Skip to content

Commit 011b33c

Browse files
pyth0n1cpyth0n1c
committed
Merge branch 'remove_detections' of https://github.com/splunk/security_content into remove_detections
2 parents 58aca7d + 59b9657 commit 011b33c

File tree

223 files changed

+2233
-750
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

223 files changed

+2233
-750
lines changed

‎data_sources/asl_aws_cloudtrail.yml

+16-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,22 @@
11
name: ASL AWS CloudTrail
22
id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898
3-
version: 1
4-
date: '2025-01-14'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for ASL AWS CloudTrail
6+
description: Represents AWS API dataset data collection from Amazon Security Lake.
7+
mitre_components:
8+
- Cloud Service Metadata
9+
- Cloud Service Modification
10+
- Cloud Storage Access
11+
- Instance Creation
12+
- Instance Deletion
13+
- Instance Start
14+
- Instance Stop
15+
- Instance Modification
16+
- Cloud Storage Creation
17+
- Cloud Storage Deletion
18+
- Cloud Service Enumeration
19+
- Cloud Storage Enumeration
720
source: aws_asl
821
sourcetype: aws:asl
922
separator: api.operation

‎data_sources/aws_cloudfront.yml

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,17 @@
11
name: AWS Cloudfront
22
id: 780086dc-2384-45b6-ade7-56cb00105464
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS Cloudfront
6+
description: Logs requests made to AWS CloudFront distributions, including details
7+
on client access, response data, and performance metrics.
8+
mitre_components:
9+
- Network Traffic Content
10+
- Network Traffic Flow
11+
- Response Metadata
12+
- Response Content
13+
- Logon Session Metadata
14+
- Cloud Service Metadata
715
source: aws
816
sourcetype: aws:cloudfront:accesslogs
917
supported_TA:

‎data_sources/aws_cloudtrail.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ id: e8ace6db-1dbd-4c72-a1fb-334684619a38
33
version: 1
44
date: '2024-07-24'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail
6+
description: All AWS CloudTrail events
77
source: aws_cloudtrail
88
sourcetype: aws:cloudtrail
99
separator: eventName

‎data_sources/aws_cloudtrail_assumerolewithsaml.yml

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
name: AWS CloudTrail AssumeRoleWithSAML
22
id: 1e28f2a6-2db9-405f-b298-18734a293f77
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail AssumeRoleWithSAML
6+
description: Logs attempts to assume roles via SAML authentication in AWS, including
7+
details of identity provider and role mapping.
8+
mitre_components:
9+
- User Account Authentication
10+
- Logon Session Creation
11+
- User Account Metadata
12+
- Cloud Service Metadata
13+
- Instance Modification
714
source: aws_cloudtrail
815
sourcetype: aws:cloudtrail
916
separator: eventName
17+
separator_value: AssumeRoleWithSAML
1018
supported_TA:
1119
- name: Splunk Add-on for AWS
1220
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_consolelogin.yml

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
name: AWS CloudTrail ConsoleLogin
22
id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail ConsoleLogin
6+
description: Logs attempts to sign in to the AWS Management Console, including successful
7+
and failed login events.
8+
mitre_components:
9+
- User Account Authentication
10+
- Logon Session Creation
11+
- User Account Metadata
12+
- Logon Session Metadata
13+
- Cloud Service Metadata
714
source: aws_cloudtrail
815
sourcetype: aws:cloudtrail
916
separator: eventName
17+
separator_value: ConsoleLogin
1018
supported_TA:
1119
- name: Splunk Add-on for AWS
1220
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_copyobject.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CopyObject
22
id: 965083f4-64a8-403f-99cc-252e1a6bd3b6
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CopyObject
6+
description: Logs operations that copy objects within or between AWS S3 buckets, including
7+
details of source and destination.
8+
mitre_components:
9+
- Cloud Storage Access
10+
- Cloud Storage Modification
11+
- Cloud Storage Metadata
12+
- Instance Modification
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CopyObject
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createaccesskey.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateAccessKey
22
id: 0460f7da-3254-4d90-b8c0-2ca657d0cea0
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateAccessKey
6+
description: Logs the creation of new AWS access keys, including details of the associated
7+
user and permissions.
8+
mitre_components:
9+
- User Account Creation
10+
- User Account Metadata
11+
- Cloud Service Modification
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateAccessKey
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createkey.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateKey
22
id: fcfc1593-b6b5-4a0f-91c5-3c395116a8b9
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateKey
6+
description: Logs the creation of new AWS KMS keys, including details of key properties
7+
and associated metadata.
8+
mitre_components:
9+
- Cloud Service Creation
10+
- Cloud Service Metadata
11+
- Instance Creation
12+
- Volume Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateKey
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createloginprofile.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateLoginProfile
22
id: 0024fdb1-0d62-4449-970a-746952cf80b6
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateLoginProfile
6+
description: Logs the creation of login profiles for IAM users, including associated
7+
metadata and authentication settings.
8+
mitre_components:
9+
- User Account Creation
10+
- User Account Metadata
11+
- Logon Session Metadata
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateLoginProfile
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createnetworkaclentry.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateNetworkAclEntry
22
id: 45934028-10ec-4ab5-a7b1-a6349b833e67
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateNetworkAclEntry
6+
description: Logs the creation of new entries in a network ACL, including rules to
7+
allow or deny specific network traffic.
8+
mitre_components:
9+
- Firewall Rule Modification
10+
- Network Connection Creation
11+
- Cloud Service Modification
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateNetworkAclEntry
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createpolicyversion.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreatePolicyVersion
22
id: f9f0f3da-37ec-4164-9ea0-0ae46645a86b
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreatePolicyVersion
6+
description: Logs the creation of new versions of IAM policies, including changes
7+
to permissions and attached roles or resources.
8+
mitre_components:
9+
- Cloud Service Modification
10+
- Cloud Service Metadata
11+
- User Account Metadata
12+
- Group Modification
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreatePolicyVersion
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createsnapshot.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateSnapshot
22
id: 514135a2-f4b2-4d32-8f31-d87824887f9f
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateSnapshot
6+
description: Logs the creation of a new snapshot of a cloud resource, such as an Amazon
7+
EBS volume, including details about the snapshot ID and resource type.
8+
mitre_components:
9+
- Snapshot Creation
10+
- Snapshot Metadata
11+
- Volume Metadata
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateSnapshot
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createtask.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateTask
22
id: 6501e4fe-05b2-45f1-bd51-9e06a94fa7d9
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateTask
6+
description: Logs the creation of a new task in AWS services, such as ECS, including
7+
details about the task definition and resource allocation.
8+
mitre_components:
9+
- Scheduled Job Creation
10+
- Scheduled Job Metadata
11+
- Cloud Service Metadata
12+
- Instance Creation
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateTask
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_createvirtualmfadevice.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateVirtualMFADevice
22
id: 13e6e952-0dad-4190-865c-fb5911725f7a
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateVirtualMFADevice
6+
description: Logs the creation of a new virtual multi-factor authentication (MFA)
7+
device, including details about the associated user and configuration.
8+
mitre_components:
9+
- User Account Creation
10+
- User Account Metadata
11+
- Cloud Service Creation
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateVirtualMFADevice
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_deactivatemfadevice.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail DeactivateMFADevice
22
id: 7397a10b-1150-4de9-8062-a96454ae53b2
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail DeactivateMFADevice
6+
description: Logs the deactivation of a multi-factor authentication (MFA) device,
7+
including details about the associated user and the device.
8+
mitre_components:
9+
- User Account Modification
10+
- User Account Metadata
11+
- Cloud Service Modification
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: DeactivateMFADevice
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml

+8-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
name: AWS CloudTrail DeleteAccountPasswordPolicy
22
id: b0730ac8-0992-4de8-b000-2c7d0fc7a67f
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail DeleteAccountPasswordPolicy
6+
description: Logs the deletion of an account-level password policy in AWS, including
7+
details about the account and policy being removed.
8+
mitre_components:
9+
- Cloud Service Modification
10+
- Cloud Service Metadata
711
source: aws_cloudtrail
812
sourcetype: aws:cloudtrail
913
separator: eventName
14+
separator_value: DeleteAccountPasswordPolicy
1015
supported_TA:
1116
- name: Splunk Add-on for AWS
1217
url: https://splunkbase.splunk.com/app/1876

‎data_sources/aws_cloudtrail_deletealarms.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail DeleteAlarms
22
id: b0730ac8-0992-4de8-b000-2c7d0fc7a61f
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Bhavin Patel, Splunk
6-
description: Data source object for AWS CloudTrail DeleteAlarms
6+
description: Logs the deletion of CloudWatch alarms, including details about the alarm
7+
names and associated monitoring configurations.
8+
mitre_components:
9+
- Cloud Service Modification
10+
- Cloud Service Metadata
11+
- Application Log Content
12+
- Host Status
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: DeleteAlarms
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876

0 commit comments

Comments
 (0)