Skip to content

v3.0.3

Choose a tag to compare

View all tags
@josehelps josehelps released this 25 Jun 22:40
v3.0.3
0506f93
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Updated the detection searches AWS related stories with AWS Mitre Mappings where applicable:

  • Suspicious AWS EC2 Activities
  • AWS Suspicious Provisioning Activities
  • AWS Cross Account Activity
  • Cloud Cryptomining
  • AWS User Monitoring
  • Suspicious Cloud Authentication Activities
  • Suspicious AWS Login Activities
  • Suspicious AWS S3 Activities
  • Unusual AWS EC2 Modifications
  • Container Implantation Monitoring and Investigation

Updated analytic stories with new detection searches:

  • Kubernetes Sensitive Role Activity
  • Kubernetes Sensitive Object Access Activity

New response tasks - "AWS Investigate Security Hub alerts by dest" that leverages Security Hub alerts for investigation/response

Fixed Issues:

  • Updated Creation of Shadow Copy with wmic and powershell to use Endpoint Datamodel

Full documentation: https://docs.splunk.com/Documentation/ESSOC/3.0.3

Assets 3
Loading