Merge pull request #3108 from splunk/more_obs_cleanup

More Observable cleanup
splunk · Sep 2, 2024 · ecee93c · ecee93c
2 parents a20338d + bb9388b
commit ecee93c
Show file tree

Hide file tree

Showing 10 changed files with 8 additions and 16 deletions.
diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml
@@ -49,7 +49,7 @@ tags:
   - T1535
   observable:
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: src_ip

diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml
@@ -56,7 +56,7 @@ tags:
   - T1078.004
   observable:
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   product:

diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -53,10 +53,6 @@ tags:
   - T1562.001
   - T1562
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   - name: dest
     type: Endpoint
     role:

diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
@@ -38,7 +38,7 @@ tags:
   - T1558.004
   observable:
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   product:

diff --git a/detections/endpoint/windows_alternate_datastream___base64_content.yml b/detections/endpoint/windows_alternate_datastream___base64_content.yml
@@ -49,7 +49,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: file_name

diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml
@@ -44,7 +44,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
 

diff --git a/detections/endpoint/windows_alternate_datastream___process_execution.yml b/detections/endpoint/windows_alternate_datastream___process_execution.yml
@@ -49,7 +49,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: process_name

diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml
@@ -48,10 +48,6 @@ tags:
   - T1562
   - T1562.001
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   - name: dest
     type: Endpoint
     role:

diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml
@@ -54,7 +54,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: process_name

diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml
@@ -66,7 +66,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: process_name