WIP

Author: Patrick Bareiss

baselines/add_prohibited_processes_to_enterprise_security.yml

@@ -1,6 +1,6 @@
 name: Add Prohibited Processes to Enterprise Security
 id: 251930a5-1451-4428-bb13-eed5775be0ce
-version: '1.0'
+version: 1
 date: '2017-09-15'
 description: This search takes the existing interesting process table from ES, filters
   out any existing additions added by ESCU and then updates the table with processes

baselines/baseline_of_api_calls_per_user_arn.yml

@@ -1,6 +1,6 @@
 name: Baseline of API Calls per User ARN
 id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
-version: '1.0'
+version: 1
 date: '2018-04-09'
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls made by each user. Also recorded is the number

baselines/baseline_of_blocked_outbound_traffic_from_aws.yml

@@ -1,6 +1,6 @@
 name: Baseline of blocked outbound traffic from AWS
 id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
-version: '1.0'
+version: 1
 date: '2018-05-07'
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of outbound connections blocked in your VPC flow logs by

baselines/baseline_of_command_line_length___mltk.yml

@@ -1,6 +1,6 @@
 name: Baseline of Command Line Length - MLTK
 id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
-version: '1.0'
+version: 1
 date: '2019-05-08'
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the length of the command lines observed for each user in the environment.
@@ -31,5 +31,5 @@ tags:
   - Suspicious MSHTA Activity
   - Unusual Processes
   detections:
-  - Unusually Long Command Line - MLTK
   - Detect Prohibited Applications Spawning cmd.exe
+  - Unusually Long Command Line - MLTK

baselines/baseline_of_dns_query_length___mltk.yml

@@ -1,6 +1,6 @@
 name: Baseline of DNS Query Length - MLTK
 id: c914844c-0ff5-4efc-8d44-c063443129ba
-version: '1.0'
+version: 1
 date: '2019-05-08'
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the length of the DNS queries for each DNS record type observed

baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml

@@ -1,6 +1,6 @@
 name: Baseline of Excessive AWS Instances Launched by User - MLTK
 id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
-version: '1.0'
+version: 1
 date: '2019-11-14'
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many RunInstances users do in the environment. By default, the search uses

baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml

@@ -1,6 +1,6 @@
 name: Baseline of Excessive AWS Instances Terminated by User - MLTK
 id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
-version: '1.0'
+version: 1
 date: '2019-11-14'
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many TerminateInstances users do in the environment. By default, the search

baselines/baseline_of_network_acl_activity_by_arn.yml

@@ -1,6 +1,6 @@
 name: Baseline of Network ACL Activity by ARN
 id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
-version: '1.0'
+version: 1
 date: '2018-05-21'
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls that were related to network ACLs made by each

baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml

@@ -1,6 +1,6 @@
 name: Baseline of S3 Bucket deletion activity by ARN
 id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
-version: '1.0'
+version: 1
 date: '2018-07-17'
 description: This search establishes, on a per-hour basis, the average and standard
   deviation for the number of API calls related to deleting an S3 bucket by each user.

baselines/baseline_of_security_group_activity_by_arn.yml

@@ -1,6 +1,6 @@
 name: Baseline of Security Group Activity by ARN
 id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
-version: '1.0'
+version: 1
 date: '2018-04-17'
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation for the number of API calls related to security groups made by each user.