Update SuspiciousAWSCLICommandExecution.yaml

Azure · Sep 4, 2023 · 5c9b27a · 5c9b27a
1 parent 6fa561c
commit 5c9b27a
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/Detections/MultipleDataSources/SuspiciousAWSCLICommandExecution.yaml b/Detections/MultipleDataSources/SuspiciousAWSCLICommandExecution.yaml
@@ -49,5 +49,9 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: SourceIpAddress
+customDetails:
+   SuspiciousCommand: commands
+   AWSUser: UserIdentityUserName
+   AWSUserIp: SourceIpAddress
 kind: Scheduled
 version: 1.0.0