security_content/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml at develop · security-mindset/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
name: Cloud Instance Modified By Previously Unseen User Unit Test
tests:
- name: Cloud Instance Modified By Previously Unseen User
  file: cloud/cloud_instance_modified_with_previously_unseen_user.yml
  pass_condition: '| stats count | where count > 0'
  earliest_time: -24h
  latest_time: now
  baselines:
  - name: Previously Seen Cloud Instance Modifications By User - Initial
    file: baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml
    pass_condition: '| stats count | where count > 0'
    earliest_time: -30d
    latest_time: -1d
  - name: Previously Seen Cloud Instance Modifications By User - Update
    file: baselines/previously_seen_cloud_instance_modifications_by_user___update.yml
    pass_condition: '| stats count | where count > 0'
    earliest_time: -30d
    latest_time: -1d
  attack_data:
  - file_name: cloudtrail_behavioural_detections.json
    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
    update_timestamp: true