Merge pull request #917 from splunk/asl_new_datasets

updated cloudtrail asl datasets
splunk · Dec 12, 2024 · 9d543dd · 9d543dd
2 parents 41868f9 + 86c08ae
commit 9d543dd
Show file tree

Hide file tree

Showing 6 changed files with 14 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail.json
diff --git a/datasets/attack_techniques/T1078/aws_create_policy_version/aws_create_policy_version.yml b/datasets/attack_techniques/T1078/aws_create_policy_version/aws_create_policy_version.yml
@@ -6,6 +6,7 @@ description: This search looks for CloudTrail events where a user created a poli
 environment: Cloud Attack Range
 dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail.json
 sourcetypes:
 - aws:cloudtrail
 references:

diff --git a/datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail.json
diff --git a/datasets/attack_techniques/T1078/aws_createaccesskey/aws_createaccesskey.yml b/datasets/attack_techniques/T1078/aws_createaccesskey/aws_createaccesskey.yml
@@ -9,6 +9,7 @@ environment: Cloud Attack Range
 dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/amazon_security_lake.json
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/asl_ocsf_cloudtrail.json
 sourcetypes:
 - aws:cloudtrail
 - aws:asl

diff --git a/datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail.json
diff --git a/datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail.json