root be3736fc61 Added detection testing service results inAWS Network Access Control List Created with All Open Ports

2021-01-12 10:33:22 +00:00

..

abnormally_high_cloud_instances_destroyed.yml

small change

2021-01-08 13:29:04 +01:00

abnormally_high_cloud_instances_launched.yml

merge with develop

2020-10-19 11:19:41 -07:00

abnormally_high_number_of_cloud_infrastructure_api_calls.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

abnormally_high_number_of_cloud_security_group_api_calls.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

aws_cross_account_activity_from_previously_unseen_account.yml

incorrect deprecation

2021-01-05 14:53:52 -08:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

Added detection testing service results inAWS Detect Users creating keys with encrypt policy without MFA

2021-01-11 14:31:23 +00:00

aws_detect_users_with_kms_keys_performing_encryption_s3.yml

Added detection testing service results inAWS Detect Users with KMS keys performing encryption S3

2021-01-11 14:56:55 +00:00

aws_network_access_control_list_created_with_all_open_ports.yml

Added detection testing service results inAWS Network Access Control List Created with All Open Ports

2021-01-12 10:33:22 +00:00

aws_network_access_control_list_deleted.yml

improved detections and tests

2021-01-12 11:13:17 +01:00

cloud_api_calls_from_previously_unseen_user_roles.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_compute_instance_created_by_previously_unseen_user.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_compute_instance_created_in_previously_unused_region.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_compute_instance_created_with_previously_unseen_image.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_compute_instance_created_with_previously_unseen_instance_type.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_instance_modified_with_previously_unseen_user.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_network_access_control_list_deleted.yml

merge with develop

2020-10-19 11:19:41 -07:00

cloud_provisioning_from_previously_unseen_city.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_provisioning_from_previously_unseen_country.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_provisioning_from_previously_unseen_ip_address.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

cloud_provisioning_from_previously_unseen_region.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_api_activity_from_users_without_mfa.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_aws_api_activities_from_unapproved_accounts.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_aws_console_login_by_new_user.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_aws_console_login_by_user_from_new_city.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_aws_console_login_by_user_from_new_country.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_aws_console_login_by_user_from_new_region.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_gcp_storage_access_from_a_new_ip.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_new_api_calls_from_user_roles.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_new_open_gcp_storage_buckets.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_new_open_s3_buckets.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_new_user_aws_console_login.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_s3_access_from_a_new_ip.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_spike_in_blocked_outbound_traffic_from_your_aws.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_spike_in_s3_bucket_deletion.yml

merge with develop

2020-10-19 11:19:41 -07:00

detect_spike_in_security_hub_alerts_for_user.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

high_number_of_login_failures_from_a_single_source.yml

filter

2020-12-16 18:26:07 -08:00

new_container_uploaded_to_aws_ecr.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

o365_suspicious_admin_email_forwarding.yml

Added detection testing service results inO365 Suspicious Admin Email Forwarding

2020-12-16 14:50:54 +00:00

o365_suspicious_rights_delegation.yml

Added detection testing service results inO365 Suspicious Rights Delegation

2020-12-15 15:57:03 +00:00

o365_suspicious_user_email_forwarding.yml

Added detection testing service results inO365 Suspicious User Email Forwarding

2020-12-16 14:25:18 +00:00