previously_seen_s3_access_from_remote_ip.yml

name: previously_seen_S3_access_from_remote_ip
date: 2024-12-23
version: 2
id: 264e5f12-ba04-47d1-bb88-f355a9b2b0e8
author: Splunk Threat Research Team
lookup_type: kvstore
description: A placeholder for a list of IPs that have access S3
fields: 
- _key
- bucket_name
- remote_ip
- earliest
- latest