rename new rule files to avoid name collisions

panther-labs · Nov 4, 2024 · b783946 · b783946
1 parent ed1ee3c
commit b783946
Show file tree

Hide file tree

Showing 25 changed files with 13 additions and 13 deletions.
diff --git a/correlation_rules/snowflake_potential_brute_force_success.yml b/correlation_rules/snowflake_potential_brute_force_success.yml
@@ -7,7 +7,7 @@ Description: Detecting brute force activity and reporting when a user has incorr
 Detection:
   - Sequence:
       - ID: Multiple Failed Logins
-        RuleID: Snowflake.Stream.BruteForceByIP
+        RuleID: Snowflake.Stream.BruteForceByIp
         MinMatchCount: 5
       - ID: Successful Login
         RuleID: Snowflake.Stream.LoginSuccess

diff --git a/...rules/snowflake_account_admin_assigned.py → ...nowflake_stream_account_admin_assigned.py b/...rules/snowflake_account_admin_assigned.py → ...nowflake_stream_account_admin_assigned.py
diff --git a/...ules/snowflake_account_admin_assigned.yml → ...owflake_stream_account_admin_assigned.yml b/...ules/snowflake_account_admin_assigned.yml → ...owflake_stream_account_admin_assigned.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_account_admin_assigned.py
+Filename: snowflake_stream_account_admin_assigned.py
 RuleID: "Snowflake.Stream.AccountAdminGranted"
 DisplayName: Snowflake Account Admin Granted
 Enabled: true

diff --git a/...lake_rules/snowflake_brute_force_by_ip.py → ...les/snowflake_stream_brute_force_by_ip.py b/...lake_rules/snowflake_brute_force_by_ip.py → ...les/snowflake_stream_brute_force_by_ip.py
diff --git a/...ake_rules/snowflake_brute_force_by_ip.yml → ...es/snowflake_stream_brute_force_by_ip.yml b/...ake_rules/snowflake_brute_force_by_ip.yml → ...es/snowflake_stream_brute_force_by_ip.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_brute_force_by_ip.py
+Filename: snowflake_stream_brute_force_by_ip.py
 RuleID: "Snowflake.Stream.BruteForceByIp"
 DisplayName: Snowflake Brute Force Attacks by IP
 Enabled: true

diff --git a/...ules/snowflake_brute_force_by_username.py → ...owflake_stream_brute_force_by_username.py b/...ules/snowflake_brute_force_by_username.py → ...owflake_stream_brute_force_by_username.py
diff --git a/...les/snowflake_brute_force_by_username.yml → ...wflake_stream_brute_force_by_username.yml b/...les/snowflake_brute_force_by_username.yml → ...wflake_stream_brute_force_by_username.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_brute_force_by_username.py
+Filename: snowflake_stream_brute_force_by_username.py
 RuleID: "Snowflake.Stream.BruteForceByUsername"
 DisplayName: Snowflake Brute Force Attacks by User
 Enabled: true

diff --git a/...wflake_rules/snowflake_external_shares.py → ...rules/snowflake_stream_external_shares.py b/...wflake_rules/snowflake_external_shares.py → ...rules/snowflake_stream_external_shares.py
diff --git a/...flake_rules/snowflake_external_shares.yml → ...ules/snowflake_stream_external_shares.yml b/...flake_rules/snowflake_external_shares.yml → ...ules/snowflake_stream_external_shares.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_external_shares.py
+Filename: snowflake_stream_external_shares.py
 RuleID: Snowflake.Stream.ExternalShares
 DisplayName: Snowflake External Data Share
 Enabled: true

diff --git a/...wflake_rules/snowflake_file_downloaded.py → ...rules/snowflake_stream_file_downloaded.py b/...wflake_rules/snowflake_file_downloaded.py → ...rules/snowflake_stream_file_downloaded.py
diff --git a/...flake_rules/snowflake_file_downloaded.yml → ...ules/snowflake_stream_file_downloaded.yml b/...flake_rules/snowflake_file_downloaded.yml → ...ules/snowflake_stream_file_downloaded.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_file_downloaded.py
+Filename: snowflake_stream_file_downloaded.py
 RuleID: Snowflake.Stream.FileDownloaded
 DisplayName: Snowflake File Downloaded
 Enabled: true

diff --git a/...nowflake_rules/snowflake_login_success.py → ...e_rules/snowflake_stream_login_success.py b/...nowflake_rules/snowflake_login_success.py → ...e_rules/snowflake_stream_login_success.py
diff --git a/...owflake_rules/snowflake_login_success.yml → ..._rules/snowflake_stream_login_success.yml b/...owflake_rules/snowflake_login_success.yml → ..._rules/snowflake_stream_login_success.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_login_success.py
+Filename: snowflake_stream_login_success.py
 RuleID: Snowflake.Stream.LoginSuccess
 DisplayName: Snowflake Successful Login
 Enabled: true

diff --git a/...lake_rules/snowflake_login_without_mfa.py → ...les/snowflake_stream_login_without_mfa.py b/...lake_rules/snowflake_login_without_mfa.py → ...les/snowflake_stream_login_without_mfa.py
diff --git a/...ake_rules/snowflake_login_without_mfa.yml → ...es/snowflake_stream_login_without_mfa.yml b/...ake_rules/snowflake_login_without_mfa.yml → ...es/snowflake_stream_login_without_mfa.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_login_without_mfa.py
+Filename: snowflake_stream_login_without_mfa.py
 RuleID: Snowflake.Stream.LoginWithoutMFA
 DisplayName: Snowflake Login Without MFA
 Enabled: false

diff --git a/...lake_rules/snowflake_public_role_grant.py → ...les/snowflake_stream_public_role_grant.py b/...lake_rules/snowflake_public_role_grant.py → ...les/snowflake_stream_public_role_grant.py
diff --git a/...ake_rules/snowflake_public_role_grant.yml → ...es/snowflake_stream_public_role_grant.yml b/...ake_rules/snowflake_public_role_grant.yml → ...es/snowflake_stream_public_role_grant.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_public_role_grant.py
+Filename: snowflake_stream_public_role_grant.py
 RuleID: Snowflake.Stream.PublicRoleGrant
 DisplayName: Snowflake Grant to Public Role
 Enabled: true

diff --git a/...ules/snowflake_table_copied_into_stage.py → ...owflake_stream_table_copied_into_stage.py b/...ules/snowflake_table_copied_into_stage.py → ...owflake_stream_table_copied_into_stage.py
diff --git a/...les/snowflake_table_copied_into_stage.yml → ...wflake_stream_table_copied_into_stage.yml b/...les/snowflake_table_copied_into_stage.yml → ...wflake_stream_table_copied_into_stage.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_table_copied_into_stage.py
+Filename: snowflake_stream_table_copied_into_stage.py
 RuleID: Snowflake.Stream.TableCopiedIntoStage
 DisplayName: Snowflake Table Copied Into Stage
 Enabled: true

diff --git a/...ake_rules/snowflake_temp_stage_created.py → ...es/snowflake_stream_temp_stage_created.py b/...ake_rules/snowflake_temp_stage_created.py → ...es/snowflake_stream_temp_stage_created.py
diff --git a/...ke_rules/snowflake_temp_stage_created.yml → ...s/snowflake_stream_temp_stage_created.yml b/...ke_rules/snowflake_temp_stage_created.yml → ...s/snowflake_stream_temp_stage_created.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_temp_stage_created.py
+Filename: snowflake_stream_temp_stage_created.py
 RuleID: Snowflake.Stream.TempStageCreated
 DisplayName: Snowflake Temporary Stage Created
 Enabled: true

diff --git a/...snowflake_rules/snowflake_user_created.py → ...ke_rules/snowflake_stream_user_created.py b/...snowflake_rules/snowflake_user_created.py → ...ke_rules/snowflake_stream_user_created.py
diff --git a/...nowflake_rules/snowflake_user_created.yml → ...e_rules/snowflake_stream_user_created.yml b/...nowflake_rules/snowflake_user_created.yml → ...e_rules/snowflake_stream_user_created.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_user_created.py
+Filename: snowflake_stream_user_created.py
 RuleID: Snowflake.Stream.UserCreated
 DisplayName: Snowflake User Created
 Enabled: false

diff --git a/...snowflake_rules/snowflake_user_enabled.py → ...ke_rules/snowflake_stream_user_enabled.py b/...snowflake_rules/snowflake_user_enabled.py → ...ke_rules/snowflake_stream_user_enabled.py
diff --git a/...nowflake_rules/snowflake_user_enabled.yml → ...e_rules/snowflake_stream_user_enabled.yml b/...nowflake_rules/snowflake_user_enabled.yml → ...e_rules/snowflake_stream_user_enabled.yml
@@ -1,5 +1,5 @@
 AnalysisType: rule
-Filename: snowflake_user_enabled.py
+Filename: snowflake_stream_user_enabled.py
 RuleID: Snowflake.Stream.UserEnabled
 DisplayName: Snowflake User Enabled
 Enabled: true