Baseline cleanup

Author: ljstella

baselines/baseline_of_network_acl_activity_by_arn.yml

@@ -16,6 +16,3 @@ product:
     - Splunk Cloud
 security_domain: network
 schedule: Default Baseline
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Baseline references detections that do not exist in the corpus: Detect Spike in Network ACL Activity'

baselines/baseline_of_security_group_activity_by_arn.yml

@@ -16,6 +16,3 @@ product:
     - Splunk Cloud
 security_domain: network
 schedule: Default Baseline
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Baseline references detections that do not exist in the corpus: Detect Spike in Security Group Activity'

baselines/create_a_list_of_approved_aws_service_accounts.yml

@@ -16,6 +16,3 @@ product:
     - Splunk Cloud
 security_domain: network
 schedule: Default Baseline
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Baseline references detections that do not exist in the corpus: Detect AWS API Activities From Unapproved Accounts'

baselines/discover_dns_records.yml

@@ -16,6 +16,3 @@ product:
     - Splunk Cloud
 security_domain: network
 schedule: Default Baseline
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Baseline references detections that do not exist in the corpus: DNS record changed'

baselines/dnstwist_domain_names.yml

@@ -16,6 +16,3 @@ product:
     - Splunk Cloud
 security_domain: network
 schedule: Default Baseline
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Baseline references detections that do not exist in the corpus: Monitor DNS For Brand Abuse'

baselines/previously_seen_command_line_arguments.yml

@@ -16,6 +16,3 @@ product:
     - Splunk Cloud
 security_domain: endpoint
 schedule: Default Baseline
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Baseline references detections that do not exist in the corpus: First time seen command line argument'

detections/application/monitor_email_for_brand_abuse.yml

@@ -43,6 +43,3 @@ category: application
 security_domain: network
 baselines:
     - DNSTwist Domain Names
-MANUAL_REVIEW:
-    rba: {}
-    manual_review_rationale: 'Detection references baseline(s) flagged for manual review: DNSTwist Domain Names'