updating yaml files

patel-bhavin · patel-bhavin · commit 0107a92b01f3 · 2025-04-09T15:39:44.000-07:00
diff --git a/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/aws_invoke_model_access_denied.yml b/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/aws_invoke_model_access_denied.yml
@@ -1,7 +1,7 @@
 author: Bhavin Patel
 id: c467c7d4-5b8d-44c8-9259-8847e1e4df7a
 date: '2024-03-07'
-description: This dataset is synthetically generated using manually simulated events in a lab environment.
+description: This dataset is generated in a AWS Bedrock Lab Environment by simulating events using AWS API calls
 environment: NA
 dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail.json
diff --git a/datasets/attack_techniques/T1485/aws_delete_knowledge_base/aws_delete_knowledge_base.yml b/datasets/attack_techniques/T1485/aws_delete_knowledge_base/aws_delete_knowledge_base.yml
@@ -1,12 +1,11 @@
 author: Bhavin Patel
 id: 984e9022-b87b-499a-a260-8d0282c46ea2
 date: '2025-04-10'
-description: Dataset generated from AWS CloudTrail logs capturing the lifecycle of an intentionally exposed S3 bucket, including its creation, public access configuration (via bucket policy and website hosting), and subsequent deletion. This simulates the an activity of a malicious actor deleting a knowledge base from AWS Bedrock.
+description: Dataset generated from AWS CloudTrail logs capturing the activity of a malicious actor deleting a knowledge base from AWS Bedrock.
 environment: attack_range
 dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail.json
 sourcetypes:
 - aws:cloudtrail
 references:
-- https://attack.mitre.org/techniques/T1485/
-
+- https://attack.mitre.org/techniques/T1485/
diff --git a/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/aws_bedrock_delete_model_invocation_logging.yml b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/aws_bedrock_delete_model_invocation_logging.yml
@@ -0,0 +1,12 @@
+author: Bhavin Patel, Splunk
+id: 09f580b9-cbc0-4d90-8e26-7dd4584a5650
+date: '2025-04-10'
+description: Dataset which contains cloudtrail logs for aws delete model invocation logging
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail.json
+sourcetypes:
+- aws:cloudtrail
+references:
+- https://attack.mitre.org/techniques/T1562/008/
+- https://github.com/aquasecurity/cloudsploit
