FilesExpand file tree

develop

/

cloud

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

cloud

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
abnormally_high_number_of_cloud_infrastructure_api_calls.yml		abnormally_high_number_of_cloud_infrastructure_api_calls.yml
abnormally_high_number_of_cloud_security_group_api_calls.yml		abnormally_high_number_of_cloud_security_group_api_calls.yml
amazon_eks_kubernetes_activity_by_src_ip.yml		amazon_eks_kubernetes_activity_by_src_ip.yml
aws_create_policy_version_to_allow_all_resources.yml		aws_create_policy_version_to_allow_all_resources.yml
aws_createaccesskey.yml		aws_createaccesskey.yml
aws_createloginprofile.yml		aws_createloginprofile.yml
aws_cross_account_activity_from_previously_unseen_account.yml		aws_cross_account_activity_from_previously_unseen_account.yml
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml		aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
aws_detect_users_with_kms_keys_performing_encryption_s3.yml		aws_detect_users_with_kms_keys_performing_encryption_s3.yml
aws_ecr_container_scanning_findings_high.yml		aws_ecr_container_scanning_findings_high.yml
aws_ecr_container_scanning_findings_low_informational_unknown.yml		aws_ecr_container_scanning_findings_low_informational_unknown.yml
aws_ecr_container_scanning_findings_medium.yml		aws_ecr_container_scanning_findings_medium.yml
aws_ecr_container_upload_outside_business_hours.yml		aws_ecr_container_upload_outside_business_hours.yml
aws_ecr_container_upload_unknown_user.yml		aws_ecr_container_upload_unknown_user.yml
aws_excessive_security_scanning.yml		aws_excessive_security_scanning.yml
aws_iam_accessdenied_discovery_events.yml		aws_iam_accessdenied_discovery_events.yml
aws_iam_assume_role_policy_brute_force.yml		aws_iam_assume_role_policy_brute_force.yml
aws_iam_delete_policy.yml		aws_iam_delete_policy.yml
aws_iam_failure_group_deletion.yml		aws_iam_failure_group_deletion.yml
aws_iam_successful_group_deletion.yml		aws_iam_successful_group_deletion.yml
aws_investigate_security_hub_alerts_by_dest.yml		aws_investigate_security_hub_alerts_by_dest.yml
aws_investigate_user_activities_by_accesskeyid.yml		aws_investigate_user_activities_by_accesskeyid.yml
aws_investigate_user_activities_by_arn.yml		aws_investigate_user_activities_by_arn.yml
aws_network_access_control_list_created_with_all_open_ports.yml		aws_network_access_control_list_created_with_all_open_ports.yml
aws_network_access_control_list_deleted.yml		aws_network_access_control_list_deleted.yml
aws_network_acl_details_from_id.yml		aws_network_acl_details_from_id.yml
aws_network_interface_details_via_resourceid.yml		aws_network_interface_details_via_resourceid.yml
aws_s3_bucket_details_via_bucketname.yml		aws_s3_bucket_details_via_bucketname.yml
aws_saml_access_by_provider_user_and_principal.yml		aws_saml_access_by_provider_user_and_principal.yml
aws_saml_update_identity_provider.yml		aws_saml_update_identity_provider.yml
aws_setdefaultpolicyversion.yml		aws_setdefaultpolicyversion.yml
aws_updateloginprofile.yml		aws_updateloginprofile.yml
baseline_of_api_calls_per_user_arn.yml		baseline_of_api_calls_per_user_arn.yml
baseline_of_blocked_outbound_traffic_from_aws.yml		baseline_of_blocked_outbound_traffic_from_aws.yml
baseline_of_cloud_infrastructure_api_calls_per_user.yml		baseline_of_cloud_infrastructure_api_calls_per_user.yml
baseline_of_cloud_instances_destroyed.yml		baseline_of_cloud_instances_destroyed.yml
baseline_of_cloud_instances_launched.yml		baseline_of_cloud_instances_launched.yml
baseline_of_cloud_security_group_api_calls_per_user.yml		baseline_of_cloud_security_group_api_calls_per_user.yml
baseline_of_excessive_aws_instances_launched_by_user___mltk.yml		baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml		baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
baseline_of_network_acl_activity_by_arn.yml		baseline_of_network_acl_activity_by_arn.yml
baseline_of_s3_bucket_deletion_activity_by_arn.yml		baseline_of_s3_bucket_deletion_activity_by_arn.yml
baseline_of_security_group_activity_by_arn.yml		baseline_of_security_group_activity_by_arn.yml
circle_ci_disable_security_job.yml		circle_ci_disable_security_job.yml
circle_ci_disable_security_step.yml		circle_ci_disable_security_step.yml
cloud_api_calls_from_previously_unseen_user_roles.yml		cloud_api_calls_from_previously_unseen_user_roles.yml
cloud_compute_instance_created_by_previously_unseen_user.yml		cloud_compute_instance_created_by_previously_unseen_user.yml
cloud_compute_instance_created_in_previously_unused_region.yml		cloud_compute_instance_created_in_previously_unused_region.yml
cloud_compute_instance_created_with_previously_unseen_image.yml		cloud_compute_instance_created_with_previously_unseen_image.yml
cloud_compute_instance_created_with_previously_unseen_instance_type.yml		cloud_compute_instance_created_with_previously_unseen_instance_type.yml
cloud_instance_modified_with_previously_unseen_user.yml		cloud_instance_modified_with_previously_unseen_user.yml
cloud_provisioning_from_previously_unseen_city.yml		cloud_provisioning_from_previously_unseen_city.yml
cloud_provisioning_from_previously_unseen_country.yml		cloud_provisioning_from_previously_unseen_country.yml
cloud_provisioning_from_previously_unseen_ip_address.yml		cloud_provisioning_from_previously_unseen_ip_address.yml
cloud_provisioning_from_previously_unseen_region.yml		cloud_provisioning_from_previously_unseen_region.yml
correlation_by_repository_and_risk.yml		correlation_by_repository_and_risk.yml
correlation_by_user_and_risk.yml		correlation_by_user_and_risk.yml
create_a_list_of_approved_aws_service_accounts.yml		create_a_list_of_approved_aws_service_accounts.yml
detect_aws_console_login_by_new_user.yml		detect_aws_console_login_by_new_user.yml
detect_aws_console_login_by_user_from_new_city.yml		detect_aws_console_login_by_user_from_new_city.yml
detect_aws_console_login_by_user_from_new_country.yml		detect_aws_console_login_by_user_from_new_country.yml
detect_aws_console_login_by_user_from_new_region.yml		detect_aws_console_login_by_user_from_new_region.yml
detect_new_open_s3_buckets.yml		detect_new_open_s3_buckets.yml
detect_new_open_s3_buckets_over_aws_cli.yml		detect_new_open_s3_buckets_over_aws_cli.yml
detect_shared_ec2_snapshot.yml		detect_shared_ec2_snapshot.yml
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml		detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
gcp_kubernetes_activity_by_src_ip.yml		gcp_kubernetes_activity_by_src_ip.yml
get_all_aws_activity_from_city.yml		get_all_aws_activity_from_city.yml
get_all_aws_activity_from_country.yml		get_all_aws_activity_from_country.yml
get_all_aws_activity_from_ip_address.yml		get_all_aws_activity_from_ip_address.yml
get_all_aws_activity_from_region.yml		get_all_aws_activity_from_region.yml
get_ec2_instance_details_by_instanceid.yml		get_ec2_instance_details_by_instanceid.yml
get_ec2_launch_details.yml		get_ec2_launch_details.yml
github_commit_changes_in_master.yml		github_commit_changes_in_master.yml
github_commit_in_develop.yml		github_commit_in_develop.yml
github_dependabot_alert.yml		github_dependabot_alert.yml
github_pull_request_from_unknown_user.yml		github_pull_request_from_unknown_user.yml
gsuite_drive_share_in_external_email.yml		gsuite_drive_share_in_external_email.yml
gsuite_email_suspicious_attachment.yml		gsuite_email_suspicious_attachment.yml
gsuite_email_suspicious_subject_with_attachment.yml		gsuite_email_suspicious_subject_with_attachment.yml
gsuite_email_with_known_abuse_web_service_link.yml		gsuite_email_with_known_abuse_web_service_link.yml
gsuite_outbound_email_with_attachment_to_external_domain.yml		gsuite_outbound_email_with_attachment_to_external_domain.yml
gsuite_suspicious_shared_file_name.yml		gsuite_suspicious_shared_file_name.yml
investigate_aws_activities_via_region_name.yml		investigate_aws_activities_via_region_name.yml
investigate_aws_user_activities_by_user_field.yml		investigate_aws_user_activities_by_user_field.yml
investigate_okta_activity_by_app.yml		investigate_okta_activity_by_app.yml
investigate_okta_activity_by_ip_address.yml		investigate_okta_activity_by_ip_address.yml
investigate_user_activities_in_okta.yml		investigate_user_activities_in_okta.yml
kubernetes_nginx_ingress_lfi.yml		kubernetes_nginx_ingress_lfi.yml
kubernetes_nginx_ingress_rfi.yml		kubernetes_nginx_ingress_rfi.yml
kubernetes_scanner_image_pulling.yml		kubernetes_scanner_image_pulling.yml
o365_add_app_role_assignment_grant_user.yml		o365_add_app_role_assignment_grant_user.yml
o365_added_service_principal.yml		o365_added_service_principal.yml
o365_bypass_mfa_via_trusted_ip.yml		o365_bypass_mfa_via_trusted_ip.yml
o365_disable_mfa.yml		o365_disable_mfa.yml
o365_excessive_authentication_failures_alert.yml		o365_excessive_authentication_failures_alert.yml
o365_excessive_sso_logon_errors.yml		o365_excessive_sso_logon_errors.yml
o365_new_federated_domain_added.yml		o365_new_federated_domain_added.yml
o365_pst_export_alert.yml		o365_pst_export_alert.yml
o365_suspicious_admin_email_forwarding.yml		o365_suspicious_admin_email_forwarding.yml
View all files