Splunk ES Content Update
Overview
Details
Requires Splunk Enterprise Security version 4.5 or greater.
For more information please visit the Splunk ES Content Update user documentation.
Release Notes
Version 1.0.18
Splunk ES Content Updates 1.0.18 Copyright (C) 2018 Splunk Inc. All rights reserved.
Splunk Enterprise Security Content Update version 1.0.18 introduced the following improvements:
New Analytic Stories
Name: AWS Cross Account Activity
Category: Cloud Security
Description: Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
Updated Analytic Stories
Name: Command and Control
Category: Adversary Tactics
Description: Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
For more please see the user documentation: http://docs.splunk.com/Documentation/ESSOC