From 656692cb9bbcddc55562267a904bcc9a6dcf7747 Mon Sep 17 00:00:00 2001 From: danielsplunk Date: Wed, 5 Feb 2025 14:33:17 -0600 Subject: [PATCH 1/2] updating Netscout detections updating Netscout detections --- data_sources/netscout/app.conf | 28 ++ data_sources/netscout/inputs.conf | 59 ++++ data_sources/netscout/props.conf | 277 ++++++++++++++++++ data_sources/netscout/transforms.conf | 29 ++ ...domains_using_pretrained_model_in_dsdl.yml | 3 +- ...tration_using_pretrained_model_in_dsdl.yml | 3 +- ...connecting_to_dynamic_domain_providers.yml | 1 + .../network/detect_outbound_ldap_traffic.yml | 1 + .../network/detect_outbound_smb_traffic.yml | 3 +- ...etect_remote_access_software_usage_dns.yml | 1 + ...t_remote_access_software_usage_traffic.yml | 1 + ...ct_software_download_to_network_device.yml | 3 +- .../dns_query_length_outliers___mltk.yml | 3 +- ...ry_length_with_high_standard_deviation.yml | 1 + detections/network/excessive_dns_failures.yml | 3 +- ...ntrol_rest_vulnerability_cve_2022_1388.yml | 1 + ...e_of_network_traffic_from_email_server.yml | 3 +- .../network/internal_horizontal_port_scan.yml | 1 + ...ernal_horizontal_port_scan_nmap_top_20.yml | 1 + .../network/internal_vertical_port_scan.yml | 1 + .../large_volume_of_dns_any_queries.yml | 3 +- .../ngrok_reverse_proxy_on_network.yml | 1 + .../prohibited_network_traffic_allowed.yml | 3 +- ...ls_passing_authentication_in_cleartext.yml | 3 +- .../remote_desktop_network_bruteforce.yml | 3 +- .../remote_desktop_network_traffic.yml | 3 +- detections/network/smb_traffic_spike.yml | 3 +- .../network/smb_traffic_spike___mltk.yml | 3 +- .../citrix_adc_exploitation_cve_2023_3519.yml | 1 + ...d_remote_code_execution_cve_2022_26134.yml | 1 + ...etect_remote_access_software_usage_url.yml | 1 + ...acing_fortinet_fortinac_cve_2022_39952.yml | 1 + .../web/fortinet_appliance_auth_bypass.yml | 1 + ...emote_code_execution_exploit_detection.yml | 1 + ...vmware_aria_operations_exploit_attempt.yml | 1 + ...re_server_side_template_injection_hunt.yml | 1 + ...emarker_server_side_template_injection.yml | 1 + 37 files changed, 440 insertions(+), 14 deletions(-) create mode 100644 data_sources/netscout/app.conf create mode 100644 data_sources/netscout/inputs.conf create mode 100644 data_sources/netscout/props.conf create mode 100644 data_sources/netscout/transforms.conf diff --git a/data_sources/netscout/app.conf b/data_sources/netscout/app.conf new file mode 100644 index 0000000000..d0d6b3e6a9 --- /dev/null +++ b/data_sources/netscout/app.conf @@ -0,0 +1,28 @@ +# Copyright (C) 2023 Netscout Systems Inc. All Rights Reserved. +# DO NOT EDIT THIS FILE! +# Please make all changes to files in $SPLUNK_HOME/etc/Omnis_AI_Streamer-TA/local. +# To make changes, copy the section/stanza you want to change from $SPLUNK_HOME/etc/apps/Omnis_AI_Streamer-TA/default +# into ../local and edit there. + +[install] +state_change_requires_restart = true +is_configured = 0 +state = enabled + +[id] +name = Omnis-AI-Streamer-TA +version = 6.4.5 + +[launcher] +author = Netscout Systems +description = Omnis Data Streamer TA +version = 6.4.5 + +[ui] +is_visible = 0 +label = Omnis Data Streamer TA +docs_section_override = AddOns:released + +[package] +id = Omnis-AI-Streamer-TA +check_for_updates = 1 diff --git a/data_sources/netscout/inputs.conf b/data_sources/netscout/inputs.conf new file mode 100644 index 0000000000..20a197bb71 --- /dev/null +++ b/data_sources/netscout/inputs.conf @@ -0,0 +1,59 @@ + +### CIM Compliant Data Sources ## +[monitor:///home/export/data/csv-export/ready/OMNIS.flow-dns*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:dns + +[monitor:///home/export/data/csv-export/ready/OMNIS.flow-http*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:http + +[monitor:///home/export/data/csv-export/ready/OMNIS.flow-https*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:https + +[monitor:///home/export/data/csv-export/ready/OMNIS.flow-icmp*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:icmp + +[monitor:///home/export/data/csv-export/ready/OMNIS.flow-smb*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:smb + + +### Other Data Sources +[monitor:///home/export/data/csv-export/ready/OMNIS.netops*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:netops + +[monitor:///home/export/data/csv-export/ready/OMNIS.application*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:application + +[monitor:///home/export/data/csv-export/ready/OMNIS.asset*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:asset + +[monitor:///home/export/data/csv-export/ready/OMNIS.sre*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:sre + +[monitor:///home/export/data/csv-export/ready/OMNIS.uc*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:uc + +[monitor:///home/export/data/csv-export/ready/OMNIS.flow-base*.csv.gz] +disabled = false +index = netscoutoais +sourcetype = netscout:omnis:flow:base +crcSalt = \ No newline at end of file diff --git a/data_sources/netscout/props.conf b/data_sources/netscout/props.conf new file mode 100644 index 0000000000..da4e28e4c4 --- /dev/null +++ b/data_sources/netscout/props.conf @@ -0,0 +1,277 @@ +[netscout:omnis-flow-dns] +rename = netscout:omnis:flow:dns +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +[netscout:omnis-flow-http] +rename = netscout:omnis:flow:http +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +[netscout:omnis-flow-https] +rename = netscout:omnis:flow:https +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +[netscout:omnis-flow-smb] +rename = netscout:omnis:flow:smb +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +[netscout:omnis-icmp] +rename = netscout:omnis:flow:icmp +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\" +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +[netscout:omnis-flow-base] +rename = netscout:omnis:flow:base +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\",\" +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +[netscout:omnis:flow:dns] +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +REPORT-dns-header = netscout_dns_header +FIELDALIAS-app = application_name AS app +FIELDALIAS-dest = server_host AS dest +FIELDALIAS-dvc = ai_sensor_name AS dvc +FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip +FIELDALIAS-dest_port = server_port AS dest_port +FIELDALIAS-src = client_host AS src +FIELDALIAS-src_port = client_port AS src_port +EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) + +### DNS Specific mappings +FIELDALIAS-answer = resolved_ip_address AS answer +FIELDALIAS-query = domain AS query +FIELDALIAS-query_type = query_type AS record_type +FIELDALIAS-name = message AS name +EVAL-answer_count = mvcount(split(resolved_ip_address,"|")) +EVAL-reply_code_id = response_code +EVAL-reply_code = if(response_code=0,"NoError", replace(response_description,"\s","")) +EVAL-message_type = "QUERY" + +[netscout:omnis:flow:icmp] +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\" +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +REPORT-icmp-header = netscout_icmp_header +FIELDALIAS-app = application_name AS app +FIELDALIAS-dest = server_host AS dest +FIELDALIAS-dest_port = server_port AS dest_port +FIELDALIAS-dvc = ai_sensor_name AS dvc +FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip +FIELDALIAS-src = client_host AS src +FIELDALIAS-src_port = client_port AS src_port +EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) +EVAL-transport = lower(packet_type_name) +EVAL-protocol = "icmp" + + +[netscout:omnis:flow:smb] +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop + +REPORT-smb-header = netscout_smb_header +FIELDALIAS-app = application_name AS app +FIELDALIAS-dest = server_host AS dest +FIELDALIAS-dest_port = server_port AS dest_port +FIELDALIAS-dvc = ai_sensor_name AS dvc +FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip +FIELDALIAS-src = client_host AS src +FIELDALIAS-src_port = client_port AS src_port +EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) + +## SMB Specific mappings to Network Traffic Datamodel +FIELDALIAS-bytes_in = smb_server_to_client_octets AS bytes_in +FIELDALIAS-bytes_out = smb_client_to_server_octets AS bytes_out +FIELDALIAS-packets_in = smb_server_to_client_packets AS packets_in +FIELDALIAS-packets_out = smb_client_to_server_packets AS packets_out +FIELDALIAS-response_time = smb_response_time AS response_time +EVAL-action = "allowed" +EVAL-bytes = bytes_in + bytes_out +EVAL-packets = packets_in + packets_out +EVAL-transport = lower(packet_type_name) +EVAL-protocol = "smb" + +[netscout:omnis:flow:http] +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) + +TRANSFORMS-header_drop = header_drop +REPORT-http-header = netscout_http_header +FIELDALIAS-dest = server_host AS dest +FIELDALIAS-dest_port = server_port AS dest_port +FIELDALIAS-dvc = ai_sensor_name AS dvc +FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip +FIELDALIAS-src = client_host AS src +FIELDALIAS-src_port = client_port AS src_port +EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) + +## HTTP specific mappings to Web Datamodels +FIELDALIAS-app = application_name AS category +FIELDALIAS-bytes_in = http_server_to_client_octets AS bytes_in +FIELDALIAS-bytes_out = http_client_to_server_octets AS bytes_out +FIELDALIAS-packets_in = http_server_to_client_packets AS packets_in +FIELDALIAS-packets_out = http_client_to_server_packets AS packets_out +FIELDALIAS-status = response_code AS status +FIELDALIAS-user_gent = user_agent AS http_user_agent +FIELDALIAS-uri_path = target_uri AS uri_path +FIELDALIAS-url_domain = request_host_name AS url_domain +FIELDALIAS-http_referrer = refferer AS http_referrer +FIELDALIAS-uri_query = uri_query_values +EVAL-action = "allowed" +EVAL-bytes = bytes_in + bytes_out +EVAL-packets = packets_in + packets_out +EVAL-http_method = if(match(message_name, "_HTTP"), upper(replace(message_name,"_HTTP","")), upper(message_name)) +EVAL-http_user_agent_length = len(http_user_agent) +EVAL-transport = lower(packet_type_name) +EVAL-url_length = len(coalesce("http://"+request_host_name+"/"+target_uri+"?"+uri_query_values, "http://"+request_host_name+"/"+target_uri, "http://"+request_host_name)) +EVAL-url = coalesce("http://"+request_host_name+"/"+target_uri+"?"+uri_query_values, "http://"+request_host_name+"/"+target_uri, "http://"+request_host_name) +EVAL-response_time = (http_response_time_usec/1000000) + +[netscout:omnis:flow:https] +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) + +TRANSFORMS-header_drop = header_drop +REPORT-https-header = netscout_https_header +FIELDALIAS-dest = server_host AS dest +FIELDALIAS-dest_port = server_port AS dest_port +FIELDALIAS-dvc = ai_sensor_name AS dvc +FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip +FIELDALIAS-src = client_host AS src +FIELDALIAS-src_port = client_port AS src_port +EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) + +## HTTPS specific mappings to Web Datamodels +FIELDALIAS-app = application_name AS category +FIELDALIAS-bytes_in = https_server_to_client_octets AS bytes_in +FIELDALIAS-bytes_out = https_client_to_server_octets AS bytes_out +FIELDALIAS-packets_in = https_server_to_client_packets AS packets_in +FIELDALIAS-packets_out = https_client_to_server_packets AS packets_out +FIELDALIAS-status = response_code AS status +EVAL-action = "allowed" +EVAL-bytes = bytes_in + bytes_out +EVAL-packets = packets_in + packets_out +EVAL-transport = lower(packet_type_name) +EVAL-response_time = (http_response_time_usec/1000000) + +[netscout:omnis:flow:base] +TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z +TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\",\" +SHOULD_LINEMERGE = false +category = Network & Security +description = Netscout Systems Network Security Appliance +pulldown_type = 1 +LINE_BREAKER = ([\r\n]+) +TRANSFORMS-header_drop = header_drop +REPORT-base-header = netscout_base_header + +FIELDALIAS-dest = server_ip_address AS dest +FIELDALIAS-dest_port = server_port AS dest_port +FIELDALIAS-src = client_ip_address AS src +FIELDALIAS-src_port = client_port AS src_port +FIELDALIAS-dvc = ai_sensor_name AS dvc +EVAL-transport = lower(packet_type_name) +EVAL-action = case(flow_end_reason_name=="End of flow detected","teardown",flow_end_reason_name=="Lack of resources","teardown",flow_end_reason_name=="Idle timeout","teardown",flow_end_reason_name=="Active","allowed", 1=1, "allowed") +FIELDALIAS-bytes_in = server_to_client_octets AS bytes_in +FIELDALIAS-bytes_out = client_to_server_octets AS bytes_out +FIELDALIAS-packets_in = server_to_client_packets AS packets_in +FIELDALIAS-packets_out = client_to_server_packets AS packets_out +FIELDALIAS-vlan = vlan_id AS vlan +EVAL-bytes = bytes_in + bytes_out +EVAL-packets = packets_in + packets_out +FIELDALIAS-app = application_name AS app +EVAL-duration = round(strptime(flow_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(flow_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) + +#specific Network Traffic fields +FIELDALIAS-rule = flow_end_reason_name AS rule +EVAL-vendor_product = "NetScout Systems, Inc." +FIELDALIAS-src_ip = client_ip_address AS src_ip +FIELDALIAS-dest_ip = server_ip_address AS dest_ip + + +### Use the following to create custom flows and update accordingly. +#[netscout:omnis:flow:] +#TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", +#SHOULD_LINEMERGE = 0 +#category = Network & Security +#description = Netscout Systems Network Security Appliance +#pulldown_type = 1 +#LINE_BREAKER = ([\r\n]+) +#TRANSFORMS-header_drop = header_drop +#TRANSFORMS-header_drop = header_drop +#REPORT-https-header = netscout_https_header +#FIELDALIAS-dest = server_host AS dest +#FIELDALIAS-dest_port = server_port AS dest_port +#FIELDALIAS-dvc = device_name AS dvc +#FIELDALIAS-dvc_ip = device_ip_address AS dvc_ip +#FIELDALIAS-src = client_host AS src +#FIELDALIAS-src_port = client_port AS src_port +#EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) diff --git a/data_sources/netscout/transforms.conf b/data_sources/netscout/transforms.conf new file mode 100644 index 0000000000..b4c45b126e --- /dev/null +++ b/data_sources/netscout/transforms.conf @@ -0,0 +1,29 @@ +[header_drop] +REGEX = ^timestamp +DEST_KEY = queue +FORMAT = nullQueue + + +[netscout_dns_header] +DELIMS = "," +FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,application_group,response_code,response_description,query_class,response_query_flag,authoritative_answer_flag,truncation_flag,recursion_desired_flag,recursion_available_flag,reserved_flag,rejected_flag,reverse_lookup_flag,resolved_ip_address,resolved_ttls,tld,subdomain,etld,message,query_type,domain,response_time,query_size,count_of_elements,dns_client_to_server_octets,dns_server_to_client_octets,dns_client_to_server_packets,dns_server_to_client_packets + +[netscout_http_header] +DELIMS = "," +FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,request_host_name,target_uri,user_agent,http_content_type,refferer,uri_path,uri_query_names,uri_query_values,http_client_to_server_octets,http_server_to_client_octets,http_client_to_server_packets,http_server_to_client_packets,http_response_time_usec + +[netscout_https_header] +DELIMS = "," +FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,tls_version,server_name_indicator,cipher,https_response_time,https_client_to_server_octets,https_server_to_client_octets,https_client_to_server_packets,https_server_to_client_packets + +[netscout_smb_header] +DELIMS = "," +FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,authentication_protocol,dialect,file_operation,user_name,tree_name,file_name,smb_response_time,smb_client_to_server_octets,smb_server_to_client_octets,smb_client_to_server_packets,smb_server_to_client_packets + +[netscout_icmp_header] +DELIMS = "," +FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,icmp_client_to_server_octets,icmp_server_to_client_octets,icmp_client_to_server_packets,icmp_server_to_client_packets + +[netscout_base_header] +DELIMS = "," +FIELDS = timestamp,flow_start_time,flow_end_time,flow_end_reason_name,server_ip_address,server_port,client_ip_address,client_port,application_name,packet_type_name,vlan_id,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,application_group,client_to_server_octets,server_to_client_octets,client_to_server_packets,server_to_client_packets diff --git a/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml b/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml index 55d18f58b5..f583c21142 100644 --- a/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml @@ -13,7 +13,8 @@ description: The following analytic identifies Domain Generation Algorithm (DGA) malicious traffic. If confirmed malicious, this activity could enable attackers to maintain persistent communication with compromised systems, evade detection, and execute further malicious actions. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(DNS)` | rename query AS domain | fields IPs, src, diff --git a/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml b/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml index 10055327b4..82786742c2 100644 --- a/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml @@ -5,7 +5,8 @@ date: '2024-11-15' status: experimental author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly -data_source: [] +data_source: +- NetScout Base description: The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index c5f4d94b92..064d876ec3 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -15,6 +15,7 @@ description: The following analytic identifies DNS queries from internal hosts t access to the network. data_source: - Sysmon EventID 22 +- NetScout Base search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index b50a17a3f6..d2d954eb41 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -14,6 +14,7 @@ description: The following analytic identifies outbound LDAP traffic to external network compromise. data_source: - Bro +- NetScout Base search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 3a2cbf6989..5187b8813d 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -13,7 +13,8 @@ description: The following analytic detects outbound SMB (Server Message Block) a key step in lateral movement and privilege escalation. If confirmed malicious, this activity could lead to unauthorized access to sensitive data and potential full system compromise. -data_source: [] +data_source: +- NetScout Base search: >- | tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index e01bd31544..b513d88098 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -14,6 +14,7 @@ description: The following analytic detects DNS queries to domains associated wi not mitigated promptly. data_source: - Sysmon EventID 22 +- NetScout DNS search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution by DNS.src DNS.query | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index aeb0b45f21..5098748be3 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -15,6 +15,7 @@ description: The following analytic detects network traffic associated with know security. data_source: - Palo Alto Network Traffic +- NetScout Base search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(user) as user from datamodel=Network_Traffic by All_Traffic.src All_Traffic.dest, All_Traffic.app | diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml index d11e5395c6..367cb3de0f 100644 --- a/detections/network/detect_software_download_to_network_device.yml +++ b/detections/network/detect_software_download_to_network_device.yml @@ -13,7 +13,8 @@ description: The following analytic identifies unauthorized software downloads t network integrity. If confirmed malicious, this could lead to unauthorized control over network devices, enabling further attacks, data exfiltration, or persistent access within the network. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.transport=udp AND All_Traffic.dest_port=69) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21) diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml index 629215e272..9cf94001f7 100644 --- a/detections/network/dns_query_length_outliers___mltk.yml +++ b/detections/network/dns_query_length_outliers___mltk.yml @@ -12,7 +12,8 @@ description: The following analytic identifies DNS requests with unusually large data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to exfiltrate sensitive data or maintain persistent communication channels with compromised systems. -data_source: [] +data_source: +- NetScout DNS search: '| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time values(DNS.src) as src values(DNS.dest) as dest from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name(DNS)` diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 744203b569..05307eb41a 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -15,6 +15,7 @@ description: The following analytic identifies DNS queries with unusually large the network. data_source: - Sysmon EventID 22 +- NetScout DNS search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.record_type IN("Pointer","PTR") by DNS.query host| `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) diff --git a/detections/network/excessive_dns_failures.yml b/detections/network/excessive_dns_failures.yml index 96cd124e74..66be2a8756 100644 --- a/detections/network/excessive_dns_failures.yml +++ b/detections/network/excessive_dns_failures.yml @@ -13,7 +13,8 @@ description: The following analytic identifies excessive DNS query failures by c attempts, or malware communication issues. If confirmed malicious, this activity could lead to disrupted network services, hindered communication, or data exfiltration attempts by attackers. -data_source: [] +data_source: +- NetScout DNS search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where nodename=DNS "DNS.reply_code"!="No Error" "DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*" by "DNS.src" "DNS.query" "DNS.reply_code" diff --git a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml index 572478664e..d1decc1036 100644 --- a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml +++ b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml @@ -15,6 +15,7 @@ description: The following analytic detects attempts to exploit the F5 BIG-IP iC and unauthorized access to sensitive data. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count from datamodel=Web where Web.url="*/mgmt/tm/util/bash*" Web.http_method="POST" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml index 16c268125d..5f60a4254a 100644 --- a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml +++ b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml @@ -12,7 +12,8 @@ description: The following analytic identifies hosts receiving an unusually high may indicate data exfiltration by a malicious actor using the email server. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising sensitive information and impacting organizational security. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` sum(All_Traffic.bytes_in) as bytes_in from datamodel=Network_Traffic where All_Traffic.dest_category=email_server by All_Traffic.src_ip _time span=1d | `drop_dm_object_name("All_Traffic")` | eventstats avg(bytes_in) diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml index a694e24f75..1a26c65bea 100644 --- a/detections/network/internal_horizontal_port_scan.yml +++ b/detections/network/internal_horizontal_port_scan.yml @@ -7,6 +7,7 @@ status: production type: TTP data_source: - AWS CloudWatchLogs VPCflow +- NetScout Base description: This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 42b955182e..877f93bb54 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -7,6 +7,7 @@ status: production type: TTP data_source: - AWS CloudWatchLogs VPCflow +- NetScout Base description: This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using on of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml index ecee156769..1c448fc8c0 100644 --- a/detections/network/internal_vertical_port_scan.yml +++ b/detections/network/internal_vertical_port_scan.yml @@ -7,6 +7,7 @@ status: production type: TTP data_source: - AWS CloudWatchLogs VPCflow +- NetScout Base description: This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. It includes filtering criteria to exclude applications performing scans over ephemeral port ranges, focusing on diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/network/large_volume_of_dns_any_queries.yml index b73ca41645..40557cf3d9 100644 --- a/detections/network/large_volume_of_dns_any_queries.yml +++ b/detections/network/large_volume_of_dns_any_queries.yml @@ -13,7 +13,8 @@ description: The following analytic identifies a large volume of DNS ANY queries this activity could disrupt services, degrade network performance, and potentially be part of a larger Distributed Denial of Service (DDoS) attack, impacting the availability of critical infrastructure. -data_source: [] +data_source: +- NetScout DNS search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" "DNS.record_type"="ANY" by "DNS.dest" | `drop_dm_object_name("DNS")` | where count>200 | `large_volume_of_dns_any_queries_filter`' diff --git a/detections/network/ngrok_reverse_proxy_on_network.yml b/detections/network/ngrok_reverse_proxy_on_network.yml index a8cf6de84a..4d01b1f2a5 100644 --- a/detections/network/ngrok_reverse_proxy_on_network.yml +++ b/detections/network/ngrok_reverse_proxy_on_network.yml @@ -15,6 +15,7 @@ description: The following analytic detects DNS queries to common Ngrok domains, security. data_source: - Sysmon EventID 22 +- NetScout DNS search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.query IN ("*.ngrok.com","*.ngrok.io", "ngrok.*.tunnel.com", "korgn.*.lennut.com") by DNS.src DNS.query DNS.answer | `drop_dm_object_name("DNS")` diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index be2edfc03a..ef19b25842 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -13,7 +13,8 @@ description: The following analytic detects instances where network traffic, ide to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.action = allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml index ba3d3d5577..33d868bab9 100644 --- a/detections/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/network/protocols_passing_authentication_in_cleartext.yml @@ -13,7 +13,8 @@ description: The following analytic identifies the use of cleartext protocols th and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.action!=blocked AND All_Traffic.transport="tcp" AND (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143" diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml index 35dcd16a5c..e738906200 100644 --- a/detections/network/remote_desktop_network_bruteforce.yml +++ b/detections/network/remote_desktop_network_bruteforce.yml @@ -13,7 +13,8 @@ description: The following analytic identifies potential Remote Desktop Protocol force attempts. This activity is significant as it may indicate an attacker attempting to gain unauthorized access to systems via RDP. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further network compromise. -data_source: [] +data_source: +- NetScout Base search: >- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.app=rdp OR All_Traffic.dest_port=3389) diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml index dea3884a91..c10096d174 100644 --- a/detections/network/remote_desktop_network_traffic.yml +++ b/detections/network/remote_desktop_network_traffic.yml @@ -13,7 +13,8 @@ description: The following analytic detects unusual Remote Desktop Protocol (RDP to control networked systems, leading to data theft, ransomware deployment, or further network compromise. If confirmed malicious, this activity could result in significant data breaches or complete system and network control loss. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml index 7154a35162..a544096b02 100644 --- a/detections/network/smb_traffic_spike.yml +++ b/detections/network/smb_traffic_spike.yml @@ -13,7 +13,8 @@ description: The following analytic detects spikes in Server Message Block (SMB) deviations from the average. This activity is significant as it may indicate potential SMB-based attacks, such as ransomware or data theft. If confirmed malicious, attackers could exfiltrate data or spread malware within the network. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src | `drop_dm_object_name("All_Traffic")` | eventstats diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml index 0ec7d9fe16..186a7fb83d 100644 --- a/detections/network/smb_traffic_spike___mltk.yml +++ b/detections/network/smb_traffic_spike___mltk.yml @@ -12,7 +12,8 @@ description: The following analytic identifies spikes in the number of Server Me sudden increases in SMB traffic can indicate lateral movement or data exfiltration attempts by attackers. If confirmed malicious, this behavior could lead to unauthorized access, data theft, or further compromise of the network. -data_source: [] +data_source: +- NetScout Base search: '| tstats `security_content_summariesonly` count values(All_Traffic.dest_ip) as dest values(All_Traffic.dest_port) as port from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index fd10fa8aee..41e200b628 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -7,6 +7,7 @@ status: production type: Hunting data_source: - Palo Alto Network Threat +- NetScout HTTP description: The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel. This activity diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index a0d16683f5..2146354333 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -16,6 +16,7 @@ description: The following analytic detects attempts to exploit CVE-2022-26134, crucial to prevent extensive damage. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index d60f2af086..6e4add0c46 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -14,6 +14,7 @@ description: The following analytic detects the execution of known remote access compromise the network, posing a severe security risk. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count min(_time) as firstTime max(_time) as lastTime latest(Web.http_method) as http_method latest(Web.http_user_agent) as http_user_agent latest(Web.url) as url latest(Web.user) as user latest(Web.dest) as dest from datamodel=Web by Web.action diff --git a/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml b/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml index a67a69b392..07664ed03b 100644 --- a/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml +++ b/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml @@ -15,6 +15,7 @@ description: The following analytic detects attempts to exploit the Fortinet For and control (C2) server. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*configWizard/keyUpload.jsp*") by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype | `drop_dm_object_name("Web")` diff --git a/detections/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml index 26b16128b0..01828e0970 100644 --- a/detections/web/fortinet_appliance_auth_bypass.yml +++ b/detections/web/fortinet_appliance_auth_bypass.yml @@ -15,6 +15,7 @@ description: The following analytic detects attempts to exploit CVE-2022-40684, access, reroute network traffic, or capture sensitive information. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/api/v2/cmdb/system/admin*") Web.http_method IN ("GET", "PUT") by Web.http_user_agent, Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, diff --git a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml index 833be2b428..57c0ca3b4f 100644 --- a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml +++ b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml @@ -7,6 +7,7 @@ status: production type: TTP data_source: - Suricata +- NetScout HTTP description: The following analytic detects attempts to exploit a remote code execution vulnerability in Juniper Networks devices. It identifies requests to /webauth_operation.php?PHPRC=*, which are indicative of uploading and executing malicious PHP files. This detection diff --git a/detections/web/vmware_aria_operations_exploit_attempt.yml b/detections/web/vmware_aria_operations_exploit_attempt.yml index bcad5a1335..274c574734 100644 --- a/detections/web/vmware_aria_operations_exploit_attempt.yml +++ b/detections/web/vmware_aria_operations_exploit_attempt.yml @@ -7,6 +7,7 @@ status: production type: TTP data_source: - Palo Alto Network Threat +- NetScout HTTP description: The following analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability. It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml index 202f0e3626..a3b3eedd63 100644 --- a/detections/web/vmware_server_side_template_injection_hunt.yml +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -15,6 +15,7 @@ description: The following analytic identifies potential server-side template in security risk. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") Web.url="*deviceudid=*" AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml index 09e37d2b77..d89dcf80ab 100644 --- a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -15,6 +15,7 @@ description: The following analytic detects server-side template injection attem within the network. data_source: - Palo Alto Network Threat +- NetScout HTTP search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*" AND Web.url="*freemarker.template.utility.Execute*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` From 954db6855b8441cbf848088830704a2bd6f1934d Mon Sep 17 00:00:00 2001 From: danielsplunk Date: Mon, 10 Feb 2025 19:00:04 -0600 Subject: [PATCH 2/2] remove netscout TA inputs --- data_sources/netscout/app.conf | 28 --- data_sources/netscout/inputs.conf | 59 ------ data_sources/netscout/props.conf | 277 -------------------------- data_sources/netscout/transforms.conf | 29 --- 4 files changed, 393 deletions(-) delete mode 100644 data_sources/netscout/app.conf delete mode 100644 data_sources/netscout/inputs.conf delete mode 100644 data_sources/netscout/props.conf delete mode 100644 data_sources/netscout/transforms.conf diff --git a/data_sources/netscout/app.conf b/data_sources/netscout/app.conf deleted file mode 100644 index d0d6b3e6a9..0000000000 --- a/data_sources/netscout/app.conf +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright (C) 2023 Netscout Systems Inc. All Rights Reserved. -# DO NOT EDIT THIS FILE! -# Please make all changes to files in $SPLUNK_HOME/etc/Omnis_AI_Streamer-TA/local. -# To make changes, copy the section/stanza you want to change from $SPLUNK_HOME/etc/apps/Omnis_AI_Streamer-TA/default -# into ../local and edit there. - -[install] -state_change_requires_restart = true -is_configured = 0 -state = enabled - -[id] -name = Omnis-AI-Streamer-TA -version = 6.4.5 - -[launcher] -author = Netscout Systems -description = Omnis Data Streamer TA -version = 6.4.5 - -[ui] -is_visible = 0 -label = Omnis Data Streamer TA -docs_section_override = AddOns:released - -[package] -id = Omnis-AI-Streamer-TA -check_for_updates = 1 diff --git a/data_sources/netscout/inputs.conf b/data_sources/netscout/inputs.conf deleted file mode 100644 index 20a197bb71..0000000000 --- a/data_sources/netscout/inputs.conf +++ /dev/null @@ -1,59 +0,0 @@ - -### CIM Compliant Data Sources ## -[monitor:///home/export/data/csv-export/ready/OMNIS.flow-dns*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:dns - -[monitor:///home/export/data/csv-export/ready/OMNIS.flow-http*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:http - -[monitor:///home/export/data/csv-export/ready/OMNIS.flow-https*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:https - -[monitor:///home/export/data/csv-export/ready/OMNIS.flow-icmp*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:icmp - -[monitor:///home/export/data/csv-export/ready/OMNIS.flow-smb*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:smb - - -### Other Data Sources -[monitor:///home/export/data/csv-export/ready/OMNIS.netops*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:netops - -[monitor:///home/export/data/csv-export/ready/OMNIS.application*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:application - -[monitor:///home/export/data/csv-export/ready/OMNIS.asset*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:asset - -[monitor:///home/export/data/csv-export/ready/OMNIS.sre*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:sre - -[monitor:///home/export/data/csv-export/ready/OMNIS.uc*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:uc - -[monitor:///home/export/data/csv-export/ready/OMNIS.flow-base*.csv.gz] -disabled = false -index = netscoutoais -sourcetype = netscout:omnis:flow:base -crcSalt = \ No newline at end of file diff --git a/data_sources/netscout/props.conf b/data_sources/netscout/props.conf deleted file mode 100644 index da4e28e4c4..0000000000 --- a/data_sources/netscout/props.conf +++ /dev/null @@ -1,277 +0,0 @@ -[netscout:omnis-flow-dns] -rename = netscout:omnis:flow:dns -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -[netscout:omnis-flow-http] -rename = netscout:omnis:flow:http -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -[netscout:omnis-flow-https] -rename = netscout:omnis:flow:https -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -[netscout:omnis-flow-smb] -rename = netscout:omnis:flow:smb -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -[netscout:omnis-icmp] -rename = netscout:omnis:flow:icmp -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\" -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -[netscout:omnis-flow-base] -rename = netscout:omnis:flow:base -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\",\" -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -[netscout:omnis:flow:dns] -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -REPORT-dns-header = netscout_dns_header -FIELDALIAS-app = application_name AS app -FIELDALIAS-dest = server_host AS dest -FIELDALIAS-dvc = ai_sensor_name AS dvc -FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip -FIELDALIAS-dest_port = server_port AS dest_port -FIELDALIAS-src = client_host AS src -FIELDALIAS-src_port = client_port AS src_port -EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) - -### DNS Specific mappings -FIELDALIAS-answer = resolved_ip_address AS answer -FIELDALIAS-query = domain AS query -FIELDALIAS-query_type = query_type AS record_type -FIELDALIAS-name = message AS name -EVAL-answer_count = mvcount(split(resolved_ip_address,"|")) -EVAL-reply_code_id = response_code -EVAL-reply_code = if(response_code=0,"NoError", replace(response_description,"\s","")) -EVAL-message_type = "QUERY" - -[netscout:omnis:flow:icmp] -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\" -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -REPORT-icmp-header = netscout_icmp_header -FIELDALIAS-app = application_name AS app -FIELDALIAS-dest = server_host AS dest -FIELDALIAS-dest_port = server_port AS dest_port -FIELDALIAS-dvc = ai_sensor_name AS dvc -FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip -FIELDALIAS-src = client_host AS src -FIELDALIAS-src_port = client_port AS src_port -EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) -EVAL-transport = lower(packet_type_name) -EVAL-protocol = "icmp" - - -[netscout:omnis:flow:smb] -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop - -REPORT-smb-header = netscout_smb_header -FIELDALIAS-app = application_name AS app -FIELDALIAS-dest = server_host AS dest -FIELDALIAS-dest_port = server_port AS dest_port -FIELDALIAS-dvc = ai_sensor_name AS dvc -FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip -FIELDALIAS-src = client_host AS src -FIELDALIAS-src_port = client_port AS src_port -EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) - -## SMB Specific mappings to Network Traffic Datamodel -FIELDALIAS-bytes_in = smb_server_to_client_octets AS bytes_in -FIELDALIAS-bytes_out = smb_client_to_server_octets AS bytes_out -FIELDALIAS-packets_in = smb_server_to_client_packets AS packets_in -FIELDALIAS-packets_out = smb_client_to_server_packets AS packets_out -FIELDALIAS-response_time = smb_response_time AS response_time -EVAL-action = "allowed" -EVAL-bytes = bytes_in + bytes_out -EVAL-packets = packets_in + packets_out -EVAL-transport = lower(packet_type_name) -EVAL-protocol = "smb" - -[netscout:omnis:flow:http] -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) - -TRANSFORMS-header_drop = header_drop -REPORT-http-header = netscout_http_header -FIELDALIAS-dest = server_host AS dest -FIELDALIAS-dest_port = server_port AS dest_port -FIELDALIAS-dvc = ai_sensor_name AS dvc -FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip -FIELDALIAS-src = client_host AS src -FIELDALIAS-src_port = client_port AS src_port -EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) - -## HTTP specific mappings to Web Datamodels -FIELDALIAS-app = application_name AS category -FIELDALIAS-bytes_in = http_server_to_client_octets AS bytes_in -FIELDALIAS-bytes_out = http_client_to_server_octets AS bytes_out -FIELDALIAS-packets_in = http_server_to_client_packets AS packets_in -FIELDALIAS-packets_out = http_client_to_server_packets AS packets_out -FIELDALIAS-status = response_code AS status -FIELDALIAS-user_gent = user_agent AS http_user_agent -FIELDALIAS-uri_path = target_uri AS uri_path -FIELDALIAS-url_domain = request_host_name AS url_domain -FIELDALIAS-http_referrer = refferer AS http_referrer -FIELDALIAS-uri_query = uri_query_values -EVAL-action = "allowed" -EVAL-bytes = bytes_in + bytes_out -EVAL-packets = packets_in + packets_out -EVAL-http_method = if(match(message_name, "_HTTP"), upper(replace(message_name,"_HTTP","")), upper(message_name)) -EVAL-http_user_agent_length = len(http_user_agent) -EVAL-transport = lower(packet_type_name) -EVAL-url_length = len(coalesce("http://"+request_host_name+"/"+target_uri+"?"+uri_query_values, "http://"+request_host_name+"/"+target_uri, "http://"+request_host_name)) -EVAL-url = coalesce("http://"+request_host_name+"/"+target_uri+"?"+uri_query_values, "http://"+request_host_name+"/"+target_uri, "http://"+request_host_name) -EVAL-response_time = (http_response_time_usec/1000000) - -[netscout:omnis:flow:https] -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) - -TRANSFORMS-header_drop = header_drop -REPORT-https-header = netscout_https_header -FIELDALIAS-dest = server_host AS dest -FIELDALIAS-dest_port = server_port AS dest_port -FIELDALIAS-dvc = ai_sensor_name AS dvc -FIELDALIAS-dvc_ip = ai_sensor_ip_address AS dvc_ip -FIELDALIAS-src = client_host AS src -FIELDALIAS-src_port = client_port AS src_port -EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) - -## HTTPS specific mappings to Web Datamodels -FIELDALIAS-app = application_name AS category -FIELDALIAS-bytes_in = https_server_to_client_octets AS bytes_in -FIELDALIAS-bytes_out = https_client_to_server_octets AS bytes_out -FIELDALIAS-packets_in = https_server_to_client_packets AS packets_in -FIELDALIAS-packets_out = https_client_to_server_packets AS packets_out -FIELDALIAS-status = response_code AS status -EVAL-action = "allowed" -EVAL-bytes = bytes_in + bytes_out -EVAL-packets = packets_in + packets_out -EVAL-transport = lower(packet_type_name) -EVAL-response_time = (http_response_time_usec/1000000) - -[netscout:omnis:flow:base] -TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6Q %Z -TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\",\" -SHOULD_LINEMERGE = false -category = Network & Security -description = Netscout Systems Network Security Appliance -pulldown_type = 1 -LINE_BREAKER = ([\r\n]+) -TRANSFORMS-header_drop = header_drop -REPORT-base-header = netscout_base_header - -FIELDALIAS-dest = server_ip_address AS dest -FIELDALIAS-dest_port = server_port AS dest_port -FIELDALIAS-src = client_ip_address AS src -FIELDALIAS-src_port = client_port AS src_port -FIELDALIAS-dvc = ai_sensor_name AS dvc -EVAL-transport = lower(packet_type_name) -EVAL-action = case(flow_end_reason_name=="End of flow detected","teardown",flow_end_reason_name=="Lack of resources","teardown",flow_end_reason_name=="Idle timeout","teardown",flow_end_reason_name=="Active","allowed", 1=1, "allowed") -FIELDALIAS-bytes_in = server_to_client_octets AS bytes_in -FIELDALIAS-bytes_out = client_to_server_octets AS bytes_out -FIELDALIAS-packets_in = server_to_client_packets AS packets_in -FIELDALIAS-packets_out = client_to_server_packets AS packets_out -FIELDALIAS-vlan = vlan_id AS vlan -EVAL-bytes = bytes_in + bytes_out -EVAL-packets = packets_in + packets_out -FIELDALIAS-app = application_name AS app -EVAL-duration = round(strptime(flow_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(flow_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) - -#specific Network Traffic fields -FIELDALIAS-rule = flow_end_reason_name AS rule -EVAL-vendor_product = "NetScout Systems, Inc." -FIELDALIAS-src_ip = client_ip_address AS src_ip -FIELDALIAS-dest_ip = server_ip_address AS dest_ip - - -### Use the following to create custom flows and update accordingly. -#[netscout:omnis:flow:] -#TIME_PREFIX = ^\"\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d+ \S+\", -#SHOULD_LINEMERGE = 0 -#category = Network & Security -#description = Netscout Systems Network Security Appliance -#pulldown_type = 1 -#LINE_BREAKER = ([\r\n]+) -#TRANSFORMS-header_drop = header_drop -#TRANSFORMS-header_drop = header_drop -#REPORT-https-header = netscout_https_header -#FIELDALIAS-dest = server_host AS dest -#FIELDALIAS-dest_port = server_port AS dest_port -#FIELDALIAS-dvc = device_name AS dvc -#FIELDALIAS-dvc_ip = device_ip_address AS dvc_ip -#FIELDALIAS-src = client_host AS src -#FIELDALIAS-src_port = client_port AS src_port -#EVAL-duration = round(strptime(transaction_end_time, "%Y-%m-%d %H:%M:%S.%N %Z")-strptime(transaction_start_time, "%Y-%m-%d %H:%M:%S.%N %Z"),2) diff --git a/data_sources/netscout/transforms.conf b/data_sources/netscout/transforms.conf deleted file mode 100644 index b4c45b126e..0000000000 --- a/data_sources/netscout/transforms.conf +++ /dev/null @@ -1,29 +0,0 @@ -[header_drop] -REGEX = ^timestamp -DEST_KEY = queue -FORMAT = nullQueue - - -[netscout_dns_header] -DELIMS = "," -FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,application_group,response_code,response_description,query_class,response_query_flag,authoritative_answer_flag,truncation_flag,recursion_desired_flag,recursion_available_flag,reserved_flag,rejected_flag,reverse_lookup_flag,resolved_ip_address,resolved_ttls,tld,subdomain,etld,message,query_type,domain,response_time,query_size,count_of_elements,dns_client_to_server_octets,dns_server_to_client_octets,dns_client_to_server_packets,dns_server_to_client_packets - -[netscout_http_header] -DELIMS = "," -FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,request_host_name,target_uri,user_agent,http_content_type,refferer,uri_path,uri_query_names,uri_query_values,http_client_to_server_octets,http_server_to_client_octets,http_client_to_server_packets,http_server_to_client_packets,http_response_time_usec - -[netscout_https_header] -DELIMS = "," -FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,tls_version,server_name_indicator,cipher,https_response_time,https_client_to_server_octets,https_server_to_client_octets,https_client_to_server_packets,https_server_to_client_packets - -[netscout_smb_header] -DELIMS = "," -FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,authentication_protocol,dialect,file_operation,user_name,tree_name,file_name,smb_response_time,smb_client_to_server_octets,smb_server_to_client_octets,smb_client_to_server_packets,smb_server_to_client_packets - -[netscout_icmp_header] -DELIMS = "," -FIELDS = timestamp,transaction_start_time,transaction_end_time,server_host,server_port,client_host,client_port,packet_type_name,vlan_id,application_name,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,message_name,application_group,response_code,response_description,icmp_client_to_server_octets,icmp_server_to_client_octets,icmp_client_to_server_packets,icmp_server_to_client_packets - -[netscout_base_header] -DELIMS = "," -FIELDS = timestamp,flow_start_time,flow_end_time,flow_end_reason_name,server_ip_address,server_port,client_ip_address,client_port,application_name,packet_type_name,vlan_id,ai_sensor_ip_address,ai_sensor_name,ai_sensor_interface_number,application_group,client_to_server_octets,server_to_client_octets,client_to_server_packets,server_to_client_packets