Possible bug in rule: "AWS Activity In New Region"

[tdziwok]

Hi ESCU Team,

I think there may have been an inadvertent bug introduced in: f9bdf7e

The rule from detections/aws_activity_in_new_region.yml no longer runs in Splunk, as | convert security_content_ctime(earliest) security_content_ctime(latest) is not a valid usage of the convert command.

I am guessing that this is an instance where sed or another replacing tool caught some "real" ctime invocations while looking for instances of the old macro name.

Thanks,
Tomasz

[josehelps]

It definetly looks to be the case @tdziwok, thank you for pointing this out! We will work on a PR to get it fixed up. If you did any changes to the search it would be great if you could shared it as an example fix 😄

[josehelps]

Hey added a PR to fix this #345 should be fixed in the next release.

[tdziwok]

Hi @d1vious,

Thanks for looking into this so quickly.
The fix you applied is exactly what I had used; sorry for not sharing it earlier :).

I believe I have found one more instance of the same issue by using:

grep  -irE '([^`]|^)security_content_ctime' ./detections/

./detections/ec2_instance_started_with_previously_unseen_instance_type.yml has the same exact pattern and needs the same exact fix.

Thanks for your help, and keep up the awesome work!

Thanks,
Tomasz

[josehelps]

@tdziwok thank you for sharing this one too, re-opened the issue for now. I will make another PR to solve this one.

[josehelps]

@tdziwok added another PR in there to include this search. Thank you again for catching this error!