Repository navigation
Conversation
…ehavioral-detections
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24f86e263e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…a_single_identity.yml Was pushed in another PR: https://github.com/splunk/security_content/pull/4312/changes
We changed the logic and I applied changes in the use of fields after review
updating after review comments, using CIM fields
…avioral-detections
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da763041a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | eval event_key=coalesce(eventID, md5(_raw)) | ||
| | dedup event_key | ||
| | eval event_time=_time | ||
| | bin _time span=1h |
There was a problem hiding this comment.
When more than 10 calls span a clock-hour boundary, this fixed bin can miss the activity—for example, six calls at 12:55 and five at 13:05 are 11 calls within ten minutes but form buckets of 6 and 5, so neither reaches the threshold. Use a rolling one-hour count or overlapping windows so the search matches the stated “within one hour” behavior.
Useful? React with 👍 / 👎.
| activity in the latest hour with the preceding seven-day baseline. | ||
| The test data contains the current-period event but does not reproduce | ||
| the complete scheduled-search time context required for an automated | ||
| unit test. | ||
| test_type: experimental |
There was a problem hiding this comment.
The rewritten search no longer has a seven-day baseline or requires a 169-hour window; it only needs more than 10 unique events in an hourly bucket. Retaining this obsolete explanation and experimental classification skips the production query during normal automated testing, while the described single current-period event cannot satisfy batch_request_count>10; provide threshold-sized attack data and make this a unit test.
Useful? React with 👍 / 👎.
Fixing logic for time window one hour in total, and description of tests
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3dd3269e5b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | streamstats time_window=1h count AS rolling_batch_request_count | ||
| min(event_time) AS window_start | ||
| BY vendor_account user_arn | ||
| | where rolling_batch_request_count>10 |
There was a problem hiding this comment.
When a principal makes exactly 11 qualifying calls, this filter discards the first 10 events before stats, so src, user_agent, and vendor_region describe only the final call even though the result represents all 11. If the earlier calls used a different source IP, the alert's threat object omits the source responsible for most of the burst; retain or rejoin the events belonging to the qualifying rolling window before aggregating the investigation fields.
Useful? React with 👍 / 👎.
This branch has not been deployed
3 participants
Summary
Detection is related to AWS Anomalous Secrets Manager Batch Retrieval, it detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour
Validation
developbranch.Attack data
The corresponding anonymized attack-data datasets are being prepared separately and have been merged into
splunk/attack_data.