Anvilogic medium experimental spl
Azure Anonymous Storage Authentication [splunk-azure]
Storage Analytics log provides you much better visibility on what has happened with your storage account. This use case looks for authentication types that indicate anonymous access.
Detection Logic
`get_cloud_data` `get_cloud_data_storage` identity.type=Anonymous
| rex field=src_ip mode=sed max_match=0 "s/\:\d{1,5}//g"
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id, bucket_name
| bin span=60s
| stats values(*) as * by _time, src_ipField Validations
Loading…
Comments (0)
Loading comments...