Skip to content

Correct Azure localization issues #3668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 3, 2025
Merged

Correct Azure localization issues #3668

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b24f8a
Correct Azure localization issues
bserocki-splunk Sep 3, 2025
939ee28
Correct Azure localization issues
bserocki-splunk Sep 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions detections/cloud/azure_automation_account_created.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: Azure Automation Account Created
id: 860902fd-2e76-46b3-b050-ba548dab576c
version: 9
date: '2025-05-02'
author: Mauricio Velazco, Splunk
version: 10
date: '2025-09-03'
author: Mauricio Velazco, Brian Serocki, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Azure Automation
Expand All @@ -15,9 +15,9 @@ description: The following analytic detects the creation of a new Azure Automati
on virtual machines, posing a significant security risk.
data_source:
- Azure Audit Create or Update an Azure Automation account
search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded
search: '`azure_audit` operationName.value="Microsoft.Automation/automationAccounts/write" status.value=Succeeded
| dedup object
| rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.localizedValue as signature
| rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as signature
| stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product object object_path signature
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_automation_account_created_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Expand Down
10 changes: 5 additions & 5 deletions detections/cloud/azure_automation_runbook_created.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: Azure Automation Runbook Created
id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
version: 9
date: '2025-05-02'
author: Mauricio Velazco, Splunk
version: 10
date: '2025-09-03'
author: Mauricio Velazco, Brian Serocki, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Azure Automation
Expand All @@ -15,9 +15,9 @@ description: The following analytic detects the creation of a new Azure Automati
environment.
data_source:
- Azure Audit Create or Update an Azure Automation Runbook
search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded
search: '`azure_audit` operationName.value="Microsoft.Automation/automationAccounts/runbooks/write" object!=AzureAutomationTutorial* status.value=Succeeded
| dedup object
| rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.localizedValue as operationName
| rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as operationName
| stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product object object_path
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
Expand Down
8 changes: 4 additions & 4 deletions detections/cloud/azure_runbook_webhook_created.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: Azure Runbook Webhook Created
id: e98944a9-92e4-443c-81b8-a322e33ce75a
version: 10
date: '2025-05-02'
author: Mauricio Velazco, Splunk
version: 11
date: '2025-09-03'
author: Mauricio Velazco, Brian Serocki, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Automation Runbook
Expand All @@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new Automation Run
control over Azure resources.
data_source:
- Azure Audit Create or Update an Azure Automation webhook
search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded
search: '`azure_audit` operationName.value="Microsoft.Automation/automationAccounts/webhooks/write" status.value=Succeeded
| dedup object
| rename claims.ipaddr as src_ip
| rename caller as user
Expand Down
Loading