Skip to content

Commit 09d8186

Browse files
terrancedejesusterrancedejesus
committed
adjusted order of investigation fields
1 parent 7974922 commit 09d8186

17 files changed

+106
-100
lines changed

‎rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -90,21 +90,21 @@ and process.args: (
9090
[rule.investigation_fields]
9191
field_names = [
9292
"@timestamp",
93-
"cloud.region",
93+
"process.user.name",
94+
"process.entry_leader.group.name",
95+
"process.entry_leader.real_user.name",
96+
"event.action",
9497
"event.type",
9598
"host.os.type",
9699
"host.os.kernel",
97100
"process.entry_leader.executable",
98-
"process.entry_leader.group.name",
99-
"process.entry_leader.real_user.name",
100101
"process.entry_leader.working_directory",
101102
"process.parent.executable",
102103
"process.executable",
103104
"process.hash.sha256",
104105
"process.parent.command_line",
105106
"process.command_line",
106-
"process.args",
107-
"process.user.name"
107+
"process.args"
108108
]
109109

110110
[[rule.threat]]

‎rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -94,16 +94,17 @@ event.dataset:aws.cloudtrail
9494

9595
[rule.investigation_fields]
9696
field_names = [
97-
"event.action",
98-
"event.outcome",
99-
"cloud.region",
100-
"user_agent.original",
97+
"@timestamp",
10198
"user.name",
99+
"aws.cloudtrail.user_identity.arn",
100+
"aws.cloudtrail.user_identity.type",
102101
"source.address",
103-
"aws.cloudtrail.request_parameters",
102+
"user_agent.original",
104103
"aws.cloudtrail.flattened.request_parameters.name",
105-
"aws.cloudtrail.user_identity.type",
106-
"aws.cloudtrail.user_identity.arn"
104+
"event.action",
105+
"event.outcome",
106+
"cloud.region",
107+
"aws.cloudtrail.request_parameters"
107108
]
108109

109110
[[rule.threat]]

‎rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,10 +109,10 @@ from logs-aws.cloudtrail-*
109109

110110
[rule.investigation_fields]
111111
field_names = [
112-
"region_count",
113-
"window_count",
112+
"aws.cloudtrail.user_identity.arn",
114113
"target_time_window",
115-
"aws.cloudtrail.user_identity.arn"
114+
"region_count",
115+
"window_count"
116116
]
117117

118118
[[rule.threat]]

‎rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,13 +102,15 @@ event.dataset: "aws.cloudtrail"
102102

103103
[rule.investigation_fields]
104104
field_names = [
105+
"@timestamp",
106+
"user.name",
107+
"aws.cloudtrail.user_identity.type",
108+
"aws.cloudtrail.user_identity.arn",
109+
"user_agent.original",
105110
"event.action",
106111
"event.outcome",
107112
"cloud.region",
108-
"user_agent.original",
109-
"user.name",
110-
"aws.cloudtrail.user_identity.type",
111-
"aws.cloudtrail.user_identity.arn"
113+
"aws.cloudtrail.request_parameters"
112114
]
113115

114116
[[rule.threat]]

‎rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,16 +85,16 @@ event.dataset: "aws.cloudtrail"
8585

8686
[rule.investigation_fields]
8787
field_names = [
88+
"@timestamp",
89+
"user.name",
90+
"aws.cloudtrail.user_identity.arn",
91+
"aws.cloudtrail.user_identity.type",
92+
"user_agent.original",
8893
"event.action",
8994
"event.outcome",
9095
"cloud.region",
91-
"related.user",
92-
"user.name",
93-
"user_agent.original",
9496
"aws.cloudtrail.request_parameters",
9597
"aws.cloudtrail.response_elements",
96-
"aws.cloudtrail.user_identity.arn",
97-
"aws.cloudtrail.user_identity.type"
9898
]
9999

100100
[[rule.threat]]

‎rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user.toml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,17 +83,18 @@ event.dataset: "aws.cloudtrail"
8383

8484
[rule.investigation_fields]
8585
field_names = [
86+
"@timestamp",
87+
"user.name",
88+
"aws.cloudtrail.user_identity.arn",
89+
"aws.cloudtrail.user_identity.type",
90+
"user_agent.original",
8691
"event.action",
8792
"event.outcome",
8893
"cloud.region",
89-
"user_agent.original",
90-
"user.name",
91-
"aws.cloudtrail.request_parameters",
9294
"aws.cloudtrail.flattened.request_parameters.protocol",
9395
"aws.cloudtrail.flattened.request_parameters.topicArn",
9496
"aws.cloudtrail.flattened.response_elements.subscriptionArn",
95-
"aws.cloudtrail.user_identity.type",
96-
"aws.cloudtrail.user_identity.arn"
97+
"aws.cloudtrail.request_parameters"
9798
]
9899

99100
[[rule.threat]]

‎rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,10 +99,10 @@ from logs-aws.cloudtrail*
9999

100100
[rule.investigation_fields]
101101
field_names = [
102-
"failed_requests",
103-
"tls.client.server_name",
104102
"source.address",
105-
"cloud.account.id"
103+
"tls.client.server_name",
104+
"cloud.account.id",
105+
"failed_requests"
106106
]
107107

108108
[[rule.threat]]

‎rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -103,18 +103,17 @@ event.dataset: "aws.cloudtrail"
103103
[rule.investigation_fields]
104104
field_names = [
105105
"@timestamp",
106-
"cloud.region",
107-
"event.provider",
106+
"user.name",
107+
"aws.cloudtrail.user_identity.arn",
108+
"aws.cloudtrail.user_identity.type",
109+
"user_agent.original",
110+
"aws.cloudtrail.flattened.request_parameters.instanceId",
108111
"event.action",
109112
"event.outcome",
110-
"related.user",
111-
"user_agent.original",
112-
"user.name",
113+
"cloud.region",
114+
"event.provider",
113115
"aws.cloudtrail.request_parameters",
114-
"aws.cloudtrail.response_elements",
115-
"aws.cloudtrail.flattened.request_parameters.instanceId",
116-
"aws.cloudtrail.user_identity.arn",
117-
"aws.cloudtrail.user_identity.type"
116+
"aws.cloudtrail.response_elements"
118117
]
119118

120119

‎rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -98,16 +98,16 @@ event.dataset: "aws.cloudtrail"
9898

9999
[rule.investigation_fields]
100100
field_names = [
101+
"@timestamp",
102+
"user.name",
103+
"aws.cloudtrail.user_identity.arn",
104+
"aws.cloudtrail.user_identity.type",
105+
"user_agent.original",
101106
"event.action",
102107
"event.outcome",
103108
"cloud.region",
104-
"related.user",
105-
"user_agent.original",
106-
"user.name",
107109
"aws.cloudtrail.request_parameters",
108-
"aws.cloudtrail.response_elements",
109-
"aws.cloudtrail.user_identity.arn",
110-
"aws.cloudtrail.user_identity.type"
110+
"aws.cloudtrail.response_elements"
111111
]
112112

113113
[[rule.threat]]

‎rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -123,18 +123,17 @@ from logs-aws.cloudtrail-* metadata _id, _version, _index
123123
[rule.investigation_fields]
124124
field_names = [
125125
"@timestamp",
126-
"cloud.region",
127-
"event.provider",
128-
"event.action",
129-
"event.outcome",
130126
"user.name",
131-
"user.target.name",
132-
"related.user",
127+
"aws.cloudtrail.user_identity.arn",
128+
"aws.cloudtrail.user_identity.type",
133129
"user_agent.original",
130+
"user.target.name",
131+
"event.action",
132+
"event.outcome",
133+
"cloud.region",
134+
"event.provider",
134135
"aws.cloudtrail.request_parameters",
135136
"aws.cloudtrail.response_elements",
136-
"aws.cloudtrail.user_identity.arn",
137-
"aws.cloudtrail.user_identity.type"
138137
]
139138

140139

0 commit comments

Comments
 (0)