Skip to content

Commit 747c006

Browse files
[8.7] Replace placeholder URLs (backport #6990) (#7003)
* Replace placeholder URLs (#6990) (cherry picked from commit 1633469) # Conflicts: # docs/AI-for-security/connect-to-byo.asciidoc # docs/cloud-native-security/cspm-get-started-aws.asciidoc # docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc # docs/release-notes/8.16.asciidoc # docs/release-notes/8.8.asciidoc # docs/release-notes/8.9.asciidoc * resolve conflict --------- Co-authored-by: natasha-moore-elastic <[email protected]> Co-authored-by: natasha-moore-elastic <[email protected]>
1 parent f1b010f commit 747c006

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

docs/cloud-native-security/kspm-get-started.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ You can use the AWS CLI to generate temporary credentials. For example, you coul
158158

159159
[source,console]
160160
----------------------------------
161-
`sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456`
161+
`sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@<example-url> --duration-seconds 129600 --token-code 123456`
162162
----------------------------------
163163

164164
The output from this command includes the following fields, which you should provide when configuring the KSPM integration:

docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ sequence by winlog.computer_name, winlog.process.pid with maxspan=1s
6262
[any where event.code : "5382" and
6363
(winlog.event_data.SchemaFriendlyName : "Windows Web Password Credential" and winlog.event_data.Resource : "http*") and
6464
not winlog.event_data.SubjectLogonId : "0x3e7" and
65-
not winlog.event_data.Resource : "http://localhost/"]
65+
not winlog.event_data.Resource : "<LOCAL_HOST_URL>"]
6666
6767
[any where event.code : "5382" and
6868
(winlog.event_data.SchemaFriendlyName : "Windows Web Password Credential" and winlog.event_data.Resource : "http*") and
6969
not winlog.event_data.SubjectLogonId : "0x3e7" and
70-
not winlog.event_data.Resource : "http://localhost/"]
70+
not winlog.event_data.Resource : "<LOCAL_HOST_URL>"]
7171
7272
----------------------------------
7373

0 commit comments

Comments
 (0)