From f5aeb32827272cbc25ab271a1e1a7a63b83e4ab8 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 5 Jan 2021 11:12:58 -0500 Subject: [PATCH] should be dest_mac as reported --- .../network/detect_unauthorized_assets_by_mac_address.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/network/detect_unauthorized_assets_by_mac_address.yml b/detections/network/detect_unauthorized_assets_by_mac_address.yml index 252c9490af..2b744a5089 100644 --- a/detections/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/network/detect_unauthorized_assets_by_mac_address.yml @@ -18,9 +18,9 @@ references: [] author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip - All_Sessions.src_mac | dedup All_Sessions.src_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` - | search NOT [| inputlookup asset_lookup_by_str |rename mac as src_mac | fields - + src_mac] | `detect_unauthorized_assets_by_mac_address_filter`' + All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` + | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter`' known_false_positives: This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the