admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v3.25.0
splunk-security_content/detections/cloud
T
History
divious1 63d2581343 Merge branch 'develop' into rba_poc
2021-06-30 16:10:23 -04:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
adding 3 rba examples
2021-06-19 22:15:49 -04:00
abnormally_high_number_of_cloud_security_group_api_calls.yml
WIP
2021-03-10 14:44:44 +01:00
aws_create_policy_version_to_allow_all_resources.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_createaccesskey.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_createloginprofile.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_cross_account_activity_from_previously_unseen_account.yml
WIP
2021-03-10 14:44:44 +01:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_excessive_security_scanning.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_iam_accessdenied_discovery_events.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_iam_assume_role_policy_brute_force.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_iam_delete_policy.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_iam_failure_group_deletion.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_iam_successful_group_deletion.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_network_access_control_list_created_with_all_open_ports.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_network_access_control_list_deleted.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_saml_access_by_provider_user_and_principal.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_saml_update_identity_provider.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
aws_setdefaultpolicyversion.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
aws_updateloginprofile.yml
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
2021-06-25 15:03:55 -04:00
cloud_api_calls_from_previously_unseen_user_roles.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_compute_instance_created_by_previously_unseen_user.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_compute_instance_created_in_previously_unused_region.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_compute_instance_created_with_previously_unseen_image.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_instance_modified_with_previously_unseen_user.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_provisioning_from_previously_unseen_city.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_provisioning_from_previously_unseen_country.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_provisioning_from_previously_unseen_ip_address.yml
WIP
2021-03-10 14:44:44 +01:00
cloud_provisioning_from_previously_unseen_region.yml
WIP
2021-03-10 14:44:44 +01:00
detect_aws_console_login_by_new_user.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
detect_aws_console_login_by_user_from_new_city.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
detect_aws_console_login_by_user_from_new_country.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
detect_aws_console_login_by_user_from_new_region.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
detect_new_open_s3_buckets_over_aws_cli.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
detect_new_open_s3_buckets.yml
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
adding risk and product tags
2021-03-23 15:03:02 -07:00
o365_add_app_role_assignment_grant_user.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_added_service_principal.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_bypass_mfa_via_trusted_ip.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_disable_mfa.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_excessive_authentication_failures_alert.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_excessive_sso_logon_errors.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_new_federated_domain_added.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_pst_export_alert.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_suspicious_admin_email_forwarding.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_suspicious_rights_delegation.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00
o365_suspicious_user_email_forwarding.yml
Revert "changing O365 to Office 365"
2021-06-25 15:05:19 -04:00