id: outlier_cloud
version: 1
meta:
  name: Outlier Cloud provider
  description: >
    A cloud provider that appeared in 10% or less of the
    total providers found. Outliers can often reveal
    entities that are rare and therefore interesting.

    Particularly in the case of cloud providers, an outlier
    may be an indicator of Shadow IT or unmtaintained
    infrastructure.
  risk: MEDIUM
collections:
  - collect:
      - method: exact
        field: type
        value: PROVIDER_HOSTING
aggregation:
  field: data
analysis:
  - method: outlier
    maximum_percent: 10
headline: "Outlier cloud provider found: {data}"