security_content/dist/DA-ESS-ContentUpdate/default/collections.conf at develop · codingWithJimmy/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2024-01-30T21:29:48 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############

[api_call_by_user_baseline]
enforceTypes = false
replicate = false

[cloud_instances_enough_data]
enforceTypes = false
replicate = false

[k8s_container_network_io_baseline]
enforceTypes = false
replicate = false

[k8s_container_network_io_ratio_baseline]
enforceTypes = false
replicate = false

[k8s_process_resource_baseline]
enforceTypes = false
replicate = false

[k8s_process_resource_ratio_baseline]
enforceTypes = false
replicate = false

[previously_seen_S3_access_from_remote_ip]
enforceTypes = false
replicate = false

[previously_seen_api_calls_from_user_roles]
enforceTypes = false
replicate = false

[previously_seen_aws_cross_account_activity]
enforceTypes = false
replicate = false

[previously_seen_aws_regions]
enforceTypes = false
replicate = false

[previously_seen_cloud_api_calls_per_user_role]
enforceTypes = false
replicate = false

[previously_seen_cloud_compute_creations_by_user]
enforceTypes = false
replicate = false

[previously_seen_cloud_compute_images]
enforceTypes = false
replicate = false

[previously_seen_cloud_compute_instance_types]
enforceTypes = false
replicate = false

[previously_seen_cloud_instance_modifications_by_user]
enforceTypes = false
replicate = false

[previously_seen_cloud_provisioning_activity_sources]
enforceTypes = false
replicate = false

[previously_seen_cloud_regions]
enforceTypes = false
replicate = false

[previously_seen_gcp_storage_access_from_remote_ip]
enforceTypes = false
replicate = false

[previously_seen_running_windows_services]
enforceTypes = false
replicate = false

[previously_seen_users_console_logins]
enforceTypes = false
replicate = false

[s3_deletion_baseline]
enforceTypes = false
replicate = false

[security_group_activity_baseline]
enforceTypes = false
replicate = false

[zoom_first_time_child_process]
enforceTypes = false
replicate = false