to_external_domain.yml
adding insider threat, fixing minor display bug
2022-05-19 21:19:35 -04:00
gsuite_suspicious_shared_file_name.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_nginx_ingress_lfi.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_nginx_ingress_rfi.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_scanner_image_pulling.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_add_app_role_assignment_grant_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_added_service_principal.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_bypass_mfa_via_trusted_ip.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_disable_mfa.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_excessive_authentication_failures_alert.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_excessive_sso_logon_errors.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_new_federated_domain_added.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_pst_export_alert.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_admin_email_forwarding.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_rights_delegation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_user_email_forwarding.yml
Refactored security content
2022-03-09 14:43:09 +01:00