add risk scores

splunk · Oct 27, 2020 · cad99d8 · cad99d8
1 parent caea9b2
commit cad99d8
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
@@ -42,3 +42,7 @@ tags:
   - PR.AC
   security_domain: network
   asset_type: AWS Instance
+  risk_score: 25
+  risk_object_type: user
+  risk_object: user
+
diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
@@ -42,3 +42,7 @@ tags:
   - PR.AC
   security_domain: network
   asset_type: AWS Instance
+  risk_score: 25
+  risk_object_type: user
+  risk_object: user
+
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -40,3 +40,6 @@ tags:
   - T1078
   security_domain: endpoint
   asset_type: AWS Instance
+  risk_score: 25
+  risk_object_type: user
+  risk_object: user