adding missing risk scores

splunk · Oct 26, 2020 · 94704b0 · 94704b0
1 parent cf117d7
commit 94704b0
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
@@ -43,4 +43,4 @@ tags:
   asset_type: AWS Instance
   risk_score: 15
   risk_object_type: user
-  risk_object: src_user
+  risk_object: user
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
@@ -49,3 +49,6 @@ tags:
   - T1078
   security_domain: endpoint
   asset_type: AWS Instance
+  risk_score: 5
+  risk_object_type: user
+  risk_object: user
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -32,3 +32,6 @@ tags:
   - DE.AE
   security_domain: network
   asset_type: AWS Instance
+  risk_score: 30
+  risk_object_type: user
+  risk_object: user