admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bd7ea8c0eee205bc8d617d396c412c41996f4f7f
splunk-security_content/detections/cloud
T
History
root 0805b7e9d3 Added detection testing service results inDetect AWS Console Login by User from New City
2020-12-01 20:54:35 +00:00
..
abnormally_high_aws_instances_launched_by_user___mltk.yml
merge with develop
2020-10-19 11:19:41 -07:00
abnormally_high_aws_instances_launched_by_user.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
abnormally_high_aws_instances_terminated_by_user___mltk.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
abnormally_high_aws_instances_terminated_by_user.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
abnormally_high_cloud_instances_destroyed.yml
merge with develop
2020-10-19 11:19:41 -07:00
abnormally_high_cloud_instances_launched.yml
merge with develop
2020-10-19 11:19:41 -07:00
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
Added detection testing service results inAbnormally High Number Of Cloud Infrastructure API Calls
2020-12-01 19:45:03 +00:00
abnormally_high_number_of_cloud_security_group_api_calls.yml
Added detection testing service results inAbnormally High Number Of Cloud Security Group API Calls
2020-12-01 20:07:25 +00:00
amazon_eks_kubernetes_cluster_scan_detection.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
amazon_eks_kubernetes_pod_scan_detection.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_cloud_provisioning_from_previously_unseen_city.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_cloud_provisioning_from_previously_unseen_country.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_cloud_provisioning_from_previously_unseen_ip_address.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_cloud_provisioning_from_previously_unseen_region.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_cross_account_activity_from_previously_unseen_account.yml
Added detection testing service results inAWS Cross Account Activity From Previously Unseen Account
2020-11-30 23:05:14 +00:00
aws_detect_attach_to_role_policy.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_detect_permanent_key_creation.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_detect_role_creation.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_detect_sts_assume_role_abuse.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_detect_sts_get_session_token_abuse.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
fixes
2020-11-06 13:50:51 -08:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
updating text
2020-11-11 16:45:41 -08:00
aws_network_access_control_list_created_with_all_open_ports.yml
merge with develop
2020-10-19 11:19:41 -07:00
aws_network_access_control_list_deleted.yml
merge with develop
2020-10-19 11:19:41 -07:00
cloud_api_calls_from_previously_unseen_user_roles.yml
Added detection testing service results inCloud API Calls From Previously Unseen User Roles
2020-11-30 23:29:04 +00:00
cloud_compute_instance_created_by_previously_unseen_user.yml
Added detection testing service results inCloud Compute Instance Created By Previously Unseen User
2020-11-30 23:29:24 +00:00
cloud_compute_instance_created_in_previously_unused_region.yml
Added detection testing service results inCloud Compute Instance Created In Previously Unused Region
2020-11-30 22:19:34 +00:00
cloud_compute_instance_created_with_previously_unseen_image.yml
Added detection testing service results inCloud Compute Instance Created With Previously Unseen Image
2020-11-30 23:39:10 +00:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
Added detection testing service results inCloud Compute Instance Created With Previously Unseen Instance Type
2020-12-01 00:02:09 +00:00
cloud_instance_modified_with_previously_unseen_user.yml
Added detection testing service results inCloud Instance Modified By Previously Unseen User
2020-12-01 20:17:56 +00:00
cloud_network_access_control_list_deleted.yml
merge with develop
2020-10-19 11:19:41 -07:00
cloud_provisioning_from_previously_unseen_city.yml
Added detection testing service results inCloud Provisioning Activity From Previously Unseen City
2020-12-01 00:02:22 +00:00
cloud_provisioning_from_previously_unseen_country.yml
Added detection testing service results inCloud Provisioning Activity From Previously Unseen Country
2020-12-01 20:38:45 +00:00
cloud_provisioning_from_previously_unseen_ip_address.yml
Added detection testing service results inCloud Provisioning Activity From Previously Unseen IP Address
2020-12-01 00:11:49 +00:00
cloud_provisioning_from_previously_unseen_region.yml
Added detection testing service results inCloud Provisioning Activity From Previously Unseen Region
2020-12-01 00:11:26 +00:00
detect_api_activity_from_users_without_mfa.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_aws_api_activities_from_unapproved_accounts.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_aws_console_login_by_new_user.yml
Added detection testing service results inDetect AWS Console Login by New User
2020-12-01 20:35:03 +00:00
detect_aws_console_login_by_user_from_new_city.yml
Added detection testing service results inDetect AWS Console Login by User from New City
2020-12-01 20:54:35 +00:00
detect_aws_console_login_by_user_from_new_country.yml
Added detection testing service results inDetect AWS Console Login by User from New Country
2020-12-01 00:11:36 +00:00
detect_aws_console_login_by_user_from_new_region.yml
Added detection testing service results inDetect AWS Console Login by User from New Region
2020-12-01 00:51:03 +00:00
detect_gcp_storage_access_from_a_new_ip.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_new_api_calls_from_user_roles.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_new_open_gcp_storage_buckets.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_new_open_s3_buckets.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_new_user_aws_console_login.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_s3_access_from_a_new_ip.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_aws_api_activity.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_network_acl_activity.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_s3_bucket_deletion.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_security_group_activity.yml
merge with develop
2020-10-19 11:19:41 -07:00
detect_spike_in_security_hub_alerts_for_user.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
ec2_instance_modified_with_previously_unseen_user.yml
merge with develop
2020-10-19 11:19:41 -07:00
ec2_instance_started_in_previously_unseen_region.yml
merge with develop
2020-10-19 11:19:41 -07:00
ec2_instance_started_with_previously_unseen_ami.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
ec2_instance_started_with_previously_unseen_instance_type.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
ec2_instance_started_with_previously_unseen_user.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
gcp_detect_accounts_with_high_risk_roles_by_project.yml
reorg dir
2020-10-19 10:10:09 -07:00
gcp_detect_gcploit_framework.yml
reorg dir
2020-10-19 10:10:09 -07:00
gcp_detect_high_risk_permissions_by_resource_and_account.yml
reorg dir
2020-10-19 10:10:09 -07:00
gcp_detect_oauth_token_abuse.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
gcp_gcr_container_uploaded.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
gcp_kubernetes_cluster_pod_scan_detection.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
gcp_kubernetes_cluster_scan_detection.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_aws_detect_rbac_authorizations_by_account.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_aws_detect_sensitive_object_access.yml
Merge branch 'develop' into organize_detections
2020-10-13 20:19:08 -04:00
kubernetes_aws_detect_sensitive_role_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_aws_detect_suspicious_kubectl_calls.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_detect_rbac_authorization_by_account.yml
updated sourcetype
2020-11-30 12:30:47 -08:00
kubernetes_azure_detect_sensitive_object_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_detect_sensitive_role_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_pod_scan_fingerprint.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_azure_scan_fingerprint.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
2020-10-29 12:09:16 -04:00
kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_gcp_detect_sensitive_object_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_gcp_detect_sensitive_role_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kubernetes_gcp_detect_suspicious_kubectl_calls.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
new_container_uploaded_to_aws_ecr.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00