security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add count condition

Browse Source
This commit is contained in:
frack113
2022-12-23 12:32:05 +01:00
parent a3f897606f
commit 32b7ef47df
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cloud/aws/aws_enum_logging.yml
+1 -1
View File
@@ -26,7 +26,7 @@ detection:
- 'DescribeSnapshotTierStatus'
- 'DescribeImages'
timeframe: 10m
condition: selection
condition: selection | count() > 5
falsepositives:
- Unknown
level: medium
rules/cloud/aws/aws_enum_network.yml
+1 -1
View File
@@ -23,7 +23,7 @@ detection:
- 'DescribeDhcpOptions'
- 'GetTransitGatewayRouteTableAssociations'
timeframe: 10m
condition: selection
condition: selection | count() > 5
falsepositives:
- Unknown
level: low
rules/cloud/aws/aws_enum_storage.yml
+1 -1
View File
@@ -24,7 +24,7 @@ detection:
- 'GetBucketPolicy'
- 'GetBucketTagging'
timeframe: 10m
condition: selection
condition: selection | count() > 5
falsepositives:
- Unknown
level: medium