previously_seen_cloud_provisioning_activity_sources.yml

name: previously_seen_cloud_provisioning_activity_sources
date: 2024-12-23
version: 2
id: be904c28-37df-4d3e-955a-ead70a537327
author: Splunk Threat Research Team
description: A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
lookup_type: kvstore
fields: 
- _key
- src
- City
- Country
- Region
- firstTimeSeen
- lastTimeSeen
- enough_data