From bbe3e20a0a10d6e633df5ebf0802bc37dd94e016 Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 25 Mar 2019 12:05:36 -0400 Subject: [PATCH 01/74] story spec update --- .DS_Store | Bin 0 -> 6148 bytes escu/.DS_Store | Bin 0 -> 6148 bytes escu/stories/.DS_Store | Bin 0 -> 6148 bytes spec/analytic_story.json.spec | 317 ++++++++++++++++---------------- spec/analytic_story.spec.sample | 55 ++++++ 5 files changed, 214 insertions(+), 158 deletions(-) create mode 100644 .DS_Store create mode 100644 escu/.DS_Store create mode 100644 escu/stories/.DS_Store create mode 100644 spec/analytic_story.spec.sample diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..6d6fb3be80744f29e567be0e687da05048766278 GIT binary patch literal 6148 zcmeHKJx{|h5PfbV(TXJ-j2W3KF|&k{4wZm`{sEM;^m*mwRRf-C!JG-b|IE9pAdW}*@Q&R<00af6K3do0< z){{LzO%+fDRDq@f@_k6?f~m*aq5X8Qu}1)6#9?df+n;}8A_K(KW9^V5G~=j5M>YP4 zVf@*_I6CjAKE8J7=rDF>=J7Kde?l?-=wT8Y4wE|6RuxbMLIt|+GM4>+bo~4ulJrUy zPzC;#0w&5P*^njqy>+iR*=rN}BVA15YKPwxcI;NnSlNot>DD-&NQanutQ~TMrauB! L25nSGXRD~ literal 0 HcmV?d00001 diff --git a/escu/.DS_Store b/escu/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..8ea314cd788a0eee75684aec4e68d368dac942ae GIT binary patch literal 6148 zcmeHK%Sr=55UkdK0WUdvoL|Tv3?cafe?T-IgusHU_dWSt`Lt9&5W~h(@FLaFT{FF1 zJ4_w6w*lDZbH4^w0G4z|e0i9gKX;$mO=XNo=R4l;ig7=_9G-_+_2q-z0V(jW6tKnial7G_s<+NA=e@SkpXgq5q`Pq)6ozQW#AwIdcsqWG cqO5Da=JQ@SB?g`OpcC~o;JV19z+WqH0!H1@V-^m;4Wg<&0T*E43hX&L&p$$qDprKhvt+--jT7}7np#A3 zem<@ulZcFPQ@L2!n>{z**++&mCkOWA81W14cNZlEfg7;MkzE(HCqgga^y>{tEnwC%0;vJ&^%eQ zLs35+`xjp>T0 Date: Mon, 25 Mar 2019 16:26:47 -0400 Subject: [PATCH 02/74] spec update --- spec/analytic_story.json.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/analytic_story.json.spec b/spec/analytic_story.json.spec index 63d0dab96d..f9615bb2cf 100644 --- a/spec/analytic_story.json.spec +++ b/spec/analytic_story.json.spec @@ -110,7 +110,7 @@ "type": { "type": "string", "description": "What product gives you a detection", - "enum": ["detection_splunk", "detection_uba", "detection_phantom"] + "enum": ["splunk", "uba", "phantom"] }, "name": { "type": "string", From 8c3a6b27962b791c78a5d018b8e5a54c304094d7 Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 25 Mar 2019 16:26:51 -0400 Subject: [PATCH 03/74] skeleton of generic detection spec --- spec/detection_phantom.example.json | 76 ++++ spec/detection_splunk.example.json | 94 +++++ spec/detections.json.spec | 535 ++++++++++++++++++++++++++++ 3 files changed, 705 insertions(+) create mode 100644 spec/detection_phantom.example.json create mode 100644 spec/detection_splunk.example.json create mode 100644 spec/detections.json.spec diff --git a/spec/detection_phantom.example.json b/spec/detection_phantom.example.json new file mode 100644 index 0000000000..72539df7bb --- /dev/null +++ b/spec/detection_phantom.example.json @@ -0,0 +1,76 @@ +{ + "asset_type": "Endpoint", + "confidence": "medium", + "creation_date": "2019-02-14", + "data_metadata": { + "data_models": [ + "Network_Resolution" + ], + "data_source": [ + "DNS" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", + "detect": { + "phantom": { + "phantom_server": "automation (hostname)", + "playbook_display_name": "Excessive Account Lockouts Enrichment And Response", + "playbook_name": "community/excessive_account_lockouts_enrichment_and_response", + "playbook_url": "https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/", + "sensitivity": "green", + "severity": "medium" + } + }, + "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", + "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", + "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", + "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", + "maintainers": [ + { + "company": "Splunk", + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" + } + ], + "mappings": { + "cis20": [ + "CIS 1", + "CIS 3", + "CIS 8", + "CIS 12" + ], + "kill_chain_phases": [ + "Command and Control" + ], + "mitre_attack": [ + "Exfiltration", + "Command and Control", + "Defense Evasion", + "Commonly Used Port" + ], + "nist": [ + "ID.AM", + "PR.DS", + "PR.IP", + "DE.AE", + "DE.CM" + ] + }, + "modification_date": "2019-02-14", + "name": "DNS record changed", + "original_authors": [ + { + "company": "Splunk", + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" + } + ], + "security_domain": "network", + "spec_version": 1, + "type": "splunk", + "version": "1.0" +} diff --git a/spec/detection_splunk.example.json b/spec/detection_splunk.example.json new file mode 100644 index 0000000000..0a73b032f1 --- /dev/null +++ b/spec/detection_splunk.example.json @@ -0,0 +1,94 @@ +{ + "asset_type": "Endpoint", + "confidence": "medium", + "creation_date": "2019-02-14", + "data_metadata": { + "data_models": [ + "Network_Resolution" + ], + "data_source": [ + "DNS" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "src", + "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", + "rule_title": "DNS record changed" + }, + "risk": { + "risk_object": "src", + "risk_object_type": [ + "system" + ], + "risk_score": 40 + }, + "suppress": { + "suppress_fields": "src", + "suppress_period": "28800s" + } + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + } + }, + "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", + "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", + "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", + "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", + "maintainers": [ + { + "company": "Splunk", + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" + } + ], + "mappings": { + "cis20": [ + "CIS 1", + "CIS 3", + "CIS 8", + "CIS 12" + ], + "kill_chain_phases": [ + "Command and Control" + ], + "mitre_attack": [ + "Exfiltration", + "Command and Control", + "Defense Evasion", + "Commonly Used Port" + ], + "nist": [ + "ID.AM", + "PR.DS", + "PR.IP", + "DE.AE", + "DE.CM" + ] + }, + "modification_date": "2019-02-14", + "name": "DNS record changed", + "original_authors": [ + { + "company": "Splunk", + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" + } + ], + "security_domain": "network", + "spec_version": 1, + "type": "splunk", + "version": "1.0" +} diff --git a/spec/detections.json.spec b/spec/detections.json.spec new file mode 100644 index 0000000000..9b9aac70f3 --- /dev/null +++ b/spec/detections.json.spec @@ -0,0 +1,535 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Detection Manifest", + "description": "A object that defines the parameters for detecting things using various Splunk capabilities", + "type": "object", + "properties": { + "name": { + "description": "The name of the detection", + "type": "string" + }, + "id": { + "description": "The unique identifier for the detection", + "type": "string" + }, + "type": { + "description": "The type of detection", + "enum": [ + "uba", + "splunk", + "phantom" + ] + }, + "description": { + "description": "A description of what the detection is designed to find", + "type": "string" + }, + "data_metadata": { + "type": "object", + "description": "Information about the date being ingested", + "properties": { + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften", + "OSquery" + ] + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false, + "required": [ + "data_source", + "providing_technologies" + ] + }, + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, + "mappings": { + "type": "object", + "description": "Mappings to various industry standards and frameworks", + "properties": { + "cis20": { + "description": "A list of critical security controls this search helps you implement", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "kill_chain_phases": { + "description": "A list of kill-chain phases to which the search applies", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "mitre_attack": { + "description": "A list of the techniques and tactics identified by the search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "nist": { + "description": "A list of the NIST controls the search helps you implement", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "eli5": { + "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "type": "string" + }, + "confidence": { + "description": "Confidence that detected behavior is malicious", + "enum": [ + "high", + "medium", + "low" + ] + }, + "asset_type": { + "description": "Designates the type of asset being investigated", + "type": "string" + }, + "known_false_positives": { + "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "baselines": { + "description": "An array of the baseline objects to exectute before the detection ", + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ] + }, + "name": { + "type": "string", + "description": "name of baseline" + }, + "id": { + "type": "string", + "description": "UUID of the baseline object" + } + }, + "additionalProperties": false, + "required": [ + "type", + "name", + "id" + ] + } + }, + "investigations": { + "description": "An array of the investigation objects to exectute on the detection results ", + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ] + }, + "name": { + "type": "string", + "description": "name of baseline" + }, + "id": { + "type": "string", + "description": "UUID of the baseline object" + } + }, + "additionalProperties": false, + "required": [ + "type", + "name", + "id" + ] + } + }, + "responses": { + "description": "An array of the response objects to exectute on the detection results ", + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ] + }, + "name": { + "type": "string", + "description": "name of baseline" + }, + "id": { + "type": "string", + "description": "UUID of the baseline object" + } + }, + "additionalProperties": false, + "required": [ + "type", + "name", + "id" + ] + } + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the search", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "references": { + "description": "A list of URLs that give more information about the search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "security_domain": { + "description": "The high-level security area to which the search belongs", + "enum": [ + "access", + "endpoint", + "network", + "threat" + ] + }, + "spec_version": { + "description": "The version of the detection specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the detection", + "type": "string" + }, + "detect": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + } + }, + "additionalProperties": false, + "definitions": { + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." + }, + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" + }, + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" + } + } + }, + "splunk": { + "type": "object", + "properties": { + "correlation_rule": { + "type": "object", + "description": "Various fields to enhance usability in Enterprise Security", + "properties": { + "notable": { + "type": "object", + "description": "Various fields associated with creating a notable event", + "properties": { + "rule_description": { + "description": "Description of the notable event that will display in Incident Review", + "type": "string" + }, + "rule_title": { + "description": "Title of the notable event that will display in Incident Review", + "type": "string" + }, + "nes_fields": { + "description": "A list of suggested fields to be used for notable-event suppression", + "type": "string" + } + }, + "additionalProperties": false, + "required": [ + "rule_description", + "rule_title", + "nes_fields" + ] + }, + "risk": { + "type": "object", + "description": "Fields associated with assigning risk to objects", + "properties": { + "risk_object": { + "description": "TThe field to which you are assigning risk", + "type": "string" + }, + "risk_object_type": { + "description": "The type of object to which you’re assigning risk", + "type": "array", + "items": { + "type": "string", + "enum": [ + "system", + "user", + "other" + ] + }, + "minItems": 0, + "maxItems": 1, + "uniqueItems": true + }, + "risk_score": { + "description": "Score assigned to risk_object", + "type": "integer" + } + }, + "additionalProperties": false, + "required": [ + "risk_score", + "risk_object", + "risk_object_type" + ] + }, + "suppress": { + "type": "object", + "description": "Fields associated with suppressing the creation of multiple alerts", + "properties": { + "suppress_fields": { + "description": "The fields to base the suppression on", + "type": "string" + }, + "suppress_period": { + "description": "The length of time the suppression should be in effect", + "type": "string" + } + }, + "additionalProperties": false, + "required": [ + "suppress_fields", + "suppress_period" + ] + } + }, + "additionalProperties": false + }, + "scheduling": { + "type": "object", + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "additionalProperties": false + }, + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" + }, + "search_description": { + "description": "A description of what the search is designed to detect", + "type": "string" + } + } + } + }, + "required": [ + "confidence", + "creation_date", + "data_metadata", + "eli5", + "how_to_implement", + "known_false_positives", + "maintainers", + "modification_date", + "original_authors", + "description", + "id", + "type", + "security_domain", + "version", + "detect" + ] +} From c0b7672df1933c92dcb6d2575a2d48e72c10a933 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 26 Mar 2019 10:28:12 -0400 Subject: [PATCH 04/74] updated project structure --- escu/.DS_Store | Bin 6148 -> 0 bytes ...contextual_aws_network_interface_details.json | 0 .../contextual_aws_s3_bucket_details.json | 0 .../contextual_first_occurrence_mac_address.json | 0 .../contextual_get_acl_details.json | 0 ...ual_get_authentication_logs_for_endpoint.json | 0 .../contextual_get_backup_logs_for_endpoint.json | 0 ...ontextual_get_ec2_details_by_instance_id.json | 0 .../contextual_get_ec2_launch_details.json | 0 ...textual_get_notable_history_for_endpoint.json | 0 .../contextual_get_notable_info.json | 0 .../contextual_get_risk_for_endpoint.json | 0 .../contextual_get_risk_for_user.json | 0 .../contextual_get_update_logs_for_endpoint.json | 0 ...extual_get_user_info_from_identity_table.json | 0 ...tual_get_vulnerability_logs_for_endpoint.json | 0 ...ion_abnormally_high_instance_termination.json | 0 ...ction_abnormally_high_instances_launched.json | 0 .../detection_account_harvesting.json | 0 .../detection_acl_with_open_ports.json | 0 ...ection_activity_related_to_pass_the_hash.json | 0 .../detection_add_to_untrust_cert_store.json | 0 .../detection_anomalous_webclick.json | 0 ...itivity_from_previously_unseen_user_role.json | 0 ...rs_scanning_for_vulnerable_jboss_servers.json | 0 .../detection_attrib_to_hide_files.json | 0 ..._aws_activity_from_non_approved_accounts.json | 0 .../detection_aws_activity_in_new_region.json | 0 ...provisioning_from_previously_unseen_city.json | 0 ...visioning_from_previously_unseen_country.json | 0 ...d_provisioning_from_previously_unseen_ip.json | 0 ...ovisioning_from_previously_unseen_region.json | 0 ..._cross_account_activity_from_new_account.json | 0 .../detection_aws_spike_acl_activity.json | 0 .../detection_badrabbit_schtasks.json | 0 .../detection_batch_file_write_system32.json | 0 .../detection_brand_abuse_dns.json | 0 .../detection_brand_abuse_email.json | 0 .../detection_brand_abuse_web.json | 0 .../detection_change_file_association.json | 0 .../detection_children_of_spoolsv.json | 0 ...ients_connecting_to_multiple_dns_servers.json | 0 .../detection_common_ransomware_extensions.json | 0 .../detection_common_ransomware_notes.json | 0 .../detection_create_hidden_shares.json | 0 .../detection_create_local_admin_via_net.json | 0 .../detection_cred_dump_via_reg.json | 0 .../detection_cscript_via_cmd.json | 0 .../detection_delete_shadow_copies.json | 0 .../detection_deletion_network_acl.json | 0 .../detection_disable_remote_uac.json | 0 .../detection_dns_amplification_any_query.json | 0 ...uery_length_with_high_standard_deviation.json | 0 .../detection_dns_record_changed.json | 0 .../detection_dns_tunnelling.json | 0 .../detection_dragonfly_schtasks.json | 0 .../detection_dyn_dns_queries.json | 0 .../detection_dyn_dns_web_traffic.json | 0 ...stance_created_by_previously_unseen_user.json | 0 ...tance_modified_by_previously_unseen_user.json | 0 ...tance_started_with_previously_unseen_ami.json | 0 ...ted_with_previously_unseen_instance_type.json | 0 .../detection_email_attachments_with_spaces.json | 0 ...ion_email_files_not_in_outlook_directory.json | 0 ...er_high_volume_outbound_traffic_to_hosts.json | 0 .../detection_excessive_dns_failures.json | 0 ...tection_excessive_lockouts_from_endpoint.json | 0 ...etection_excessive_user_account_lockouts.json | 0 .../detection_execution_of_nirsoft_tools.json | 0 .../detection_file_write_spikes.json | 0 .../detection_first_time_seen_cmd_line.json | 0 ..._first_time_seen_running_windows_service.json | 0 .../detection_fsutil_deleting_journals.json | 0 .../detection_hosts_file_modification.json | 0 ...olume_network_traffic_from_email_servers.json | 0 .../detection_large_icmp_outbound.json | 0 .../detection_local_admin_account_creation.json | 0 .../detection_long_dns_text_response.json | 0 ...icious_application_shimming_via_registry.json | 0 ...s_connect_to_internet_with_hidden_window.json | 0 ...cious_powershell_process_encoded_command.json | 0 ..._malicious_powershell_process_execpolicy.json | 0 ...ll_process_multiple_suspicious_arguments.json | 0 ...owershell_process_obfuscation_techniques.json | 0 ...icious_requests_to_exploit_jboss_servers.json | 0 .../detection_mshta_launching_scripts.json | 0 .../detection_netbackup_failed_backup.json | 0 ...tion_netbackup_no_backups_in_time_period.json | 0 .../detection_netsh_launching_process.json | 0 .../detection_new_aws_console_login_by_user.json | 0 .../detection_new_connections_to_routers.json | 0 .../detection_new_open_s3_buckets.json | 0 .../detection_new_user_accounts.json | 0 .../detection_no_win_updates_in_timeframe.json | 0 .../detection_open_redirect_in_splunk_web.json | 0 .../detection_osx_coldroot_pack.json | 0 .../detection_osx_keyboard_taps.json | 0 .../detection_outbound_smb_connections.json | 0 ...tection_overwrite_accessibility_binaries.json | 0 .../detection_password_sharing.json | 0 .../detection_path_interception_program.exe.json | 0 .../detection_port_monitor_via_registry.json | 0 .../detection_powershell_get_sedebug.json | 0 .../detection_powershell_read_from_lsass.json | 0 .../detection_powershell_reg_key_mod.json | 0 .../detection_process_launching_netsh.json | 0 .../detection_process_with_double_extension.json | 0 ...ion_process_with_spaces_before_extension.json | 0 .../detection_prohibited_allowed_through_fw.json | 0 ...ction_prohibited_apps_spawning_cmdprompt.json | 0 ...etection_prohibited_software_on_endpoint.json | 0 .../detection_protocol_mismatch.json | 0 ...on_protocols_authenticating_in_cleartext.json | 0 .../detection_psexec_accepteula.json | 0 .../detection_rare_executables_on_endpoint.json | 0 .../detection_reg_manipulating_services.json | 0 .../detection_reg_used_to_hide_files.json | 0 .../detection_registry_persistence.json | 0 .../detection_registry_privilege_escalation.json | 0 .../detection_remote_desktop_bruteforce.json | 0 ...detection_remote_desktop_network_traffic.json | 0 ...remote_desktop_process_running_on_system.json | 0 .../detection_remote_registry_modifications.json | 0 .../detection_remote_wmi_command_attempt.json | 0 ...tection_remote_wmi_process_instantiation.json | 0 .../detection_rundll_loading_dll_by_ordinal.json | 0 .../detection_s3_access_from_new_ip.json | 0 .../detection_samsam_payload_extensions.json | 0 .../detection_samsam_test_file_write.json | 0 .../detection_sc_manipulating_services.json | 0 .../detection_schtasks_forced_reboot.json | 0 ...schtasks_scheduling_job_on_remote_system.json | 0 .../detection_shim_database_file_creation.json | 0 .../detection_shim_database_installation.json | 0 .../detection_short_lived_accounts.json | 0 .../detection_single_letter_executables.json | 0 .../detection_smb_traffic_spike.json | 0 .../detection_sncd_processes.json | 0 ...tection_spectre_meltdown_vulnerabilities.json | 0 ...detection_spike_aws_api_call_per_account.json | 0 ...ection_spike_aws_security_group_activity.json | 0 .../detection_spike_s3_deletion.json | 0 .../detection_spike_vpc_blocked_traffic.json | 0 .../detection_splunk_information_disclosure.json | 0 .../detection_sql_injection_with_long_urls.json | 0 .../detection_stop_security_services.json | 0 .../detection_suspicious_email_attachments.json | 0 .../detection_suspicious_file_writes.json | 0 .../detection_suspicious_java_classes.json | 0 .../detection_suspicious_reg_process.json | 0 .../detection_suspicious_wevtutil_usage.json | 0 .../detection_suspicious_write_to_recycler.json | 0 .../detection_suspicious_write_to_sysvol.json | 0 ..._processes_run_from_unexpected_locations.json | 0 .../detection_tor_traffic.json | 0 ...tion_unauthorized_assets_via_mac_address.json | 0 .../detection_unauthorized_dns_servers.json | 0 .../detection_uncommon_processes.json | 0 .../detection_unusually_long_commandlines.json | 0 ...ction_unusually_long_content-type_length.json | 0 .../detection_usb_insertion.json | 0 .../detection_users_without_mfa.json | 0 ...b_servers_executing_suspicious_processes.json | 0 .../detection_windows_event_log_cleared.json | 0 .../detection_wmi_perm_event_subscription.json | 0 ...ction_wmi_perm_event_subscription_sysmon.json | 0 .../detection_wmi_process_launch.json | 0 .../detection_wmi_script_execution.json | 0 .../detection_wmi_temp_event_subscription.json | 0 .../investigative_aws_activity_via_region.json | 0 ...gative_aws_user_activities_by_user_field.json | 0 ...igative_aws_user_activity_by_accesskeyid.json | 0 ...estigative_aws_user_activity_by_src_user.json | 0 .../investigative_dns_server_history.json | 0 .../investigative_dns_traffic_stats.json | 0 ...gative_email_sent_to_hidden_cobra_actors.json | 0 ...tigative_get_all_aws_activitiy_from_city.json | 0 ...ative_get_all_aws_activitiy_from_country.json | 0 ...gative_get_all_aws_activitiy_from_region.json | 0 ...gative_get_all_aws_activitiy_from_src_ip.json | 0 ...vestigative_get_all_backup_data_for_host.json | 0 .../investigative_get_email_info.json | 0 .../investigative_get_emails_from_sender.json | 0 .../investigative_get_emails_from_source.json | 0 ..._logon_rights_modifications_for_endpoint.json | 0 ..._get_logon_rights_modifications_for_user.json | 0 ...tigative_get_network_traffic_from_src_ip.json | 0 .../investigative_get_parent_process_info.json | 0 ...igative_get_process_creating_dns_traffic.json | 0 .../investigative_get_process_info.json | 0 .../investigative_get_process_info_for_port.json | 0 .../investigative_get_rdp_authentications.json | 0 .../investigative_get_registry_activities.json | 0 .../investigative_get_web_activity.json | 0 ...investigative_get_web_activity_by_src_ip.json | 0 .../investigative_get_web_posts_by_src.json | 0 .../investigative_get_web_session_info.json | 0 .../investigative_get_wmi_sysmon_events.json | 0 ...gative_suspicious_strings_in_HTTP_header.json | 0 ...vestigative_user_activity_via_cloudtrail.json | 0 .../support_add_prohibited_processes_to_es.json | 0 .../support_approved_aws_service_accounts.json | 0 .../support_assets_sorted_by_category.json | 0 .../support_baseline_api_calls_per_user_arn.json | 0 .../support_baseline_aws_regions.json | 0 .../support_baseline_blocked_vpc_traffic.json | 0 ...pport_baseline_network_acl_modifications.json | 0 .../support_baseline_s3_deletion_by_arn.json | 0 ..._baseline_security_group_activity_by_arn.json | 0 .../support_brand_abuse_dnstwist_domains.json | 0 .../support_discover_dns_records.json | 0 .../support_identify_ports_on_network.json | 0 ...rt_identify_systems_creating_rdp_traffic.json | 0 ...t_identify_systems_receiving_rdp_traffic.json | 0 ...rt_identify_systems_using_remote_desktop.json | 0 .../support_monitor_successful_backups.json | 0 ...pport_monitor_successful_windows_updates.json | 0 .../support_monitor_unsuccessful_backups.json | 0 ...ort_monitor_unsuccessful_windows_updates.json | 0 ...eviously_seen_aws_cross_account_activity.json | 0 .../support_previously_seen_cmd_arguments.json | 0 .../support_previously_seen_ec2_amis.json | 0 ...pport_previously_seen_ec2_instance_types.json | 0 ...ort_previously_seen_ec2_launches_by_user.json | 0 ...upport_previously_seen_ec2_modifications.json | 0 ...reviously_seen_provisioning_activity_src.json | 0 .../support_previously_seen_s3_remote_ip.json | 0 .../support_previously_seen_user_roles.json | 0 .../support_previously_seen_users.json | 0 ...t_previously_seen_windows_service_starts.json | 0 ...systems_ready_for_spectre_meltdown_patch.json | 0 {escu/stories => stories}/.DS_Store | Bin .../stories => stories}/account_monitoring.json | 0 {escu/stories => stories}/apache_struts.json | 0 {escu/stories => stories}/asset_tracking.json | 0 .../aws_cross_account_activity.json | 0 {escu/stories => stories}/aws_cryptomining.json | 0 {escu/stories => stories}/aws_ec2.json | 0 .../aws_ec2_modifications.json | 0 {escu/stories => stories}/aws_network_acl.json | 0 {escu/stories => stories}/aws_provisioning.json | 0 {escu/stories => stories}/aws_s3.json | 0 .../aws_suspcious_logins.json | 0 .../aws_suspcious_traffic.json | 0 .../stories => stories}/aws_user_monitoring.json | 0 {escu/stories => stories}/brand_monitoring.json | 0 {escu/stories => stories}/coldroot.json | 0 .../collection_and_staging.json | 0 .../stories => stories}/command_and_control.json | 0 .../stories => stories}/credential_dumping.json | 0 {escu/stories => stories}/data_protection.json | 0 {escu/stories => stories}/defense_evasion.json | 0 .../detect_unauthorized_processes.json | 0 .../dhs_report_TA18-074A.json | 0 .../disable_security_tools.json | 0 .../dns_amplification_attacks.json | 0 {escu/stories => stories}/dns_hijacking.json | 0 {escu/stories => stories}/dynamic_dns.json | 0 {escu/stories => stories}/emotet.json | 0 .../file_extension_abuse.json | 0 .../hidden_cobra_malware.json | 0 {escu/stories => stories}/host_redirection.json | 0 .../jboss_vulnerabilities.json | 0 {escu/stories => stories}/lateral_movement.json | 0 .../malicious_powershell.json | 0 {escu/stories => stories}/monitor_backups.json | 0 .../stories => stories}/monitor_for_updates.json | 0 {iDefense/stories => stories}/mudcarp.json | 0 {escu/stories => stories}/netsh_abuse.json | 0 .../non-secure_communications.json | 0 {escu/stories => stories}/orangeworm.json | 0 ...prohibited_traffic_and_protocol_mismatch.json | 0 {escu/stories => stories}/ransomware.json | 0 .../routers_and_infrastructure.json | 0 {escu/stories => stories}/samsam.json | 0 {escu/stories => stories}/service_abuse.json | 0 {escu/stories => stories}/spectre_meltdown.json | 0 .../splunk_information_disclosure.json | 0 .../splunk_vulnerabilities.json | 0 {escu/stories => stories}/sql_injection.json | 0 .../suspicious_cmd_line_executions.json | 0 .../suspicious_dns_traffic.json | 0 {escu/stories => stories}/suspicious_emails.json | 0 .../suspicious_event_log_activity.json | 0 .../suspicious_mshta_activities.json | 0 .../suspicious_windows_registry_activities.json | 0 {escu/stories => stories}/suspicious_wmi.json | 0 {escu/stories => stories}/unusual_processes.json | 0 {escu/stories => stories}/web_fraud.json | 0 .../stories => stories}/windows_persistence.json | 0 .../windows_privilege_escalation.json | 0 291 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 escu/.DS_Store rename {escu/searches => searches}/contextual_aws_network_interface_details.json (100%) rename {escu/searches => searches}/contextual_aws_s3_bucket_details.json (100%) rename {escu/searches => searches}/contextual_first_occurrence_mac_address.json (100%) rename {escu/searches => searches}/contextual_get_acl_details.json (100%) rename {escu/searches => searches}/contextual_get_authentication_logs_for_endpoint.json (100%) rename {escu/searches => searches}/contextual_get_backup_logs_for_endpoint.json (100%) rename {escu/searches => searches}/contextual_get_ec2_details_by_instance_id.json (100%) rename {escu/searches => searches}/contextual_get_ec2_launch_details.json (100%) rename {escu/searches => searches}/contextual_get_notable_history_for_endpoint.json (100%) rename {escu/searches => searches}/contextual_get_notable_info.json (100%) rename {escu/searches => searches}/contextual_get_risk_for_endpoint.json (100%) rename {escu/searches => searches}/contextual_get_risk_for_user.json (100%) rename {escu/searches => searches}/contextual_get_update_logs_for_endpoint.json (100%) rename {escu/searches => searches}/contextual_get_user_info_from_identity_table.json (100%) rename {escu/searches => searches}/contextual_get_vulnerability_logs_for_endpoint.json (100%) rename {escu/searches => searches}/detection_abnormally_high_instance_termination.json (100%) rename {escu/searches => searches}/detection_abnormally_high_instances_launched.json (100%) rename {escu/searches => searches}/detection_account_harvesting.json (100%) rename {escu/searches => searches}/detection_acl_with_open_ports.json (100%) rename {escu/searches => searches}/detection_activity_related_to_pass_the_hash.json (100%) rename {escu/searches => searches}/detection_add_to_untrust_cert_store.json (100%) rename {escu/searches => searches}/detection_anomalous_webclick.json (100%) rename {escu/searches => searches}/detection_api_acitivity_from_previously_unseen_user_role.json (100%) rename {escu/searches => searches}/detection_attackers_scanning_for_vulnerable_jboss_servers.json (100%) rename {escu/searches => searches}/detection_attrib_to_hide_files.json (100%) rename {escu/searches => searches}/detection_aws_activity_from_non_approved_accounts.json (100%) rename {escu/searches => searches}/detection_aws_activity_in_new_region.json (100%) rename {escu/searches => searches}/detection_aws_cloud_provisioning_from_previously_unseen_city.json (100%) rename {escu/searches => searches}/detection_aws_cloud_provisioning_from_previously_unseen_country.json (100%) rename {escu/searches => searches}/detection_aws_cloud_provisioning_from_previously_unseen_ip.json (100%) rename {escu/searches => searches}/detection_aws_cloud_provisioning_from_previously_unseen_region.json (100%) rename {escu/searches => searches}/detection_aws_cross_account_activity_from_new_account.json (100%) rename {escu/searches => searches}/detection_aws_spike_acl_activity.json (100%) rename {escu/searches => searches}/detection_badrabbit_schtasks.json (100%) rename {escu/searches => searches}/detection_batch_file_write_system32.json (100%) rename {escu/searches => searches}/detection_brand_abuse_dns.json (100%) rename {escu/searches => searches}/detection_brand_abuse_email.json (100%) rename {escu/searches => searches}/detection_brand_abuse_web.json (100%) rename {escu/searches => searches}/detection_change_file_association.json (100%) rename {escu/searches => searches}/detection_children_of_spoolsv.json (100%) rename {escu/searches => searches}/detection_clients_connecting_to_multiple_dns_servers.json (100%) rename {escu/searches => searches}/detection_common_ransomware_extensions.json (100%) rename {escu/searches => searches}/detection_common_ransomware_notes.json (100%) rename {escu/searches => searches}/detection_create_hidden_shares.json (100%) rename {escu/searches => searches}/detection_create_local_admin_via_net.json (100%) rename {escu/searches => searches}/detection_cred_dump_via_reg.json (100%) rename {escu/searches => searches}/detection_cscript_via_cmd.json (100%) rename {escu/searches => searches}/detection_delete_shadow_copies.json (100%) rename {escu/searches => searches}/detection_deletion_network_acl.json (100%) rename {escu/searches => searches}/detection_disable_remote_uac.json (100%) rename {escu/searches => searches}/detection_dns_amplification_any_query.json (100%) rename {escu/searches => searches}/detection_dns_query_length_with_high_standard_deviation.json (100%) rename {escu/searches => searches}/detection_dns_record_changed.json (100%) rename {escu/searches => searches}/detection_dns_tunnelling.json (100%) rename {escu/searches => searches}/detection_dragonfly_schtasks.json (100%) rename {escu/searches => searches}/detection_dyn_dns_queries.json (100%) rename {escu/searches => searches}/detection_dyn_dns_web_traffic.json (100%) rename {escu/searches => searches}/detection_ec2_instance_created_by_previously_unseen_user.json (100%) rename {escu/searches => searches}/detection_ec2_instance_modified_by_previously_unseen_user.json (100%) rename {escu/searches => searches}/detection_ec2_instance_started_with_previously_unseen_ami.json (100%) rename {escu/searches => searches}/detection_ec2_instance_started_with_previously_unseen_instance_type.json (100%) rename {escu/searches => searches}/detection_email_attachments_with_spaces.json (100%) rename {escu/searches => searches}/detection_email_files_not_in_outlook_directory.json (100%) rename {escu/searches => searches}/detection_emailserver_high_volume_outbound_traffic_to_hosts.json (100%) rename {escu/searches => searches}/detection_excessive_dns_failures.json (100%) rename {escu/searches => searches}/detection_excessive_lockouts_from_endpoint.json (100%) rename {escu/searches => searches}/detection_excessive_user_account_lockouts.json (100%) rename {escu/searches => searches}/detection_execution_of_nirsoft_tools.json (100%) rename {escu/searches => searches}/detection_file_write_spikes.json (100%) rename {escu/searches => searches}/detection_first_time_seen_cmd_line.json (100%) rename {escu/searches => searches}/detection_first_time_seen_running_windows_service.json (100%) rename {escu/searches => searches}/detection_fsutil_deleting_journals.json (100%) rename {escu/searches => searches}/detection_hosts_file_modification.json (100%) rename {escu/searches => searches}/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json (100%) rename {escu/searches => searches}/detection_large_icmp_outbound.json (100%) rename {escu/searches => searches}/detection_local_admin_account_creation.json (100%) rename {escu/searches => searches}/detection_long_dns_text_response.json (100%) rename {escu/searches => searches}/detection_malicious_application_shimming_via_registry.json (100%) rename {escu/searches => searches}/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json (100%) rename {escu/searches => searches}/detection_malicious_powershell_process_encoded_command.json (100%) rename {escu/searches => searches}/detection_malicious_powershell_process_execpolicy.json (100%) rename {escu/searches => searches}/detection_malicious_powershell_process_multiple_suspicious_arguments.json (100%) rename {escu/searches => searches}/detection_malicious_powershell_process_obfuscation_techniques.json (100%) rename {escu/searches => searches}/detection_malicious_requests_to_exploit_jboss_servers.json (100%) rename {escu/searches => searches}/detection_mshta_launching_scripts.json (100%) rename {escu/searches => searches}/detection_netbackup_failed_backup.json (100%) rename {escu/searches => searches}/detection_netbackup_no_backups_in_time_period.json (100%) rename {escu/searches => searches}/detection_netsh_launching_process.json (100%) rename {escu/searches => searches}/detection_new_aws_console_login_by_user.json (100%) rename {escu/searches => searches}/detection_new_connections_to_routers.json (100%) rename {escu/searches => searches}/detection_new_open_s3_buckets.json (100%) rename {escu/searches => searches}/detection_new_user_accounts.json (100%) rename {escu/searches => searches}/detection_no_win_updates_in_timeframe.json (100%) rename {escu/searches => searches}/detection_open_redirect_in_splunk_web.json (100%) rename {escu/searches => searches}/detection_osx_coldroot_pack.json (100%) rename {escu/searches => searches}/detection_osx_keyboard_taps.json (100%) rename {escu/searches => searches}/detection_outbound_smb_connections.json (100%) rename {escu/searches => searches}/detection_overwrite_accessibility_binaries.json (100%) rename {escu/searches => searches}/detection_password_sharing.json (100%) rename {escu/searches => searches}/detection_path_interception_program.exe.json (100%) rename {escu/searches => searches}/detection_port_monitor_via_registry.json (100%) rename {escu/searches => searches}/detection_powershell_get_sedebug.json (100%) rename {escu/searches => searches}/detection_powershell_read_from_lsass.json (100%) rename {escu/searches => searches}/detection_powershell_reg_key_mod.json (100%) rename {escu/searches => searches}/detection_process_launching_netsh.json (100%) rename {escu/searches => searches}/detection_process_with_double_extension.json (100%) rename {escu/searches => searches}/detection_process_with_spaces_before_extension.json (100%) rename {escu/searches => searches}/detection_prohibited_allowed_through_fw.json (100%) rename {escu/searches => searches}/detection_prohibited_apps_spawning_cmdprompt.json (100%) rename {escu/searches => searches}/detection_prohibited_software_on_endpoint.json (100%) rename {escu/searches => searches}/detection_protocol_mismatch.json (100%) rename {escu/searches => searches}/detection_protocols_authenticating_in_cleartext.json (100%) rename {escu/searches => searches}/detection_psexec_accepteula.json (100%) rename {escu/searches => searches}/detection_rare_executables_on_endpoint.json (100%) rename {escu/searches => searches}/detection_reg_manipulating_services.json (100%) rename {escu/searches => searches}/detection_reg_used_to_hide_files.json (100%) rename {escu/searches => searches}/detection_registry_persistence.json (100%) rename {escu/searches => searches}/detection_registry_privilege_escalation.json (100%) rename {escu/searches => searches}/detection_remote_desktop_bruteforce.json (100%) rename {escu/searches => searches}/detection_remote_desktop_network_traffic.json (100%) rename {escu/searches => searches}/detection_remote_desktop_process_running_on_system.json (100%) rename {escu/searches => searches}/detection_remote_registry_modifications.json (100%) rename {escu/searches => searches}/detection_remote_wmi_command_attempt.json (100%) rename {escu/searches => searches}/detection_remote_wmi_process_instantiation.json (100%) rename {escu/searches => searches}/detection_rundll_loading_dll_by_ordinal.json (100%) rename {escu/searches => searches}/detection_s3_access_from_new_ip.json (100%) rename {escu/searches => searches}/detection_samsam_payload_extensions.json (100%) rename {escu/searches => searches}/detection_samsam_test_file_write.json (100%) rename {escu/searches => searches}/detection_sc_manipulating_services.json (100%) rename {escu/searches => searches}/detection_schtasks_forced_reboot.json (100%) rename {escu/searches => searches}/detection_schtasks_scheduling_job_on_remote_system.json (100%) rename {escu/searches => searches}/detection_shim_database_file_creation.json (100%) rename {escu/searches => searches}/detection_shim_database_installation.json (100%) rename {escu/searches => searches}/detection_short_lived_accounts.json (100%) rename {escu/searches => searches}/detection_single_letter_executables.json (100%) rename {escu/searches => searches}/detection_smb_traffic_spike.json (100%) rename {escu/searches => searches}/detection_sncd_processes.json (100%) rename {escu/searches => searches}/detection_spectre_meltdown_vulnerabilities.json (100%) rename {escu/searches => searches}/detection_spike_aws_api_call_per_account.json (100%) rename {escu/searches => searches}/detection_spike_aws_security_group_activity.json (100%) rename {escu/searches => searches}/detection_spike_s3_deletion.json (100%) rename {escu/searches => searches}/detection_spike_vpc_blocked_traffic.json (100%) rename {escu/searches => searches}/detection_splunk_information_disclosure.json (100%) rename {escu/searches => searches}/detection_sql_injection_with_long_urls.json (100%) rename {escu/searches => searches}/detection_stop_security_services.json (100%) rename {escu/searches => searches}/detection_suspicious_email_attachments.json (100%) rename {escu/searches => searches}/detection_suspicious_file_writes.json (100%) rename {escu/searches => searches}/detection_suspicious_java_classes.json (100%) rename {escu/searches => searches}/detection_suspicious_reg_process.json (100%) rename {escu/searches => searches}/detection_suspicious_wevtutil_usage.json (100%) rename {escu/searches => searches}/detection_suspicious_write_to_recycler.json (100%) rename {escu/searches => searches}/detection_suspicious_write_to_sysvol.json (100%) rename {escu/searches => searches}/detection_system_processes_run_from_unexpected_locations.json (100%) rename {escu/searches => searches}/detection_tor_traffic.json (100%) rename {escu/searches => searches}/detection_unauthorized_assets_via_mac_address.json (100%) rename {escu/searches => searches}/detection_unauthorized_dns_servers.json (100%) rename {escu/searches => searches}/detection_uncommon_processes.json (100%) rename {escu/searches => searches}/detection_unusually_long_commandlines.json (100%) rename {escu/searches => searches}/detection_unusually_long_content-type_length.json (100%) rename {escu/searches => searches}/detection_usb_insertion.json (100%) rename {escu/searches => searches}/detection_users_without_mfa.json (100%) rename {escu/searches => searches}/detection_web_servers_executing_suspicious_processes.json (100%) rename {escu/searches => searches}/detection_windows_event_log_cleared.json (100%) rename {escu/searches => searches}/detection_wmi_perm_event_subscription.json (100%) rename {escu/searches => searches}/detection_wmi_perm_event_subscription_sysmon.json (100%) rename {escu/searches => searches}/detection_wmi_process_launch.json (100%) rename {escu/searches => searches}/detection_wmi_script_execution.json (100%) rename {escu/searches => searches}/detection_wmi_temp_event_subscription.json (100%) rename {escu/searches => searches}/investigative_aws_activity_via_region.json (100%) rename {escu/searches => searches}/investigative_aws_user_activities_by_user_field.json (100%) rename {escu/searches => searches}/investigative_aws_user_activity_by_accesskeyid.json (100%) rename {escu/searches => searches}/investigative_aws_user_activity_by_src_user.json (100%) rename {escu/searches => searches}/investigative_dns_server_history.json (100%) rename {escu/searches => searches}/investigative_dns_traffic_stats.json (100%) rename {escu/searches => searches}/investigative_email_sent_to_hidden_cobra_actors.json (100%) rename {escu/searches => searches}/investigative_get_all_aws_activitiy_from_city.json (100%) rename {escu/searches => searches}/investigative_get_all_aws_activitiy_from_country.json (100%) rename {escu/searches => searches}/investigative_get_all_aws_activitiy_from_region.json (100%) rename {escu/searches => searches}/investigative_get_all_aws_activitiy_from_src_ip.json (100%) rename {escu/searches => searches}/investigative_get_all_backup_data_for_host.json (100%) rename {escu/searches => searches}/investigative_get_email_info.json (100%) rename {escu/searches => searches}/investigative_get_emails_from_sender.json (100%) rename {escu/searches => searches}/investigative_get_emails_from_source.json (100%) rename {escu/searches => searches}/investigative_get_logon_rights_modifications_for_endpoint.json (100%) rename {escu/searches => searches}/investigative_get_logon_rights_modifications_for_user.json (100%) rename {escu/searches => searches}/investigative_get_network_traffic_from_src_ip.json (100%) rename {escu/searches => searches}/investigative_get_parent_process_info.json (100%) rename {escu/searches => searches}/investigative_get_process_creating_dns_traffic.json (100%) rename {escu/searches => searches}/investigative_get_process_info.json (100%) rename {escu/searches => searches}/investigative_get_process_info_for_port.json (100%) rename {escu/searches => searches}/investigative_get_rdp_authentications.json (100%) rename {escu/searches => searches}/investigative_get_registry_activities.json (100%) rename {escu/searches => searches}/investigative_get_web_activity.json (100%) rename {escu/searches => searches}/investigative_get_web_activity_by_src_ip.json (100%) rename {escu/searches => searches}/investigative_get_web_posts_by_src.json (100%) rename {escu/searches => searches}/investigative_get_web_session_info.json (100%) rename {escu/searches => searches}/investigative_get_wmi_sysmon_events.json (100%) rename {escu/searches => searches}/investigative_suspicious_strings_in_HTTP_header.json (100%) rename {escu/searches => searches}/investigative_user_activity_via_cloudtrail.json (100%) rename {escu/searches => searches}/support_add_prohibited_processes_to_es.json (100%) rename {escu/searches => searches}/support_approved_aws_service_accounts.json (100%) rename {escu/searches => searches}/support_assets_sorted_by_category.json (100%) rename {escu/searches => searches}/support_baseline_api_calls_per_user_arn.json (100%) rename {escu/searches => searches}/support_baseline_aws_regions.json (100%) rename {escu/searches => searches}/support_baseline_blocked_vpc_traffic.json (100%) rename {escu/searches => searches}/support_baseline_network_acl_modifications.json (100%) rename {escu/searches => searches}/support_baseline_s3_deletion_by_arn.json (100%) rename {escu/searches => searches}/support_baseline_security_group_activity_by_arn.json (100%) rename {escu/searches => searches}/support_brand_abuse_dnstwist_domains.json (100%) rename {escu/searches => searches}/support_discover_dns_records.json (100%) rename {escu/searches => searches}/support_identify_ports_on_network.json (100%) rename {escu/searches => searches}/support_identify_systems_creating_rdp_traffic.json (100%) rename {escu/searches => searches}/support_identify_systems_receiving_rdp_traffic.json (100%) rename {escu/searches => searches}/support_identify_systems_using_remote_desktop.json (100%) rename {escu/searches => searches}/support_monitor_successful_backups.json (100%) rename {escu/searches => searches}/support_monitor_successful_windows_updates.json (100%) rename {escu/searches => searches}/support_monitor_unsuccessful_backups.json (100%) rename {escu/searches => searches}/support_monitor_unsuccessful_windows_updates.json (100%) rename {escu/searches => searches}/support_previously_seen_aws_cross_account_activity.json (100%) rename {escu/searches => searches}/support_previously_seen_cmd_arguments.json (100%) rename {escu/searches => searches}/support_previously_seen_ec2_amis.json (100%) rename {escu/searches => searches}/support_previously_seen_ec2_instance_types.json (100%) rename {escu/searches => searches}/support_previously_seen_ec2_launches_by_user.json (100%) rename {escu/searches => searches}/support_previously_seen_ec2_modifications.json (100%) rename {escu/searches => searches}/support_previously_seen_provisioning_activity_src.json (100%) rename {escu/searches => searches}/support_previously_seen_s3_remote_ip.json (100%) rename {escu/searches => searches}/support_previously_seen_user_roles.json (100%) rename {escu/searches => searches}/support_previously_seen_users.json (100%) rename {escu/searches => searches}/support_previously_seen_windows_service_starts.json (100%) rename {escu/searches => searches}/support_systems_ready_for_spectre_meltdown_patch.json (100%) rename {escu/stories => stories}/.DS_Store (100%) rename {escu/stories => stories}/account_monitoring.json (100%) rename {escu/stories => stories}/apache_struts.json (100%) rename {escu/stories => stories}/asset_tracking.json (100%) rename {escu/stories => stories}/aws_cross_account_activity.json (100%) rename {escu/stories => stories}/aws_cryptomining.json (100%) rename {escu/stories => stories}/aws_ec2.json (100%) rename {escu/stories => stories}/aws_ec2_modifications.json (100%) rename {escu/stories => stories}/aws_network_acl.json (100%) rename {escu/stories => stories}/aws_provisioning.json (100%) rename {escu/stories => stories}/aws_s3.json (100%) rename {escu/stories => stories}/aws_suspcious_logins.json (100%) rename {escu/stories => stories}/aws_suspcious_traffic.json (100%) rename {escu/stories => stories}/aws_user_monitoring.json (100%) rename {escu/stories => stories}/brand_monitoring.json (100%) rename {escu/stories => stories}/coldroot.json (100%) rename {escu/stories => stories}/collection_and_staging.json (100%) rename {escu/stories => stories}/command_and_control.json (100%) rename {escu/stories => stories}/credential_dumping.json (100%) rename {escu/stories => stories}/data_protection.json (100%) rename {escu/stories => stories}/defense_evasion.json (100%) rename {escu/stories => stories}/detect_unauthorized_processes.json (100%) rename {escu/stories => stories}/dhs_report_TA18-074A.json (100%) rename {escu/stories => stories}/disable_security_tools.json (100%) rename {escu/stories => stories}/dns_amplification_attacks.json (100%) rename {escu/stories => stories}/dns_hijacking.json (100%) rename {escu/stories => stories}/dynamic_dns.json (100%) rename {escu/stories => stories}/emotet.json (100%) rename {escu/stories => stories}/file_extension_abuse.json (100%) rename {escu/stories => stories}/hidden_cobra_malware.json (100%) rename {escu/stories => stories}/host_redirection.json (100%) rename {escu/stories => stories}/jboss_vulnerabilities.json (100%) rename {escu/stories => stories}/lateral_movement.json (100%) rename {escu/stories => stories}/malicious_powershell.json (100%) rename {escu/stories => stories}/monitor_backups.json (100%) rename {escu/stories => stories}/monitor_for_updates.json (100%) rename {iDefense/stories => stories}/mudcarp.json (100%) rename {escu/stories => stories}/netsh_abuse.json (100%) rename {escu/stories => stories}/non-secure_communications.json (100%) rename {escu/stories => stories}/orangeworm.json (100%) rename {escu/stories => stories}/prohibited_traffic_and_protocol_mismatch.json (100%) rename {escu/stories => stories}/ransomware.json (100%) rename {escu/stories => stories}/routers_and_infrastructure.json (100%) rename {escu/stories => stories}/samsam.json (100%) rename {escu/stories => stories}/service_abuse.json (100%) rename {escu/stories => stories}/spectre_meltdown.json (100%) rename {escu/stories => stories}/splunk_information_disclosure.json (100%) rename {escu/stories => stories}/splunk_vulnerabilities.json (100%) rename {escu/stories => stories}/sql_injection.json (100%) rename {escu/stories => stories}/suspicious_cmd_line_executions.json (100%) rename {escu/stories => stories}/suspicious_dns_traffic.json (100%) rename {escu/stories => stories}/suspicious_emails.json (100%) rename {escu/stories => stories}/suspicious_event_log_activity.json (100%) rename {escu/stories => stories}/suspicious_mshta_activities.json (100%) rename {escu/stories => stories}/suspicious_windows_registry_activities.json (100%) rename {escu/stories => stories}/suspicious_wmi.json (100%) rename {escu/stories => stories}/unusual_processes.json (100%) rename {escu/stories => stories}/web_fraud.json (100%) rename {escu/stories => stories}/windows_persistence.json (100%) rename {escu/stories => stories}/windows_privilege_escalation.json (100%) diff --git a/escu/.DS_Store b/escu/.DS_Store deleted file mode 100644 index 8ea314cd788a0eee75684aec4e68d368dac942ae..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHK%Sr=55UkdK0WUdvoL|Tv3?cafe?T-IgusHU_dWSt`Lt9&5W~h(@FLaFT{FF1 zJ4_w6w*lDZbH4^w0G4z|e0i9gKX;$mO=XNo=R4l;ig7=_9G-_+_2q-z0V(jW6tKnial7G_s<+NA=e@SkpXgq5q`Pq)6ozQW#AwIdcsqWG cqO5Da=JQ@SB?g`OpcC~o;JV19z+WqH0! Date: Tue, 26 Mar 2019 13:22:34 -0400 Subject: [PATCH 05/74] removing ds store osx files --- .gitignore | 3 +++ stories/.DS_Store | Bin 6148 -> 0 bytes 2 files changed, 3 insertions(+) delete mode 100644 stories/.DS_Store diff --git a/.gitignore b/.gitignore index c3f77ce1a6..9ca157a05b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ +# usual mac files +.DS_Store + # Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] diff --git a/stories/.DS_Store b/stories/.DS_Store deleted file mode 100644 index 5008ddfcf53c02e82d7eee2e57c38e5672ef89f6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeH~Jr2S!425mzP>H1@V-^m;4Wg<&0T*E43hX&L&p$$qDprKhvt+--jT7}7np#A3 zem<@ulZcFPQ@L2!n>{z**++&mCkOWA81W14cNZlEfg7;MkzE(HCqgga^y>{tEnwC%0;vJ&^%eQ zLs35+`xjp>T0 Date: Tue, 26 Mar 2019 13:36:04 -0400 Subject: [PATCH 06/74] updated dirs and README --- README.md | 9 ++++++++- .../support_add_prohibited_processes_to_es.json | 0 .../support_approved_aws_service_accounts.json | 0 .../support_assets_sorted_by_category.json | 0 .../support_baseline_api_calls_per_user_arn.json | 0 .../support_baseline_aws_regions.json | 0 .../support_baseline_blocked_vpc_traffic.json | 0 .../support_baseline_network_acl_modifications.json | 0 .../support_baseline_s3_deletion_by_arn.json | 0 .../support_baseline_security_group_activity_by_arn.json | 0 .../support_brand_abuse_dnstwist_domains.json | 0 .../support_discover_dns_records.json | 0 .../support_identify_ports_on_network.json | 0 .../support_identify_systems_creating_rdp_traffic.json | 0 .../support_identify_systems_receiving_rdp_traffic.json | 0 .../support_identify_systems_using_remote_desktop.json | 0 .../support_monitor_successful_backups.json | 0 .../support_monitor_successful_windows_updates.json | 0 .../support_monitor_unsuccessful_backups.json | 0 .../support_monitor_unsuccessful_windows_updates.json | 0 ...pport_previously_seen_aws_cross_account_activity.json | 0 .../support_previously_seen_cmd_arguments.json | 0 .../support_previously_seen_ec2_amis.json | 0 .../support_previously_seen_ec2_instance_types.json | 0 .../support_previously_seen_ec2_launches_by_user.json | 0 .../support_previously_seen_ec2_modifications.json | 0 ...upport_previously_seen_provisioning_activity_src.json | 0 .../support_previously_seen_s3_remote_ip.json | 0 .../support_previously_seen_user_roles.json | 0 .../support_previously_seen_users.json | 0 .../support_previously_seen_windows_service_starts.json | 0 ...support_systems_ready_for_spectre_meltdown_patch.json | 0 bin/config.ini | 2 -- .../detection_abnormally_high_instance_termination.json | 0 .../detection_abnormally_high_instances_launched.json | 0 .../detection_account_harvesting.json | 0 .../detection_acl_with_open_ports.json | 0 .../detection_activity_related_to_pass_the_hash.json | 0 .../detection_add_to_untrust_cert_store.json | 0 .../detection_anomalous_webclick.json | 0 ...n_api_acitivity_from_previously_unseen_user_role.json | 0 ..._attackers_scanning_for_vulnerable_jboss_servers.json | 0 .../detection_attrib_to_hide_files.json | 0 ...etection_aws_activity_from_non_approved_accounts.json | 0 .../detection_aws_activity_in_new_region.json | 0 ...s_cloud_provisioning_from_previously_unseen_city.json | 0 ...loud_provisioning_from_previously_unseen_country.json | 0 ...aws_cloud_provisioning_from_previously_unseen_ip.json | 0 ...cloud_provisioning_from_previously_unseen_region.json | 0 ...tion_aws_cross_account_activity_from_new_account.json | 0 .../detection_aws_spike_acl_activity.json | 0 .../detection_badrabbit_schtasks.json | 0 .../detection_batch_file_write_system32.json | 0 {searches => detections}/detection_brand_abuse_dns.json | 0 .../detection_brand_abuse_email.json | 0 {searches => detections}/detection_brand_abuse_web.json | 0 .../detection_change_file_association.json | 0 .../detection_children_of_spoolsv.json | 0 ...ction_clients_connecting_to_multiple_dns_servers.json | 0 .../detection_common_ransomware_extensions.json | 0 .../detection_common_ransomware_notes.json | 0 .../detection_create_hidden_shares.json | 0 .../detection_create_local_admin_via_net.json | 0 .../detection_cred_dump_via_reg.json | 0 {searches => detections}/detection_cscript_via_cmd.json | 0 .../detection_delete_shadow_copies.json | 0 .../detection_deletion_network_acl.json | 0 .../detection_disable_remote_uac.json | 0 .../detection_dns_amplification_any_query.json | 0 ...on_dns_query_length_with_high_standard_deviation.json | 0 .../detection_dns_record_changed.json | 0 {searches => detections}/detection_dns_tunnelling.json | 0 .../detection_dragonfly_schtasks.json | 0 {searches => detections}/detection_dyn_dns_queries.json | 0 .../detection_dyn_dns_web_traffic.json | 0 ...n_ec2_instance_created_by_previously_unseen_user.json | 0 ..._ec2_instance_modified_by_previously_unseen_user.json | 0 ..._ec2_instance_started_with_previously_unseen_ami.json | 0 ...nce_started_with_previously_unseen_instance_type.json | 0 .../detection_email_attachments_with_spaces.json | 0 .../detection_email_files_not_in_outlook_directory.json | 0 ...mailserver_high_volume_outbound_traffic_to_hosts.json | 0 .../detection_excessive_dns_failures.json | 0 .../detection_excessive_lockouts_from_endpoint.json | 0 .../detection_excessive_user_account_lockouts.json | 0 .../detection_execution_of_nirsoft_tools.json | 0 .../detection_file_write_spikes.json | 0 .../detection_first_time_seen_cmd_line.json | 0 ...etection_first_time_seen_running_windows_service.json | 0 .../detection_fsutil_deleting_journals.json | 0 .../detection_hosts_file_modification.json | 0 ...g_high_volume_network_traffic_from_email_servers.json | 0 .../detection_large_icmp_outbound.json | 0 .../detection_local_admin_account_creation.json | 0 .../detection_long_dns_text_response.json | 0 ...tion_malicious_application_shimming_via_registry.json | 0 ...l_process_connect_to_internet_with_hidden_window.json | 0 ...ion_malicious_powershell_process_encoded_command.json | 0 ...etection_malicious_powershell_process_execpolicy.json | 0 ...powershell_process_multiple_suspicious_arguments.json | 0 ...icious_powershell_process_obfuscation_techniques.json | 0 ...tion_malicious_requests_to_exploit_jboss_servers.json | 0 .../detection_mshta_launching_scripts.json | 0 .../detection_netbackup_failed_backup.json | 0 .../detection_netbackup_no_backups_in_time_period.json | 0 .../detection_netsh_launching_process.json | 0 .../detection_new_aws_console_login_by_user.json | 0 .../detection_new_connections_to_routers.json | 0 .../detection_new_open_s3_buckets.json | 0 .../detection_new_user_accounts.json | 0 .../detection_no_win_updates_in_timeframe.json | 0 .../detection_open_redirect_in_splunk_web.json | 0 .../detection_osx_coldroot_pack.json | 0 .../detection_osx_keyboard_taps.json | 0 .../detection_outbound_smb_connections.json | 0 .../detection_overwrite_accessibility_binaries.json | 0 {searches => detections}/detection_password_sharing.json | 0 .../detection_path_interception_program.exe.json | 0 .../detection_port_monitor_via_registry.json | 0 .../detection_powershell_get_sedebug.json | 0 .../detection_powershell_read_from_lsass.json | 0 .../detection_powershell_reg_key_mod.json | 0 .../detection_process_launching_netsh.json | 0 .../detection_process_with_double_extension.json | 0 .../detection_process_with_spaces_before_extension.json | 0 .../detection_prohibited_allowed_through_fw.json | 0 .../detection_prohibited_apps_spawning_cmdprompt.json | 0 .../detection_prohibited_software_on_endpoint.json | 0 .../detection_protocol_mismatch.json | 0 .../detection_protocols_authenticating_in_cleartext.json | 0 .../detection_psexec_accepteula.json | 0 .../detection_rare_executables_on_endpoint.json | 0 .../detection_reg_manipulating_services.json | 0 .../detection_reg_used_to_hide_files.json | 0 .../detection_registry_persistence.json | 0 .../detection_registry_privilege_escalation.json | 0 .../detection_remote_desktop_bruteforce.json | 0 .../detection_remote_desktop_network_traffic.json | 0 ...tection_remote_desktop_process_running_on_system.json | 0 .../detection_remote_registry_modifications.json | 0 .../detection_remote_wmi_command_attempt.json | 0 .../detection_remote_wmi_process_instantiation.json | 0 .../detection_rundll_loading_dll_by_ordinal.json | 0 .../detection_s3_access_from_new_ip.json | 0 .../detection_samsam_payload_extensions.json | 0 .../detection_samsam_test_file_write.json | 0 .../detection_sc_manipulating_services.json | 0 .../detection_schtasks_forced_reboot.json | 0 ...tection_schtasks_scheduling_job_on_remote_system.json | 0 .../detection_shim_database_file_creation.json | 0 .../detection_shim_database_installation.json | 0 .../detection_short_lived_accounts.json | 0 .../detection_single_letter_executables.json | 0 .../detection_smb_traffic_spike.json | 0 {searches => detections}/detection_sncd_processes.json | 0 .../detection_spectre_meltdown_vulnerabilities.json | 0 .../detection_spike_aws_api_call_per_account.json | 0 .../detection_spike_aws_security_group_activity.json | 0 .../detection_spike_s3_deletion.json | 0 .../detection_spike_vpc_blocked_traffic.json | 0 .../detection_splunk_information_disclosure.json | 0 .../detection_sql_injection_with_long_urls.json | 0 .../detection_stop_security_services.json | 0 .../detection_suspicious_email_attachments.json | 0 .../detection_suspicious_file_writes.json | 0 .../detection_suspicious_java_classes.json | 0 .../detection_suspicious_reg_process.json | 0 .../detection_suspicious_wevtutil_usage.json | 0 .../detection_suspicious_write_to_recycler.json | 0 .../detection_suspicious_write_to_sysvol.json | 0 ...n_system_processes_run_from_unexpected_locations.json | 0 {searches => detections}/detection_tor_traffic.json | 0 .../detection_unauthorized_assets_via_mac_address.json | 0 .../detection_unauthorized_dns_servers.json | 0 .../detection_uncommon_processes.json | 0 .../detection_unusually_long_commandlines.json | 0 .../detection_unusually_long_content-type_length.json | 0 {searches => detections}/detection_usb_insertion.json | 0 .../detection_users_without_mfa.json | 0 ...ction_web_servers_executing_suspicious_processes.json | 0 .../detection_windows_event_log_cleared.json | 0 .../detection_wmi_perm_event_subscription.json | 0 .../detection_wmi_perm_event_subscription_sysmon.json | 0 .../detection_wmi_process_launch.json | 0 .../detection_wmi_script_execution.json | 0 .../detection_wmi_temp_event_subscription.json | 0 .../contextual_aws_network_interface_details.json | 0 .../contextual_aws_s3_bucket_details.json | 0 .../contextual_first_occurrence_mac_address.json | 0 .../contextual_get_acl_details.json | 0 .../contextual_get_authentication_logs_for_endpoint.json | 0 .../contextual_get_backup_logs_for_endpoint.json | 0 .../contextual_get_ec2_details_by_instance_id.json | 0 .../contextual_get_ec2_launch_details.json | 0 .../contextual_get_notable_history_for_endpoint.json | 0 .../contextual_get_notable_info.json | 0 .../contextual_get_risk_for_endpoint.json | 0 .../contextual_get_risk_for_user.json | 0 .../contextual_get_update_logs_for_endpoint.json | 0 .../contextual_get_user_info_from_identity_table.json | 0 .../contextual_get_vulnerability_logs_for_endpoint.json | 0 .../investigative_aws_activity_via_region.json | 0 .../investigative_aws_user_activities_by_user_field.json | 0 .../investigative_aws_user_activity_by_accesskeyid.json | 0 .../investigative_aws_user_activity_by_src_user.json | 0 .../investigative_dns_server_history.json | 0 .../investigative_dns_traffic_stats.json | 0 .../investigative_email_sent_to_hidden_cobra_actors.json | 0 .../investigative_get_all_aws_activitiy_from_city.json | 0 ...investigative_get_all_aws_activitiy_from_country.json | 0 .../investigative_get_all_aws_activitiy_from_region.json | 0 .../investigative_get_all_aws_activitiy_from_src_ip.json | 0 .../investigative_get_all_backup_data_for_host.json | 0 .../investigative_get_email_info.json | 0 .../investigative_get_emails_from_sender.json | 0 .../investigative_get_emails_from_source.json | 0 ...tive_get_logon_rights_modifications_for_endpoint.json | 0 ...tigative_get_logon_rights_modifications_for_user.json | 0 .../investigative_get_network_traffic_from_src_ip.json | 0 .../investigative_get_parent_process_info.json | 0 .../investigative_get_process_creating_dns_traffic.json | 0 .../investigative_get_process_info.json | 0 .../investigative_get_process_info_for_port.json | 0 .../investigative_get_rdp_authentications.json | 0 .../investigative_get_registry_activities.json | 0 .../investigative_get_web_activity.json | 0 .../investigative_get_web_activity_by_src_ip.json | 0 .../investigative_get_web_posts_by_src.json | 0 .../investigative_get_web_session_info.json | 0 .../investigative_get_wmi_sysmon_events.json | 0 .../investigative_suspicious_strings_in_HTTP_header.json | 0 .../investigative_user_activity_via_cloudtrail.json | 0 232 files changed, 8 insertions(+), 3 deletions(-) rename {searches => baselines}/support_add_prohibited_processes_to_es.json (100%) rename {searches => baselines}/support_approved_aws_service_accounts.json (100%) rename {searches => baselines}/support_assets_sorted_by_category.json (100%) rename {searches => baselines}/support_baseline_api_calls_per_user_arn.json (100%) rename {searches => baselines}/support_baseline_aws_regions.json (100%) rename {searches => baselines}/support_baseline_blocked_vpc_traffic.json (100%) rename {searches => baselines}/support_baseline_network_acl_modifications.json (100%) rename {searches => baselines}/support_baseline_s3_deletion_by_arn.json (100%) rename {searches => baselines}/support_baseline_security_group_activity_by_arn.json (100%) rename {searches => baselines}/support_brand_abuse_dnstwist_domains.json (100%) rename {searches => baselines}/support_discover_dns_records.json (100%) rename {searches => baselines}/support_identify_ports_on_network.json (100%) rename {searches => baselines}/support_identify_systems_creating_rdp_traffic.json (100%) rename {searches => baselines}/support_identify_systems_receiving_rdp_traffic.json (100%) rename {searches => baselines}/support_identify_systems_using_remote_desktop.json (100%) rename {searches => baselines}/support_monitor_successful_backups.json (100%) rename {searches => baselines}/support_monitor_successful_windows_updates.json (100%) rename {searches => baselines}/support_monitor_unsuccessful_backups.json (100%) rename {searches => baselines}/support_monitor_unsuccessful_windows_updates.json (100%) rename {searches => baselines}/support_previously_seen_aws_cross_account_activity.json (100%) rename {searches => baselines}/support_previously_seen_cmd_arguments.json (100%) rename {searches => baselines}/support_previously_seen_ec2_amis.json (100%) rename {searches => baselines}/support_previously_seen_ec2_instance_types.json (100%) rename {searches => baselines}/support_previously_seen_ec2_launches_by_user.json (100%) rename {searches => baselines}/support_previously_seen_ec2_modifications.json (100%) rename {searches => baselines}/support_previously_seen_provisioning_activity_src.json (100%) rename {searches => baselines}/support_previously_seen_s3_remote_ip.json (100%) rename {searches => baselines}/support_previously_seen_user_roles.json (100%) rename {searches => baselines}/support_previously_seen_users.json (100%) rename {searches => baselines}/support_previously_seen_windows_service_starts.json (100%) rename {searches => baselines}/support_systems_ready_for_spectre_meltdown_patch.json (100%) delete mode 100644 bin/config.ini rename {searches => detections}/detection_abnormally_high_instance_termination.json (100%) rename {searches => detections}/detection_abnormally_high_instances_launched.json (100%) rename {searches => detections}/detection_account_harvesting.json (100%) rename {searches => detections}/detection_acl_with_open_ports.json (100%) rename {searches => detections}/detection_activity_related_to_pass_the_hash.json (100%) rename {searches => detections}/detection_add_to_untrust_cert_store.json (100%) rename {searches => detections}/detection_anomalous_webclick.json (100%) rename {searches => detections}/detection_api_acitivity_from_previously_unseen_user_role.json (100%) rename {searches => detections}/detection_attackers_scanning_for_vulnerable_jboss_servers.json (100%) rename {searches => detections}/detection_attrib_to_hide_files.json (100%) rename {searches => detections}/detection_aws_activity_from_non_approved_accounts.json (100%) rename {searches => detections}/detection_aws_activity_in_new_region.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_city.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_country.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_ip.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_region.json (100%) rename {searches => detections}/detection_aws_cross_account_activity_from_new_account.json (100%) rename {searches => detections}/detection_aws_spike_acl_activity.json (100%) rename {searches => detections}/detection_badrabbit_schtasks.json (100%) rename {searches => detections}/detection_batch_file_write_system32.json (100%) rename {searches => detections}/detection_brand_abuse_dns.json (100%) rename {searches => detections}/detection_brand_abuse_email.json (100%) rename {searches => detections}/detection_brand_abuse_web.json (100%) rename {searches => detections}/detection_change_file_association.json (100%) rename {searches => detections}/detection_children_of_spoolsv.json (100%) rename {searches => detections}/detection_clients_connecting_to_multiple_dns_servers.json (100%) rename {searches => detections}/detection_common_ransomware_extensions.json (100%) rename {searches => detections}/detection_common_ransomware_notes.json (100%) rename {searches => detections}/detection_create_hidden_shares.json (100%) rename {searches => detections}/detection_create_local_admin_via_net.json (100%) rename {searches => detections}/detection_cred_dump_via_reg.json (100%) rename {searches => detections}/detection_cscript_via_cmd.json (100%) rename {searches => detections}/detection_delete_shadow_copies.json (100%) rename {searches => detections}/detection_deletion_network_acl.json (100%) rename {searches => detections}/detection_disable_remote_uac.json (100%) rename {searches => detections}/detection_dns_amplification_any_query.json (100%) rename {searches => detections}/detection_dns_query_length_with_high_standard_deviation.json (100%) rename {searches => detections}/detection_dns_record_changed.json (100%) rename {searches => detections}/detection_dns_tunnelling.json (100%) rename {searches => detections}/detection_dragonfly_schtasks.json (100%) rename {searches => detections}/detection_dyn_dns_queries.json (100%) rename {searches => detections}/detection_dyn_dns_web_traffic.json (100%) rename {searches => detections}/detection_ec2_instance_created_by_previously_unseen_user.json (100%) rename {searches => detections}/detection_ec2_instance_modified_by_previously_unseen_user.json (100%) rename {searches => detections}/detection_ec2_instance_started_with_previously_unseen_ami.json (100%) rename {searches => detections}/detection_ec2_instance_started_with_previously_unseen_instance_type.json (100%) rename {searches => detections}/detection_email_attachments_with_spaces.json (100%) rename {searches => detections}/detection_email_files_not_in_outlook_directory.json (100%) rename {searches => detections}/detection_emailserver_high_volume_outbound_traffic_to_hosts.json (100%) rename {searches => detections}/detection_excessive_dns_failures.json (100%) rename {searches => detections}/detection_excessive_lockouts_from_endpoint.json (100%) rename {searches => detections}/detection_excessive_user_account_lockouts.json (100%) rename {searches => detections}/detection_execution_of_nirsoft_tools.json (100%) rename {searches => detections}/detection_file_write_spikes.json (100%) rename {searches => detections}/detection_first_time_seen_cmd_line.json (100%) rename {searches => detections}/detection_first_time_seen_running_windows_service.json (100%) rename {searches => detections}/detection_fsutil_deleting_journals.json (100%) rename {searches => detections}/detection_hosts_file_modification.json (100%) rename {searches => detections}/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json (100%) rename {searches => detections}/detection_large_icmp_outbound.json (100%) rename {searches => detections}/detection_local_admin_account_creation.json (100%) rename {searches => detections}/detection_long_dns_text_response.json (100%) rename {searches => detections}/detection_malicious_application_shimming_via_registry.json (100%) rename {searches => detections}/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json (100%) rename {searches => detections}/detection_malicious_powershell_process_encoded_command.json (100%) rename {searches => detections}/detection_malicious_powershell_process_execpolicy.json (100%) rename {searches => detections}/detection_malicious_powershell_process_multiple_suspicious_arguments.json (100%) rename {searches => detections}/detection_malicious_powershell_process_obfuscation_techniques.json (100%) rename {searches => detections}/detection_malicious_requests_to_exploit_jboss_servers.json (100%) rename {searches => detections}/detection_mshta_launching_scripts.json (100%) rename {searches => detections}/detection_netbackup_failed_backup.json (100%) rename {searches => detections}/detection_netbackup_no_backups_in_time_period.json (100%) rename {searches => detections}/detection_netsh_launching_process.json (100%) rename {searches => detections}/detection_new_aws_console_login_by_user.json (100%) rename {searches => detections}/detection_new_connections_to_routers.json (100%) rename {searches => detections}/detection_new_open_s3_buckets.json (100%) rename {searches => detections}/detection_new_user_accounts.json (100%) rename {searches => detections}/detection_no_win_updates_in_timeframe.json (100%) rename {searches => detections}/detection_open_redirect_in_splunk_web.json (100%) rename {searches => detections}/detection_osx_coldroot_pack.json (100%) rename {searches => detections}/detection_osx_keyboard_taps.json (100%) rename {searches => detections}/detection_outbound_smb_connections.json (100%) rename {searches => detections}/detection_overwrite_accessibility_binaries.json (100%) rename {searches => detections}/detection_password_sharing.json (100%) rename {searches => detections}/detection_path_interception_program.exe.json (100%) rename {searches => detections}/detection_port_monitor_via_registry.json (100%) rename {searches => detections}/detection_powershell_get_sedebug.json (100%) rename {searches => detections}/detection_powershell_read_from_lsass.json (100%) rename {searches => detections}/detection_powershell_reg_key_mod.json (100%) rename {searches => detections}/detection_process_launching_netsh.json (100%) rename {searches => detections}/detection_process_with_double_extension.json (100%) rename {searches => detections}/detection_process_with_spaces_before_extension.json (100%) rename {searches => detections}/detection_prohibited_allowed_through_fw.json (100%) rename {searches => detections}/detection_prohibited_apps_spawning_cmdprompt.json (100%) rename {searches => detections}/detection_prohibited_software_on_endpoint.json (100%) rename {searches => detections}/detection_protocol_mismatch.json (100%) rename {searches => detections}/detection_protocols_authenticating_in_cleartext.json (100%) rename {searches => detections}/detection_psexec_accepteula.json (100%) rename {searches => detections}/detection_rare_executables_on_endpoint.json (100%) rename {searches => detections}/detection_reg_manipulating_services.json (100%) rename {searches => detections}/detection_reg_used_to_hide_files.json (100%) rename {searches => detections}/detection_registry_persistence.json (100%) rename {searches => detections}/detection_registry_privilege_escalation.json (100%) rename {searches => detections}/detection_remote_desktop_bruteforce.json (100%) rename {searches => detections}/detection_remote_desktop_network_traffic.json (100%) rename {searches => detections}/detection_remote_desktop_process_running_on_system.json (100%) rename {searches => detections}/detection_remote_registry_modifications.json (100%) rename {searches => detections}/detection_remote_wmi_command_attempt.json (100%) rename {searches => detections}/detection_remote_wmi_process_instantiation.json (100%) rename {searches => detections}/detection_rundll_loading_dll_by_ordinal.json (100%) rename {searches => detections}/detection_s3_access_from_new_ip.json (100%) rename {searches => detections}/detection_samsam_payload_extensions.json (100%) rename {searches => detections}/detection_samsam_test_file_write.json (100%) rename {searches => detections}/detection_sc_manipulating_services.json (100%) rename {searches => detections}/detection_schtasks_forced_reboot.json (100%) rename {searches => detections}/detection_schtasks_scheduling_job_on_remote_system.json (100%) rename {searches => detections}/detection_shim_database_file_creation.json (100%) rename {searches => detections}/detection_shim_database_installation.json (100%) rename {searches => detections}/detection_short_lived_accounts.json (100%) rename {searches => detections}/detection_single_letter_executables.json (100%) rename {searches => detections}/detection_smb_traffic_spike.json (100%) rename {searches => detections}/detection_sncd_processes.json (100%) rename {searches => detections}/detection_spectre_meltdown_vulnerabilities.json (100%) rename {searches => detections}/detection_spike_aws_api_call_per_account.json (100%) rename {searches => detections}/detection_spike_aws_security_group_activity.json (100%) rename {searches => detections}/detection_spike_s3_deletion.json (100%) rename {searches => detections}/detection_spike_vpc_blocked_traffic.json (100%) rename {searches => detections}/detection_splunk_information_disclosure.json (100%) rename {searches => detections}/detection_sql_injection_with_long_urls.json (100%) rename {searches => detections}/detection_stop_security_services.json (100%) rename {searches => detections}/detection_suspicious_email_attachments.json (100%) rename {searches => detections}/detection_suspicious_file_writes.json (100%) rename {searches => detections}/detection_suspicious_java_classes.json (100%) rename {searches => detections}/detection_suspicious_reg_process.json (100%) rename {searches => detections}/detection_suspicious_wevtutil_usage.json (100%) rename {searches => detections}/detection_suspicious_write_to_recycler.json (100%) rename {searches => detections}/detection_suspicious_write_to_sysvol.json (100%) rename {searches => detections}/detection_system_processes_run_from_unexpected_locations.json (100%) rename {searches => detections}/detection_tor_traffic.json (100%) rename {searches => detections}/detection_unauthorized_assets_via_mac_address.json (100%) rename {searches => detections}/detection_unauthorized_dns_servers.json (100%) rename {searches => detections}/detection_uncommon_processes.json (100%) rename {searches => detections}/detection_unusually_long_commandlines.json (100%) rename {searches => detections}/detection_unusually_long_content-type_length.json (100%) rename {searches => detections}/detection_usb_insertion.json (100%) rename {searches => detections}/detection_users_without_mfa.json (100%) rename {searches => detections}/detection_web_servers_executing_suspicious_processes.json (100%) rename {searches => detections}/detection_windows_event_log_cleared.json (100%) rename {searches => detections}/detection_wmi_perm_event_subscription.json (100%) rename {searches => detections}/detection_wmi_perm_event_subscription_sysmon.json (100%) rename {searches => detections}/detection_wmi_process_launch.json (100%) rename {searches => detections}/detection_wmi_script_execution.json (100%) rename {searches => detections}/detection_wmi_temp_event_subscription.json (100%) rename {searches => investigations}/contextual_aws_network_interface_details.json (100%) rename {searches => investigations}/contextual_aws_s3_bucket_details.json (100%) rename {searches => investigations}/contextual_first_occurrence_mac_address.json (100%) rename {searches => investigations}/contextual_get_acl_details.json (100%) rename {searches => investigations}/contextual_get_authentication_logs_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_backup_logs_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_ec2_details_by_instance_id.json (100%) rename {searches => investigations}/contextual_get_ec2_launch_details.json (100%) rename {searches => investigations}/contextual_get_notable_history_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_notable_info.json (100%) rename {searches => investigations}/contextual_get_risk_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_risk_for_user.json (100%) rename {searches => investigations}/contextual_get_update_logs_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_user_info_from_identity_table.json (100%) rename {searches => investigations}/contextual_get_vulnerability_logs_for_endpoint.json (100%) rename {searches => investigations}/investigative_aws_activity_via_region.json (100%) rename {searches => investigations}/investigative_aws_user_activities_by_user_field.json (100%) rename {searches => investigations}/investigative_aws_user_activity_by_accesskeyid.json (100%) rename {searches => investigations}/investigative_aws_user_activity_by_src_user.json (100%) rename {searches => investigations}/investigative_dns_server_history.json (100%) rename {searches => investigations}/investigative_dns_traffic_stats.json (100%) rename {searches => investigations}/investigative_email_sent_to_hidden_cobra_actors.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_city.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_country.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_region.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_src_ip.json (100%) rename {searches => investigations}/investigative_get_all_backup_data_for_host.json (100%) rename {searches => investigations}/investigative_get_email_info.json (100%) rename {searches => investigations}/investigative_get_emails_from_sender.json (100%) rename {searches => investigations}/investigative_get_emails_from_source.json (100%) rename {searches => investigations}/investigative_get_logon_rights_modifications_for_endpoint.json (100%) rename {searches => investigations}/investigative_get_logon_rights_modifications_for_user.json (100%) rename {searches => investigations}/investigative_get_network_traffic_from_src_ip.json (100%) rename {searches => investigations}/investigative_get_parent_process_info.json (100%) rename {searches => investigations}/investigative_get_process_creating_dns_traffic.json (100%) rename {searches => investigations}/investigative_get_process_info.json (100%) rename {searches => investigations}/investigative_get_process_info_for_port.json (100%) rename {searches => investigations}/investigative_get_rdp_authentications.json (100%) rename {searches => investigations}/investigative_get_registry_activities.json (100%) rename {searches => investigations}/investigative_get_web_activity.json (100%) rename {searches => investigations}/investigative_get_web_activity_by_src_ip.json (100%) rename {searches => investigations}/investigative_get_web_posts_by_src.json (100%) rename {searches => investigations}/investigative_get_web_session_info.json (100%) rename {searches => investigations}/investigative_get_wmi_sysmon_events.json (100%) rename {searches => investigations}/investigative_suspicious_strings_in_HTTP_header.json (100%) rename {searches => investigations}/investigative_user_activity_via_cloudtrail.json (100%) diff --git a/README.md b/README.md index d72b2d933e..fc768b5e23 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,14 @@ Can be consumed using: * CLI # Structure -`src/` - splunk content app source files, includes lookups, binaries, and defaul config files +[stories/](stories/) - contains all analytics stories/use cases for ESCU +[detections/](detections/) - splunk, uba and phantom detections that power stories +[investigations/](investigations/) - splunk, and phantom investigation content that are used in stories +[responses/](responses/) - automated splunk and phantom responses that are used in stories +[baselines/](baselines/) - phantom and Splunk baseline needed to support detections in stories +[src/](src/) - splunk content app source files, includes lookups, binaries, and defaul config files +[bin/](bin/) - where all binaries to produce, and test content lives +[spec/](spec/) - location of all spec files that describe ESCU content # Developing diff --git a/searches/support_add_prohibited_processes_to_es.json b/baselines/support_add_prohibited_processes_to_es.json similarity index 100% rename from searches/support_add_prohibited_processes_to_es.json rename to baselines/support_add_prohibited_processes_to_es.json diff --git a/searches/support_approved_aws_service_accounts.json b/baselines/support_approved_aws_service_accounts.json similarity index 100% rename from searches/support_approved_aws_service_accounts.json rename to baselines/support_approved_aws_service_accounts.json diff --git a/searches/support_assets_sorted_by_category.json b/baselines/support_assets_sorted_by_category.json similarity index 100% rename from searches/support_assets_sorted_by_category.json rename to baselines/support_assets_sorted_by_category.json diff --git a/searches/support_baseline_api_calls_per_user_arn.json b/baselines/support_baseline_api_calls_per_user_arn.json similarity index 100% rename from searches/support_baseline_api_calls_per_user_arn.json rename to baselines/support_baseline_api_calls_per_user_arn.json diff --git a/searches/support_baseline_aws_regions.json b/baselines/support_baseline_aws_regions.json similarity index 100% rename from searches/support_baseline_aws_regions.json rename to baselines/support_baseline_aws_regions.json diff --git a/searches/support_baseline_blocked_vpc_traffic.json b/baselines/support_baseline_blocked_vpc_traffic.json similarity index 100% rename from searches/support_baseline_blocked_vpc_traffic.json rename to baselines/support_baseline_blocked_vpc_traffic.json diff --git a/searches/support_baseline_network_acl_modifications.json b/baselines/support_baseline_network_acl_modifications.json similarity index 100% rename from searches/support_baseline_network_acl_modifications.json rename to baselines/support_baseline_network_acl_modifications.json diff --git a/searches/support_baseline_s3_deletion_by_arn.json b/baselines/support_baseline_s3_deletion_by_arn.json similarity index 100% rename from searches/support_baseline_s3_deletion_by_arn.json rename to baselines/support_baseline_s3_deletion_by_arn.json diff --git a/searches/support_baseline_security_group_activity_by_arn.json b/baselines/support_baseline_security_group_activity_by_arn.json similarity index 100% rename from searches/support_baseline_security_group_activity_by_arn.json rename to baselines/support_baseline_security_group_activity_by_arn.json diff --git a/searches/support_brand_abuse_dnstwist_domains.json b/baselines/support_brand_abuse_dnstwist_domains.json similarity index 100% rename from searches/support_brand_abuse_dnstwist_domains.json rename to baselines/support_brand_abuse_dnstwist_domains.json diff --git a/searches/support_discover_dns_records.json b/baselines/support_discover_dns_records.json similarity index 100% rename from searches/support_discover_dns_records.json rename to baselines/support_discover_dns_records.json diff --git a/searches/support_identify_ports_on_network.json b/baselines/support_identify_ports_on_network.json similarity index 100% rename from searches/support_identify_ports_on_network.json rename to baselines/support_identify_ports_on_network.json diff --git a/searches/support_identify_systems_creating_rdp_traffic.json b/baselines/support_identify_systems_creating_rdp_traffic.json similarity index 100% rename from searches/support_identify_systems_creating_rdp_traffic.json rename to baselines/support_identify_systems_creating_rdp_traffic.json diff --git a/searches/support_identify_systems_receiving_rdp_traffic.json b/baselines/support_identify_systems_receiving_rdp_traffic.json similarity index 100% rename from searches/support_identify_systems_receiving_rdp_traffic.json rename to baselines/support_identify_systems_receiving_rdp_traffic.json diff --git a/searches/support_identify_systems_using_remote_desktop.json b/baselines/support_identify_systems_using_remote_desktop.json similarity index 100% rename from searches/support_identify_systems_using_remote_desktop.json rename to baselines/support_identify_systems_using_remote_desktop.json diff --git a/searches/support_monitor_successful_backups.json b/baselines/support_monitor_successful_backups.json similarity index 100% rename from searches/support_monitor_successful_backups.json rename to baselines/support_monitor_successful_backups.json diff --git a/searches/support_monitor_successful_windows_updates.json b/baselines/support_monitor_successful_windows_updates.json similarity index 100% rename from searches/support_monitor_successful_windows_updates.json rename to baselines/support_monitor_successful_windows_updates.json diff --git a/searches/support_monitor_unsuccessful_backups.json b/baselines/support_monitor_unsuccessful_backups.json similarity index 100% rename from searches/support_monitor_unsuccessful_backups.json rename to baselines/support_monitor_unsuccessful_backups.json diff --git a/searches/support_monitor_unsuccessful_windows_updates.json b/baselines/support_monitor_unsuccessful_windows_updates.json similarity index 100% rename from searches/support_monitor_unsuccessful_windows_updates.json rename to baselines/support_monitor_unsuccessful_windows_updates.json diff --git a/searches/support_previously_seen_aws_cross_account_activity.json b/baselines/support_previously_seen_aws_cross_account_activity.json similarity index 100% rename from searches/support_previously_seen_aws_cross_account_activity.json rename to baselines/support_previously_seen_aws_cross_account_activity.json diff --git a/searches/support_previously_seen_cmd_arguments.json b/baselines/support_previously_seen_cmd_arguments.json similarity index 100% rename from searches/support_previously_seen_cmd_arguments.json rename to baselines/support_previously_seen_cmd_arguments.json diff --git a/searches/support_previously_seen_ec2_amis.json b/baselines/support_previously_seen_ec2_amis.json similarity index 100% rename from searches/support_previously_seen_ec2_amis.json rename to baselines/support_previously_seen_ec2_amis.json diff --git a/searches/support_previously_seen_ec2_instance_types.json b/baselines/support_previously_seen_ec2_instance_types.json similarity index 100% rename from searches/support_previously_seen_ec2_instance_types.json rename to baselines/support_previously_seen_ec2_instance_types.json diff --git a/searches/support_previously_seen_ec2_launches_by_user.json b/baselines/support_previously_seen_ec2_launches_by_user.json similarity index 100% rename from searches/support_previously_seen_ec2_launches_by_user.json rename to baselines/support_previously_seen_ec2_launches_by_user.json diff --git a/searches/support_previously_seen_ec2_modifications.json b/baselines/support_previously_seen_ec2_modifications.json similarity index 100% rename from searches/support_previously_seen_ec2_modifications.json rename to baselines/support_previously_seen_ec2_modifications.json diff --git a/searches/support_previously_seen_provisioning_activity_src.json b/baselines/support_previously_seen_provisioning_activity_src.json similarity index 100% rename from searches/support_previously_seen_provisioning_activity_src.json rename to baselines/support_previously_seen_provisioning_activity_src.json diff --git a/searches/support_previously_seen_s3_remote_ip.json b/baselines/support_previously_seen_s3_remote_ip.json similarity index 100% rename from searches/support_previously_seen_s3_remote_ip.json rename to baselines/support_previously_seen_s3_remote_ip.json diff --git a/searches/support_previously_seen_user_roles.json b/baselines/support_previously_seen_user_roles.json similarity index 100% rename from searches/support_previously_seen_user_roles.json rename to baselines/support_previously_seen_user_roles.json diff --git a/searches/support_previously_seen_users.json b/baselines/support_previously_seen_users.json similarity index 100% rename from searches/support_previously_seen_users.json rename to baselines/support_previously_seen_users.json diff --git a/searches/support_previously_seen_windows_service_starts.json b/baselines/support_previously_seen_windows_service_starts.json similarity index 100% rename from searches/support_previously_seen_windows_service_starts.json rename to baselines/support_previously_seen_windows_service_starts.json diff --git a/searches/support_systems_ready_for_spectre_meltdown_patch.json b/baselines/support_systems_ready_for_spectre_meltdown_patch.json similarity index 100% rename from searches/support_systems_ready_for_spectre_meltdown_patch.json rename to baselines/support_systems_ready_for_spectre_meltdown_patch.json diff --git a/bin/config.ini b/bin/config.ini deleted file mode 100644 index 894a621d2f..0000000000 --- a/bin/config.ini +++ /dev/null @@ -1,2 +0,0 @@ -[confluence] -url=https://confluence.splunk.com diff --git a/searches/detection_abnormally_high_instance_termination.json b/detections/detection_abnormally_high_instance_termination.json similarity index 100% rename from searches/detection_abnormally_high_instance_termination.json rename to detections/detection_abnormally_high_instance_termination.json diff --git a/searches/detection_abnormally_high_instances_launched.json b/detections/detection_abnormally_high_instances_launched.json similarity index 100% rename from searches/detection_abnormally_high_instances_launched.json rename to detections/detection_abnormally_high_instances_launched.json diff --git a/searches/detection_account_harvesting.json b/detections/detection_account_harvesting.json similarity index 100% rename from searches/detection_account_harvesting.json rename to detections/detection_account_harvesting.json diff --git a/searches/detection_acl_with_open_ports.json b/detections/detection_acl_with_open_ports.json similarity index 100% rename from searches/detection_acl_with_open_ports.json rename to detections/detection_acl_with_open_ports.json diff --git a/searches/detection_activity_related_to_pass_the_hash.json b/detections/detection_activity_related_to_pass_the_hash.json similarity index 100% rename from searches/detection_activity_related_to_pass_the_hash.json rename to detections/detection_activity_related_to_pass_the_hash.json diff --git a/searches/detection_add_to_untrust_cert_store.json b/detections/detection_add_to_untrust_cert_store.json similarity index 100% rename from searches/detection_add_to_untrust_cert_store.json rename to detections/detection_add_to_untrust_cert_store.json diff --git a/searches/detection_anomalous_webclick.json b/detections/detection_anomalous_webclick.json similarity index 100% rename from searches/detection_anomalous_webclick.json rename to detections/detection_anomalous_webclick.json diff --git a/searches/detection_api_acitivity_from_previously_unseen_user_role.json b/detections/detection_api_acitivity_from_previously_unseen_user_role.json similarity index 100% rename from searches/detection_api_acitivity_from_previously_unseen_user_role.json rename to detections/detection_api_acitivity_from_previously_unseen_user_role.json diff --git a/searches/detection_attackers_scanning_for_vulnerable_jboss_servers.json b/detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json similarity index 100% rename from searches/detection_attackers_scanning_for_vulnerable_jboss_servers.json rename to detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json diff --git a/searches/detection_attrib_to_hide_files.json b/detections/detection_attrib_to_hide_files.json similarity index 100% rename from searches/detection_attrib_to_hide_files.json rename to detections/detection_attrib_to_hide_files.json diff --git a/searches/detection_aws_activity_from_non_approved_accounts.json b/detections/detection_aws_activity_from_non_approved_accounts.json similarity index 100% rename from searches/detection_aws_activity_from_non_approved_accounts.json rename to detections/detection_aws_activity_from_non_approved_accounts.json diff --git a/searches/detection_aws_activity_in_new_region.json b/detections/detection_aws_activity_in_new_region.json similarity index 100% rename from searches/detection_aws_activity_in_new_region.json rename to detections/detection_aws_activity_in_new_region.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_city.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_city.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_country.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_country.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_ip.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_ip.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_region.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_region.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json diff --git a/searches/detection_aws_cross_account_activity_from_new_account.json b/detections/detection_aws_cross_account_activity_from_new_account.json similarity index 100% rename from searches/detection_aws_cross_account_activity_from_new_account.json rename to detections/detection_aws_cross_account_activity_from_new_account.json diff --git a/searches/detection_aws_spike_acl_activity.json b/detections/detection_aws_spike_acl_activity.json similarity index 100% rename from searches/detection_aws_spike_acl_activity.json rename to detections/detection_aws_spike_acl_activity.json diff --git a/searches/detection_badrabbit_schtasks.json b/detections/detection_badrabbit_schtasks.json similarity index 100% rename from searches/detection_badrabbit_schtasks.json rename to detections/detection_badrabbit_schtasks.json diff --git a/searches/detection_batch_file_write_system32.json b/detections/detection_batch_file_write_system32.json similarity index 100% rename from searches/detection_batch_file_write_system32.json rename to detections/detection_batch_file_write_system32.json diff --git a/searches/detection_brand_abuse_dns.json b/detections/detection_brand_abuse_dns.json similarity index 100% rename from searches/detection_brand_abuse_dns.json rename to detections/detection_brand_abuse_dns.json diff --git a/searches/detection_brand_abuse_email.json b/detections/detection_brand_abuse_email.json similarity index 100% rename from searches/detection_brand_abuse_email.json rename to detections/detection_brand_abuse_email.json diff --git a/searches/detection_brand_abuse_web.json b/detections/detection_brand_abuse_web.json similarity index 100% rename from searches/detection_brand_abuse_web.json rename to detections/detection_brand_abuse_web.json diff --git a/searches/detection_change_file_association.json b/detections/detection_change_file_association.json similarity index 100% rename from searches/detection_change_file_association.json rename to detections/detection_change_file_association.json diff --git a/searches/detection_children_of_spoolsv.json b/detections/detection_children_of_spoolsv.json similarity index 100% rename from searches/detection_children_of_spoolsv.json rename to detections/detection_children_of_spoolsv.json diff --git a/searches/detection_clients_connecting_to_multiple_dns_servers.json b/detections/detection_clients_connecting_to_multiple_dns_servers.json similarity index 100% rename from searches/detection_clients_connecting_to_multiple_dns_servers.json rename to detections/detection_clients_connecting_to_multiple_dns_servers.json diff --git a/searches/detection_common_ransomware_extensions.json b/detections/detection_common_ransomware_extensions.json similarity index 100% rename from searches/detection_common_ransomware_extensions.json rename to detections/detection_common_ransomware_extensions.json diff --git a/searches/detection_common_ransomware_notes.json b/detections/detection_common_ransomware_notes.json similarity index 100% rename from searches/detection_common_ransomware_notes.json rename to detections/detection_common_ransomware_notes.json diff --git a/searches/detection_create_hidden_shares.json b/detections/detection_create_hidden_shares.json similarity index 100% rename from searches/detection_create_hidden_shares.json rename to detections/detection_create_hidden_shares.json diff --git a/searches/detection_create_local_admin_via_net.json b/detections/detection_create_local_admin_via_net.json similarity index 100% rename from searches/detection_create_local_admin_via_net.json rename to detections/detection_create_local_admin_via_net.json diff --git a/searches/detection_cred_dump_via_reg.json b/detections/detection_cred_dump_via_reg.json similarity index 100% rename from searches/detection_cred_dump_via_reg.json rename to detections/detection_cred_dump_via_reg.json diff --git a/searches/detection_cscript_via_cmd.json b/detections/detection_cscript_via_cmd.json similarity index 100% rename from searches/detection_cscript_via_cmd.json rename to detections/detection_cscript_via_cmd.json diff --git a/searches/detection_delete_shadow_copies.json b/detections/detection_delete_shadow_copies.json similarity index 100% rename from searches/detection_delete_shadow_copies.json rename to detections/detection_delete_shadow_copies.json diff --git a/searches/detection_deletion_network_acl.json b/detections/detection_deletion_network_acl.json similarity index 100% rename from searches/detection_deletion_network_acl.json rename to detections/detection_deletion_network_acl.json diff --git a/searches/detection_disable_remote_uac.json b/detections/detection_disable_remote_uac.json similarity index 100% rename from searches/detection_disable_remote_uac.json rename to detections/detection_disable_remote_uac.json diff --git a/searches/detection_dns_amplification_any_query.json b/detections/detection_dns_amplification_any_query.json similarity index 100% rename from searches/detection_dns_amplification_any_query.json rename to detections/detection_dns_amplification_any_query.json diff --git a/searches/detection_dns_query_length_with_high_standard_deviation.json b/detections/detection_dns_query_length_with_high_standard_deviation.json similarity index 100% rename from searches/detection_dns_query_length_with_high_standard_deviation.json rename to detections/detection_dns_query_length_with_high_standard_deviation.json diff --git a/searches/detection_dns_record_changed.json b/detections/detection_dns_record_changed.json similarity index 100% rename from searches/detection_dns_record_changed.json rename to detections/detection_dns_record_changed.json diff --git a/searches/detection_dns_tunnelling.json b/detections/detection_dns_tunnelling.json similarity index 100% rename from searches/detection_dns_tunnelling.json rename to detections/detection_dns_tunnelling.json diff --git a/searches/detection_dragonfly_schtasks.json b/detections/detection_dragonfly_schtasks.json similarity index 100% rename from searches/detection_dragonfly_schtasks.json rename to detections/detection_dragonfly_schtasks.json diff --git a/searches/detection_dyn_dns_queries.json b/detections/detection_dyn_dns_queries.json similarity index 100% rename from searches/detection_dyn_dns_queries.json rename to detections/detection_dyn_dns_queries.json diff --git a/searches/detection_dyn_dns_web_traffic.json b/detections/detection_dyn_dns_web_traffic.json similarity index 100% rename from searches/detection_dyn_dns_web_traffic.json rename to detections/detection_dyn_dns_web_traffic.json diff --git a/searches/detection_ec2_instance_created_by_previously_unseen_user.json b/detections/detection_ec2_instance_created_by_previously_unseen_user.json similarity index 100% rename from searches/detection_ec2_instance_created_by_previously_unseen_user.json rename to detections/detection_ec2_instance_created_by_previously_unseen_user.json diff --git a/searches/detection_ec2_instance_modified_by_previously_unseen_user.json b/detections/detection_ec2_instance_modified_by_previously_unseen_user.json similarity index 100% rename from searches/detection_ec2_instance_modified_by_previously_unseen_user.json rename to detections/detection_ec2_instance_modified_by_previously_unseen_user.json diff --git a/searches/detection_ec2_instance_started_with_previously_unseen_ami.json b/detections/detection_ec2_instance_started_with_previously_unseen_ami.json similarity index 100% rename from searches/detection_ec2_instance_started_with_previously_unseen_ami.json rename to detections/detection_ec2_instance_started_with_previously_unseen_ami.json diff --git a/searches/detection_ec2_instance_started_with_previously_unseen_instance_type.json b/detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json similarity index 100% rename from searches/detection_ec2_instance_started_with_previously_unseen_instance_type.json rename to detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json diff --git a/searches/detection_email_attachments_with_spaces.json b/detections/detection_email_attachments_with_spaces.json similarity index 100% rename from searches/detection_email_attachments_with_spaces.json rename to detections/detection_email_attachments_with_spaces.json diff --git a/searches/detection_email_files_not_in_outlook_directory.json b/detections/detection_email_files_not_in_outlook_directory.json similarity index 100% rename from searches/detection_email_files_not_in_outlook_directory.json rename to detections/detection_email_files_not_in_outlook_directory.json diff --git a/searches/detection_emailserver_high_volume_outbound_traffic_to_hosts.json b/detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json similarity index 100% rename from searches/detection_emailserver_high_volume_outbound_traffic_to_hosts.json rename to detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json diff --git a/searches/detection_excessive_dns_failures.json b/detections/detection_excessive_dns_failures.json similarity index 100% rename from searches/detection_excessive_dns_failures.json rename to detections/detection_excessive_dns_failures.json diff --git a/searches/detection_excessive_lockouts_from_endpoint.json b/detections/detection_excessive_lockouts_from_endpoint.json similarity index 100% rename from searches/detection_excessive_lockouts_from_endpoint.json rename to detections/detection_excessive_lockouts_from_endpoint.json diff --git a/searches/detection_excessive_user_account_lockouts.json b/detections/detection_excessive_user_account_lockouts.json similarity index 100% rename from searches/detection_excessive_user_account_lockouts.json rename to detections/detection_excessive_user_account_lockouts.json diff --git a/searches/detection_execution_of_nirsoft_tools.json b/detections/detection_execution_of_nirsoft_tools.json similarity index 100% rename from searches/detection_execution_of_nirsoft_tools.json rename to detections/detection_execution_of_nirsoft_tools.json diff --git a/searches/detection_file_write_spikes.json b/detections/detection_file_write_spikes.json similarity index 100% rename from searches/detection_file_write_spikes.json rename to detections/detection_file_write_spikes.json diff --git a/searches/detection_first_time_seen_cmd_line.json b/detections/detection_first_time_seen_cmd_line.json similarity index 100% rename from searches/detection_first_time_seen_cmd_line.json rename to detections/detection_first_time_seen_cmd_line.json diff --git a/searches/detection_first_time_seen_running_windows_service.json b/detections/detection_first_time_seen_running_windows_service.json similarity index 100% rename from searches/detection_first_time_seen_running_windows_service.json rename to detections/detection_first_time_seen_running_windows_service.json diff --git a/searches/detection_fsutil_deleting_journals.json b/detections/detection_fsutil_deleting_journals.json similarity index 100% rename from searches/detection_fsutil_deleting_journals.json rename to detections/detection_fsutil_deleting_journals.json diff --git a/searches/detection_hosts_file_modification.json b/detections/detection_hosts_file_modification.json similarity index 100% rename from searches/detection_hosts_file_modification.json rename to detections/detection_hosts_file_modification.json diff --git a/searches/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json b/detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json similarity index 100% rename from searches/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json rename to detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json diff --git a/searches/detection_large_icmp_outbound.json b/detections/detection_large_icmp_outbound.json similarity index 100% rename from searches/detection_large_icmp_outbound.json rename to detections/detection_large_icmp_outbound.json diff --git a/searches/detection_local_admin_account_creation.json b/detections/detection_local_admin_account_creation.json similarity index 100% rename from searches/detection_local_admin_account_creation.json rename to detections/detection_local_admin_account_creation.json diff --git a/searches/detection_long_dns_text_response.json b/detections/detection_long_dns_text_response.json similarity index 100% rename from searches/detection_long_dns_text_response.json rename to detections/detection_long_dns_text_response.json diff --git a/searches/detection_malicious_application_shimming_via_registry.json b/detections/detection_malicious_application_shimming_via_registry.json similarity index 100% rename from searches/detection_malicious_application_shimming_via_registry.json rename to detections/detection_malicious_application_shimming_via_registry.json diff --git a/searches/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json b/detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json similarity index 100% rename from searches/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json rename to detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json diff --git a/searches/detection_malicious_powershell_process_encoded_command.json b/detections/detection_malicious_powershell_process_encoded_command.json similarity index 100% rename from searches/detection_malicious_powershell_process_encoded_command.json rename to detections/detection_malicious_powershell_process_encoded_command.json diff --git a/searches/detection_malicious_powershell_process_execpolicy.json b/detections/detection_malicious_powershell_process_execpolicy.json similarity index 100% rename from searches/detection_malicious_powershell_process_execpolicy.json rename to detections/detection_malicious_powershell_process_execpolicy.json diff --git a/searches/detection_malicious_powershell_process_multiple_suspicious_arguments.json b/detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json similarity index 100% rename from searches/detection_malicious_powershell_process_multiple_suspicious_arguments.json rename to detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json diff --git a/searches/detection_malicious_powershell_process_obfuscation_techniques.json b/detections/detection_malicious_powershell_process_obfuscation_techniques.json similarity index 100% rename from searches/detection_malicious_powershell_process_obfuscation_techniques.json rename to detections/detection_malicious_powershell_process_obfuscation_techniques.json diff --git a/searches/detection_malicious_requests_to_exploit_jboss_servers.json b/detections/detection_malicious_requests_to_exploit_jboss_servers.json similarity index 100% rename from searches/detection_malicious_requests_to_exploit_jboss_servers.json rename to detections/detection_malicious_requests_to_exploit_jboss_servers.json diff --git a/searches/detection_mshta_launching_scripts.json b/detections/detection_mshta_launching_scripts.json similarity index 100% rename from searches/detection_mshta_launching_scripts.json rename to detections/detection_mshta_launching_scripts.json diff --git a/searches/detection_netbackup_failed_backup.json b/detections/detection_netbackup_failed_backup.json similarity index 100% rename from searches/detection_netbackup_failed_backup.json rename to detections/detection_netbackup_failed_backup.json diff --git a/searches/detection_netbackup_no_backups_in_time_period.json b/detections/detection_netbackup_no_backups_in_time_period.json similarity index 100% rename from searches/detection_netbackup_no_backups_in_time_period.json rename to detections/detection_netbackup_no_backups_in_time_period.json diff --git a/searches/detection_netsh_launching_process.json b/detections/detection_netsh_launching_process.json similarity index 100% rename from searches/detection_netsh_launching_process.json rename to detections/detection_netsh_launching_process.json diff --git a/searches/detection_new_aws_console_login_by_user.json b/detections/detection_new_aws_console_login_by_user.json similarity index 100% rename from searches/detection_new_aws_console_login_by_user.json rename to detections/detection_new_aws_console_login_by_user.json diff --git a/searches/detection_new_connections_to_routers.json b/detections/detection_new_connections_to_routers.json similarity index 100% rename from searches/detection_new_connections_to_routers.json rename to detections/detection_new_connections_to_routers.json diff --git a/searches/detection_new_open_s3_buckets.json b/detections/detection_new_open_s3_buckets.json similarity index 100% rename from searches/detection_new_open_s3_buckets.json rename to detections/detection_new_open_s3_buckets.json diff --git a/searches/detection_new_user_accounts.json b/detections/detection_new_user_accounts.json similarity index 100% rename from searches/detection_new_user_accounts.json rename to detections/detection_new_user_accounts.json diff --git a/searches/detection_no_win_updates_in_timeframe.json b/detections/detection_no_win_updates_in_timeframe.json similarity index 100% rename from searches/detection_no_win_updates_in_timeframe.json rename to detections/detection_no_win_updates_in_timeframe.json diff --git a/searches/detection_open_redirect_in_splunk_web.json b/detections/detection_open_redirect_in_splunk_web.json similarity index 100% rename from searches/detection_open_redirect_in_splunk_web.json rename to detections/detection_open_redirect_in_splunk_web.json diff --git a/searches/detection_osx_coldroot_pack.json b/detections/detection_osx_coldroot_pack.json similarity index 100% rename from searches/detection_osx_coldroot_pack.json rename to detections/detection_osx_coldroot_pack.json diff --git a/searches/detection_osx_keyboard_taps.json b/detections/detection_osx_keyboard_taps.json similarity index 100% rename from searches/detection_osx_keyboard_taps.json rename to detections/detection_osx_keyboard_taps.json diff --git a/searches/detection_outbound_smb_connections.json b/detections/detection_outbound_smb_connections.json similarity index 100% rename from searches/detection_outbound_smb_connections.json rename to detections/detection_outbound_smb_connections.json diff --git a/searches/detection_overwrite_accessibility_binaries.json b/detections/detection_overwrite_accessibility_binaries.json similarity index 100% rename from searches/detection_overwrite_accessibility_binaries.json rename to detections/detection_overwrite_accessibility_binaries.json diff --git a/searches/detection_password_sharing.json b/detections/detection_password_sharing.json similarity index 100% rename from searches/detection_password_sharing.json rename to detections/detection_password_sharing.json diff --git a/searches/detection_path_interception_program.exe.json b/detections/detection_path_interception_program.exe.json similarity index 100% rename from searches/detection_path_interception_program.exe.json rename to detections/detection_path_interception_program.exe.json diff --git a/searches/detection_port_monitor_via_registry.json b/detections/detection_port_monitor_via_registry.json similarity index 100% rename from searches/detection_port_monitor_via_registry.json rename to detections/detection_port_monitor_via_registry.json diff --git a/searches/detection_powershell_get_sedebug.json b/detections/detection_powershell_get_sedebug.json similarity index 100% rename from searches/detection_powershell_get_sedebug.json rename to detections/detection_powershell_get_sedebug.json diff --git a/searches/detection_powershell_read_from_lsass.json b/detections/detection_powershell_read_from_lsass.json similarity index 100% rename from searches/detection_powershell_read_from_lsass.json rename to detections/detection_powershell_read_from_lsass.json diff --git a/searches/detection_powershell_reg_key_mod.json b/detections/detection_powershell_reg_key_mod.json similarity index 100% rename from searches/detection_powershell_reg_key_mod.json rename to detections/detection_powershell_reg_key_mod.json diff --git a/searches/detection_process_launching_netsh.json b/detections/detection_process_launching_netsh.json similarity index 100% rename from searches/detection_process_launching_netsh.json rename to detections/detection_process_launching_netsh.json diff --git a/searches/detection_process_with_double_extension.json b/detections/detection_process_with_double_extension.json similarity index 100% rename from searches/detection_process_with_double_extension.json rename to detections/detection_process_with_double_extension.json diff --git a/searches/detection_process_with_spaces_before_extension.json b/detections/detection_process_with_spaces_before_extension.json similarity index 100% rename from searches/detection_process_with_spaces_before_extension.json rename to detections/detection_process_with_spaces_before_extension.json diff --git a/searches/detection_prohibited_allowed_through_fw.json b/detections/detection_prohibited_allowed_through_fw.json similarity index 100% rename from searches/detection_prohibited_allowed_through_fw.json rename to detections/detection_prohibited_allowed_through_fw.json diff --git a/searches/detection_prohibited_apps_spawning_cmdprompt.json b/detections/detection_prohibited_apps_spawning_cmdprompt.json similarity index 100% rename from searches/detection_prohibited_apps_spawning_cmdprompt.json rename to detections/detection_prohibited_apps_spawning_cmdprompt.json diff --git a/searches/detection_prohibited_software_on_endpoint.json b/detections/detection_prohibited_software_on_endpoint.json similarity index 100% rename from searches/detection_prohibited_software_on_endpoint.json rename to detections/detection_prohibited_software_on_endpoint.json diff --git a/searches/detection_protocol_mismatch.json b/detections/detection_protocol_mismatch.json similarity index 100% rename from searches/detection_protocol_mismatch.json rename to detections/detection_protocol_mismatch.json diff --git a/searches/detection_protocols_authenticating_in_cleartext.json b/detections/detection_protocols_authenticating_in_cleartext.json similarity index 100% rename from searches/detection_protocols_authenticating_in_cleartext.json rename to detections/detection_protocols_authenticating_in_cleartext.json diff --git a/searches/detection_psexec_accepteula.json b/detections/detection_psexec_accepteula.json similarity index 100% rename from searches/detection_psexec_accepteula.json rename to detections/detection_psexec_accepteula.json diff --git a/searches/detection_rare_executables_on_endpoint.json b/detections/detection_rare_executables_on_endpoint.json similarity index 100% rename from searches/detection_rare_executables_on_endpoint.json rename to detections/detection_rare_executables_on_endpoint.json diff --git a/searches/detection_reg_manipulating_services.json b/detections/detection_reg_manipulating_services.json similarity index 100% rename from searches/detection_reg_manipulating_services.json rename to detections/detection_reg_manipulating_services.json diff --git a/searches/detection_reg_used_to_hide_files.json b/detections/detection_reg_used_to_hide_files.json similarity index 100% rename from searches/detection_reg_used_to_hide_files.json rename to detections/detection_reg_used_to_hide_files.json diff --git a/searches/detection_registry_persistence.json b/detections/detection_registry_persistence.json similarity index 100% rename from searches/detection_registry_persistence.json rename to detections/detection_registry_persistence.json diff --git a/searches/detection_registry_privilege_escalation.json b/detections/detection_registry_privilege_escalation.json similarity index 100% rename from searches/detection_registry_privilege_escalation.json rename to detections/detection_registry_privilege_escalation.json diff --git a/searches/detection_remote_desktop_bruteforce.json b/detections/detection_remote_desktop_bruteforce.json similarity index 100% rename from searches/detection_remote_desktop_bruteforce.json rename to detections/detection_remote_desktop_bruteforce.json diff --git a/searches/detection_remote_desktop_network_traffic.json b/detections/detection_remote_desktop_network_traffic.json similarity index 100% rename from searches/detection_remote_desktop_network_traffic.json rename to detections/detection_remote_desktop_network_traffic.json diff --git a/searches/detection_remote_desktop_process_running_on_system.json b/detections/detection_remote_desktop_process_running_on_system.json similarity index 100% rename from searches/detection_remote_desktop_process_running_on_system.json rename to detections/detection_remote_desktop_process_running_on_system.json diff --git a/searches/detection_remote_registry_modifications.json b/detections/detection_remote_registry_modifications.json similarity index 100% rename from searches/detection_remote_registry_modifications.json rename to detections/detection_remote_registry_modifications.json diff --git a/searches/detection_remote_wmi_command_attempt.json b/detections/detection_remote_wmi_command_attempt.json similarity index 100% rename from searches/detection_remote_wmi_command_attempt.json rename to detections/detection_remote_wmi_command_attempt.json diff --git a/searches/detection_remote_wmi_process_instantiation.json b/detections/detection_remote_wmi_process_instantiation.json similarity index 100% rename from searches/detection_remote_wmi_process_instantiation.json rename to detections/detection_remote_wmi_process_instantiation.json diff --git a/searches/detection_rundll_loading_dll_by_ordinal.json b/detections/detection_rundll_loading_dll_by_ordinal.json similarity index 100% rename from searches/detection_rundll_loading_dll_by_ordinal.json rename to detections/detection_rundll_loading_dll_by_ordinal.json diff --git a/searches/detection_s3_access_from_new_ip.json b/detections/detection_s3_access_from_new_ip.json similarity index 100% rename from searches/detection_s3_access_from_new_ip.json rename to detections/detection_s3_access_from_new_ip.json diff --git a/searches/detection_samsam_payload_extensions.json b/detections/detection_samsam_payload_extensions.json similarity index 100% rename from searches/detection_samsam_payload_extensions.json rename to detections/detection_samsam_payload_extensions.json diff --git a/searches/detection_samsam_test_file_write.json b/detections/detection_samsam_test_file_write.json similarity index 100% rename from searches/detection_samsam_test_file_write.json rename to detections/detection_samsam_test_file_write.json diff --git a/searches/detection_sc_manipulating_services.json b/detections/detection_sc_manipulating_services.json similarity index 100% rename from searches/detection_sc_manipulating_services.json rename to detections/detection_sc_manipulating_services.json diff --git a/searches/detection_schtasks_forced_reboot.json b/detections/detection_schtasks_forced_reboot.json similarity index 100% rename from searches/detection_schtasks_forced_reboot.json rename to detections/detection_schtasks_forced_reboot.json diff --git a/searches/detection_schtasks_scheduling_job_on_remote_system.json b/detections/detection_schtasks_scheduling_job_on_remote_system.json similarity index 100% rename from searches/detection_schtasks_scheduling_job_on_remote_system.json rename to detections/detection_schtasks_scheduling_job_on_remote_system.json diff --git a/searches/detection_shim_database_file_creation.json b/detections/detection_shim_database_file_creation.json similarity index 100% rename from searches/detection_shim_database_file_creation.json rename to detections/detection_shim_database_file_creation.json diff --git a/searches/detection_shim_database_installation.json b/detections/detection_shim_database_installation.json similarity index 100% rename from searches/detection_shim_database_installation.json rename to detections/detection_shim_database_installation.json diff --git a/searches/detection_short_lived_accounts.json b/detections/detection_short_lived_accounts.json similarity index 100% rename from searches/detection_short_lived_accounts.json rename to detections/detection_short_lived_accounts.json diff --git a/searches/detection_single_letter_executables.json b/detections/detection_single_letter_executables.json similarity index 100% rename from searches/detection_single_letter_executables.json rename to detections/detection_single_letter_executables.json diff --git a/searches/detection_smb_traffic_spike.json b/detections/detection_smb_traffic_spike.json similarity index 100% rename from searches/detection_smb_traffic_spike.json rename to detections/detection_smb_traffic_spike.json diff --git a/searches/detection_sncd_processes.json b/detections/detection_sncd_processes.json similarity index 100% rename from searches/detection_sncd_processes.json rename to detections/detection_sncd_processes.json diff --git a/searches/detection_spectre_meltdown_vulnerabilities.json b/detections/detection_spectre_meltdown_vulnerabilities.json similarity index 100% rename from searches/detection_spectre_meltdown_vulnerabilities.json rename to detections/detection_spectre_meltdown_vulnerabilities.json diff --git a/searches/detection_spike_aws_api_call_per_account.json b/detections/detection_spike_aws_api_call_per_account.json similarity index 100% rename from searches/detection_spike_aws_api_call_per_account.json rename to detections/detection_spike_aws_api_call_per_account.json diff --git a/searches/detection_spike_aws_security_group_activity.json b/detections/detection_spike_aws_security_group_activity.json similarity index 100% rename from searches/detection_spike_aws_security_group_activity.json rename to detections/detection_spike_aws_security_group_activity.json diff --git a/searches/detection_spike_s3_deletion.json b/detections/detection_spike_s3_deletion.json similarity index 100% rename from searches/detection_spike_s3_deletion.json rename to detections/detection_spike_s3_deletion.json diff --git a/searches/detection_spike_vpc_blocked_traffic.json b/detections/detection_spike_vpc_blocked_traffic.json similarity index 100% rename from searches/detection_spike_vpc_blocked_traffic.json rename to detections/detection_spike_vpc_blocked_traffic.json diff --git a/searches/detection_splunk_information_disclosure.json b/detections/detection_splunk_information_disclosure.json similarity index 100% rename from searches/detection_splunk_information_disclosure.json rename to detections/detection_splunk_information_disclosure.json diff --git a/searches/detection_sql_injection_with_long_urls.json b/detections/detection_sql_injection_with_long_urls.json similarity index 100% rename from searches/detection_sql_injection_with_long_urls.json rename to detections/detection_sql_injection_with_long_urls.json diff --git a/searches/detection_stop_security_services.json b/detections/detection_stop_security_services.json similarity index 100% rename from searches/detection_stop_security_services.json rename to detections/detection_stop_security_services.json diff --git a/searches/detection_suspicious_email_attachments.json b/detections/detection_suspicious_email_attachments.json similarity index 100% rename from searches/detection_suspicious_email_attachments.json rename to detections/detection_suspicious_email_attachments.json diff --git a/searches/detection_suspicious_file_writes.json b/detections/detection_suspicious_file_writes.json similarity index 100% rename from searches/detection_suspicious_file_writes.json rename to detections/detection_suspicious_file_writes.json diff --git a/searches/detection_suspicious_java_classes.json b/detections/detection_suspicious_java_classes.json similarity index 100% rename from searches/detection_suspicious_java_classes.json rename to detections/detection_suspicious_java_classes.json diff --git a/searches/detection_suspicious_reg_process.json b/detections/detection_suspicious_reg_process.json similarity index 100% rename from searches/detection_suspicious_reg_process.json rename to detections/detection_suspicious_reg_process.json diff --git a/searches/detection_suspicious_wevtutil_usage.json b/detections/detection_suspicious_wevtutil_usage.json similarity index 100% rename from searches/detection_suspicious_wevtutil_usage.json rename to detections/detection_suspicious_wevtutil_usage.json diff --git a/searches/detection_suspicious_write_to_recycler.json b/detections/detection_suspicious_write_to_recycler.json similarity index 100% rename from searches/detection_suspicious_write_to_recycler.json rename to detections/detection_suspicious_write_to_recycler.json diff --git a/searches/detection_suspicious_write_to_sysvol.json b/detections/detection_suspicious_write_to_sysvol.json similarity index 100% rename from searches/detection_suspicious_write_to_sysvol.json rename to detections/detection_suspicious_write_to_sysvol.json diff --git a/searches/detection_system_processes_run_from_unexpected_locations.json b/detections/detection_system_processes_run_from_unexpected_locations.json similarity index 100% rename from searches/detection_system_processes_run_from_unexpected_locations.json rename to detections/detection_system_processes_run_from_unexpected_locations.json diff --git a/searches/detection_tor_traffic.json b/detections/detection_tor_traffic.json similarity index 100% rename from searches/detection_tor_traffic.json rename to detections/detection_tor_traffic.json diff --git a/searches/detection_unauthorized_assets_via_mac_address.json b/detections/detection_unauthorized_assets_via_mac_address.json similarity index 100% rename from searches/detection_unauthorized_assets_via_mac_address.json rename to detections/detection_unauthorized_assets_via_mac_address.json diff --git a/searches/detection_unauthorized_dns_servers.json b/detections/detection_unauthorized_dns_servers.json similarity index 100% rename from searches/detection_unauthorized_dns_servers.json rename to detections/detection_unauthorized_dns_servers.json diff --git a/searches/detection_uncommon_processes.json b/detections/detection_uncommon_processes.json similarity index 100% rename from searches/detection_uncommon_processes.json rename to detections/detection_uncommon_processes.json diff --git a/searches/detection_unusually_long_commandlines.json b/detections/detection_unusually_long_commandlines.json similarity index 100% rename from searches/detection_unusually_long_commandlines.json rename to detections/detection_unusually_long_commandlines.json diff --git a/searches/detection_unusually_long_content-type_length.json b/detections/detection_unusually_long_content-type_length.json similarity index 100% rename from searches/detection_unusually_long_content-type_length.json rename to detections/detection_unusually_long_content-type_length.json diff --git a/searches/detection_usb_insertion.json b/detections/detection_usb_insertion.json similarity index 100% rename from searches/detection_usb_insertion.json rename to detections/detection_usb_insertion.json diff --git a/searches/detection_users_without_mfa.json b/detections/detection_users_without_mfa.json similarity index 100% rename from searches/detection_users_without_mfa.json rename to detections/detection_users_without_mfa.json diff --git a/searches/detection_web_servers_executing_suspicious_processes.json b/detections/detection_web_servers_executing_suspicious_processes.json similarity index 100% rename from searches/detection_web_servers_executing_suspicious_processes.json rename to detections/detection_web_servers_executing_suspicious_processes.json diff --git a/searches/detection_windows_event_log_cleared.json b/detections/detection_windows_event_log_cleared.json similarity index 100% rename from searches/detection_windows_event_log_cleared.json rename to detections/detection_windows_event_log_cleared.json diff --git a/searches/detection_wmi_perm_event_subscription.json b/detections/detection_wmi_perm_event_subscription.json similarity index 100% rename from searches/detection_wmi_perm_event_subscription.json rename to detections/detection_wmi_perm_event_subscription.json diff --git a/searches/detection_wmi_perm_event_subscription_sysmon.json b/detections/detection_wmi_perm_event_subscription_sysmon.json similarity index 100% rename from searches/detection_wmi_perm_event_subscription_sysmon.json rename to detections/detection_wmi_perm_event_subscription_sysmon.json diff --git a/searches/detection_wmi_process_launch.json b/detections/detection_wmi_process_launch.json similarity index 100% rename from searches/detection_wmi_process_launch.json rename to detections/detection_wmi_process_launch.json diff --git a/searches/detection_wmi_script_execution.json b/detections/detection_wmi_script_execution.json similarity index 100% rename from searches/detection_wmi_script_execution.json rename to detections/detection_wmi_script_execution.json diff --git a/searches/detection_wmi_temp_event_subscription.json b/detections/detection_wmi_temp_event_subscription.json similarity index 100% rename from searches/detection_wmi_temp_event_subscription.json rename to detections/detection_wmi_temp_event_subscription.json diff --git a/searches/contextual_aws_network_interface_details.json b/investigations/contextual_aws_network_interface_details.json similarity index 100% rename from searches/contextual_aws_network_interface_details.json rename to investigations/contextual_aws_network_interface_details.json diff --git a/searches/contextual_aws_s3_bucket_details.json b/investigations/contextual_aws_s3_bucket_details.json similarity index 100% rename from searches/contextual_aws_s3_bucket_details.json rename to investigations/contextual_aws_s3_bucket_details.json diff --git a/searches/contextual_first_occurrence_mac_address.json b/investigations/contextual_first_occurrence_mac_address.json similarity index 100% rename from searches/contextual_first_occurrence_mac_address.json rename to investigations/contextual_first_occurrence_mac_address.json diff --git a/searches/contextual_get_acl_details.json b/investigations/contextual_get_acl_details.json similarity index 100% rename from searches/contextual_get_acl_details.json rename to investigations/contextual_get_acl_details.json diff --git a/searches/contextual_get_authentication_logs_for_endpoint.json b/investigations/contextual_get_authentication_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_authentication_logs_for_endpoint.json rename to investigations/contextual_get_authentication_logs_for_endpoint.json diff --git a/searches/contextual_get_backup_logs_for_endpoint.json b/investigations/contextual_get_backup_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_backup_logs_for_endpoint.json rename to investigations/contextual_get_backup_logs_for_endpoint.json diff --git a/searches/contextual_get_ec2_details_by_instance_id.json b/investigations/contextual_get_ec2_details_by_instance_id.json similarity index 100% rename from searches/contextual_get_ec2_details_by_instance_id.json rename to investigations/contextual_get_ec2_details_by_instance_id.json diff --git a/searches/contextual_get_ec2_launch_details.json b/investigations/contextual_get_ec2_launch_details.json similarity index 100% rename from searches/contextual_get_ec2_launch_details.json rename to investigations/contextual_get_ec2_launch_details.json diff --git a/searches/contextual_get_notable_history_for_endpoint.json b/investigations/contextual_get_notable_history_for_endpoint.json similarity index 100% rename from searches/contextual_get_notable_history_for_endpoint.json rename to investigations/contextual_get_notable_history_for_endpoint.json diff --git a/searches/contextual_get_notable_info.json b/investigations/contextual_get_notable_info.json similarity index 100% rename from searches/contextual_get_notable_info.json rename to investigations/contextual_get_notable_info.json diff --git a/searches/contextual_get_risk_for_endpoint.json b/investigations/contextual_get_risk_for_endpoint.json similarity index 100% rename from searches/contextual_get_risk_for_endpoint.json rename to investigations/contextual_get_risk_for_endpoint.json diff --git a/searches/contextual_get_risk_for_user.json b/investigations/contextual_get_risk_for_user.json similarity index 100% rename from searches/contextual_get_risk_for_user.json rename to investigations/contextual_get_risk_for_user.json diff --git a/searches/contextual_get_update_logs_for_endpoint.json b/investigations/contextual_get_update_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_update_logs_for_endpoint.json rename to investigations/contextual_get_update_logs_for_endpoint.json diff --git a/searches/contextual_get_user_info_from_identity_table.json b/investigations/contextual_get_user_info_from_identity_table.json similarity index 100% rename from searches/contextual_get_user_info_from_identity_table.json rename to investigations/contextual_get_user_info_from_identity_table.json diff --git a/searches/contextual_get_vulnerability_logs_for_endpoint.json b/investigations/contextual_get_vulnerability_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_vulnerability_logs_for_endpoint.json rename to investigations/contextual_get_vulnerability_logs_for_endpoint.json diff --git a/searches/investigative_aws_activity_via_region.json b/investigations/investigative_aws_activity_via_region.json similarity index 100% rename from searches/investigative_aws_activity_via_region.json rename to investigations/investigative_aws_activity_via_region.json diff --git a/searches/investigative_aws_user_activities_by_user_field.json b/investigations/investigative_aws_user_activities_by_user_field.json similarity index 100% rename from searches/investigative_aws_user_activities_by_user_field.json rename to investigations/investigative_aws_user_activities_by_user_field.json diff --git a/searches/investigative_aws_user_activity_by_accesskeyid.json b/investigations/investigative_aws_user_activity_by_accesskeyid.json similarity index 100% rename from searches/investigative_aws_user_activity_by_accesskeyid.json rename to investigations/investigative_aws_user_activity_by_accesskeyid.json diff --git a/searches/investigative_aws_user_activity_by_src_user.json b/investigations/investigative_aws_user_activity_by_src_user.json similarity index 100% rename from searches/investigative_aws_user_activity_by_src_user.json rename to investigations/investigative_aws_user_activity_by_src_user.json diff --git a/searches/investigative_dns_server_history.json b/investigations/investigative_dns_server_history.json similarity index 100% rename from searches/investigative_dns_server_history.json rename to investigations/investigative_dns_server_history.json diff --git a/searches/investigative_dns_traffic_stats.json b/investigations/investigative_dns_traffic_stats.json similarity index 100% rename from searches/investigative_dns_traffic_stats.json rename to investigations/investigative_dns_traffic_stats.json diff --git a/searches/investigative_email_sent_to_hidden_cobra_actors.json b/investigations/investigative_email_sent_to_hidden_cobra_actors.json similarity index 100% rename from searches/investigative_email_sent_to_hidden_cobra_actors.json rename to investigations/investigative_email_sent_to_hidden_cobra_actors.json diff --git a/searches/investigative_get_all_aws_activitiy_from_city.json b/investigations/investigative_get_all_aws_activitiy_from_city.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_city.json rename to investigations/investigative_get_all_aws_activitiy_from_city.json diff --git a/searches/investigative_get_all_aws_activitiy_from_country.json b/investigations/investigative_get_all_aws_activitiy_from_country.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_country.json rename to investigations/investigative_get_all_aws_activitiy_from_country.json diff --git a/searches/investigative_get_all_aws_activitiy_from_region.json b/investigations/investigative_get_all_aws_activitiy_from_region.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_region.json rename to investigations/investigative_get_all_aws_activitiy_from_region.json diff --git a/searches/investigative_get_all_aws_activitiy_from_src_ip.json b/investigations/investigative_get_all_aws_activitiy_from_src_ip.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_src_ip.json rename to investigations/investigative_get_all_aws_activitiy_from_src_ip.json diff --git a/searches/investigative_get_all_backup_data_for_host.json b/investigations/investigative_get_all_backup_data_for_host.json similarity index 100% rename from searches/investigative_get_all_backup_data_for_host.json rename to investigations/investigative_get_all_backup_data_for_host.json diff --git a/searches/investigative_get_email_info.json b/investigations/investigative_get_email_info.json similarity index 100% rename from searches/investigative_get_email_info.json rename to investigations/investigative_get_email_info.json diff --git a/searches/investigative_get_emails_from_sender.json b/investigations/investigative_get_emails_from_sender.json similarity index 100% rename from searches/investigative_get_emails_from_sender.json rename to investigations/investigative_get_emails_from_sender.json diff --git a/searches/investigative_get_emails_from_source.json b/investigations/investigative_get_emails_from_source.json similarity index 100% rename from searches/investigative_get_emails_from_source.json rename to investigations/investigative_get_emails_from_source.json diff --git a/searches/investigative_get_logon_rights_modifications_for_endpoint.json b/investigations/investigative_get_logon_rights_modifications_for_endpoint.json similarity index 100% rename from searches/investigative_get_logon_rights_modifications_for_endpoint.json rename to investigations/investigative_get_logon_rights_modifications_for_endpoint.json diff --git a/searches/investigative_get_logon_rights_modifications_for_user.json b/investigations/investigative_get_logon_rights_modifications_for_user.json similarity index 100% rename from searches/investigative_get_logon_rights_modifications_for_user.json rename to investigations/investigative_get_logon_rights_modifications_for_user.json diff --git a/searches/investigative_get_network_traffic_from_src_ip.json b/investigations/investigative_get_network_traffic_from_src_ip.json similarity index 100% rename from searches/investigative_get_network_traffic_from_src_ip.json rename to investigations/investigative_get_network_traffic_from_src_ip.json diff --git a/searches/investigative_get_parent_process_info.json b/investigations/investigative_get_parent_process_info.json similarity index 100% rename from searches/investigative_get_parent_process_info.json rename to investigations/investigative_get_parent_process_info.json diff --git a/searches/investigative_get_process_creating_dns_traffic.json b/investigations/investigative_get_process_creating_dns_traffic.json similarity index 100% rename from searches/investigative_get_process_creating_dns_traffic.json rename to investigations/investigative_get_process_creating_dns_traffic.json diff --git a/searches/investigative_get_process_info.json b/investigations/investigative_get_process_info.json similarity index 100% rename from searches/investigative_get_process_info.json rename to investigations/investigative_get_process_info.json diff --git a/searches/investigative_get_process_info_for_port.json b/investigations/investigative_get_process_info_for_port.json similarity index 100% rename from searches/investigative_get_process_info_for_port.json rename to investigations/investigative_get_process_info_for_port.json diff --git a/searches/investigative_get_rdp_authentications.json b/investigations/investigative_get_rdp_authentications.json similarity index 100% rename from searches/investigative_get_rdp_authentications.json rename to investigations/investigative_get_rdp_authentications.json diff --git a/searches/investigative_get_registry_activities.json b/investigations/investigative_get_registry_activities.json similarity index 100% rename from searches/investigative_get_registry_activities.json rename to investigations/investigative_get_registry_activities.json diff --git a/searches/investigative_get_web_activity.json b/investigations/investigative_get_web_activity.json similarity index 100% rename from searches/investigative_get_web_activity.json rename to investigations/investigative_get_web_activity.json diff --git a/searches/investigative_get_web_activity_by_src_ip.json b/investigations/investigative_get_web_activity_by_src_ip.json similarity index 100% rename from searches/investigative_get_web_activity_by_src_ip.json rename to investigations/investigative_get_web_activity_by_src_ip.json diff --git a/searches/investigative_get_web_posts_by_src.json b/investigations/investigative_get_web_posts_by_src.json similarity index 100% rename from searches/investigative_get_web_posts_by_src.json rename to investigations/investigative_get_web_posts_by_src.json diff --git a/searches/investigative_get_web_session_info.json b/investigations/investigative_get_web_session_info.json similarity index 100% rename from searches/investigative_get_web_session_info.json rename to investigations/investigative_get_web_session_info.json diff --git a/searches/investigative_get_wmi_sysmon_events.json b/investigations/investigative_get_wmi_sysmon_events.json similarity index 100% rename from searches/investigative_get_wmi_sysmon_events.json rename to investigations/investigative_get_wmi_sysmon_events.json diff --git a/searches/investigative_suspicious_strings_in_HTTP_header.json b/investigations/investigative_suspicious_strings_in_HTTP_header.json similarity index 100% rename from searches/investigative_suspicious_strings_in_HTTP_header.json rename to investigations/investigative_suspicious_strings_in_HTTP_header.json diff --git a/searches/investigative_user_activity_via_cloudtrail.json b/investigations/investigative_user_activity_via_cloudtrail.json similarity index 100% rename from searches/investigative_user_activity_via_cloudtrail.json rename to investigations/investigative_user_activity_via_cloudtrail.json From 821eee8afe5ea0a6813112edcc6961a9e62d6d5c Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 26 Mar 2019 13:39:10 -0400 Subject: [PATCH 07/74] minor spelling mistakes --- README.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index fc768b5e23..89f4938a8b 100644 --- a/README.md +++ b/README.md @@ -13,14 +13,14 @@ Can be consumed using: * CLI # Structure -[stories/](stories/) - contains all analytics stories/use cases for ESCU -[detections/](detections/) - splunk, uba and phantom detections that power stories -[investigations/](investigations/) - splunk, and phantom investigation content that are used in stories -[responses/](responses/) - automated splunk and phantom responses that are used in stories -[baselines/](baselines/) - phantom and Splunk baseline needed to support detections in stories -[src/](src/) - splunk content app source files, includes lookups, binaries, and defaul config files -[bin/](bin/) - where all binaries to produce, and test content lives -[spec/](spec/) - location of all spec files that describe ESCU content +* [stories/](stories/) - contains all analytics stories/use cases for ESCU +* [detections/](detections/) - splunk, uba and phantom detections that power stories +* [investigations/](investigations/) - splunk, and phantom investigation content that are used in stories +* [responses/](responses/) - automated splunk and phantom responses that are used in stories +* [baselines/](baselines/) - phantom and Splunk baseline needed to support detections in stories +* [src/](src/) - splunk content app source files, includes lookups, binaries, and defaul config files +* [bin/](bin/) - where all binaries to produce, and test content lives +* [spec/](spec/) - location of all spec files that describe ESCU content # Developing From c400c6657f38d5100433a38eda3d5e49f2fba01d Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 13:40:52 -0400 Subject: [PATCH 08/74] support spec to support splunk/phantom --- .DS_Store | Bin 6148 -> 0 bytes spec/detections.json.spec | 8 +- spec/support_search.json.spec | 433 ++++++++++++++++++++-------------- 3 files changed, 254 insertions(+), 187 deletions(-) delete mode 100644 .DS_Store diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index 6d6fb3be80744f29e567be0e687da05048766278..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKJx{|h5PfbV(TXJ-j2W3KF|&k{4wZm`{sEM;^m*mwRRf-C!JG-b|IE9pAdW}*@Q&R<00af6K3do0< z){{LzO%+fDRDq@f@_k6?f~m*aq5X8Qu}1)6#9?df+n;}8A_K(KW9^V5G~=j5M>YP4 zVf@*_I6CjAKE8J7=rDF>=J7Kde?l?-=wT8Y4wE|6RuxbMLIt|+GM4>+bo~4ulJrUy zPzC;#0w&5P*^njqy>+iR*=rN}BVA15YKPwxcI;NnSlNot>DD-&NQanutQ~TMrauB! L25nSGXRD~ diff --git a/spec/detections.json.spec b/spec/detections.json.spec index 9b9aac70f3..0cb4afea50 100644 --- a/spec/detections.json.spec +++ b/spec/detections.json.spec @@ -1,7 +1,7 @@ { + "description": "A object that defines the parameters for detecting things using various Splunk capabilities", "$schema": "http://json-schema.org/draft-04/schema#", "title": "Detection Manifest", - "description": "A object that defines the parameters for detecting things using various Splunk capabilities", "type": "object", "properties": { "name": { @@ -507,10 +507,6 @@ "search": { "description": "The search (in SPL) executed within core Splunk", "type": "string" - }, - "search_description": { - "description": "A description of what the search is designed to detect", - "type": "string" } } } @@ -532,4 +528,4 @@ "version", "detect" ] -} +} \ No newline at end of file diff --git a/spec/support_search.json.spec b/spec/support_search.json.spec index ec920e2f47..0e34e2935f 100644 --- a/spec/support_search.json.spec +++ b/spec/support_search.json.spec @@ -1,200 +1,271 @@ { - "$schema": "http://json-schema.org/draft-04/schema#", - "title": "Support Search Manifest", - "description": "The fields that make up the manifest of a version 1 support search", - "type": "object", - "properties": { - "channel": { - "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Updates are in the ESCU channel", - "type": "string" - }, - "creation_date": { - "description": "The date the story manifest was created", + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Baseline Manifest", + "description": "The fields that make up the manifest of a version 2 baseline search", + "type": "object", + "properties": { + "name": { + "description": "The name of the search that creates the baseline", + "type": "string" + }, + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "type": { + "description": "The type of baseline", + "enum": [ + "splunk", + "phantom" + ] + }, + "description": { + "description": "A description of what the search is is doing to create a baseline", + "type": "string" + }, + "data_metadata": { + "type": "object", + "description": "Information about the date being ingested", + "properties": { + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "data_metadata": { - "type": "object", - "description": "Information about the date being ingested", - "properties": { - "data_models": { - "description": "A list of data models, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "providing_technologies": { - "description": "A list of technologies that provide this data", - "type": "array", - "items": { - "enum": ["Apache", "AWS", "Bro", "Microsoft Windows", "Linux", "macOS", "Netbackup", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Stream", "Active Directory", "Bluecoat", "Carbon Black Response", "Carbon Black Protect", "CrowdStrike Falcon", "Microsoft Exchange", "Nessus", "Palo Alto Firewall", "Qualys" , "Sysmon", "Tanium", "Ziften"] - }, - "minItems": 0, - "uniqueItems": true - } - }, - "additionalProperties": false, - "required": ["data_source", "providing_technologies"] - }, - "eli5": { - "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", - "items" :{ - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" - }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this search" - }, - "name": { - "type": "string", - "description": "Name of the person maintaining this search" - } - }, - "additionalProperties": false, - "required": ["name", "email", "company"] - } - }, - "modification_date": { - "description": "The date of the most recent modification to the search", + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "original_authors": { - "description": "A list of the original authors of the search", - "type": "array", - "items" :{ - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" - }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the search" - } - }, - "additionalProperties": false, - "required": ["name", "email", "company"] - } - }, - "scheduling": { - "type": "object", - "description": "Various fields to assist in scheduling the search", - "properties": { - "cron_schedule": { - "description": "Schedule of the search in cron format", - "type": "string" - }, - "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" - }, - "latest_time": { - "description": "The latest time the search should run against in Splunk format", - "type": "string" - } - }, - "additionalProperties": false - }, - "search": { - "description": "The search (in SPL) executed within core Splunk", - "type": "string" + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false, + "required": [ + "data_source", + "providing_technologies" + ] + }, + "creation_date": { + "description": "The date the baseline manifest was created", + "type": "string" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the search", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } }, - "search_description": { - "description": "A description of what the search is designed to detect", - "type": "string" + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } }, - "search_id": { - "description": "The unique identifier for the search", - "type": "string" + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "known_false_positives": { + "description": "Describe the known false postives while the analyst builds the baseline.", + "type": "string" + }, + "eli5": { + "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "type": "string" + }, + "spec_version": { + "description": "The version of the detection search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + }, + "baseline": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" }, - "search_name": { - "description": "The name of the search", - "type": "string" + { + "$ref": "#/definitions/phantom" + } + ] + } + }, + "additionalProperties": false, + "definitions": { + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" }, - "search_type": { - "description": "The type of the search", - "enum": ["detection", "investigative", "contextual", "support"] + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" }, - "spec_version": { - "description": "The version of the detection search specification this manifest follows", - "type": "integer" + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" }, - "status": { - "description": "The current status of the search - development, experimental, production", - "enum": ["development", "experimental", "production"] + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." }, - "team_notes": { - "description": "Notes for the team about the search", - "type": "string" + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" }, - "version": { - "description": "The version of the search", - "type": "string" + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" } + } }, - "additionalProperties": false, - "required": [ - "channel", - "creation_date", - "data_metadata", - "eli5", - "how_to_implement", - "maintainers", - "modification_date", - "original_authors", - "scheduling", - "search", - "search_description", - "search_id", - "search_type", - "spec_version", - "version" - ] -} + "splunk": { + "type": "object", + "properties": { + "scheduling": { + "type": "object", + "description": "Various fields to assist in scheduling the search", + "properties": { + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "additionalProperties": false + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for creating a baseline", + "type": "string" + } + } + } + }, + "required": [ + "id", + "creation_date", + "data_metadata", + "eli5", + "known_false_positives", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "name", + "description", + "type", + "spec_version", + "version", + "baseline" + ] +} \ No newline at end of file From 58d082d2bd17fb930e3b14679e86c45dac13541a Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 13:44:02 -0400 Subject: [PATCH 09/74] baseline spec --- spec/baselines.json.spec | 271 +++++++++++++++++++++ spec/support_search.json.spec | 431 ++++++++++++++-------------------- 2 files changed, 451 insertions(+), 251 deletions(-) create mode 100644 spec/baselines.json.spec diff --git a/spec/baselines.json.spec b/spec/baselines.json.spec new file mode 100644 index 0000000000..0e34e2935f --- /dev/null +++ b/spec/baselines.json.spec @@ -0,0 +1,271 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Baseline Manifest", + "description": "The fields that make up the manifest of a version 2 baseline search", + "type": "object", + "properties": { + "name": { + "description": "The name of the search that creates the baseline", + "type": "string" + }, + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "type": { + "description": "The type of baseline", + "enum": [ + "splunk", + "phantom" + ] + }, + "description": { + "description": "A description of what the search is is doing to create a baseline", + "type": "string" + }, + "data_metadata": { + "type": "object", + "description": "Information about the date being ingested", + "properties": { + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false, + "required": [ + "data_source", + "providing_technologies" + ] + }, + "creation_date": { + "description": "The date the baseline manifest was created", + "type": "string" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the search", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "known_false_positives": { + "description": "Describe the known false postives while the analyst builds the baseline.", + "type": "string" + }, + "eli5": { + "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "type": "string" + }, + "spec_version": { + "description": "The version of the detection search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + }, + "baseline": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + } + }, + "additionalProperties": false, + "definitions": { + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." + }, + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" + }, + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" + } + } + }, + "splunk": { + "type": "object", + "properties": { + "scheduling": { + "type": "object", + "description": "Various fields to assist in scheduling the search", + "properties": { + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "additionalProperties": false + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for creating a baseline", + "type": "string" + } + } + } + }, + "required": [ + "id", + "creation_date", + "data_metadata", + "eli5", + "known_false_positives", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "name", + "description", + "type", + "spec_version", + "version", + "baseline" + ] +} \ No newline at end of file diff --git a/spec/support_search.json.spec b/spec/support_search.json.spec index 0e34e2935f..6998d4c8aa 100644 --- a/spec/support_search.json.spec +++ b/spec/support_search.json.spec @@ -1,271 +1,200 @@ { - "$schema": "http://json-schema.org/draft-04/schema#", - "title": "Baseline Manifest", - "description": "The fields that make up the manifest of a version 2 baseline search", - "type": "object", - "properties": { - "name": { - "description": "The name of the search that creates the baseline", - "type": "string" - }, - "id": { - "description": "The unique identifier for the search", - "type": "string" - }, - "type": { - "description": "The type of baseline", - "enum": [ - "splunk", - "phantom" - ] - }, - "description": { - "description": "A description of what the search is is doing to create a baseline", - "type": "string" - }, - "data_metadata": { - "type": "object", - "description": "Information about the date being ingested", - "properties": { - "data_models": { - "description": "A list of data models, if any, used by this search", - "type": "array", - "items": { + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Support Search Manifest", + "description": "The fields that make up the manifest of a version 1 support search", + "type": "object", + "properties": { + "channel": { + "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Updates are in the ESCU channel", "type": "string" - }, - "minItems": 0, - "uniqueItems": true }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "type": "array", - "items": { + "creation_date": { + "description": "The date the story manifest was created", "type": "string" - }, - "minItems": 0, - "uniqueItems": true }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", - "items": { + "data_metadata": { + "type": "object", + "description": "Information about the date being ingested", + "properties": { + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": ["Apache", "AWS", "Bro", "Microsoft Windows", "Linux", "macOS", "Netbackup", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Stream", "Active Directory", "Bluecoat", "Carbon Black Response", "Carbon Black Protect", "CrowdStrike Falcon", "Microsoft Exchange", "Nessus", "Palo Alto Firewall", "Qualys" , "Sysmon", "Tanium", "Ziften"] + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false, + "required": ["data_source", "providing_technologies"] + }, + "eli5": { + "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", "type": "string" - }, - "minItems": 0, - "uniqueItems": true }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "type": "array", - "items": { + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", "type": "string" - }, - "minItems": 0, - "uniqueItems": true }, - "providing_technologies": { - "description": "A list of technologies that provide this data", - "type": "array", - "items": { - "enum": [ - "Apache", - "AWS", - "Bro", - "Microsoft Windows", - "Linux", - "macOS", - "Netbackup", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Stream", - "Active Directory", - "Bluecoat", - "Carbon Black Response", - "Carbon Black Protect", - "CrowdStrike Falcon", - "Microsoft Exchange", - "Nessus", - "Palo Alto Firewall", - "Qualys", - "Sysmon", - "Tanium", - "Ziften" - ] - }, - "minItems": 0, - "uniqueItems": true - } - }, - "additionalProperties": false, - "required": [ - "data_source", - "providing_technologies" - ] - }, - "creation_date": { - "description": "The date the baseline manifest was created", - "type": "string" - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "original_authors": { - "description": "A list of the original authors of the search", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" - }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the search" - } + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items" :{ + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } + }, + "additionalProperties": false, + "required": ["name", "email", "company"] + } }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" - }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this search" - }, - "name": { - "type": "string", - "description": "Name of the person maintaining this search" - } + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", - "type": "string" - }, - "known_false_positives": { - "description": "Describe the known false postives while the analyst builds the baseline.", - "type": "string" - }, - "eli5": { - "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", - "type": "string" - }, - "spec_version": { - "description": "The version of the detection search specification this manifest follows", - "type": "integer" - }, - "version": { - "description": "The version of the search", - "type": "string" - }, - "baseline": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" + "original_authors": { + "description": "A list of the original authors of the search", + "type": "array", + "items" :{ + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } + }, + "additionalProperties": false, + "required": ["name", "email", "company"] + } }, - { - "$ref": "#/definitions/phantom" - } - ] - } - }, - "additionalProperties": false, - "definitions": { - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + "scheduling": { + "type": "object", + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time the search should run against in Splunk format", + "type": "string" + } + }, + "additionalProperties": false }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + "search_description": { + "description": "A description of what the search is designed to detect", + "type": "string" }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." + "search_id": { + "description": "The unique identifier for the search", + "type": "string" }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" + "search_name": { + "description": "The name of the search", + "type": "string" }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - } - } - }, - "splunk": { - "type": "object", - "properties": { - "scheduling": { - "type": "object", - "description": "Various fields to assist in scheduling the search", - "properties": { - "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" - }, - "latest_time": { - "description": "The latest time tes search should run against in Splunk format", - "type": "string" - } - }, - "additionalProperties": false + "search_type": { + "description": "The type of the search", + "enum": ["detection", "investigative", "contextual", "support"] }, - "search": { - "description": "The search (in SPL) executed within core Splunk for creating a baseline", - "type": "string" + "spec_version": { + "description": "The version of the detection search specification this manifest follows", + "type": "integer" + }, + "status": { + "description": "The current status of the search - development, experimental, production", + "enum": ["development", "experimental", "production"] + }, + "team_notes": { + "description": "Notes for the team about the search", + "type": "string" + }, + "version": { + "description": "The version of the search", + "type": "string" } - } - } - }, - "required": [ - "id", - "creation_date", - "data_metadata", - "eli5", - "known_false_positives", - "how_to_implement", - "maintainers", - "modification_date", - "original_authors", - "name", - "description", - "type", - "spec_version", - "version", - "baseline" - ] + }, + "additionalProperties": false, + "required": [ + "channel", + "creation_date", + "data_metadata", + "eli5", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "scheduling", + "search", + "search_description", + "search_id", + "search_type", + "spec_version", + "version" + ] } \ No newline at end of file From c615358fea5ec7051533a7b564cfe416e4e96f28 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 26 Mar 2019 13:49:48 -0400 Subject: [PATCH 10/74] updating readme, adding logo --- README.md | 17 +++++++++++------ static/logo.png | Bin 0 -> 3658 bytes 2 files changed, 11 insertions(+), 6 deletions(-) create mode 100644 static/logo.png diff --git a/README.md b/README.md index 89f4938a8b..58d2c66225 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,21 @@ +security-content ![security-content](static/logo.png) +===== + +Contains a collection of security stories with their corresponding detection, investigative, contexual and support splunk searches | branch | build status | | --- | --- | | develop| [![develop status](https://circleci.com/gh/splunk/security-content/tree/develop.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/develop)| | master | [![master status](https://circleci.com/gh/splunk/security-content/tree/master.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/master)| -# security-content -Contains a collection of security stories with their corresponding detection, investigative, contexual and support splunk searches - -# Consumption +# Usage Can be consumed using: -* API (https://api.splunksecuritycontent.com) -* CLI + +#### [API](https://github.com/splunk/security-content-api) +`curl https://g7jbilqdth.execute-api.us-west-2.amazonaws.com/api/` + +#### [CLI](https://github.com/splunk/security-content-api/blob/master/content-update.py) +`python content-update.py -o $SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate --splunk_user admin --splunk_password xxxx` # Structure * [stories/](stories/) - contains all analytics stories/use cases for ESCU diff --git a/static/logo.png b/static/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..593ed9af8cc747cf4a88fc6aa24d83f905dd1a40 GIT binary patch literal 3658 zcmaJ^XIN8Pvj(Zs1E_REKnyh`)CB3F_a>kygb*MgBql)u(u-0oh=5T%5D-+P7b#Mu zND&Z0fql<=sfo5VlrBBAA(192d&>Q224b}yHYitDpu|B#WR}C9g8@w^b zA8Q^?z&M55I-|n_(QqG-z8>%t8Nnb3!jMova?pifB7&?7`kNQQ*dLf7AmHCFq(EKJ zf0A;uu?HIC2pFJ-il#Ces-_Lpf~!C^;My>CB_K={stHkrL!j!)s!)U~9H9yY{_}ts z(Fi`i2uGypKd~4mU64PCghxOip`oEFp=v5Pf*%A5hr=PNFbE8$% z>US)FiHWP;0%_<>o~Us%VZh&^cbfDVEv5m zR?mP&S9*kcX}?m(n|^|!`bdd2TYvV=u;X_O)7*T=GR5w-LsGvCRP z#i#HUfex=c!~S`L=T*#Uh%*)scLA@ZK`}Sg9<+If#=V`6pcKaLeCceP`WBZ@9Wm;j zo~6B+9_9&A3`G_P*gtLW`!p1F)+T*KE59~H$)LoEe(bA_Q%ejQimEhjs6HaSi6cOgsi z=ZwJnDMm!Vyg*2jNarD>OarPG9(&ae7ctDgn<-d6XUkFcg8AwI->p0Xb4tSO{Sp~K z7+^q?>sK`Mtt5ZL@6jTOJ%<_v^nuPv*kUAo_AdAMpYTV#`vIeJKVUsP02 zJtM25?^b?--7qN67RR!EY4f;GWCgdwwS_V9L~nqn3>U!ZYoiu_Y&Y|cZo)fxzUESD z$@2)8ybR+Zsv&;6&BA>6*xe6<*9LwH5Z-8BC9)E=B(VaKv=120Z#fFi2~_uA7mu3( z8j{2hNp0|dmr;leefw!Q_bJDoM7Z|qlqQ%~ziUv!(;o9p_fZG38xI#=&7J*<dM;B!c5ST;ocLbUTk=UTRMlhtI7O6z5%kg3?G?fc$>2BXh+97oDNRuxI-*bhSx ztk>9IO7$CGUYXPDWKV#AQqL7rHq7q8by+<)Z*k`pb^N%TXz#@x5Pt52(0Tvms`#US z9kD~7EVkyNbKVM6qe(N#6fX>rKltg}cZaDCzPRmvQG+X4U?`Kyp4l}boez=zLfdt* z(VY3AvT}62&8jE%+4g%o?yS0_VTUinhtZMm)=xV-C0qXgt|<( z;M%}=Z{&nv+=uZRhOdxl2eymrd^HM}~ir7^|9Rcvr{Y2yg-?6gi)Os|U3*Df62 zoz#cIk)EwJCB6AA_9*R0y4MDn@9KoO!m-l!_9vzevDuEdX~ls~1uIuLQl>jKnz`S{ zPvnT%+KQY4b7VL#Dh{sAvA2UoIx+Q|;yv-Fcwpfn~K_lPFW z^{#{TbF&r8)-x;}r^x={i0WF?4khi2_j`Nv+kGT@(Wi^bVXuzsT^Xe>lQ6Yx4sF7= z%1yPJvBG_pqZ?8Qf%3+?G4Oled5NUBW>rN#cJ}1y;s#XPlDJE^gw)w^|ESLR&m45# zln&Y&d6Z!CAerTKHCxjOsWu_5ycP%kxE8=rUXjSKgUht`rNSWfS4)(ZMk=kksf)hD z;jTw5czvOKNF-8Gyq{%Es(dC>o#Jd(R%6E1|Dv-hQF?z=DjR#qhwa4Wl6k(j=0F9>Q93s#ofuzw+!{?Cerm3pRI3w zZb-q7mfo_CGEI7Nc5wUi<9U^`YkvD}9x4L4y}v?h_=(z~j`sUrSgchT_XE@md>H+@*vtv_ z_gqT6a2xZ`preY~lOYc`*j{k!XH9ZdXl7Kf?F35&Or&$3x!}(FPDei3w`yHZF ztd{kHtWW{$Y(;gC-g)jFNPvYna>iq=E*0(NSYr2~%9JSS+aTwmk@iL@oprUw^<`5S zO)~sJ=y+A}U*X%#5sy2p8x@UB5plA~jLQlR;8d}pl#8NJy)s#|j)PD3nY+_nnr8~l zDeBg%_pR!|T{qLMMzT8#yx&Pth92(1%QjV zg)z*Ly5apI-IZhFq2o+5?Q`bQ4&bqXiSO+W6;#Imd|zjI(uFcw^h!<2s%;By>@(gC^ka9xc@c>Zq6kz|Ma;5#Js+P z4v}WG0B$`@AgWEPiH}9+C3gvppPVDU9}ADy2$k~2)Ey2HLAoWKYZ-S+_w30Lc6h>U zqj3{|=d7~aW36^4nTOY$Vv2;8#xbnhT(^2?Hi5R94d>-PHAJLSmW1iLS-G#8?r?%y zJ59EJZhy-Pyw!F8V zuiQ5t?hZ_HZ^d=vi1|CMX5R}OWLs1va_v4>4VMaEZS>m{IzLJIBG{*r?sblCaAd6@ z49#-7K$Z=**~sLn*-=`wyW$YJryZBPUTIl+LJ#ZqY4K)e4q|=ptFb^vTFhZbwq@U| zfaa+3@{>5k*LNMwMG+at#mx(f*z_Eq9_!xUA1Ga{mHhU^v-7rjQS-5y>{}r%b-KFj zyF+7~jj~PK=L7c4g+Z&|SS?~Cs0Gt+e??_k>B&WyO?;BnuQR+@Ev6R^m7vSWQajE( z?ocoweJS#8cI51BF5Zy7GFn4<*XST5e%&Bt`QuVx#WprG)da~AR{zXEY%x~{H5a~S zahXlx3j~bhJc7{dpK|8WpYjiFeLG0EZGHNK%o{-}1MJ@g#%uTY$bLxU4dK6L35?9W f-lEmN4{2k{gkb~l8Am1${_ZSHY>{O~UUB~eqD^Z5 literal 0 HcmV?d00001 From 130e6fc9c62b7ba463d8589846d31080e128e8f3 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 20:30:21 -0400 Subject: [PATCH 11/74] renames: --- spec/v1/analytic_story.json.spec | 163 ++++++++++ spec/{ => v1}/contextual_search.json.spec | 0 spec/{ => v1}/detection_search.json.spec | 0 spec/{ => v1}/investigative_search.json.spec | 0 spec/{ => v1}/support_search.json.spec | 0 spec/v2/baseline_dns_record_changed.json | 48 +++ spec/{ => v2}/detection_phantom.example.json | 4 +- spec/{ => v2}/detection_splunk.example.json | 0 .../dns_hijack.json.sample} | 0 spec/v2/investigations.json.spec.example.json | 47 +++ .../v2_analytic_story.json.spec} | 0 .../v2_baselines.json.spec} | 0 .../v2_detections.json.spec} | 0 spec/v2/v2_investigations.json.spec | 282 ++++++++++++++++++ 14 files changed, 542 insertions(+), 2 deletions(-) create mode 100644 spec/v1/analytic_story.json.spec rename spec/{ => v1}/contextual_search.json.spec (100%) rename spec/{ => v1}/detection_search.json.spec (100%) rename spec/{ => v1}/investigative_search.json.spec (100%) rename spec/{ => v1}/support_search.json.spec (100%) create mode 100644 spec/v2/baseline_dns_record_changed.json rename spec/{ => v2}/detection_phantom.example.json (98%) rename spec/{ => v2}/detection_splunk.example.json (100%) rename spec/{analytic_story.spec.sample => v2/dns_hijack.json.sample} (100%) create mode 100644 spec/v2/investigations.json.spec.example.json rename spec/{analytic_story.json.spec => v2/v2_analytic_story.json.spec} (100%) rename spec/{baselines.json.spec => v2/v2_baselines.json.spec} (100%) rename spec/{detections.json.spec => v2/v2_detections.json.spec} (100%) create mode 100644 spec/v2/v2_investigations.json.spec diff --git a/spec/v1/analytic_story.json.spec b/spec/v1/analytic_story.json.spec new file mode 100644 index 0000000000..aff21a1eb0 --- /dev/null +++ b/spec/v1/analytic_story.json.spec @@ -0,0 +1,163 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Analytic Story Manifest", + "description": "The fields that make up the manifest of a version 1 Analytic Story", + "type": "object", + "properties": { + "category": { + "description": "The category to which the Analytic Story belongs", + "enum": ["Abuse", "Adversary Tactics", "Best Practices", "Cloud Security", "Malware", "Vulnerability"] + }, + "channel": { + "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", + "type": "string" + }, + "creation_date": { + "description": "The date this story was created", + "type": "string" + }, + "description": { + "description": "A high-level description or goal of the Analytic Story", + "type": "string" + }, + "id": { + "description": "A unique identifier for the Analytic Story", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items" :{ + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this Analytic Story" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this Analytic Story" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this Analytic Story" + } + }, + "additionalProperties": false, + "required": ["name", "email", "company"] + } + }, + "modification_date": { + "description": "The date of the most recent modification to this Analytic Story", + "type": "string" + }, + "name": { + "description": "The name of the Analytic Story", + "type": "string" + }, + "narrative": { + "description": "Long-form text that describes the Analytic Story and the rationale behind it, as well as an overview of the included searches, and how they enable the story", + "type": "string" + }, + "original_authors": { + "description": "An array of the original authors of the Analytic Story", + "type": "array", + "items" :{ + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the Analytic Story" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the Analytic Story" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the Analytic Story" + } + }, + "additionalProperties": false, + "required": ["name", "email", "company"] + } + }, + "references": { + "description": "An array of URLs that give information about the problem the story is addressing", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "searches": { + "type": "object", + "description": "The different types of searches", + "properties": { + "contextual_searches": { + "description": "The names of the searches used to help scope and provide context to the detection searches", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "detection_searches": { + "description": "The names of the searches used to detect the behaviors detailed within the Analytic Story", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "investigative_searches": { + "description": "The names of the searches used to investigate further after a detection search uncovers events", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "support_searches": { + "description": "The names of the searches that create intermediate data used by the other searches or to provide baseline information to better understand your environment", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false + }, + "spec_version": { + "description": "The version of the Analytic Story specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the Analytic Story", + "type": "string" + } + }, + "additionalProperties": false, + "required": [ + "category", + "channel", + "creation_date", + "description", + "id", + "maintainers", + "modification_date", + "narrative", + "original_authors", + "name", + "references", + "searches", + "spec_version", + "version" + ] +} \ No newline at end of file diff --git a/spec/contextual_search.json.spec b/spec/v1/contextual_search.json.spec similarity index 100% rename from spec/contextual_search.json.spec rename to spec/v1/contextual_search.json.spec diff --git a/spec/detection_search.json.spec b/spec/v1/detection_search.json.spec similarity index 100% rename from spec/detection_search.json.spec rename to spec/v1/detection_search.json.spec diff --git a/spec/investigative_search.json.spec b/spec/v1/investigative_search.json.spec similarity index 100% rename from spec/investigative_search.json.spec rename to spec/v1/investigative_search.json.spec diff --git a/spec/support_search.json.spec b/spec/v1/support_search.json.spec similarity index 100% rename from spec/support_search.json.spec rename to spec/v1/support_search.json.spec diff --git a/spec/v2/baseline_dns_record_changed.json b/spec/v2/baseline_dns_record_changed.json new file mode 100644 index 0000000000..458ee5c0f9 --- /dev/null +++ b/spec/v2/baseline_dns_record_changed.json @@ -0,0 +1,48 @@ +{ + "baseline": { + "splunk:": { + "scheduling": { + "earliest_time": "-30d@d", + "latest_time": "-10m@m" + }, + "search": "| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \"\\*\", \"\")) | join domain [|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records.csv" + } + }, + "creation_date": "2019-02-14", + "data_metadata": { + "data_models": [ + "Network_Resolution" + ], + "data_source": [ + "Network Communication" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Traffic` datamodel, then stores the output under the `discovered_dns_records.csv` lookup", + "eli5": "Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`", + "how_to_implement": "To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "known_false_positives": "Please vet the lookup created by this baseline search ", + "maintainers": [ + { + "company": "Splunk", + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" + } + ], + "modification_date": "2019-02-14", + "name": "Discover DNS records", + "original_authors": [ + { + "company": "Splunk", + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" + } + ], + "spec_version": 2, + "type": "baseline", + "version": "1.0" +} diff --git a/spec/detection_phantom.example.json b/spec/v2/detection_phantom.example.json similarity index 98% rename from spec/detection_phantom.example.json rename to spec/v2/detection_phantom.example.json index 72539df7bb..561cbf602f 100644 --- a/spec/detection_phantom.example.json +++ b/spec/v2/detection_phantom.example.json @@ -70,7 +70,7 @@ } ], "security_domain": "network", - "spec_version": 1, - "type": "splunk", + "spec_version": 2, + "type": "phantom", "version": "1.0" } diff --git a/spec/detection_splunk.example.json b/spec/v2/detection_splunk.example.json similarity index 100% rename from spec/detection_splunk.example.json rename to spec/v2/detection_splunk.example.json diff --git a/spec/analytic_story.spec.sample b/spec/v2/dns_hijack.json.sample similarity index 100% rename from spec/analytic_story.spec.sample rename to spec/v2/dns_hijack.json.sample diff --git a/spec/v2/investigations.json.spec.example.json b/spec/v2/investigations.json.spec.example.json new file mode 100644 index 0000000000..1b6efb733e --- /dev/null +++ b/spec/v2/investigations.json.spec.example.json @@ -0,0 +1,47 @@ +{ + "channel": "ESCU", + "creation_date": "2017-04-10", + "data_metadata": { + "data_source": [ + "DNS" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.", + "how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic", + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd72", + "investigate": { + "splunk": { + "fields_required": [ + "src_ip" + ], + "search": "| search tag=dns src_ip={src_ip} dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count", + "search_window": { + "earliest_time_offset": 0, + "latest_time_offset": 86400 + } + } + }, + "maintainers": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "modification_date": "2017-11-09", + "name": "Get DNS Server History for a host", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "spec_version": 1, + "type": "investigative", + "version": "1.0" +} diff --git a/spec/analytic_story.json.spec b/spec/v2/v2_analytic_story.json.spec similarity index 100% rename from spec/analytic_story.json.spec rename to spec/v2/v2_analytic_story.json.spec diff --git a/spec/baselines.json.spec b/spec/v2/v2_baselines.json.spec similarity index 100% rename from spec/baselines.json.spec rename to spec/v2/v2_baselines.json.spec diff --git a/spec/detections.json.spec b/spec/v2/v2_detections.json.spec similarity index 100% rename from spec/detections.json.spec rename to spec/v2/v2_detections.json.spec diff --git a/spec/v2/v2_investigations.json.spec b/spec/v2/v2_investigations.json.spec new file mode 100644 index 0000000000..9feda2ff70 --- /dev/null +++ b/spec/v2/v2_investigations.json.spec @@ -0,0 +1,282 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Investigative Search Manifest", + "description": "The fields that make up the manifest of a version 1 investigative earch", + "type": "object", + "properties": { + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "data_metadata": { + "type": "object", + "description": "Information about the date being ingested", + "properties": { + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false, + "required": [ + "data_source", + "providing_technologies" + ] + }, + "fields_required": { + "description": "A list of fields that need to be in the result of the detection search for the search to be successful", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the search", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" + }, + "description": { + "description": "A description of what the search is designed to detect", + "type": "string" + }, + "name": { + "description": "The name of the search", + "type": "string" + }, + "type": { + "description": "The type of the search", + "enum": [ + "detection", + "investigative", + "contextual", + "baseline" + ] + }, + "spec_version": { + "description": "The version of the investigative search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + }, + "investigate": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + } + }, + "additionalProperties": false, + "definitions": { + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." + }, + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" + }, + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" + } + } + }, + "splunk": { + "type": "object", + "properties": { + "investigate_window": { + "type": "object", + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "additionalProperties": false, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ] + }, + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" + } + } + } + }, + "required": [ + "creation_date", + "data_metadata", + "fields_required", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "search", + "description", + "id", + "type", + "investigate_window", + "spec_version", + "version", + "investigate" + ] +} \ No newline at end of file From f622335cda81773788cfe7c1436f384ad3bd6bbd Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 21:15:04 -0400 Subject: [PATCH 12/74] spec and structure --- spec/v2/detection_phantom.example.json | 58 +++++++++++++++---- spec/v2/detection_splunk.example.json | 33 ++++++++++- spec/v2/investigate_phantom_example.json | 44 ++++++++++++++ ...c.example.json => investigate_search.json} | 2 +- ...jack.json.sample => story_dns_hijack.json} | 40 ++++++------- 5 files changed, 142 insertions(+), 35 deletions(-) create mode 100644 spec/v2/investigate_phantom_example.json rename spec/v2/{investigations.json.spec.example.json => investigate_search.json} (98%) rename spec/v2/{dns_hijack.json.sample => story_dns_hijack.json} (80%) diff --git a/spec/v2/detection_phantom.example.json b/spec/v2/detection_phantom.example.json index 561cbf602f..b2e343209d 100644 --- a/spec/v2/detection_phantom.example.json +++ b/spec/v2/detection_phantom.example.json @@ -1,5 +1,12 @@ { "asset_type": "Endpoint", + "baselines": [ + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "name": "Discover DNS records,", + "type": "splunk" + } + ], "confidence": "medium", "creation_date": "2019-02-14", "data_metadata": { @@ -16,18 +23,48 @@ }, "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", "detect": { - "phantom": { - "phantom_server": "automation (hostname)", - "playbook_display_name": "Excessive Account Lockouts Enrichment And Response", - "playbook_name": "community/excessive_account_lockouts_enrichment_and_response", - "playbook_url": "https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/", - "sensitivity": "green", - "severity": "medium" + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "src", + "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", + "rule_title": "DNS record changed" + }, + "risk": { + "risk_object": "src", + "risk_object_type": [ + "system" + ], + "risk_score": 40 + }, + "suppress": { + "suppress_fields": "src", + "suppress_period": "28800s" + } + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" } }, "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", - "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", + "id": "1229w27b-ef78-4w59-aae8-5369073014e1", + "investigations": [ + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "name": "Discover DNS records,", + "type": "splunk" + }, + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", + "name": "DNS record change investigation", + "type": "phantom" + } + ], "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", "maintainers": [ { @@ -61,7 +98,7 @@ ] }, "modification_date": "2019-02-14", - "name": "DNS record changed", + "name": "Playbook that detects DNS Hijacks", "original_authors": [ { "company": "Splunk", @@ -69,8 +106,9 @@ "name": "Jose Hernandez" } ], + "responses": [], "security_domain": "network", "spec_version": 2, - "type": "phantom", + "type": "splunk", "version": "1.0" } diff --git a/spec/v2/detection_splunk.example.json b/spec/v2/detection_splunk.example.json index 0a73b032f1..b7a19dead8 100644 --- a/spec/v2/detection_splunk.example.json +++ b/spec/v2/detection_splunk.example.json @@ -1,5 +1,12 @@ { "asset_type": "Endpoint", + "baselines": [ + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "name": "Discover DNS records,", + "type": "splunk" + } + ], "confidence": "medium", "creation_date": "2019-02-14", "data_metadata": { @@ -46,6 +53,18 @@ "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", + "investigations": [ + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "name": "Discover DNS records,", + "type": "splunk" + }, + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", + "name": "DNS record change investigation", + "type": "phantom" + } + ], "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", "maintainers": [ { @@ -87,8 +106,20 @@ "name": "Jose Hernandez" } ], + "responses": [ + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "name": "Discover DNS records,", + "type": "splunk" + }, + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", + "name": "DNS record change investigation", + "type": "phantom" + } + ], "security_domain": "network", - "spec_version": 1, + "spec_version": 2, "type": "splunk", "version": "1.0" } diff --git a/spec/v2/investigate_phantom_example.json b/spec/v2/investigate_phantom_example.json new file mode 100644 index 0000000000..e50cd4ffc3 --- /dev/null +++ b/spec/v2/investigate_phantom_example.json @@ -0,0 +1,44 @@ +{ + "creation_date": "2017-04-10", + "data_metadata": { + "data_source": [ + "DNS" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.", + "how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic", + "id": "pc91a8cf-35e7-4bb2-8140-e756cc06fd72", + "investigate": { + "phantom": { + "phantom_server": "automation (hostname)", + "playbook_display_name": "DNS record change investigation", + "playbook_name": "community/dns_hijack_investigation", + "playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/", + "sensitivity": "green", + "severity": "medium" + } + }, + "maintainers": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "modification_date": "2017-11-09", + "name": "DNS record change investigation", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "spec_version": 2, + "type": "investigative", + "version": "1.0" +} diff --git a/spec/v2/investigations.json.spec.example.json b/spec/v2/investigate_search.json similarity index 98% rename from spec/v2/investigations.json.spec.example.json rename to spec/v2/investigate_search.json index 1b6efb733e..2290267732 100644 --- a/spec/v2/investigations.json.spec.example.json +++ b/spec/v2/investigate_search.json @@ -41,7 +41,7 @@ "name": "Bhavin Patel" } ], - "spec_version": 1, + "spec_version": 2, "type": "investigative", "version": "1.0" } diff --git a/spec/v2/dns_hijack.json.sample b/spec/v2/story_dns_hijack.json similarity index 80% rename from spec/v2/dns_hijack.json.sample rename to spec/v2/story_dns_hijack.json index 40e9a76566..41424805fc 100644 --- a/spec/v2/dns_hijack.json.sample +++ b/spec/v2/story_dns_hijack.json @@ -3,6 +3,23 @@ "channel": "ESCU", "creation_date": "2017-11-21", "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", + "detections": [ + { + "detection_id": "8169w17b-ef78-4b59-aae8-5369073014e1", + "name": "DNS record changed", + "type": "splunk" + }, + { + "detection_id": "8129w27b-ef78-4w59-aae8-5369073014e1", + "name": "Lateral Movement detected", + "type": "uba" + }, + { + "detection_id": "1229w27b-ef78-4w59-aae8-5369073014e1", + "name": "Playbook that detects DNS Hijacks", + "type": "phantom" + } + ], "id": "8169f17b-ef68-4b59-aae8-5869073014e1", "maintainers": [ { @@ -27,29 +44,6 @@ "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html" ], - "detections":[ - { - "detection_id": "8169w17b-ef78-4b59-aae8-5369073014e1", - "type": "detection_splunk", - "name": "Detect hosts connecting to dynamic domain providers" - }, - { - "detection_id": "8129w27b-ef78-4b59-aae8-5369073014e1", - "type": "detection_splunk", - "name": "Detect web traffic to dynamic domain providers" - }, - { - "detection_id": "8129w27b-ef78-4w59-aae8-5369073014e1", - "type": "detection_uba", - "name": "Lateral Movement detected" - }, - { - "detection_id": "8129w27b-ef78-4w59-aae8-5369073014e1", - "type": "detection_phantom", - "name": "playbook that detects dynamic DNS connections" - } - - ], "spec_version": 2, "version": "1.0" } From 185ab940686494a2b7f1c04ed144cc3eeaf84adc Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 21:22:35 -0400 Subject: [PATCH 13/74] example updates --- spec/v2/detection_phantom.example.json | 8 +------- spec/v2/detection_splunk.example.json | 17 +++-------------- spec/v2/investigate_search.json | 2 +- 3 files changed, 5 insertions(+), 22 deletions(-) diff --git a/spec/v2/detection_phantom.example.json b/spec/v2/detection_phantom.example.json index b2e343209d..8c45a0843d 100644 --- a/spec/v2/detection_phantom.example.json +++ b/spec/v2/detection_phantom.example.json @@ -1,12 +1,6 @@ { "asset_type": "Endpoint", - "baselines": [ - { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", - "name": "Discover DNS records,", - "type": "splunk" - } - ], + "baselines": [], "confidence": "medium", "creation_date": "2019-02-14", "data_metadata": { diff --git a/spec/v2/detection_splunk.example.json b/spec/v2/detection_splunk.example.json index b7a19dead8..6089afbeb1 100644 --- a/spec/v2/detection_splunk.example.json +++ b/spec/v2/detection_splunk.example.json @@ -55,8 +55,8 @@ "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", "investigations": [ { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", - "name": "Discover DNS records,", + "id": "bc11a8cf-35e7-4bb2-8140-e756cc06fd72", + "name": "Get DNS Server History for a host", "type": "splunk" }, { @@ -106,18 +106,7 @@ "name": "Jose Hernandez" } ], - "responses": [ - { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", - "name": "Discover DNS records,", - "type": "splunk" - }, - { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", - "name": "DNS record change investigation", - "type": "phantom" - } - ], + "responses": [], "security_domain": "network", "spec_version": 2, "type": "splunk", diff --git a/spec/v2/investigate_search.json b/spec/v2/investigate_search.json index 2290267732..eee20a3e96 100644 --- a/spec/v2/investigate_search.json +++ b/spec/v2/investigate_search.json @@ -12,7 +12,7 @@ }, "description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.", "how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic", - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd72", + "id": "bc11a8cf-35e7-4bb2-8140-e756cc06fd72", "investigate": { "splunk": { "fields_required": [ From 0063df9c6d7091c59501a11ba51f935fc25814c0 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 21:26:19 -0400 Subject: [PATCH 14/74] id mappings --- spec/v2/detection_splunk.example.json | 4 ++-- spec/v2/investigate_phantom_example.json | 2 +- spec/v2/story_dns_hijack.json | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/spec/v2/detection_splunk.example.json b/spec/v2/detection_splunk.example.json index 6089afbeb1..53b70fce50 100644 --- a/spec/v2/detection_splunk.example.json +++ b/spec/v2/detection_splunk.example.json @@ -52,7 +52,7 @@ }, "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", - "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", + "id": "1169w17b-ef78-4b59-aae8-5369073014e1", "investigations": [ { "id": "bc11a8cf-35e7-4bb2-8140-e756cc06fd72", @@ -60,7 +60,7 @@ "type": "splunk" }, { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b712", "name": "DNS record change investigation", "type": "phantom" } diff --git a/spec/v2/investigate_phantom_example.json b/spec/v2/investigate_phantom_example.json index e50cd4ffc3..bb353961e3 100644 --- a/spec/v2/investigate_phantom_example.json +++ b/spec/v2/investigate_phantom_example.json @@ -11,7 +11,7 @@ }, "description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.", "how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic", - "id": "pc91a8cf-35e7-4bb2-8140-e756cc06fd72", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b712", "investigate": { "phantom": { "phantom_server": "automation (hostname)", diff --git a/spec/v2/story_dns_hijack.json b/spec/v2/story_dns_hijack.json index 41424805fc..8def8bd053 100644 --- a/spec/v2/story_dns_hijack.json +++ b/spec/v2/story_dns_hijack.json @@ -5,7 +5,7 @@ "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", "detections": [ { - "detection_id": "8169w17b-ef78-4b59-aae8-5369073014e1", + "detection_id": "1169w17b-ef78-4b59-aae8-5369073014e1", "name": "DNS record changed", "type": "splunk" }, From 31ff0c50f26f7703c50a5a05000be4b4ab4cd319 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Mar 2019 21:28:07 -0400 Subject: [PATCH 15/74] name conventions on file --- ...te_phantom_example.json => investigation_phantom_example.json} | 0 spec/v2/{investigate_search.json => investigation_search.json} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename spec/v2/{investigate_phantom_example.json => investigation_phantom_example.json} (100%) rename spec/v2/{investigate_search.json => investigation_search.json} (100%) diff --git a/spec/v2/investigate_phantom_example.json b/spec/v2/investigation_phantom_example.json similarity index 100% rename from spec/v2/investigate_phantom_example.json rename to spec/v2/investigation_phantom_example.json diff --git a/spec/v2/investigate_search.json b/spec/v2/investigation_search.json similarity index 100% rename from spec/v2/investigate_search.json rename to spec/v2/investigation_search.json From 5d75e12a0b53b0ef09f68f833efef2c46df9634b Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 10:25:44 -0400 Subject: [PATCH 16/74] spec update --- spec/v2/{v2_analytic_story.json.spec => analytic_story.json.spec} | 0 spec/v2/{v2_baselines.json.spec => baselines.json.spec} | 0 spec/v2/{v2_detections.json.spec => detections.json.spec} | 0 spec/v2/{v2_investigations.json.spec => investigations.json.spec} | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename spec/v2/{v2_analytic_story.json.spec => analytic_story.json.spec} (100%) rename spec/v2/{v2_baselines.json.spec => baselines.json.spec} (100%) rename spec/v2/{v2_detections.json.spec => detections.json.spec} (100%) rename spec/v2/{v2_investigations.json.spec => investigations.json.spec} (100%) diff --git a/spec/v2/v2_analytic_story.json.spec b/spec/v2/analytic_story.json.spec similarity index 100% rename from spec/v2/v2_analytic_story.json.spec rename to spec/v2/analytic_story.json.spec diff --git a/spec/v2/v2_baselines.json.spec b/spec/v2/baselines.json.spec similarity index 100% rename from spec/v2/v2_baselines.json.spec rename to spec/v2/baselines.json.spec diff --git a/spec/v2/v2_detections.json.spec b/spec/v2/detections.json.spec similarity index 100% rename from spec/v2/v2_detections.json.spec rename to spec/v2/detections.json.spec diff --git a/spec/v2/v2_investigations.json.spec b/spec/v2/investigations.json.spec similarity index 100% rename from spec/v2/v2_investigations.json.spec rename to spec/v2/investigations.json.spec From 722c2e2031ce88029a2faaf1981facda929fb1d4 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 10:29:44 -0400 Subject: [PATCH 17/74] renamed things a bit --- spec/v2/{v2_analytic_story.json.spec => analytic_story.json.spec} | 0 ...cord_changed.json => baseline_dns_record_changed.json.example} | 0 spec/v2/{v2_baselines.json.spec => baselines.json.spec} | 0 ...ection_phantom.example.json => detection_phantom.json.example} | 0 ...etection_splunk.example.json => detection_splunk.json.example} | 0 spec/v2/{v2_detections.json.spec => detections.json.spec} | 0 ...on_phantom_example.json => investigation_phantom.json.example} | 0 ...nvestigation_search.json => investigation_search.json.example} | 0 spec/v2/{v2_investigations.json.spec => investigations.json.spec} | 0 spec/v2/{story_dns_hijack.json => story_dns_hijack.json.example} | 0 10 files changed, 0 insertions(+), 0 deletions(-) rename spec/v2/{v2_analytic_story.json.spec => analytic_story.json.spec} (100%) rename spec/v2/{baseline_dns_record_changed.json => baseline_dns_record_changed.json.example} (100%) rename spec/v2/{v2_baselines.json.spec => baselines.json.spec} (100%) rename spec/v2/{detection_phantom.example.json => detection_phantom.json.example} (100%) rename spec/v2/{detection_splunk.example.json => detection_splunk.json.example} (100%) rename spec/v2/{v2_detections.json.spec => detections.json.spec} (100%) rename spec/v2/{investigation_phantom_example.json => investigation_phantom.json.example} (100%) rename spec/v2/{investigation_search.json => investigation_search.json.example} (100%) rename spec/v2/{v2_investigations.json.spec => investigations.json.spec} (100%) rename spec/v2/{story_dns_hijack.json => story_dns_hijack.json.example} (100%) diff --git a/spec/v2/v2_analytic_story.json.spec b/spec/v2/analytic_story.json.spec similarity index 100% rename from spec/v2/v2_analytic_story.json.spec rename to spec/v2/analytic_story.json.spec diff --git a/spec/v2/baseline_dns_record_changed.json b/spec/v2/baseline_dns_record_changed.json.example similarity index 100% rename from spec/v2/baseline_dns_record_changed.json rename to spec/v2/baseline_dns_record_changed.json.example diff --git a/spec/v2/v2_baselines.json.spec b/spec/v2/baselines.json.spec similarity index 100% rename from spec/v2/v2_baselines.json.spec rename to spec/v2/baselines.json.spec diff --git a/spec/v2/detection_phantom.example.json b/spec/v2/detection_phantom.json.example similarity index 100% rename from spec/v2/detection_phantom.example.json rename to spec/v2/detection_phantom.json.example diff --git a/spec/v2/detection_splunk.example.json b/spec/v2/detection_splunk.json.example similarity index 100% rename from spec/v2/detection_splunk.example.json rename to spec/v2/detection_splunk.json.example diff --git a/spec/v2/v2_detections.json.spec b/spec/v2/detections.json.spec similarity index 100% rename from spec/v2/v2_detections.json.spec rename to spec/v2/detections.json.spec diff --git a/spec/v2/investigation_phantom_example.json b/spec/v2/investigation_phantom.json.example similarity index 100% rename from spec/v2/investigation_phantom_example.json rename to spec/v2/investigation_phantom.json.example diff --git a/spec/v2/investigation_search.json b/spec/v2/investigation_search.json.example similarity index 100% rename from spec/v2/investigation_search.json rename to spec/v2/investigation_search.json.example diff --git a/spec/v2/v2_investigations.json.spec b/spec/v2/investigations.json.spec similarity index 100% rename from spec/v2/v2_investigations.json.spec rename to spec/v2/investigations.json.spec diff --git a/spec/v2/story_dns_hijack.json b/spec/v2/story_dns_hijack.json.example similarity index 100% rename from spec/v2/story_dns_hijack.json rename to spec/v2/story_dns_hijack.json.example From aa67083954a033c215ba6b83d0d45249ae4eec78 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 10:34:24 -0400 Subject: [PATCH 18/74] moved examples into their own folder --- spec/v2/{ => example}/baseline_dns_record_changed.json.example | 0 spec/v2/{ => example}/detection_phantom.json.example | 0 spec/v2/{ => example}/detection_splunk.json.example | 0 spec/v2/{ => example}/investigation_phantom.json.example | 0 spec/v2/{ => example}/investigation_search.json.example | 0 spec/v2/{ => example}/story_dns_hijack.json.example | 0 6 files changed, 0 insertions(+), 0 deletions(-) rename spec/v2/{ => example}/baseline_dns_record_changed.json.example (100%) rename spec/v2/{ => example}/detection_phantom.json.example (100%) rename spec/v2/{ => example}/detection_splunk.json.example (100%) rename spec/v2/{ => example}/investigation_phantom.json.example (100%) rename spec/v2/{ => example}/investigation_search.json.example (100%) rename spec/v2/{ => example}/story_dns_hijack.json.example (100%) diff --git a/spec/v2/baseline_dns_record_changed.json.example b/spec/v2/example/baseline_dns_record_changed.json.example similarity index 100% rename from spec/v2/baseline_dns_record_changed.json.example rename to spec/v2/example/baseline_dns_record_changed.json.example diff --git a/spec/v2/detection_phantom.json.example b/spec/v2/example/detection_phantom.json.example similarity index 100% rename from spec/v2/detection_phantom.json.example rename to spec/v2/example/detection_phantom.json.example diff --git a/spec/v2/detection_splunk.json.example b/spec/v2/example/detection_splunk.json.example similarity index 100% rename from spec/v2/detection_splunk.json.example rename to spec/v2/example/detection_splunk.json.example diff --git a/spec/v2/investigation_phantom.json.example b/spec/v2/example/investigation_phantom.json.example similarity index 100% rename from spec/v2/investigation_phantom.json.example rename to spec/v2/example/investigation_phantom.json.example diff --git a/spec/v2/investigation_search.json.example b/spec/v2/example/investigation_search.json.example similarity index 100% rename from spec/v2/investigation_search.json.example rename to spec/v2/example/investigation_search.json.example diff --git a/spec/v2/story_dns_hijack.json.example b/spec/v2/example/story_dns_hijack.json.example similarity index 100% rename from spec/v2/story_dns_hijack.json.example rename to spec/v2/example/story_dns_hijack.json.example From f334e8173225030fbb52f4301781bbd22d70ac9b Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 11:05:14 -0400 Subject: [PATCH 19/74] updates --- spec/v2/detections.json.spec | 90 +++++++++++++++++++++++------------- 1 file changed, 59 insertions(+), 31 deletions(-) diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index 0cb4afea50..e421ef0506 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -1,8 +1,8 @@ { "description": "A object that defines the parameters for detecting things using various Splunk capabilities", + "type": "object", "$schema": "http://json-schema.org/draft-04/schema#", "title": "Detection Manifest", - "type": "object", "properties": { "name": { "description": "The name of the detection", @@ -362,41 +362,15 @@ }, { "$ref": "#/definitions/phantom" + }, + { + "$ref": "#/definitions/uba" } ] } }, "additionalProperties": false, "definitions": { - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" - }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - } - } - }, "splunk": { "type": "object", "properties": { @@ -509,6 +483,60 @@ "type": "string" } } + }, + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." + }, + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" + }, + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" + } + } + }, + "uba": { + "type": "object", + "properties": { + "threat_category": { + "type": "string", + "description": "The category of a threat in Splunk UBA." + }, + "uba_search": { + "type": "string", + "description": "The search you will run against the UEBA index to idenfiy the threat." + }, + "uba_event_type": { + "type": "string", + "description": "An anomaly or threat." + }, + "uba_model": { + "type": "string", + "description": "The name of the Splunk UBA model that detected the anomaly." + }, + "uba_model_version": { + "type": "string", + "description": "Url of the playbook on Phantom website." + } + } } }, "required": [ @@ -528,4 +556,4 @@ "version", "detect" ] -} \ No newline at end of file +}} \ No newline at end of file From a121e91d7255b8d955db4955afba0952fc72711f Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 11:09:51 -0400 Subject: [PATCH 20/74] uba detection --- spec/v2/detections.json.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index e421ef0506..908e369f9d 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -520,19 +520,19 @@ "type": "string", "description": "The category of a threat in Splunk UBA." }, - "uba_search": { + "search": { "type": "string", "description": "The search you will run against the UEBA index to idenfiy the threat." }, - "uba_event_type": { + "event_type": { "type": "string", "description": "An anomaly or threat." }, - "uba_model": { + "model": { "type": "string", "description": "The name of the Splunk UBA model that detected the anomaly." }, - "uba_model_version": { + "model_version": { "type": "string", "description": "Url of the playbook on Phantom website." } @@ -556,4 +556,4 @@ "version", "detect" ] -}} \ No newline at end of file +} \ No newline at end of file From af6689391771ed95849f265ef8a9a5c1d750119f Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 11:13:11 -0400 Subject: [PATCH 21/74] removed unecessary prefixes --- ...d_processes_to_es.json => add_prohibited_processes_to_es.json} | 0 ...s_service_accounts.json => approved_aws_service_accounts.json} | 0 ...ets_sorted_by_category.json => assets_sorted_by_category.json} | 0 ...lls_per_user_arn.json => baseline_api_calls_per_user_arn.json} | 0 ...upport_baseline_aws_regions.json => baseline_aws_regions.json} | 0 ...blocked_vpc_traffic.json => baseline_blocked_vpc_traffic.json} | 0 ...modifications.json => baseline_network_acl_modifications.json} | 0 ...e_s3_deletion_by_arn.json => baseline_s3_deletion_by_arn.json} | 0 ...y_by_arn.json => baseline_security_group_activity_by_arn.json} | 0 ...se_dnstwist_domains.json => brand_abuse_dnstwist_domains.json} | 0 ...upport_discover_dns_records.json => discover_dns_records.json} | 0 ...ntify_ports_on_network.json => identify_ports_on_network.json} | 0 ...dp_traffic.json => identify_systems_creating_rdp_traffic.json} | 0 ...p_traffic.json => identify_systems_receiving_rdp_traffic.json} | 0 ...te_desktop.json => identify_systems_using_remote_desktop.json} | 0 ...or_successful_backups.json => monitor_successful_backups.json} | 0 ...ndows_updates.json => monitor_successful_windows_updates.json} | 0 ...nsuccessful_backups.json => monitor_unsuccessful_backups.json} | 0 ...ows_updates.json => monitor_unsuccessful_windows_updates.json} | 0 ...ivity.json => previously_seen_aws_cross_account_activity.json} | 0 ...seen_cmd_arguments.json => previously_seen_cmd_arguments.json} | 0 ...reviously_seen_ec2_amis.json => previously_seen_ec2_amis.json} | 0 ...nstance_types.json => previously_seen_ec2_instance_types.json} | 0 ...hes_by_user.json => previously_seen_ec2_launches_by_user.json} | 0 ..._modifications.json => previously_seen_ec2_modifications.json} | 0 ...ty_src.json => previously_seen_provisioning_activity_src.json} | 0 ...y_seen_s3_remote_ip.json => previously_seen_s3_remote_ip.json} | 0 ...ously_seen_user_roles.json => previously_seen_user_roles.json} | 0 ...port_previously_seen_users.json => previously_seen_users.json} | 0 ...ce_starts.json => previously_seen_windows_service_starts.json} | 0 ...n_patch.json => systems_ready_for_spectre_meltdown_patch.json} | 0 ...termination.json => abnormally_high_instance_termination.json} | 0 ...nces_launched.json => abnormally_high_instances_launched.json} | 0 ...{detection_account_harvesting.json => account_harvesting.json} | 0 ...etection_acl_with_open_ports.json => acl_with_open_ports.json} | 0 ..._pass_the_hash.json => activity_related_to_pass_the_hash.json} | 0 ..._to_untrust_cert_store.json => add_to_untrust_cert_store.json} | 0 ...{detection_anomalous_webclick.json => anomalous_webclick.json} | 0 ...e.json => api_acitivity_from_previously_unseen_user_role.json} | 0 ....json => attackers_scanning_for_vulnerable_jboss_servers.json} | 0 ...ection_attrib_to_hide_files.json => attrib_to_hide_files.json} | 0 ...accounts.json => aws_activity_from_non_approved_accounts.json} | 0 ...ctivity_in_new_region.json => aws_activity_in_new_region.json} | 0 ...on => aws_cloud_provisioning_from_previously_unseen_city.json} | 0 ...=> aws_cloud_provisioning_from_previously_unseen_country.json} | 0 ...json => aws_cloud_provisioning_from_previously_unseen_ip.json} | 0 ... => aws_cloud_provisioning_from_previously_unseen_region.json} | 0 ...ount.json => aws_cross_account_activity_from_new_account.json} | 0 ...on_aws_spike_acl_activity.json => aws_spike_acl_activity.json} | 0 ...{detection_badrabbit_schtasks.json => badrabbit_schtasks.json} | 0 ...ch_file_write_system32.json => batch_file_write_system32.json} | 0 .../{detection_brand_abuse_dns.json => brand_abuse_dns.json} | 0 .../{detection_brand_abuse_email.json => brand_abuse_email.json} | 0 .../{detection_brand_abuse_web.json => brand_abuse_web.json} | 0 ..._change_file_association.json => change_file_association.json} | 0 ...etection_children_of_spoolsv.json => children_of_spoolsv.json} | 0 ...rvers.json => clients_connecting_to_multiple_dns_servers.json} | 0 ...nsomware_extensions.json => common_ransomware_extensions.json} | 0 ..._common_ransomware_notes.json => common_ransomware_notes.json} | 0 ...ection_create_hidden_shares.json => create_hidden_shares.json} | 0 ...e_local_admin_via_net.json => create_local_admin_via_net.json} | 0 .../{detection_cred_dump_via_reg.json => cred_dump_via_reg.json} | 0 .../{detection_cscript_via_cmd.json => cscript_via_cmd.json} | 0 ...ection_delete_shadow_copies.json => delete_shadow_copies.json} | 0 ...ection_deletion_network_acl.json => deletion_network_acl.json} | 0 ...{detection_disable_remote_uac.json => disable_remote_uac.json} | 0 ...lification_any_query.json => dns_amplification_any_query.json} | 0 ...on.json => dns_query_length_with_high_standard_deviation.json} | 0 ...{detection_dns_record_changed.json => dns_record_changed.json} | 0 detections/{detection_dns_tunnelling.json => dns_tunnelling.json} | 0 ...{detection_dragonfly_schtasks.json => dragonfly_schtasks.json} | 0 .../{detection_dyn_dns_queries.json => dyn_dns_queries.json} | 0 ...etection_dyn_dns_web_traffic.json => dyn_dns_web_traffic.json} | 0 ...r.json => ec2_instance_created_by_previously_unseen_user.json} | 0 ....json => ec2_instance_modified_by_previously_unseen_user.json} | 0 ....json => ec2_instance_started_with_previously_unseen_ami.json} | 0 ...c2_instance_started_with_previously_unseen_instance_type.json} | 0 ...hments_with_spaces.json => email_attachments_with_spaces.json} | 0 ...k_directory.json => email_files_not_in_outlook_directory.json} | 0 ...son => emailserver_high_volume_outbound_traffic_to_hosts.json} | 0 ...on_excessive_dns_failures.json => excessive_dns_failures.json} | 0 ...s_from_endpoint.json => excessive_lockouts_from_endpoint.json} | 0 ...account_lockouts.json => excessive_user_account_lockouts.json} | 0 ...tion_of_nirsoft_tools.json => execution_of_nirsoft_tools.json} | 0 .../{detection_file_write_spikes.json => file_write_spikes.json} | 0 ...irst_time_seen_cmd_line.json => first_time_seen_cmd_line.json} | 0 ..._service.json => first_time_seen_running_windows_service.json} | 0 ...sutil_deleting_journals.json => fsutil_deleting_journals.json} | 0 ..._hosts_file_modification.json => hosts_file_modification.json} | 0 ...receiving_high_volume_network_traffic_from_email_servers.json} | 0 ...etection_large_icmp_outbound.json => large_icmp_outbound.json} | 0 ...in_account_creation.json => local_admin_account_creation.json} | 0 ...on_long_dns_text_response.json => long_dns_text_response.json} | 0 ...stry.json => malicious_application_shimming_via_registry.json} | 0 ...owershell_process_connect_to_internet_with_hidden_window.json} | 0 ...and.json => malicious_powershell_process_encoded_command.json} | 0 ...ecpolicy.json => malicious_powershell_process_execpolicy.json} | 0 ...licious_powershell_process_multiple_suspicious_arguments.json} | 0 ...n => malicious_powershell_process_obfuscation_techniques.json} | 0 ...vers.json => malicious_requests_to_exploit_jboss_servers.json} | 0 ..._mshta_launching_scripts.json => mshta_launching_scripts.json} | 0 ..._netbackup_failed_backup.json => netbackup_failed_backup.json} | 0 ..._time_period.json => netbackup_no_backups_in_time_period.json} | 0 ..._netsh_launching_process.json => netsh_launching_process.json} | 0 ...sole_login_by_user.json => new_aws_console_login_by_user.json} | 0 ...onnections_to_routers.json => new_connections_to_routers.json} | 0 ...etection_new_open_s3_buckets.json => new_open_s3_buckets.json} | 0 .../{detection_new_user_accounts.json => new_user_accounts.json} | 0 ...updates_in_timeframe.json => no_win_updates_in_timeframe.json} | 0 ...direct_in_splunk_web.json => open_redirect_in_splunk_web.json} | 0 .../{detection_osx_coldroot_pack.json => osx_coldroot_pack.json} | 0 .../{detection_osx_keyboard_taps.json => osx_keyboard_taps.json} | 0 ...utbound_smb_connections.json => outbound_smb_connections.json} | 0 ...bility_binaries.json => overwrite_accessibility_binaries.json} | 0 .../{detection_password_sharing.json => password_sharing.json} | 0 ...eption_program.exe.json => path_interception_program.exe.json} | 0 ...t_monitor_via_registry.json => port_monitor_via_registry.json} | 0 ...on_powershell_get_sedebug.json => powershell_get_sedebug.json} | 0 ...shell_read_from_lsass.json => powershell_read_from_lsass.json} | 0 ...on_powershell_reg_key_mod.json => powershell_reg_key_mod.json} | 0 ..._process_launching_netsh.json => process_launching_netsh.json} | 0 ...h_double_extension.json => process_with_double_extension.json} | 0 ...e_extension.json => process_with_spaces_before_extension.json} | 0 ...allowed_through_fw.json => prohibited_allowed_through_fw.json} | 0 ...ing_cmdprompt.json => prohibited_apps_spawning_cmdprompt.json} | 0 ...ware_on_endpoint.json => prohibited_software_on_endpoint.json} | 0 .../{detection_protocol_mismatch.json => protocol_mismatch.json} | 0 ..._cleartext.json => protocols_authenticating_in_cleartext.json} | 0 .../{detection_psexec_accepteula.json => psexec_accepteula.json} | 0 ...utables_on_endpoint.json => rare_executables_on_endpoint.json} | 0 ..._manipulating_services.json => reg_manipulating_services.json} | 0 ...on_reg_used_to_hide_files.json => reg_used_to_hide_files.json} | 0 ...ection_registry_persistence.json => registry_persistence.json} | 0 ...ivilege_escalation.json => registry_privilege_escalation.json} | 0 ...ote_desktop_bruteforce.json => remote_desktop_bruteforce.json} | 0 ...p_network_traffic.json => remote_desktop_network_traffic.json} | 0 ..._system.json => remote_desktop_process_running_on_system.json} | 0 ...stry_modifications.json => remote_registry_modifications.json} | 0 ...e_wmi_command_attempt.json => remote_wmi_command_attempt.json} | 0 ...s_instantiation.json => remote_wmi_process_instantiation.json} | 0 ...ing_dll_by_ordinal.json => rundll_loading_dll_by_ordinal.json} | 0 ...tion_s3_access_from_new_ip.json => s3_access_from_new_ip.json} | 0 ...sam_payload_extensions.json => samsam_payload_extensions.json} | 0 ...on_samsam_test_file_write.json => samsam_test_file_write.json} | 0 ...c_manipulating_services.json => sc_manipulating_services.json} | 0 ...on_schtasks_forced_reboot.json => schtasks_forced_reboot.json} | 0 ..._system.json => schtasks_scheduling_job_on_remote_system.json} | 0 ...tabase_file_creation.json => shim_database_file_creation.json} | 0 ...database_installation.json => shim_database_installation.json} | 0 ...ection_short_lived_accounts.json => short_lived_accounts.json} | 0 ...gle_letter_executables.json => single_letter_executables.json} | 0 .../{detection_smb_traffic_spike.json => smb_traffic_spike.json} | 0 detections/{detection_sncd_processes.json => sncd_processes.json} | 0 ...vulnerabilities.json => spectre_meltdown_vulnerabilities.json} | 0 ..._call_per_account.json => spike_aws_api_call_per_account.json} | 0 ...group_activity.json => spike_aws_security_group_activity.json} | 0 .../{detection_spike_s3_deletion.json => spike_s3_deletion.json} | 0 ...ke_vpc_blocked_traffic.json => spike_vpc_blocked_traffic.json} | 0 ...rmation_disclosure.json => splunk_information_disclosure.json} | 0 ...tion_with_long_urls.json => sql_injection_with_long_urls.json} | 0 ...on_stop_security_services.json => stop_security_services.json} | 0 ...s_email_attachments.json => suspicious_email_attachments.json} | 0 ...on_suspicious_file_writes.json => suspicious_file_writes.json} | 0 ..._suspicious_java_classes.json => suspicious_java_classes.json} | 0 ...on_suspicious_reg_process.json => suspicious_reg_process.json} | 0 ...picious_wevtutil_usage.json => suspicious_wevtutil_usage.json} | 0 ...s_write_to_recycler.json => suspicious_write_to_recycler.json} | 0 ...cious_write_to_sysvol.json => suspicious_write_to_sysvol.json} | 0 ...s.json => system_processes_run_from_unexpected_locations.json} | 0 detections/{detection_tor_traffic.json => tor_traffic.json} | 0 ..._mac_address.json => unauthorized_assets_via_mac_address.json} | 0 ...nauthorized_dns_servers.json => unauthorized_dns_servers.json} | 0 ...{detection_uncommon_processes.json => uncommon_processes.json} | 0 ...ly_long_commandlines.json => unusually_long_commandlines.json} | 0 ...t-type_length.json => unusually_long_content-type_length.json} | 0 detections/{detection_usb_insertion.json => usb_insertion.json} | 0 .../{detection_users_without_mfa.json => users_without_mfa.json} | 0 ...esses.json => web_servers_executing_suspicious_processes.json} | 0 ...dows_event_log_cleared.json => windows_event_log_cleared.json} | 0 ...m_event_subscription.json => wmi_perm_event_subscription.json} | 0 ...iption_sysmon.json => wmi_perm_event_subscription_sysmon.json} | 0 ...{detection_wmi_process_launch.json => wmi_process_launch.json} | 0 ...ection_wmi_script_execution.json => wmi_script_execution.json} | 0 ...p_event_subscription.json => wmi_temp_event_subscription.json} | 0 ..._aws_activity_via_region.json => aws_activity_via_region.json} | 0 ..._interface_details.json => aws_network_interface_details.json} | 0 ...tual_aws_s3_bucket_details.json => aws_s3_bucket_details.json} | 0 ..._by_user_field.json => aws_user_activities_by_user_field.json} | 0 ..._by_accesskeyid.json => aws_user_activity_by_accesskeyid.json} | 0 ...tivity_by_src_user.json => aws_user_activity_by_src_user.json} | 0 ...estigative_dns_server_history.json => dns_server_history.json} | 0 ...nvestigative_dns_traffic_stats.json => dns_traffic_stats.json} | 0 ...n_cobra_actors.json => email_sent_to_hidden_cobra_actors.json} | 0 ...urrence_mac_address.json => first_occurrence_mac_address.json} | 0 .../{contextual_get_acl_details.json => get_acl_details.json} | 0 ...ivitiy_from_city.json => get_all_aws_activitiy_from_city.json} | 0 ..._from_country.json => get_all_aws_activitiy_from_country.json} | 0 ...iy_from_region.json => get_all_aws_activitiy_from_region.json} | 0 ...iy_from_src_ip.json => get_all_aws_activitiy_from_src_ip.json} | 0 ...ackup_data_for_host.json => get_all_backup_data_for_host.json} | 0 ...or_endpoint.json => get_authentication_logs_for_endpoint.json} | 0 ...p_logs_for_endpoint.json => get_backup_logs_for_endpoint.json} | 0 ...ls_by_instance_id.json => get_ec2_details_by_instance_id.json} | 0 ...al_get_ec2_launch_details.json => get_ec2_launch_details.json} | 0 .../{investigative_get_email_info.json => get_email_info.json} | 0 ...ve_get_emails_from_sender.json => get_emails_from_sender.json} | 0 ...ve_get_emails_from_source.json => get_emails_from_source.json} | 0 ...oint.json => get_logon_rights_modifications_for_endpoint.json} | 0 ...for_user.json => get_logon_rights_modifications_for_user.json} | 0 ...ffic_from_src_ip.json => get_network_traffic_from_src_ip.json} | 0 ...ry_for_endpoint.json => get_notable_history_for_endpoint.json} | 0 .../{contextual_get_notable_info.json => get_notable_info.json} | 0 ..._get_parent_process_info.json => get_parent_process_info.json} | 0 ...ing_dns_traffic.json => get_process_creating_dns_traffic.json} | 0 ...{investigative_get_process_info.json => get_process_info.json} | 0 ..._process_info_for_port.json => get_process_info_for_port.json} | 0 ..._get_rdp_authentications.json => get_rdp_authentications.json} | 0 ..._get_registry_activities.json => get_registry_activities.json} | 0 ...tual_get_risk_for_endpoint.json => get_risk_for_endpoint.json} | 0 .../{contextual_get_risk_for_user.json => get_risk_for_user.json} | 0 ...e_logs_for_endpoint.json => get_update_logs_for_endpoint.json} | 0 ...identity_table.json => get_user_info_from_identity_table.json} | 0 ...for_endpoint.json => get_vulnerability_logs_for_endpoint.json} | 0 ...{investigative_get_web_activity.json => get_web_activity.json} | 0 ...eb_activity_by_src_ip.json => get_web_activity_by_src_ip.json} | 0 ...gative_get_web_posts_by_src.json => get_web_posts_by_src.json} | 0 ...gative_get_web_session_info.json => get_web_session_info.json} | 0 ...tive_get_wmi_sysmon_events.json => get_wmi_sysmon_events.json} | 0 ...in_HTTP_header.json => suspicious_strings_in_HTTP_header.json} | 0 ...vity_via_cloudtrail.json => user_activity_via_cloudtrail.json} | 0 230 files changed, 0 insertions(+), 0 deletions(-) rename baselines/{support_add_prohibited_processes_to_es.json => add_prohibited_processes_to_es.json} (100%) rename baselines/{support_approved_aws_service_accounts.json => approved_aws_service_accounts.json} (100%) rename baselines/{support_assets_sorted_by_category.json => assets_sorted_by_category.json} (100%) rename baselines/{support_baseline_api_calls_per_user_arn.json => baseline_api_calls_per_user_arn.json} (100%) rename baselines/{support_baseline_aws_regions.json => baseline_aws_regions.json} (100%) rename baselines/{support_baseline_blocked_vpc_traffic.json => baseline_blocked_vpc_traffic.json} (100%) rename baselines/{support_baseline_network_acl_modifications.json => baseline_network_acl_modifications.json} (100%) rename baselines/{support_baseline_s3_deletion_by_arn.json => baseline_s3_deletion_by_arn.json} (100%) rename baselines/{support_baseline_security_group_activity_by_arn.json => baseline_security_group_activity_by_arn.json} (100%) rename baselines/{support_brand_abuse_dnstwist_domains.json => brand_abuse_dnstwist_domains.json} (100%) rename baselines/{support_discover_dns_records.json => discover_dns_records.json} (100%) rename baselines/{support_identify_ports_on_network.json => identify_ports_on_network.json} (100%) rename baselines/{support_identify_systems_creating_rdp_traffic.json => identify_systems_creating_rdp_traffic.json} (100%) rename baselines/{support_identify_systems_receiving_rdp_traffic.json => identify_systems_receiving_rdp_traffic.json} (100%) rename baselines/{support_identify_systems_using_remote_desktop.json => identify_systems_using_remote_desktop.json} (100%) rename baselines/{support_monitor_successful_backups.json => monitor_successful_backups.json} (100%) rename baselines/{support_monitor_successful_windows_updates.json => monitor_successful_windows_updates.json} (100%) rename baselines/{support_monitor_unsuccessful_backups.json => monitor_unsuccessful_backups.json} (100%) rename baselines/{support_monitor_unsuccessful_windows_updates.json => monitor_unsuccessful_windows_updates.json} (100%) rename baselines/{support_previously_seen_aws_cross_account_activity.json => previously_seen_aws_cross_account_activity.json} (100%) rename baselines/{support_previously_seen_cmd_arguments.json => previously_seen_cmd_arguments.json} (100%) rename baselines/{support_previously_seen_ec2_amis.json => previously_seen_ec2_amis.json} (100%) rename baselines/{support_previously_seen_ec2_instance_types.json => previously_seen_ec2_instance_types.json} (100%) rename baselines/{support_previously_seen_ec2_launches_by_user.json => previously_seen_ec2_launches_by_user.json} (100%) rename baselines/{support_previously_seen_ec2_modifications.json => previously_seen_ec2_modifications.json} (100%) rename baselines/{support_previously_seen_provisioning_activity_src.json => previously_seen_provisioning_activity_src.json} (100%) rename baselines/{support_previously_seen_s3_remote_ip.json => previously_seen_s3_remote_ip.json} (100%) rename baselines/{support_previously_seen_user_roles.json => previously_seen_user_roles.json} (100%) rename baselines/{support_previously_seen_users.json => previously_seen_users.json} (100%) rename baselines/{support_previously_seen_windows_service_starts.json => previously_seen_windows_service_starts.json} (100%) rename baselines/{support_systems_ready_for_spectre_meltdown_patch.json => systems_ready_for_spectre_meltdown_patch.json} (100%) rename detections/{detection_abnormally_high_instance_termination.json => abnormally_high_instance_termination.json} (100%) rename detections/{detection_abnormally_high_instances_launched.json => abnormally_high_instances_launched.json} (100%) rename detections/{detection_account_harvesting.json => account_harvesting.json} (100%) rename detections/{detection_acl_with_open_ports.json => acl_with_open_ports.json} (100%) rename detections/{detection_activity_related_to_pass_the_hash.json => activity_related_to_pass_the_hash.json} (100%) rename detections/{detection_add_to_untrust_cert_store.json => add_to_untrust_cert_store.json} (100%) rename detections/{detection_anomalous_webclick.json => anomalous_webclick.json} (100%) rename detections/{detection_api_acitivity_from_previously_unseen_user_role.json => api_acitivity_from_previously_unseen_user_role.json} (100%) rename detections/{detection_attackers_scanning_for_vulnerable_jboss_servers.json => attackers_scanning_for_vulnerable_jboss_servers.json} (100%) rename detections/{detection_attrib_to_hide_files.json => attrib_to_hide_files.json} (100%) rename detections/{detection_aws_activity_from_non_approved_accounts.json => aws_activity_from_non_approved_accounts.json} (100%) rename detections/{detection_aws_activity_in_new_region.json => aws_activity_in_new_region.json} (100%) rename detections/{detection_aws_cloud_provisioning_from_previously_unseen_city.json => aws_cloud_provisioning_from_previously_unseen_city.json} (100%) rename detections/{detection_aws_cloud_provisioning_from_previously_unseen_country.json => aws_cloud_provisioning_from_previously_unseen_country.json} (100%) rename detections/{detection_aws_cloud_provisioning_from_previously_unseen_ip.json => aws_cloud_provisioning_from_previously_unseen_ip.json} (100%) rename detections/{detection_aws_cloud_provisioning_from_previously_unseen_region.json => aws_cloud_provisioning_from_previously_unseen_region.json} (100%) rename detections/{detection_aws_cross_account_activity_from_new_account.json => aws_cross_account_activity_from_new_account.json} (100%) rename detections/{detection_aws_spike_acl_activity.json => aws_spike_acl_activity.json} (100%) rename detections/{detection_badrabbit_schtasks.json => badrabbit_schtasks.json} (100%) rename detections/{detection_batch_file_write_system32.json => batch_file_write_system32.json} (100%) rename detections/{detection_brand_abuse_dns.json => brand_abuse_dns.json} (100%) rename detections/{detection_brand_abuse_email.json => brand_abuse_email.json} (100%) rename detections/{detection_brand_abuse_web.json => brand_abuse_web.json} (100%) rename detections/{detection_change_file_association.json => change_file_association.json} (100%) rename detections/{detection_children_of_spoolsv.json => children_of_spoolsv.json} (100%) rename detections/{detection_clients_connecting_to_multiple_dns_servers.json => clients_connecting_to_multiple_dns_servers.json} (100%) rename detections/{detection_common_ransomware_extensions.json => common_ransomware_extensions.json} (100%) rename detections/{detection_common_ransomware_notes.json => common_ransomware_notes.json} (100%) rename detections/{detection_create_hidden_shares.json => create_hidden_shares.json} (100%) rename detections/{detection_create_local_admin_via_net.json => create_local_admin_via_net.json} (100%) rename detections/{detection_cred_dump_via_reg.json => cred_dump_via_reg.json} (100%) rename detections/{detection_cscript_via_cmd.json => cscript_via_cmd.json} (100%) rename detections/{detection_delete_shadow_copies.json => delete_shadow_copies.json} (100%) rename detections/{detection_deletion_network_acl.json => deletion_network_acl.json} (100%) rename detections/{detection_disable_remote_uac.json => disable_remote_uac.json} (100%) rename detections/{detection_dns_amplification_any_query.json => dns_amplification_any_query.json} (100%) rename detections/{detection_dns_query_length_with_high_standard_deviation.json => dns_query_length_with_high_standard_deviation.json} (100%) rename detections/{detection_dns_record_changed.json => dns_record_changed.json} (100%) rename detections/{detection_dns_tunnelling.json => dns_tunnelling.json} (100%) rename detections/{detection_dragonfly_schtasks.json => dragonfly_schtasks.json} (100%) rename detections/{detection_dyn_dns_queries.json => dyn_dns_queries.json} (100%) rename detections/{detection_dyn_dns_web_traffic.json => dyn_dns_web_traffic.json} (100%) rename detections/{detection_ec2_instance_created_by_previously_unseen_user.json => ec2_instance_created_by_previously_unseen_user.json} (100%) rename detections/{detection_ec2_instance_modified_by_previously_unseen_user.json => ec2_instance_modified_by_previously_unseen_user.json} (100%) rename detections/{detection_ec2_instance_started_with_previously_unseen_ami.json => ec2_instance_started_with_previously_unseen_ami.json} (100%) rename detections/{detection_ec2_instance_started_with_previously_unseen_instance_type.json => ec2_instance_started_with_previously_unseen_instance_type.json} (100%) rename detections/{detection_email_attachments_with_spaces.json => email_attachments_with_spaces.json} (100%) rename detections/{detection_email_files_not_in_outlook_directory.json => email_files_not_in_outlook_directory.json} (100%) rename detections/{detection_emailserver_high_volume_outbound_traffic_to_hosts.json => emailserver_high_volume_outbound_traffic_to_hosts.json} (100%) rename detections/{detection_excessive_dns_failures.json => excessive_dns_failures.json} (100%) rename detections/{detection_excessive_lockouts_from_endpoint.json => excessive_lockouts_from_endpoint.json} (100%) rename detections/{detection_excessive_user_account_lockouts.json => excessive_user_account_lockouts.json} (100%) rename detections/{detection_execution_of_nirsoft_tools.json => execution_of_nirsoft_tools.json} (100%) rename detections/{detection_file_write_spikes.json => file_write_spikes.json} (100%) rename detections/{detection_first_time_seen_cmd_line.json => first_time_seen_cmd_line.json} (100%) rename detections/{detection_first_time_seen_running_windows_service.json => first_time_seen_running_windows_service.json} (100%) rename detections/{detection_fsutil_deleting_journals.json => fsutil_deleting_journals.json} (100%) rename detections/{detection_hosts_file_modification.json => hosts_file_modification.json} (100%) rename detections/{detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json => hosts_receiving_high_volume_network_traffic_from_email_servers.json} (100%) rename detections/{detection_large_icmp_outbound.json => large_icmp_outbound.json} (100%) rename detections/{detection_local_admin_account_creation.json => local_admin_account_creation.json} (100%) rename detections/{detection_long_dns_text_response.json => long_dns_text_response.json} (100%) rename detections/{detection_malicious_application_shimming_via_registry.json => malicious_application_shimming_via_registry.json} (100%) rename detections/{detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json => malicious_powershell_process_connect_to_internet_with_hidden_window.json} (100%) rename detections/{detection_malicious_powershell_process_encoded_command.json => malicious_powershell_process_encoded_command.json} (100%) rename detections/{detection_malicious_powershell_process_execpolicy.json => malicious_powershell_process_execpolicy.json} (100%) rename detections/{detection_malicious_powershell_process_multiple_suspicious_arguments.json => malicious_powershell_process_multiple_suspicious_arguments.json} (100%) rename detections/{detection_malicious_powershell_process_obfuscation_techniques.json => malicious_powershell_process_obfuscation_techniques.json} (100%) rename detections/{detection_malicious_requests_to_exploit_jboss_servers.json => malicious_requests_to_exploit_jboss_servers.json} (100%) rename detections/{detection_mshta_launching_scripts.json => mshta_launching_scripts.json} (100%) rename detections/{detection_netbackup_failed_backup.json => netbackup_failed_backup.json} (100%) rename detections/{detection_netbackup_no_backups_in_time_period.json => netbackup_no_backups_in_time_period.json} (100%) rename detections/{detection_netsh_launching_process.json => netsh_launching_process.json} (100%) rename detections/{detection_new_aws_console_login_by_user.json => new_aws_console_login_by_user.json} (100%) rename detections/{detection_new_connections_to_routers.json => new_connections_to_routers.json} (100%) rename detections/{detection_new_open_s3_buckets.json => new_open_s3_buckets.json} (100%) rename detections/{detection_new_user_accounts.json => new_user_accounts.json} (100%) rename detections/{detection_no_win_updates_in_timeframe.json => no_win_updates_in_timeframe.json} (100%) rename detections/{detection_open_redirect_in_splunk_web.json => open_redirect_in_splunk_web.json} (100%) rename detections/{detection_osx_coldroot_pack.json => osx_coldroot_pack.json} (100%) rename detections/{detection_osx_keyboard_taps.json => osx_keyboard_taps.json} (100%) rename detections/{detection_outbound_smb_connections.json => outbound_smb_connections.json} (100%) rename detections/{detection_overwrite_accessibility_binaries.json => overwrite_accessibility_binaries.json} (100%) rename detections/{detection_password_sharing.json => password_sharing.json} (100%) rename detections/{detection_path_interception_program.exe.json => path_interception_program.exe.json} (100%) rename detections/{detection_port_monitor_via_registry.json => port_monitor_via_registry.json} (100%) rename detections/{detection_powershell_get_sedebug.json => powershell_get_sedebug.json} (100%) rename detections/{detection_powershell_read_from_lsass.json => powershell_read_from_lsass.json} (100%) rename detections/{detection_powershell_reg_key_mod.json => powershell_reg_key_mod.json} (100%) rename detections/{detection_process_launching_netsh.json => process_launching_netsh.json} (100%) rename detections/{detection_process_with_double_extension.json => process_with_double_extension.json} (100%) rename detections/{detection_process_with_spaces_before_extension.json => process_with_spaces_before_extension.json} (100%) rename detections/{detection_prohibited_allowed_through_fw.json => prohibited_allowed_through_fw.json} (100%) rename detections/{detection_prohibited_apps_spawning_cmdprompt.json => prohibited_apps_spawning_cmdprompt.json} (100%) rename detections/{detection_prohibited_software_on_endpoint.json => prohibited_software_on_endpoint.json} (100%) rename detections/{detection_protocol_mismatch.json => protocol_mismatch.json} (100%) rename detections/{detection_protocols_authenticating_in_cleartext.json => protocols_authenticating_in_cleartext.json} (100%) rename detections/{detection_psexec_accepteula.json => psexec_accepteula.json} (100%) rename detections/{detection_rare_executables_on_endpoint.json => rare_executables_on_endpoint.json} (100%) rename detections/{detection_reg_manipulating_services.json => reg_manipulating_services.json} (100%) rename detections/{detection_reg_used_to_hide_files.json => reg_used_to_hide_files.json} (100%) rename detections/{detection_registry_persistence.json => registry_persistence.json} (100%) rename detections/{detection_registry_privilege_escalation.json => registry_privilege_escalation.json} (100%) rename detections/{detection_remote_desktop_bruteforce.json => remote_desktop_bruteforce.json} (100%) rename detections/{detection_remote_desktop_network_traffic.json => remote_desktop_network_traffic.json} (100%) rename detections/{detection_remote_desktop_process_running_on_system.json => remote_desktop_process_running_on_system.json} (100%) rename detections/{detection_remote_registry_modifications.json => remote_registry_modifications.json} (100%) rename detections/{detection_remote_wmi_command_attempt.json => remote_wmi_command_attempt.json} (100%) rename detections/{detection_remote_wmi_process_instantiation.json => remote_wmi_process_instantiation.json} (100%) rename detections/{detection_rundll_loading_dll_by_ordinal.json => rundll_loading_dll_by_ordinal.json} (100%) rename detections/{detection_s3_access_from_new_ip.json => s3_access_from_new_ip.json} (100%) rename detections/{detection_samsam_payload_extensions.json => samsam_payload_extensions.json} (100%) rename detections/{detection_samsam_test_file_write.json => samsam_test_file_write.json} (100%) rename detections/{detection_sc_manipulating_services.json => sc_manipulating_services.json} (100%) rename detections/{detection_schtasks_forced_reboot.json => schtasks_forced_reboot.json} (100%) rename detections/{detection_schtasks_scheduling_job_on_remote_system.json => schtasks_scheduling_job_on_remote_system.json} (100%) rename detections/{detection_shim_database_file_creation.json => shim_database_file_creation.json} (100%) rename detections/{detection_shim_database_installation.json => shim_database_installation.json} (100%) rename detections/{detection_short_lived_accounts.json => short_lived_accounts.json} (100%) rename detections/{detection_single_letter_executables.json => single_letter_executables.json} (100%) rename detections/{detection_smb_traffic_spike.json => smb_traffic_spike.json} (100%) rename detections/{detection_sncd_processes.json => sncd_processes.json} (100%) rename detections/{detection_spectre_meltdown_vulnerabilities.json => spectre_meltdown_vulnerabilities.json} (100%) rename detections/{detection_spike_aws_api_call_per_account.json => spike_aws_api_call_per_account.json} (100%) rename detections/{detection_spike_aws_security_group_activity.json => spike_aws_security_group_activity.json} (100%) rename detections/{detection_spike_s3_deletion.json => spike_s3_deletion.json} (100%) rename detections/{detection_spike_vpc_blocked_traffic.json => spike_vpc_blocked_traffic.json} (100%) rename detections/{detection_splunk_information_disclosure.json => splunk_information_disclosure.json} (100%) rename detections/{detection_sql_injection_with_long_urls.json => sql_injection_with_long_urls.json} (100%) rename detections/{detection_stop_security_services.json => stop_security_services.json} (100%) rename detections/{detection_suspicious_email_attachments.json => suspicious_email_attachments.json} (100%) rename detections/{detection_suspicious_file_writes.json => suspicious_file_writes.json} (100%) rename detections/{detection_suspicious_java_classes.json => suspicious_java_classes.json} (100%) rename detections/{detection_suspicious_reg_process.json => suspicious_reg_process.json} (100%) rename detections/{detection_suspicious_wevtutil_usage.json => suspicious_wevtutil_usage.json} (100%) rename detections/{detection_suspicious_write_to_recycler.json => suspicious_write_to_recycler.json} (100%) rename detections/{detection_suspicious_write_to_sysvol.json => suspicious_write_to_sysvol.json} (100%) rename detections/{detection_system_processes_run_from_unexpected_locations.json => system_processes_run_from_unexpected_locations.json} (100%) rename detections/{detection_tor_traffic.json => tor_traffic.json} (100%) rename detections/{detection_unauthorized_assets_via_mac_address.json => unauthorized_assets_via_mac_address.json} (100%) rename detections/{detection_unauthorized_dns_servers.json => unauthorized_dns_servers.json} (100%) rename detections/{detection_uncommon_processes.json => uncommon_processes.json} (100%) rename detections/{detection_unusually_long_commandlines.json => unusually_long_commandlines.json} (100%) rename detections/{detection_unusually_long_content-type_length.json => unusually_long_content-type_length.json} (100%) rename detections/{detection_usb_insertion.json => usb_insertion.json} (100%) rename detections/{detection_users_without_mfa.json => users_without_mfa.json} (100%) rename detections/{detection_web_servers_executing_suspicious_processes.json => web_servers_executing_suspicious_processes.json} (100%) rename detections/{detection_windows_event_log_cleared.json => windows_event_log_cleared.json} (100%) rename detections/{detection_wmi_perm_event_subscription.json => wmi_perm_event_subscription.json} (100%) rename detections/{detection_wmi_perm_event_subscription_sysmon.json => wmi_perm_event_subscription_sysmon.json} (100%) rename detections/{detection_wmi_process_launch.json => wmi_process_launch.json} (100%) rename detections/{detection_wmi_script_execution.json => wmi_script_execution.json} (100%) rename detections/{detection_wmi_temp_event_subscription.json => wmi_temp_event_subscription.json} (100%) rename investigations/{investigative_aws_activity_via_region.json => aws_activity_via_region.json} (100%) rename investigations/{contextual_aws_network_interface_details.json => aws_network_interface_details.json} (100%) rename investigations/{contextual_aws_s3_bucket_details.json => aws_s3_bucket_details.json} (100%) rename investigations/{investigative_aws_user_activities_by_user_field.json => aws_user_activities_by_user_field.json} (100%) rename investigations/{investigative_aws_user_activity_by_accesskeyid.json => aws_user_activity_by_accesskeyid.json} (100%) rename investigations/{investigative_aws_user_activity_by_src_user.json => aws_user_activity_by_src_user.json} (100%) rename investigations/{investigative_dns_server_history.json => dns_server_history.json} (100%) rename investigations/{investigative_dns_traffic_stats.json => dns_traffic_stats.json} (100%) rename investigations/{investigative_email_sent_to_hidden_cobra_actors.json => email_sent_to_hidden_cobra_actors.json} (100%) rename investigations/{contextual_first_occurrence_mac_address.json => first_occurrence_mac_address.json} (100%) rename investigations/{contextual_get_acl_details.json => get_acl_details.json} (100%) rename investigations/{investigative_get_all_aws_activitiy_from_city.json => get_all_aws_activitiy_from_city.json} (100%) rename investigations/{investigative_get_all_aws_activitiy_from_country.json => get_all_aws_activitiy_from_country.json} (100%) rename investigations/{investigative_get_all_aws_activitiy_from_region.json => get_all_aws_activitiy_from_region.json} (100%) rename investigations/{investigative_get_all_aws_activitiy_from_src_ip.json => get_all_aws_activitiy_from_src_ip.json} (100%) rename investigations/{investigative_get_all_backup_data_for_host.json => get_all_backup_data_for_host.json} (100%) rename investigations/{contextual_get_authentication_logs_for_endpoint.json => get_authentication_logs_for_endpoint.json} (100%) rename investigations/{contextual_get_backup_logs_for_endpoint.json => get_backup_logs_for_endpoint.json} (100%) rename investigations/{contextual_get_ec2_details_by_instance_id.json => get_ec2_details_by_instance_id.json} (100%) rename investigations/{contextual_get_ec2_launch_details.json => get_ec2_launch_details.json} (100%) rename investigations/{investigative_get_email_info.json => get_email_info.json} (100%) rename investigations/{investigative_get_emails_from_sender.json => get_emails_from_sender.json} (100%) rename investigations/{investigative_get_emails_from_source.json => get_emails_from_source.json} (100%) rename investigations/{investigative_get_logon_rights_modifications_for_endpoint.json => get_logon_rights_modifications_for_endpoint.json} (100%) rename investigations/{investigative_get_logon_rights_modifications_for_user.json => get_logon_rights_modifications_for_user.json} (100%) rename investigations/{investigative_get_network_traffic_from_src_ip.json => get_network_traffic_from_src_ip.json} (100%) rename investigations/{contextual_get_notable_history_for_endpoint.json => get_notable_history_for_endpoint.json} (100%) rename investigations/{contextual_get_notable_info.json => get_notable_info.json} (100%) rename investigations/{investigative_get_parent_process_info.json => get_parent_process_info.json} (100%) rename investigations/{investigative_get_process_creating_dns_traffic.json => get_process_creating_dns_traffic.json} (100%) rename investigations/{investigative_get_process_info.json => get_process_info.json} (100%) rename investigations/{investigative_get_process_info_for_port.json => get_process_info_for_port.json} (100%) rename investigations/{investigative_get_rdp_authentications.json => get_rdp_authentications.json} (100%) rename investigations/{investigative_get_registry_activities.json => get_registry_activities.json} (100%) rename investigations/{contextual_get_risk_for_endpoint.json => get_risk_for_endpoint.json} (100%) rename investigations/{contextual_get_risk_for_user.json => get_risk_for_user.json} (100%) rename investigations/{contextual_get_update_logs_for_endpoint.json => get_update_logs_for_endpoint.json} (100%) rename investigations/{contextual_get_user_info_from_identity_table.json => get_user_info_from_identity_table.json} (100%) rename investigations/{contextual_get_vulnerability_logs_for_endpoint.json => get_vulnerability_logs_for_endpoint.json} (100%) rename investigations/{investigative_get_web_activity.json => get_web_activity.json} (100%) rename investigations/{investigative_get_web_activity_by_src_ip.json => get_web_activity_by_src_ip.json} (100%) rename investigations/{investigative_get_web_posts_by_src.json => get_web_posts_by_src.json} (100%) rename investigations/{investigative_get_web_session_info.json => get_web_session_info.json} (100%) rename investigations/{investigative_get_wmi_sysmon_events.json => get_wmi_sysmon_events.json} (100%) rename investigations/{investigative_suspicious_strings_in_HTTP_header.json => suspicious_strings_in_HTTP_header.json} (100%) rename investigations/{investigative_user_activity_via_cloudtrail.json => user_activity_via_cloudtrail.json} (100%) diff --git a/baselines/support_add_prohibited_processes_to_es.json b/baselines/add_prohibited_processes_to_es.json similarity index 100% rename from baselines/support_add_prohibited_processes_to_es.json rename to baselines/add_prohibited_processes_to_es.json diff --git a/baselines/support_approved_aws_service_accounts.json b/baselines/approved_aws_service_accounts.json similarity index 100% rename from baselines/support_approved_aws_service_accounts.json rename to baselines/approved_aws_service_accounts.json diff --git a/baselines/support_assets_sorted_by_category.json b/baselines/assets_sorted_by_category.json similarity index 100% rename from baselines/support_assets_sorted_by_category.json rename to baselines/assets_sorted_by_category.json diff --git a/baselines/support_baseline_api_calls_per_user_arn.json b/baselines/baseline_api_calls_per_user_arn.json similarity index 100% rename from baselines/support_baseline_api_calls_per_user_arn.json rename to baselines/baseline_api_calls_per_user_arn.json diff --git a/baselines/support_baseline_aws_regions.json b/baselines/baseline_aws_regions.json similarity index 100% rename from baselines/support_baseline_aws_regions.json rename to baselines/baseline_aws_regions.json diff --git a/baselines/support_baseline_blocked_vpc_traffic.json b/baselines/baseline_blocked_vpc_traffic.json similarity index 100% rename from baselines/support_baseline_blocked_vpc_traffic.json rename to baselines/baseline_blocked_vpc_traffic.json diff --git a/baselines/support_baseline_network_acl_modifications.json b/baselines/baseline_network_acl_modifications.json similarity index 100% rename from baselines/support_baseline_network_acl_modifications.json rename to baselines/baseline_network_acl_modifications.json diff --git a/baselines/support_baseline_s3_deletion_by_arn.json b/baselines/baseline_s3_deletion_by_arn.json similarity index 100% rename from baselines/support_baseline_s3_deletion_by_arn.json rename to baselines/baseline_s3_deletion_by_arn.json diff --git a/baselines/support_baseline_security_group_activity_by_arn.json b/baselines/baseline_security_group_activity_by_arn.json similarity index 100% rename from baselines/support_baseline_security_group_activity_by_arn.json rename to baselines/baseline_security_group_activity_by_arn.json diff --git a/baselines/support_brand_abuse_dnstwist_domains.json b/baselines/brand_abuse_dnstwist_domains.json similarity index 100% rename from baselines/support_brand_abuse_dnstwist_domains.json rename to baselines/brand_abuse_dnstwist_domains.json diff --git a/baselines/support_discover_dns_records.json b/baselines/discover_dns_records.json similarity index 100% rename from baselines/support_discover_dns_records.json rename to baselines/discover_dns_records.json diff --git a/baselines/support_identify_ports_on_network.json b/baselines/identify_ports_on_network.json similarity index 100% rename from baselines/support_identify_ports_on_network.json rename to baselines/identify_ports_on_network.json diff --git a/baselines/support_identify_systems_creating_rdp_traffic.json b/baselines/identify_systems_creating_rdp_traffic.json similarity index 100% rename from baselines/support_identify_systems_creating_rdp_traffic.json rename to baselines/identify_systems_creating_rdp_traffic.json diff --git a/baselines/support_identify_systems_receiving_rdp_traffic.json b/baselines/identify_systems_receiving_rdp_traffic.json similarity index 100% rename from baselines/support_identify_systems_receiving_rdp_traffic.json rename to baselines/identify_systems_receiving_rdp_traffic.json diff --git a/baselines/support_identify_systems_using_remote_desktop.json b/baselines/identify_systems_using_remote_desktop.json similarity index 100% rename from baselines/support_identify_systems_using_remote_desktop.json rename to baselines/identify_systems_using_remote_desktop.json diff --git a/baselines/support_monitor_successful_backups.json b/baselines/monitor_successful_backups.json similarity index 100% rename from baselines/support_monitor_successful_backups.json rename to baselines/monitor_successful_backups.json diff --git a/baselines/support_monitor_successful_windows_updates.json b/baselines/monitor_successful_windows_updates.json similarity index 100% rename from baselines/support_monitor_successful_windows_updates.json rename to baselines/monitor_successful_windows_updates.json diff --git a/baselines/support_monitor_unsuccessful_backups.json b/baselines/monitor_unsuccessful_backups.json similarity index 100% rename from baselines/support_monitor_unsuccessful_backups.json rename to baselines/monitor_unsuccessful_backups.json diff --git a/baselines/support_monitor_unsuccessful_windows_updates.json b/baselines/monitor_unsuccessful_windows_updates.json similarity index 100% rename from baselines/support_monitor_unsuccessful_windows_updates.json rename to baselines/monitor_unsuccessful_windows_updates.json diff --git a/baselines/support_previously_seen_aws_cross_account_activity.json b/baselines/previously_seen_aws_cross_account_activity.json similarity index 100% rename from baselines/support_previously_seen_aws_cross_account_activity.json rename to baselines/previously_seen_aws_cross_account_activity.json diff --git a/baselines/support_previously_seen_cmd_arguments.json b/baselines/previously_seen_cmd_arguments.json similarity index 100% rename from baselines/support_previously_seen_cmd_arguments.json rename to baselines/previously_seen_cmd_arguments.json diff --git a/baselines/support_previously_seen_ec2_amis.json b/baselines/previously_seen_ec2_amis.json similarity index 100% rename from baselines/support_previously_seen_ec2_amis.json rename to baselines/previously_seen_ec2_amis.json diff --git a/baselines/support_previously_seen_ec2_instance_types.json b/baselines/previously_seen_ec2_instance_types.json similarity index 100% rename from baselines/support_previously_seen_ec2_instance_types.json rename to baselines/previously_seen_ec2_instance_types.json diff --git a/baselines/support_previously_seen_ec2_launches_by_user.json b/baselines/previously_seen_ec2_launches_by_user.json similarity index 100% rename from baselines/support_previously_seen_ec2_launches_by_user.json rename to baselines/previously_seen_ec2_launches_by_user.json diff --git a/baselines/support_previously_seen_ec2_modifications.json b/baselines/previously_seen_ec2_modifications.json similarity index 100% rename from baselines/support_previously_seen_ec2_modifications.json rename to baselines/previously_seen_ec2_modifications.json diff --git a/baselines/support_previously_seen_provisioning_activity_src.json b/baselines/previously_seen_provisioning_activity_src.json similarity index 100% rename from baselines/support_previously_seen_provisioning_activity_src.json rename to baselines/previously_seen_provisioning_activity_src.json diff --git a/baselines/support_previously_seen_s3_remote_ip.json b/baselines/previously_seen_s3_remote_ip.json similarity index 100% rename from baselines/support_previously_seen_s3_remote_ip.json rename to baselines/previously_seen_s3_remote_ip.json diff --git a/baselines/support_previously_seen_user_roles.json b/baselines/previously_seen_user_roles.json similarity index 100% rename from baselines/support_previously_seen_user_roles.json rename to baselines/previously_seen_user_roles.json diff --git a/baselines/support_previously_seen_users.json b/baselines/previously_seen_users.json similarity index 100% rename from baselines/support_previously_seen_users.json rename to baselines/previously_seen_users.json diff --git a/baselines/support_previously_seen_windows_service_starts.json b/baselines/previously_seen_windows_service_starts.json similarity index 100% rename from baselines/support_previously_seen_windows_service_starts.json rename to baselines/previously_seen_windows_service_starts.json diff --git a/baselines/support_systems_ready_for_spectre_meltdown_patch.json b/baselines/systems_ready_for_spectre_meltdown_patch.json similarity index 100% rename from baselines/support_systems_ready_for_spectre_meltdown_patch.json rename to baselines/systems_ready_for_spectre_meltdown_patch.json diff --git a/detections/detection_abnormally_high_instance_termination.json b/detections/abnormally_high_instance_termination.json similarity index 100% rename from detections/detection_abnormally_high_instance_termination.json rename to detections/abnormally_high_instance_termination.json diff --git a/detections/detection_abnormally_high_instances_launched.json b/detections/abnormally_high_instances_launched.json similarity index 100% rename from detections/detection_abnormally_high_instances_launched.json rename to detections/abnormally_high_instances_launched.json diff --git a/detections/detection_account_harvesting.json b/detections/account_harvesting.json similarity index 100% rename from detections/detection_account_harvesting.json rename to detections/account_harvesting.json diff --git a/detections/detection_acl_with_open_ports.json b/detections/acl_with_open_ports.json similarity index 100% rename from detections/detection_acl_with_open_ports.json rename to detections/acl_with_open_ports.json diff --git a/detections/detection_activity_related_to_pass_the_hash.json b/detections/activity_related_to_pass_the_hash.json similarity index 100% rename from detections/detection_activity_related_to_pass_the_hash.json rename to detections/activity_related_to_pass_the_hash.json diff --git a/detections/detection_add_to_untrust_cert_store.json b/detections/add_to_untrust_cert_store.json similarity index 100% rename from detections/detection_add_to_untrust_cert_store.json rename to detections/add_to_untrust_cert_store.json diff --git a/detections/detection_anomalous_webclick.json b/detections/anomalous_webclick.json similarity index 100% rename from detections/detection_anomalous_webclick.json rename to detections/anomalous_webclick.json diff --git a/detections/detection_api_acitivity_from_previously_unseen_user_role.json b/detections/api_acitivity_from_previously_unseen_user_role.json similarity index 100% rename from detections/detection_api_acitivity_from_previously_unseen_user_role.json rename to detections/api_acitivity_from_previously_unseen_user_role.json diff --git a/detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json b/detections/attackers_scanning_for_vulnerable_jboss_servers.json similarity index 100% rename from detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json rename to detections/attackers_scanning_for_vulnerable_jboss_servers.json diff --git a/detections/detection_attrib_to_hide_files.json b/detections/attrib_to_hide_files.json similarity index 100% rename from detections/detection_attrib_to_hide_files.json rename to detections/attrib_to_hide_files.json diff --git a/detections/detection_aws_activity_from_non_approved_accounts.json b/detections/aws_activity_from_non_approved_accounts.json similarity index 100% rename from detections/detection_aws_activity_from_non_approved_accounts.json rename to detections/aws_activity_from_non_approved_accounts.json diff --git a/detections/detection_aws_activity_in_new_region.json b/detections/aws_activity_in_new_region.json similarity index 100% rename from detections/detection_aws_activity_in_new_region.json rename to detections/aws_activity_in_new_region.json diff --git a/detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json b/detections/aws_cloud_provisioning_from_previously_unseen_city.json similarity index 100% rename from detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json rename to detections/aws_cloud_provisioning_from_previously_unseen_city.json diff --git a/detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json b/detections/aws_cloud_provisioning_from_previously_unseen_country.json similarity index 100% rename from detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json rename to detections/aws_cloud_provisioning_from_previously_unseen_country.json diff --git a/detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json b/detections/aws_cloud_provisioning_from_previously_unseen_ip.json similarity index 100% rename from detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json rename to detections/aws_cloud_provisioning_from_previously_unseen_ip.json diff --git a/detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json b/detections/aws_cloud_provisioning_from_previously_unseen_region.json similarity index 100% rename from detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json rename to detections/aws_cloud_provisioning_from_previously_unseen_region.json diff --git a/detections/detection_aws_cross_account_activity_from_new_account.json b/detections/aws_cross_account_activity_from_new_account.json similarity index 100% rename from detections/detection_aws_cross_account_activity_from_new_account.json rename to detections/aws_cross_account_activity_from_new_account.json diff --git a/detections/detection_aws_spike_acl_activity.json b/detections/aws_spike_acl_activity.json similarity index 100% rename from detections/detection_aws_spike_acl_activity.json rename to detections/aws_spike_acl_activity.json diff --git a/detections/detection_badrabbit_schtasks.json b/detections/badrabbit_schtasks.json similarity index 100% rename from detections/detection_badrabbit_schtasks.json rename to detections/badrabbit_schtasks.json diff --git a/detections/detection_batch_file_write_system32.json b/detections/batch_file_write_system32.json similarity index 100% rename from detections/detection_batch_file_write_system32.json rename to detections/batch_file_write_system32.json diff --git a/detections/detection_brand_abuse_dns.json b/detections/brand_abuse_dns.json similarity index 100% rename from detections/detection_brand_abuse_dns.json rename to detections/brand_abuse_dns.json diff --git a/detections/detection_brand_abuse_email.json b/detections/brand_abuse_email.json similarity index 100% rename from detections/detection_brand_abuse_email.json rename to detections/brand_abuse_email.json diff --git a/detections/detection_brand_abuse_web.json b/detections/brand_abuse_web.json similarity index 100% rename from detections/detection_brand_abuse_web.json rename to detections/brand_abuse_web.json diff --git a/detections/detection_change_file_association.json b/detections/change_file_association.json similarity index 100% rename from detections/detection_change_file_association.json rename to detections/change_file_association.json diff --git a/detections/detection_children_of_spoolsv.json b/detections/children_of_spoolsv.json similarity index 100% rename from detections/detection_children_of_spoolsv.json rename to detections/children_of_spoolsv.json diff --git a/detections/detection_clients_connecting_to_multiple_dns_servers.json b/detections/clients_connecting_to_multiple_dns_servers.json similarity index 100% rename from detections/detection_clients_connecting_to_multiple_dns_servers.json rename to detections/clients_connecting_to_multiple_dns_servers.json diff --git a/detections/detection_common_ransomware_extensions.json b/detections/common_ransomware_extensions.json similarity index 100% rename from detections/detection_common_ransomware_extensions.json rename to detections/common_ransomware_extensions.json diff --git a/detections/detection_common_ransomware_notes.json b/detections/common_ransomware_notes.json similarity index 100% rename from detections/detection_common_ransomware_notes.json rename to detections/common_ransomware_notes.json diff --git a/detections/detection_create_hidden_shares.json b/detections/create_hidden_shares.json similarity index 100% rename from detections/detection_create_hidden_shares.json rename to detections/create_hidden_shares.json diff --git a/detections/detection_create_local_admin_via_net.json b/detections/create_local_admin_via_net.json similarity index 100% rename from detections/detection_create_local_admin_via_net.json rename to detections/create_local_admin_via_net.json diff --git a/detections/detection_cred_dump_via_reg.json b/detections/cred_dump_via_reg.json similarity index 100% rename from detections/detection_cred_dump_via_reg.json rename to detections/cred_dump_via_reg.json diff --git a/detections/detection_cscript_via_cmd.json b/detections/cscript_via_cmd.json similarity index 100% rename from detections/detection_cscript_via_cmd.json rename to detections/cscript_via_cmd.json diff --git a/detections/detection_delete_shadow_copies.json b/detections/delete_shadow_copies.json similarity index 100% rename from detections/detection_delete_shadow_copies.json rename to detections/delete_shadow_copies.json diff --git a/detections/detection_deletion_network_acl.json b/detections/deletion_network_acl.json similarity index 100% rename from detections/detection_deletion_network_acl.json rename to detections/deletion_network_acl.json diff --git a/detections/detection_disable_remote_uac.json b/detections/disable_remote_uac.json similarity index 100% rename from detections/detection_disable_remote_uac.json rename to detections/disable_remote_uac.json diff --git a/detections/detection_dns_amplification_any_query.json b/detections/dns_amplification_any_query.json similarity index 100% rename from detections/detection_dns_amplification_any_query.json rename to detections/dns_amplification_any_query.json diff --git a/detections/detection_dns_query_length_with_high_standard_deviation.json b/detections/dns_query_length_with_high_standard_deviation.json similarity index 100% rename from detections/detection_dns_query_length_with_high_standard_deviation.json rename to detections/dns_query_length_with_high_standard_deviation.json diff --git a/detections/detection_dns_record_changed.json b/detections/dns_record_changed.json similarity index 100% rename from detections/detection_dns_record_changed.json rename to detections/dns_record_changed.json diff --git a/detections/detection_dns_tunnelling.json b/detections/dns_tunnelling.json similarity index 100% rename from detections/detection_dns_tunnelling.json rename to detections/dns_tunnelling.json diff --git a/detections/detection_dragonfly_schtasks.json b/detections/dragonfly_schtasks.json similarity index 100% rename from detections/detection_dragonfly_schtasks.json rename to detections/dragonfly_schtasks.json diff --git a/detections/detection_dyn_dns_queries.json b/detections/dyn_dns_queries.json similarity index 100% rename from detections/detection_dyn_dns_queries.json rename to detections/dyn_dns_queries.json diff --git a/detections/detection_dyn_dns_web_traffic.json b/detections/dyn_dns_web_traffic.json similarity index 100% rename from detections/detection_dyn_dns_web_traffic.json rename to detections/dyn_dns_web_traffic.json diff --git a/detections/detection_ec2_instance_created_by_previously_unseen_user.json b/detections/ec2_instance_created_by_previously_unseen_user.json similarity index 100% rename from detections/detection_ec2_instance_created_by_previously_unseen_user.json rename to detections/ec2_instance_created_by_previously_unseen_user.json diff --git a/detections/detection_ec2_instance_modified_by_previously_unseen_user.json b/detections/ec2_instance_modified_by_previously_unseen_user.json similarity index 100% rename from detections/detection_ec2_instance_modified_by_previously_unseen_user.json rename to detections/ec2_instance_modified_by_previously_unseen_user.json diff --git a/detections/detection_ec2_instance_started_with_previously_unseen_ami.json b/detections/ec2_instance_started_with_previously_unseen_ami.json similarity index 100% rename from detections/detection_ec2_instance_started_with_previously_unseen_ami.json rename to detections/ec2_instance_started_with_previously_unseen_ami.json diff --git a/detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json b/detections/ec2_instance_started_with_previously_unseen_instance_type.json similarity index 100% rename from detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json rename to detections/ec2_instance_started_with_previously_unseen_instance_type.json diff --git a/detections/detection_email_attachments_with_spaces.json b/detections/email_attachments_with_spaces.json similarity index 100% rename from detections/detection_email_attachments_with_spaces.json rename to detections/email_attachments_with_spaces.json diff --git a/detections/detection_email_files_not_in_outlook_directory.json b/detections/email_files_not_in_outlook_directory.json similarity index 100% rename from detections/detection_email_files_not_in_outlook_directory.json rename to detections/email_files_not_in_outlook_directory.json diff --git a/detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json b/detections/emailserver_high_volume_outbound_traffic_to_hosts.json similarity index 100% rename from detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json rename to detections/emailserver_high_volume_outbound_traffic_to_hosts.json diff --git a/detections/detection_excessive_dns_failures.json b/detections/excessive_dns_failures.json similarity index 100% rename from detections/detection_excessive_dns_failures.json rename to detections/excessive_dns_failures.json diff --git a/detections/detection_excessive_lockouts_from_endpoint.json b/detections/excessive_lockouts_from_endpoint.json similarity index 100% rename from detections/detection_excessive_lockouts_from_endpoint.json rename to detections/excessive_lockouts_from_endpoint.json diff --git a/detections/detection_excessive_user_account_lockouts.json b/detections/excessive_user_account_lockouts.json similarity index 100% rename from detections/detection_excessive_user_account_lockouts.json rename to detections/excessive_user_account_lockouts.json diff --git a/detections/detection_execution_of_nirsoft_tools.json b/detections/execution_of_nirsoft_tools.json similarity index 100% rename from detections/detection_execution_of_nirsoft_tools.json rename to detections/execution_of_nirsoft_tools.json diff --git a/detections/detection_file_write_spikes.json b/detections/file_write_spikes.json similarity index 100% rename from detections/detection_file_write_spikes.json rename to detections/file_write_spikes.json diff --git a/detections/detection_first_time_seen_cmd_line.json b/detections/first_time_seen_cmd_line.json similarity index 100% rename from detections/detection_first_time_seen_cmd_line.json rename to detections/first_time_seen_cmd_line.json diff --git a/detections/detection_first_time_seen_running_windows_service.json b/detections/first_time_seen_running_windows_service.json similarity index 100% rename from detections/detection_first_time_seen_running_windows_service.json rename to detections/first_time_seen_running_windows_service.json diff --git a/detections/detection_fsutil_deleting_journals.json b/detections/fsutil_deleting_journals.json similarity index 100% rename from detections/detection_fsutil_deleting_journals.json rename to detections/fsutil_deleting_journals.json diff --git a/detections/detection_hosts_file_modification.json b/detections/hosts_file_modification.json similarity index 100% rename from detections/detection_hosts_file_modification.json rename to detections/hosts_file_modification.json diff --git a/detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json b/detections/hosts_receiving_high_volume_network_traffic_from_email_servers.json similarity index 100% rename from detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json rename to detections/hosts_receiving_high_volume_network_traffic_from_email_servers.json diff --git a/detections/detection_large_icmp_outbound.json b/detections/large_icmp_outbound.json similarity index 100% rename from detections/detection_large_icmp_outbound.json rename to detections/large_icmp_outbound.json diff --git a/detections/detection_local_admin_account_creation.json b/detections/local_admin_account_creation.json similarity index 100% rename from detections/detection_local_admin_account_creation.json rename to detections/local_admin_account_creation.json diff --git a/detections/detection_long_dns_text_response.json b/detections/long_dns_text_response.json similarity index 100% rename from detections/detection_long_dns_text_response.json rename to detections/long_dns_text_response.json diff --git a/detections/detection_malicious_application_shimming_via_registry.json b/detections/malicious_application_shimming_via_registry.json similarity index 100% rename from detections/detection_malicious_application_shimming_via_registry.json rename to detections/malicious_application_shimming_via_registry.json diff --git a/detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json b/detections/malicious_powershell_process_connect_to_internet_with_hidden_window.json similarity index 100% rename from detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json rename to detections/malicious_powershell_process_connect_to_internet_with_hidden_window.json diff --git a/detections/detection_malicious_powershell_process_encoded_command.json b/detections/malicious_powershell_process_encoded_command.json similarity index 100% rename from detections/detection_malicious_powershell_process_encoded_command.json rename to detections/malicious_powershell_process_encoded_command.json diff --git a/detections/detection_malicious_powershell_process_execpolicy.json b/detections/malicious_powershell_process_execpolicy.json similarity index 100% rename from detections/detection_malicious_powershell_process_execpolicy.json rename to detections/malicious_powershell_process_execpolicy.json diff --git a/detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json b/detections/malicious_powershell_process_multiple_suspicious_arguments.json similarity index 100% rename from detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json rename to detections/malicious_powershell_process_multiple_suspicious_arguments.json diff --git a/detections/detection_malicious_powershell_process_obfuscation_techniques.json b/detections/malicious_powershell_process_obfuscation_techniques.json similarity index 100% rename from detections/detection_malicious_powershell_process_obfuscation_techniques.json rename to detections/malicious_powershell_process_obfuscation_techniques.json diff --git a/detections/detection_malicious_requests_to_exploit_jboss_servers.json b/detections/malicious_requests_to_exploit_jboss_servers.json similarity index 100% rename from detections/detection_malicious_requests_to_exploit_jboss_servers.json rename to detections/malicious_requests_to_exploit_jboss_servers.json diff --git a/detections/detection_mshta_launching_scripts.json b/detections/mshta_launching_scripts.json similarity index 100% rename from detections/detection_mshta_launching_scripts.json rename to detections/mshta_launching_scripts.json diff --git a/detections/detection_netbackup_failed_backup.json b/detections/netbackup_failed_backup.json similarity index 100% rename from detections/detection_netbackup_failed_backup.json rename to detections/netbackup_failed_backup.json diff --git a/detections/detection_netbackup_no_backups_in_time_period.json b/detections/netbackup_no_backups_in_time_period.json similarity index 100% rename from detections/detection_netbackup_no_backups_in_time_period.json rename to detections/netbackup_no_backups_in_time_period.json diff --git a/detections/detection_netsh_launching_process.json b/detections/netsh_launching_process.json similarity index 100% rename from detections/detection_netsh_launching_process.json rename to detections/netsh_launching_process.json diff --git a/detections/detection_new_aws_console_login_by_user.json b/detections/new_aws_console_login_by_user.json similarity index 100% rename from detections/detection_new_aws_console_login_by_user.json rename to detections/new_aws_console_login_by_user.json diff --git a/detections/detection_new_connections_to_routers.json b/detections/new_connections_to_routers.json similarity index 100% rename from detections/detection_new_connections_to_routers.json rename to detections/new_connections_to_routers.json diff --git a/detections/detection_new_open_s3_buckets.json b/detections/new_open_s3_buckets.json similarity index 100% rename from detections/detection_new_open_s3_buckets.json rename to detections/new_open_s3_buckets.json diff --git a/detections/detection_new_user_accounts.json b/detections/new_user_accounts.json similarity index 100% rename from detections/detection_new_user_accounts.json rename to detections/new_user_accounts.json diff --git a/detections/detection_no_win_updates_in_timeframe.json b/detections/no_win_updates_in_timeframe.json similarity index 100% rename from detections/detection_no_win_updates_in_timeframe.json rename to detections/no_win_updates_in_timeframe.json diff --git a/detections/detection_open_redirect_in_splunk_web.json b/detections/open_redirect_in_splunk_web.json similarity index 100% rename from detections/detection_open_redirect_in_splunk_web.json rename to detections/open_redirect_in_splunk_web.json diff --git a/detections/detection_osx_coldroot_pack.json b/detections/osx_coldroot_pack.json similarity index 100% rename from detections/detection_osx_coldroot_pack.json rename to detections/osx_coldroot_pack.json diff --git a/detections/detection_osx_keyboard_taps.json b/detections/osx_keyboard_taps.json similarity index 100% rename from detections/detection_osx_keyboard_taps.json rename to detections/osx_keyboard_taps.json diff --git a/detections/detection_outbound_smb_connections.json b/detections/outbound_smb_connections.json similarity index 100% rename from detections/detection_outbound_smb_connections.json rename to detections/outbound_smb_connections.json diff --git a/detections/detection_overwrite_accessibility_binaries.json b/detections/overwrite_accessibility_binaries.json similarity index 100% rename from detections/detection_overwrite_accessibility_binaries.json rename to detections/overwrite_accessibility_binaries.json diff --git a/detections/detection_password_sharing.json b/detections/password_sharing.json similarity index 100% rename from detections/detection_password_sharing.json rename to detections/password_sharing.json diff --git a/detections/detection_path_interception_program.exe.json b/detections/path_interception_program.exe.json similarity index 100% rename from detections/detection_path_interception_program.exe.json rename to detections/path_interception_program.exe.json diff --git a/detections/detection_port_monitor_via_registry.json b/detections/port_monitor_via_registry.json similarity index 100% rename from detections/detection_port_monitor_via_registry.json rename to detections/port_monitor_via_registry.json diff --git a/detections/detection_powershell_get_sedebug.json b/detections/powershell_get_sedebug.json similarity index 100% rename from detections/detection_powershell_get_sedebug.json rename to detections/powershell_get_sedebug.json diff --git a/detections/detection_powershell_read_from_lsass.json b/detections/powershell_read_from_lsass.json similarity index 100% rename from detections/detection_powershell_read_from_lsass.json rename to detections/powershell_read_from_lsass.json diff --git a/detections/detection_powershell_reg_key_mod.json b/detections/powershell_reg_key_mod.json similarity index 100% rename from detections/detection_powershell_reg_key_mod.json rename to detections/powershell_reg_key_mod.json diff --git a/detections/detection_process_launching_netsh.json b/detections/process_launching_netsh.json similarity index 100% rename from detections/detection_process_launching_netsh.json rename to detections/process_launching_netsh.json diff --git a/detections/detection_process_with_double_extension.json b/detections/process_with_double_extension.json similarity index 100% rename from detections/detection_process_with_double_extension.json rename to detections/process_with_double_extension.json diff --git a/detections/detection_process_with_spaces_before_extension.json b/detections/process_with_spaces_before_extension.json similarity index 100% rename from detections/detection_process_with_spaces_before_extension.json rename to detections/process_with_spaces_before_extension.json diff --git a/detections/detection_prohibited_allowed_through_fw.json b/detections/prohibited_allowed_through_fw.json similarity index 100% rename from detections/detection_prohibited_allowed_through_fw.json rename to detections/prohibited_allowed_through_fw.json diff --git a/detections/detection_prohibited_apps_spawning_cmdprompt.json b/detections/prohibited_apps_spawning_cmdprompt.json similarity index 100% rename from detections/detection_prohibited_apps_spawning_cmdprompt.json rename to detections/prohibited_apps_spawning_cmdprompt.json diff --git a/detections/detection_prohibited_software_on_endpoint.json b/detections/prohibited_software_on_endpoint.json similarity index 100% rename from detections/detection_prohibited_software_on_endpoint.json rename to detections/prohibited_software_on_endpoint.json diff --git a/detections/detection_protocol_mismatch.json b/detections/protocol_mismatch.json similarity index 100% rename from detections/detection_protocol_mismatch.json rename to detections/protocol_mismatch.json diff --git a/detections/detection_protocols_authenticating_in_cleartext.json b/detections/protocols_authenticating_in_cleartext.json similarity index 100% rename from detections/detection_protocols_authenticating_in_cleartext.json rename to detections/protocols_authenticating_in_cleartext.json diff --git a/detections/detection_psexec_accepteula.json b/detections/psexec_accepteula.json similarity index 100% rename from detections/detection_psexec_accepteula.json rename to detections/psexec_accepteula.json diff --git a/detections/detection_rare_executables_on_endpoint.json b/detections/rare_executables_on_endpoint.json similarity index 100% rename from detections/detection_rare_executables_on_endpoint.json rename to detections/rare_executables_on_endpoint.json diff --git a/detections/detection_reg_manipulating_services.json b/detections/reg_manipulating_services.json similarity index 100% rename from detections/detection_reg_manipulating_services.json rename to detections/reg_manipulating_services.json diff --git a/detections/detection_reg_used_to_hide_files.json b/detections/reg_used_to_hide_files.json similarity index 100% rename from detections/detection_reg_used_to_hide_files.json rename to detections/reg_used_to_hide_files.json diff --git a/detections/detection_registry_persistence.json b/detections/registry_persistence.json similarity index 100% rename from detections/detection_registry_persistence.json rename to detections/registry_persistence.json diff --git a/detections/detection_registry_privilege_escalation.json b/detections/registry_privilege_escalation.json similarity index 100% rename from detections/detection_registry_privilege_escalation.json rename to detections/registry_privilege_escalation.json diff --git a/detections/detection_remote_desktop_bruteforce.json b/detections/remote_desktop_bruteforce.json similarity index 100% rename from detections/detection_remote_desktop_bruteforce.json rename to detections/remote_desktop_bruteforce.json diff --git a/detections/detection_remote_desktop_network_traffic.json b/detections/remote_desktop_network_traffic.json similarity index 100% rename from detections/detection_remote_desktop_network_traffic.json rename to detections/remote_desktop_network_traffic.json diff --git a/detections/detection_remote_desktop_process_running_on_system.json b/detections/remote_desktop_process_running_on_system.json similarity index 100% rename from detections/detection_remote_desktop_process_running_on_system.json rename to detections/remote_desktop_process_running_on_system.json diff --git a/detections/detection_remote_registry_modifications.json b/detections/remote_registry_modifications.json similarity index 100% rename from detections/detection_remote_registry_modifications.json rename to detections/remote_registry_modifications.json diff --git a/detections/detection_remote_wmi_command_attempt.json b/detections/remote_wmi_command_attempt.json similarity index 100% rename from detections/detection_remote_wmi_command_attempt.json rename to detections/remote_wmi_command_attempt.json diff --git a/detections/detection_remote_wmi_process_instantiation.json b/detections/remote_wmi_process_instantiation.json similarity index 100% rename from detections/detection_remote_wmi_process_instantiation.json rename to detections/remote_wmi_process_instantiation.json diff --git a/detections/detection_rundll_loading_dll_by_ordinal.json b/detections/rundll_loading_dll_by_ordinal.json similarity index 100% rename from detections/detection_rundll_loading_dll_by_ordinal.json rename to detections/rundll_loading_dll_by_ordinal.json diff --git a/detections/detection_s3_access_from_new_ip.json b/detections/s3_access_from_new_ip.json similarity index 100% rename from detections/detection_s3_access_from_new_ip.json rename to detections/s3_access_from_new_ip.json diff --git a/detections/detection_samsam_payload_extensions.json b/detections/samsam_payload_extensions.json similarity index 100% rename from detections/detection_samsam_payload_extensions.json rename to detections/samsam_payload_extensions.json diff --git a/detections/detection_samsam_test_file_write.json b/detections/samsam_test_file_write.json similarity index 100% rename from detections/detection_samsam_test_file_write.json rename to detections/samsam_test_file_write.json diff --git a/detections/detection_sc_manipulating_services.json b/detections/sc_manipulating_services.json similarity index 100% rename from detections/detection_sc_manipulating_services.json rename to detections/sc_manipulating_services.json diff --git a/detections/detection_schtasks_forced_reboot.json b/detections/schtasks_forced_reboot.json similarity index 100% rename from detections/detection_schtasks_forced_reboot.json rename to detections/schtasks_forced_reboot.json diff --git a/detections/detection_schtasks_scheduling_job_on_remote_system.json b/detections/schtasks_scheduling_job_on_remote_system.json similarity index 100% rename from detections/detection_schtasks_scheduling_job_on_remote_system.json rename to detections/schtasks_scheduling_job_on_remote_system.json diff --git a/detections/detection_shim_database_file_creation.json b/detections/shim_database_file_creation.json similarity index 100% rename from detections/detection_shim_database_file_creation.json rename to detections/shim_database_file_creation.json diff --git a/detections/detection_shim_database_installation.json b/detections/shim_database_installation.json similarity index 100% rename from detections/detection_shim_database_installation.json rename to detections/shim_database_installation.json diff --git a/detections/detection_short_lived_accounts.json b/detections/short_lived_accounts.json similarity index 100% rename from detections/detection_short_lived_accounts.json rename to detections/short_lived_accounts.json diff --git a/detections/detection_single_letter_executables.json b/detections/single_letter_executables.json similarity index 100% rename from detections/detection_single_letter_executables.json rename to detections/single_letter_executables.json diff --git a/detections/detection_smb_traffic_spike.json b/detections/smb_traffic_spike.json similarity index 100% rename from detections/detection_smb_traffic_spike.json rename to detections/smb_traffic_spike.json diff --git a/detections/detection_sncd_processes.json b/detections/sncd_processes.json similarity index 100% rename from detections/detection_sncd_processes.json rename to detections/sncd_processes.json diff --git a/detections/detection_spectre_meltdown_vulnerabilities.json b/detections/spectre_meltdown_vulnerabilities.json similarity index 100% rename from detections/detection_spectre_meltdown_vulnerabilities.json rename to detections/spectre_meltdown_vulnerabilities.json diff --git a/detections/detection_spike_aws_api_call_per_account.json b/detections/spike_aws_api_call_per_account.json similarity index 100% rename from detections/detection_spike_aws_api_call_per_account.json rename to detections/spike_aws_api_call_per_account.json diff --git a/detections/detection_spike_aws_security_group_activity.json b/detections/spike_aws_security_group_activity.json similarity index 100% rename from detections/detection_spike_aws_security_group_activity.json rename to detections/spike_aws_security_group_activity.json diff --git a/detections/detection_spike_s3_deletion.json b/detections/spike_s3_deletion.json similarity index 100% rename from detections/detection_spike_s3_deletion.json rename to detections/spike_s3_deletion.json diff --git a/detections/detection_spike_vpc_blocked_traffic.json b/detections/spike_vpc_blocked_traffic.json similarity index 100% rename from detections/detection_spike_vpc_blocked_traffic.json rename to detections/spike_vpc_blocked_traffic.json diff --git a/detections/detection_splunk_information_disclosure.json b/detections/splunk_information_disclosure.json similarity index 100% rename from detections/detection_splunk_information_disclosure.json rename to detections/splunk_information_disclosure.json diff --git a/detections/detection_sql_injection_with_long_urls.json b/detections/sql_injection_with_long_urls.json similarity index 100% rename from detections/detection_sql_injection_with_long_urls.json rename to detections/sql_injection_with_long_urls.json diff --git a/detections/detection_stop_security_services.json b/detections/stop_security_services.json similarity index 100% rename from detections/detection_stop_security_services.json rename to detections/stop_security_services.json diff --git a/detections/detection_suspicious_email_attachments.json b/detections/suspicious_email_attachments.json similarity index 100% rename from detections/detection_suspicious_email_attachments.json rename to detections/suspicious_email_attachments.json diff --git a/detections/detection_suspicious_file_writes.json b/detections/suspicious_file_writes.json similarity index 100% rename from detections/detection_suspicious_file_writes.json rename to detections/suspicious_file_writes.json diff --git a/detections/detection_suspicious_java_classes.json b/detections/suspicious_java_classes.json similarity index 100% rename from detections/detection_suspicious_java_classes.json rename to detections/suspicious_java_classes.json diff --git a/detections/detection_suspicious_reg_process.json b/detections/suspicious_reg_process.json similarity index 100% rename from detections/detection_suspicious_reg_process.json rename to detections/suspicious_reg_process.json diff --git a/detections/detection_suspicious_wevtutil_usage.json b/detections/suspicious_wevtutil_usage.json similarity index 100% rename from detections/detection_suspicious_wevtutil_usage.json rename to detections/suspicious_wevtutil_usage.json diff --git a/detections/detection_suspicious_write_to_recycler.json b/detections/suspicious_write_to_recycler.json similarity index 100% rename from detections/detection_suspicious_write_to_recycler.json rename to detections/suspicious_write_to_recycler.json diff --git a/detections/detection_suspicious_write_to_sysvol.json b/detections/suspicious_write_to_sysvol.json similarity index 100% rename from detections/detection_suspicious_write_to_sysvol.json rename to detections/suspicious_write_to_sysvol.json diff --git a/detections/detection_system_processes_run_from_unexpected_locations.json b/detections/system_processes_run_from_unexpected_locations.json similarity index 100% rename from detections/detection_system_processes_run_from_unexpected_locations.json rename to detections/system_processes_run_from_unexpected_locations.json diff --git a/detections/detection_tor_traffic.json b/detections/tor_traffic.json similarity index 100% rename from detections/detection_tor_traffic.json rename to detections/tor_traffic.json diff --git a/detections/detection_unauthorized_assets_via_mac_address.json b/detections/unauthorized_assets_via_mac_address.json similarity index 100% rename from detections/detection_unauthorized_assets_via_mac_address.json rename to detections/unauthorized_assets_via_mac_address.json diff --git a/detections/detection_unauthorized_dns_servers.json b/detections/unauthorized_dns_servers.json similarity index 100% rename from detections/detection_unauthorized_dns_servers.json rename to detections/unauthorized_dns_servers.json diff --git a/detections/detection_uncommon_processes.json b/detections/uncommon_processes.json similarity index 100% rename from detections/detection_uncommon_processes.json rename to detections/uncommon_processes.json diff --git a/detections/detection_unusually_long_commandlines.json b/detections/unusually_long_commandlines.json similarity index 100% rename from detections/detection_unusually_long_commandlines.json rename to detections/unusually_long_commandlines.json diff --git a/detections/detection_unusually_long_content-type_length.json b/detections/unusually_long_content-type_length.json similarity index 100% rename from detections/detection_unusually_long_content-type_length.json rename to detections/unusually_long_content-type_length.json diff --git a/detections/detection_usb_insertion.json b/detections/usb_insertion.json similarity index 100% rename from detections/detection_usb_insertion.json rename to detections/usb_insertion.json diff --git a/detections/detection_users_without_mfa.json b/detections/users_without_mfa.json similarity index 100% rename from detections/detection_users_without_mfa.json rename to detections/users_without_mfa.json diff --git a/detections/detection_web_servers_executing_suspicious_processes.json b/detections/web_servers_executing_suspicious_processes.json similarity index 100% rename from detections/detection_web_servers_executing_suspicious_processes.json rename to detections/web_servers_executing_suspicious_processes.json diff --git a/detections/detection_windows_event_log_cleared.json b/detections/windows_event_log_cleared.json similarity index 100% rename from detections/detection_windows_event_log_cleared.json rename to detections/windows_event_log_cleared.json diff --git a/detections/detection_wmi_perm_event_subscription.json b/detections/wmi_perm_event_subscription.json similarity index 100% rename from detections/detection_wmi_perm_event_subscription.json rename to detections/wmi_perm_event_subscription.json diff --git a/detections/detection_wmi_perm_event_subscription_sysmon.json b/detections/wmi_perm_event_subscription_sysmon.json similarity index 100% rename from detections/detection_wmi_perm_event_subscription_sysmon.json rename to detections/wmi_perm_event_subscription_sysmon.json diff --git a/detections/detection_wmi_process_launch.json b/detections/wmi_process_launch.json similarity index 100% rename from detections/detection_wmi_process_launch.json rename to detections/wmi_process_launch.json diff --git a/detections/detection_wmi_script_execution.json b/detections/wmi_script_execution.json similarity index 100% rename from detections/detection_wmi_script_execution.json rename to detections/wmi_script_execution.json diff --git a/detections/detection_wmi_temp_event_subscription.json b/detections/wmi_temp_event_subscription.json similarity index 100% rename from detections/detection_wmi_temp_event_subscription.json rename to detections/wmi_temp_event_subscription.json diff --git a/investigations/investigative_aws_activity_via_region.json b/investigations/aws_activity_via_region.json similarity index 100% rename from investigations/investigative_aws_activity_via_region.json rename to investigations/aws_activity_via_region.json diff --git a/investigations/contextual_aws_network_interface_details.json b/investigations/aws_network_interface_details.json similarity index 100% rename from investigations/contextual_aws_network_interface_details.json rename to investigations/aws_network_interface_details.json diff --git a/investigations/contextual_aws_s3_bucket_details.json b/investigations/aws_s3_bucket_details.json similarity index 100% rename from investigations/contextual_aws_s3_bucket_details.json rename to investigations/aws_s3_bucket_details.json diff --git a/investigations/investigative_aws_user_activities_by_user_field.json b/investigations/aws_user_activities_by_user_field.json similarity index 100% rename from investigations/investigative_aws_user_activities_by_user_field.json rename to investigations/aws_user_activities_by_user_field.json diff --git a/investigations/investigative_aws_user_activity_by_accesskeyid.json b/investigations/aws_user_activity_by_accesskeyid.json similarity index 100% rename from investigations/investigative_aws_user_activity_by_accesskeyid.json rename to investigations/aws_user_activity_by_accesskeyid.json diff --git a/investigations/investigative_aws_user_activity_by_src_user.json b/investigations/aws_user_activity_by_src_user.json similarity index 100% rename from investigations/investigative_aws_user_activity_by_src_user.json rename to investigations/aws_user_activity_by_src_user.json diff --git a/investigations/investigative_dns_server_history.json b/investigations/dns_server_history.json similarity index 100% rename from investigations/investigative_dns_server_history.json rename to investigations/dns_server_history.json diff --git a/investigations/investigative_dns_traffic_stats.json b/investigations/dns_traffic_stats.json similarity index 100% rename from investigations/investigative_dns_traffic_stats.json rename to investigations/dns_traffic_stats.json diff --git a/investigations/investigative_email_sent_to_hidden_cobra_actors.json b/investigations/email_sent_to_hidden_cobra_actors.json similarity index 100% rename from investigations/investigative_email_sent_to_hidden_cobra_actors.json rename to investigations/email_sent_to_hidden_cobra_actors.json diff --git a/investigations/contextual_first_occurrence_mac_address.json b/investigations/first_occurrence_mac_address.json similarity index 100% rename from investigations/contextual_first_occurrence_mac_address.json rename to investigations/first_occurrence_mac_address.json diff --git a/investigations/contextual_get_acl_details.json b/investigations/get_acl_details.json similarity index 100% rename from investigations/contextual_get_acl_details.json rename to investigations/get_acl_details.json diff --git a/investigations/investigative_get_all_aws_activitiy_from_city.json b/investigations/get_all_aws_activitiy_from_city.json similarity index 100% rename from investigations/investigative_get_all_aws_activitiy_from_city.json rename to investigations/get_all_aws_activitiy_from_city.json diff --git a/investigations/investigative_get_all_aws_activitiy_from_country.json b/investigations/get_all_aws_activitiy_from_country.json similarity index 100% rename from investigations/investigative_get_all_aws_activitiy_from_country.json rename to investigations/get_all_aws_activitiy_from_country.json diff --git a/investigations/investigative_get_all_aws_activitiy_from_region.json b/investigations/get_all_aws_activitiy_from_region.json similarity index 100% rename from investigations/investigative_get_all_aws_activitiy_from_region.json rename to investigations/get_all_aws_activitiy_from_region.json diff --git a/investigations/investigative_get_all_aws_activitiy_from_src_ip.json b/investigations/get_all_aws_activitiy_from_src_ip.json similarity index 100% rename from investigations/investigative_get_all_aws_activitiy_from_src_ip.json rename to investigations/get_all_aws_activitiy_from_src_ip.json diff --git a/investigations/investigative_get_all_backup_data_for_host.json b/investigations/get_all_backup_data_for_host.json similarity index 100% rename from investigations/investigative_get_all_backup_data_for_host.json rename to investigations/get_all_backup_data_for_host.json diff --git a/investigations/contextual_get_authentication_logs_for_endpoint.json b/investigations/get_authentication_logs_for_endpoint.json similarity index 100% rename from investigations/contextual_get_authentication_logs_for_endpoint.json rename to investigations/get_authentication_logs_for_endpoint.json diff --git a/investigations/contextual_get_backup_logs_for_endpoint.json b/investigations/get_backup_logs_for_endpoint.json similarity index 100% rename from investigations/contextual_get_backup_logs_for_endpoint.json rename to investigations/get_backup_logs_for_endpoint.json diff --git a/investigations/contextual_get_ec2_details_by_instance_id.json b/investigations/get_ec2_details_by_instance_id.json similarity index 100% rename from investigations/contextual_get_ec2_details_by_instance_id.json rename to investigations/get_ec2_details_by_instance_id.json diff --git a/investigations/contextual_get_ec2_launch_details.json b/investigations/get_ec2_launch_details.json similarity index 100% rename from investigations/contextual_get_ec2_launch_details.json rename to investigations/get_ec2_launch_details.json diff --git a/investigations/investigative_get_email_info.json b/investigations/get_email_info.json similarity index 100% rename from investigations/investigative_get_email_info.json rename to investigations/get_email_info.json diff --git a/investigations/investigative_get_emails_from_sender.json b/investigations/get_emails_from_sender.json similarity index 100% rename from investigations/investigative_get_emails_from_sender.json rename to investigations/get_emails_from_sender.json diff --git a/investigations/investigative_get_emails_from_source.json b/investigations/get_emails_from_source.json similarity index 100% rename from investigations/investigative_get_emails_from_source.json rename to investigations/get_emails_from_source.json diff --git a/investigations/investigative_get_logon_rights_modifications_for_endpoint.json b/investigations/get_logon_rights_modifications_for_endpoint.json similarity index 100% rename from investigations/investigative_get_logon_rights_modifications_for_endpoint.json rename to investigations/get_logon_rights_modifications_for_endpoint.json diff --git a/investigations/investigative_get_logon_rights_modifications_for_user.json b/investigations/get_logon_rights_modifications_for_user.json similarity index 100% rename from investigations/investigative_get_logon_rights_modifications_for_user.json rename to investigations/get_logon_rights_modifications_for_user.json diff --git a/investigations/investigative_get_network_traffic_from_src_ip.json b/investigations/get_network_traffic_from_src_ip.json similarity index 100% rename from investigations/investigative_get_network_traffic_from_src_ip.json rename to investigations/get_network_traffic_from_src_ip.json diff --git a/investigations/contextual_get_notable_history_for_endpoint.json b/investigations/get_notable_history_for_endpoint.json similarity index 100% rename from investigations/contextual_get_notable_history_for_endpoint.json rename to investigations/get_notable_history_for_endpoint.json diff --git a/investigations/contextual_get_notable_info.json b/investigations/get_notable_info.json similarity index 100% rename from investigations/contextual_get_notable_info.json rename to investigations/get_notable_info.json diff --git a/investigations/investigative_get_parent_process_info.json b/investigations/get_parent_process_info.json similarity index 100% rename from investigations/investigative_get_parent_process_info.json rename to investigations/get_parent_process_info.json diff --git a/investigations/investigative_get_process_creating_dns_traffic.json b/investigations/get_process_creating_dns_traffic.json similarity index 100% rename from investigations/investigative_get_process_creating_dns_traffic.json rename to investigations/get_process_creating_dns_traffic.json diff --git a/investigations/investigative_get_process_info.json b/investigations/get_process_info.json similarity index 100% rename from investigations/investigative_get_process_info.json rename to investigations/get_process_info.json diff --git a/investigations/investigative_get_process_info_for_port.json b/investigations/get_process_info_for_port.json similarity index 100% rename from investigations/investigative_get_process_info_for_port.json rename to investigations/get_process_info_for_port.json diff --git a/investigations/investigative_get_rdp_authentications.json b/investigations/get_rdp_authentications.json similarity index 100% rename from investigations/investigative_get_rdp_authentications.json rename to investigations/get_rdp_authentications.json diff --git a/investigations/investigative_get_registry_activities.json b/investigations/get_registry_activities.json similarity index 100% rename from investigations/investigative_get_registry_activities.json rename to investigations/get_registry_activities.json diff --git a/investigations/contextual_get_risk_for_endpoint.json b/investigations/get_risk_for_endpoint.json similarity index 100% rename from investigations/contextual_get_risk_for_endpoint.json rename to investigations/get_risk_for_endpoint.json diff --git a/investigations/contextual_get_risk_for_user.json b/investigations/get_risk_for_user.json similarity index 100% rename from investigations/contextual_get_risk_for_user.json rename to investigations/get_risk_for_user.json diff --git a/investigations/contextual_get_update_logs_for_endpoint.json b/investigations/get_update_logs_for_endpoint.json similarity index 100% rename from investigations/contextual_get_update_logs_for_endpoint.json rename to investigations/get_update_logs_for_endpoint.json diff --git a/investigations/contextual_get_user_info_from_identity_table.json b/investigations/get_user_info_from_identity_table.json similarity index 100% rename from investigations/contextual_get_user_info_from_identity_table.json rename to investigations/get_user_info_from_identity_table.json diff --git a/investigations/contextual_get_vulnerability_logs_for_endpoint.json b/investigations/get_vulnerability_logs_for_endpoint.json similarity index 100% rename from investigations/contextual_get_vulnerability_logs_for_endpoint.json rename to investigations/get_vulnerability_logs_for_endpoint.json diff --git a/investigations/investigative_get_web_activity.json b/investigations/get_web_activity.json similarity index 100% rename from investigations/investigative_get_web_activity.json rename to investigations/get_web_activity.json diff --git a/investigations/investigative_get_web_activity_by_src_ip.json b/investigations/get_web_activity_by_src_ip.json similarity index 100% rename from investigations/investigative_get_web_activity_by_src_ip.json rename to investigations/get_web_activity_by_src_ip.json diff --git a/investigations/investigative_get_web_posts_by_src.json b/investigations/get_web_posts_by_src.json similarity index 100% rename from investigations/investigative_get_web_posts_by_src.json rename to investigations/get_web_posts_by_src.json diff --git a/investigations/investigative_get_web_session_info.json b/investigations/get_web_session_info.json similarity index 100% rename from investigations/investigative_get_web_session_info.json rename to investigations/get_web_session_info.json diff --git a/investigations/investigative_get_wmi_sysmon_events.json b/investigations/get_wmi_sysmon_events.json similarity index 100% rename from investigations/investigative_get_wmi_sysmon_events.json rename to investigations/get_wmi_sysmon_events.json diff --git a/investigations/investigative_suspicious_strings_in_HTTP_header.json b/investigations/suspicious_strings_in_HTTP_header.json similarity index 100% rename from investigations/investigative_suspicious_strings_in_HTTP_header.json rename to investigations/suspicious_strings_in_HTTP_header.json diff --git a/investigations/investigative_user_activity_via_cloudtrail.json b/investigations/user_activity_via_cloudtrail.json similarity index 100% rename from investigations/investigative_user_activity_via_cloudtrail.json rename to investigations/user_activity_via_cloudtrail.json From 9833427a4ffa7b8d98c5cf2c2c36c073e3624477 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 11:27:29 -0400 Subject: [PATCH 22/74] product_up --- spec/v2/analytic_story.json.spec | 2 +- spec/v2/detections.json.spec | 4 ++-- spec/v2/example/detection_phantom.json.example | 2 +- spec/v2/example/detection_splunk.json.example | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/spec/v2/analytic_story.json.spec b/spec/v2/analytic_story.json.spec index f9615bb2cf..f04c7ed471 100644 --- a/spec/v2/analytic_story.json.spec +++ b/spec/v2/analytic_story.json.spec @@ -1,7 +1,7 @@ { "$schema": "http://json-schema.org/draft-04/schema#", "title": "Analytic Story Manifest", - "description": "The fields that make up the manifest of a version 1 Analytic Story", + "description": "The fields that make up the manifest of a version 2 Analytic Story", "type": "object", "properties": { "id": { diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index 908e369f9d..5bb964ff31 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -12,7 +12,7 @@ "description": "The unique identifier for the detection", "type": "string" }, - "type": { + "product_type": { "description": "The type of detection", "enum": [ "uba", @@ -551,7 +551,7 @@ "original_authors", "description", "id", - "type", + "product_type", "security_domain", "version", "detect" diff --git a/spec/v2/example/detection_phantom.json.example b/spec/v2/example/detection_phantom.json.example index 8c45a0843d..fe3f2a4862 100644 --- a/spec/v2/example/detection_phantom.json.example +++ b/spec/v2/example/detection_phantom.json.example @@ -103,6 +103,6 @@ "responses": [], "security_domain": "network", "spec_version": 2, - "type": "splunk", + "product_type": "phantom", "version": "1.0" } diff --git a/spec/v2/example/detection_splunk.json.example b/spec/v2/example/detection_splunk.json.example index 53b70fce50..5c520920ef 100644 --- a/spec/v2/example/detection_splunk.json.example +++ b/spec/v2/example/detection_splunk.json.example @@ -109,6 +109,6 @@ "responses": [], "security_domain": "network", "spec_version": 2, - "type": "splunk", + "product_type": "splunk", "version": "1.0" } From 3717c4ddb623d5714c752fc47948eb6a3d358707 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 11:35:18 -0400 Subject: [PATCH 23/74] updated schema versions --- spec/v2/baselines.json.spec | 5 +++-- spec/v2/detections.json.spec | 5 +++-- spec/v2/investigations.json.spec | 5 +++-- spec/v2/{analytic_story.json.spec => story.json.spec} | 5 +++-- 4 files changed, 12 insertions(+), 8 deletions(-) rename spec/v2/{analytic_story.json.spec => story.json.spec} (97%) diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec index 0e34e2935f..a945032cb2 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.json.spec @@ -1,6 +1,7 @@ { - "$schema": "http://json-schema.org/draft-04/schema#", + "$schema": "http://json-schema.org/draft-07/schema#", "title": "Baseline Manifest", + "$id": "https://api.splunkresearch.com/schemas/baselines.json", "description": "The fields that make up the manifest of a version 2 baseline search", "type": "object", "properties": { @@ -268,4 +269,4 @@ "version", "baseline" ] -} \ No newline at end of file +} diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index 5bb964ff31..a6d0b6b057 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -1,7 +1,8 @@ { "description": "A object that defines the parameters for detecting things using various Splunk capabilities", "type": "object", - "$schema": "http://json-schema.org/draft-04/schema#", + "$id": "https://api.splunkresearch.com/schemas/detections.json", + "$schema": "http://json-schema.org/draft-07/schema#", "title": "Detection Manifest", "properties": { "name": { @@ -556,4 +557,4 @@ "version", "detect" ] -} \ No newline at end of file +} diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec index 9feda2ff70..972ae208f5 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.json.spec @@ -1,6 +1,7 @@ { - "$schema": "http://json-schema.org/draft-04/schema#", + "$schema": "http://json-schema.org/draft-07/schema#", "title": "Investigative Search Manifest", + "$id": "https://api.splunkresearch.com/schemas/investigations.json", "description": "The fields that make up the manifest of a version 1 investigative earch", "type": "object", "properties": { @@ -279,4 +280,4 @@ "version", "investigate" ] -} \ No newline at end of file +} diff --git a/spec/v2/analytic_story.json.spec b/spec/v2/story.json.spec similarity index 97% rename from spec/v2/analytic_story.json.spec rename to spec/v2/story.json.spec index f04c7ed471..2e7ca93b7c 100644 --- a/spec/v2/analytic_story.json.spec +++ b/spec/v2/story.json.spec @@ -1,6 +1,7 @@ { - "$schema": "http://json-schema.org/draft-04/schema#", + "$schema": "http://json-schema.org/draft-07/schema#", "title": "Analytic Story Manifest", + "$id": "https://api.splunkresearch.com/schemas/story.json", "description": "The fields that make up the manifest of a version 2 Analytic Story", "type": "object", "properties": { @@ -161,4 +162,4 @@ "spec_version", "version" ] -} \ No newline at end of file +} From 7ee0f625e8991639c49a62bd8d4408b5d7e2ecf5 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 12:08:34 -0400 Subject: [PATCH 24/74] detection --- spec/v2/analytic_story.json.spec | 164 ++++++++++++++++++ spec/v2/example/detection_splunk.json.example | 123 ++++--------- 2 files changed, 193 insertions(+), 94 deletions(-) create mode 100644 spec/v2/analytic_story.json.spec diff --git a/spec/v2/analytic_story.json.spec b/spec/v2/analytic_story.json.spec new file mode 100644 index 0000000000..b0132c92dc --- /dev/null +++ b/spec/v2/analytic_story.json.spec @@ -0,0 +1,164 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "title": "Analytic Story Manifest", + "description": "The fields that make up the manifest of a version 2 Analytic Story", + "type": "object", + "properties": { + "id": { + "description": "A unique identifier for the Analytic Story", + "type": "string" + }, + "category": { + "description": "The category to which the Analytic Story belongs", + "enum": [ + "Abuse", + "Adversary Tactics", + "Best Practices", + "Cloud Security", + "Malware", + "Vulnerability" + ] + }, + "channel": { + "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", + "type": "string" + }, + "original_authors": { + "description": "An array of the original authors of the Analytic Story", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the Analytic Story" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the Analytic Story" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the Analytic Story" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this Analytic Story" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this Analytic Story" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this Analytic Story" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "creation_date": { + "description": "The date this story was created", + "type": "string" + }, + "modification_date": { + "description": "The date of the most recent modification to this Analytic Story", + "type": "string" + }, + "name": { + "description": "The name of the Analytic Story", + "type": "string" + }, + "description": { + "description": "A high-level description or goal of the Analytic Story", + "type": "string" + }, + "narrative": { + "description": "Long-form text that describes the Analytic Story and the rationale behind it, as well as an overview of the included searches, and how they enable the story", + "type": "string" + }, + "detections": { + "description": "An array of detection mechanisms from Splunk, UBA and phantom. ", + "type": "array", + "items": { + "type": "object", + "properties": { + "detection_id": { + "type": "string", + "description": "unique identifier of the detection, in the form of UUID" + }, + "product_type": { + "product_type": "string", + "description": "What product gives you a detection", + "enum": ["splunk", "uba", "phantom"] + }, + "name": { + "type": "string", + "description": "Name of the Detection. It can be a name of a Splunk correlation search name, a UBA threat or a Phantom detection playbook." + } + }, + "additionalProperties": false, + "required": [ + "detection_id", + "product_type", + "name" + ] + } + }, + "references": { + "description": "An array of URLs that give information about the problem the story is addressing", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + + "spec_version": { + "description": "The version of the Analytic Story specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the Analytic Story", + "type": "string" + } + }, + "additionalProperties": false, + "required": [ + "category", + "channel", + "creation_date", + "description", + "id", + "maintainers", + "modification_date", + "narrative", + "original_authors", + "name", + "references", + "detections", + "spec_version", + "version" + ] +} \ No newline at end of file diff --git a/spec/v2/example/detection_splunk.json.example b/spec/v2/example/detection_splunk.json.example index 5c520920ef..8ab0583809 100644 --- a/spec/v2/example/detection_splunk.json.example +++ b/spec/v2/example/detection_splunk.json.example @@ -1,114 +1,49 @@ { - "asset_type": "Endpoint", - "baselines": [ + "category": "Malware", + "channel": "ESCU", + "creation_date": "2017-11-21", + "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", + "detections": [ { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", - "name": "Discover DNS records,", - "type": "splunk" - } - ], - "confidence": "medium", - "creation_date": "2019-02-14", - "data_metadata": { - "data_models": [ - "Network_Resolution" - ], - "data_source": [ - "DNS" - ], - "providing_technologies": [ - "Splunk Stream", - "Bro" - ] - }, - "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", - "detect": { - "splunk": { - "correlation_rule": { - "notable": { - "nes_fields": "src", - "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", - "rule_title": "DNS record changed" - }, - "risk": { - "risk_object": "src", - "risk_object_type": [ - "system" - ], - "risk_score": 40 - }, - "suppress": { - "suppress_fields": "src", - "suppress_period": "28800s" - } - }, - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m" - }, - "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" - } - }, - "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", - "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", - "id": "1169w17b-ef78-4b59-aae8-5369073014e1", - "investigations": [ + "detection_id": "1169w17b-ef78-4b59-aae8-5369073014e1", + "name": "DNS record changed", + "product_type": "splunk" + }, { - "id": "bc11a8cf-35e7-4bb2-8140-e756cc06fd72", - "name": "Get DNS Server History for a host", - "type": "splunk" + "detection_id": "8129w27b-ef78-4w59-aae8-5369073014e1", + "name": "Lateral Movement detected", + "product_type": "uba" }, { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b712", - "name": "DNS record change investigation", - "type": "phantom" + "detection_id": "1229w27b-ef78-4w59-aae8-5369073014e1", + "name": "Playbook that detects DNS Hijacks", + "product_type": "phantom" } ], - "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", + "id": "8169f17b-ef68-4b59-aae8-5869073014e1", "maintainers": [ { "company": "Splunk", - "email": "jhernandez@splunk.com", - "name": "Jose Hernandez" + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" } ], - "mappings": { - "cis20": [ - "CIS 1", - "CIS 3", - "CIS 8", - "CIS 12" - ], - "kill_chain_phases": [ - "Command and Control" - ], - "mitre_attack": [ - "Exfiltration", - "Command and Control", - "Defense Evasion", - "Commonly Used Port" - ], - "nist": [ - "ID.AM", - "PR.DS", - "PR.IP", - "DE.AE", - "DE.CM" - ] - }, - "modification_date": "2019-02-14", - "name": "DNS record changed", + "modification_date": "2018-09-06", + "name": "Dynamic DNS", + "narrative": "Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.", "original_authors": [ { "company": "Splunk", - "email": "jhernandez@splunk.com", - "name": "Jose Hernandez" + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" } ], - "responses": [], - "security_domain": "network", + "references": [ + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", + "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", + "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", + "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html" + ], "spec_version": 2, - "product_type": "splunk", "version": "1.0" } From de1b66abb067788e1c7471a143decedf7c73e591 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 13:45:45 -0400 Subject: [PATCH 25/74] splunk example --- spec/v2/detections.json.spec | 177 ++++++++++++++++-- .../v2/example/detection_phantom.json.example | 110 +++++------ spec/v2/example/detection_splunk.json.example | 121 +++++++++--- 3 files changed, 310 insertions(+), 98 deletions(-) diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index a6d0b6b057..a80bee0bc4 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -33,7 +33,25 @@ "description": "A list of data models, if any, used by this search", "type": "array", "items": { - "type": "string" + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, "minItems": 0, "uniqueItems": true @@ -117,8 +135,10 @@ "description": "A list of critical security controls this search helps you implement", "type": "array", "items": { - "type": "string" - }, + "enum": [ + "CIS 1", "CIS 2", "CIS 3", "CIS 4", "CIS 5", "CIS 6", "CIS 7", "CIS 8","CIS 9", "CIS 10", "CIS 11", "CIS 12", "CIS 13", "CIS 14", "CIS 15","CIS 16", "CIS 17", "CIS 18", "CIS 19", "CIS 20" + ] + }, "minItems": 0, "uniqueItems": true }, @@ -126,7 +146,10 @@ "description": "A list of kill-chain phases to which the search applies", "type": "array", "items": { - "type": "string" + "enum":[ + "Reconnaissance", "Weaponization", "Delivery", "Exploitation", + "Installation", "Command and Control", "Actions on Objectives" + ] }, "minItems": 0, "uniqueItems": true @@ -135,7 +158,127 @@ "description": "A list of the techniques and tactics identified by the search", "type": "array", "items": { - "type": "string" + "enum": [ + "Initial Access", + "Execution", + "Persistence", + "Privilege Escalation", + "Defense Evasion", + "Credential Access", + "Discovery", + "Lateral Movement", + "Collection", + "Exfiltration", + "Command and Control", + "Command and Control Protocol", + "Commonly Used Port", + "Custom Cryptographic Protocol", + "DLL Injection", + "DLL Search Order Hijacking", + "DLL Side-Loading", + "Data Compressed", + "Data Encrypted", + "Data Obfuscation", + "Data Staged", + "Data Transfer Size Limits", + "Data from Local System", + "Data from Network Shared Drive", + "Data from Removable Media", + "Disabling Security Tools", + "Email Collection", + "Execution through API", + "Exfiltration Over Alternative Protocol", + "Exfiltration Over Command and Control Channel", + "Exfiltration Over Other Network Medium", + "Exfiltration Over Physical Medium", + "Exploitation of Vulnerability", + "Fallback Channels", + "File Deletion", + "File System Logical Offsets", + "File System Permissions Weakness", + "File and Directory Discovery", + "Graphical User Interface", + "Hypervisor", + "Indicator Blocking", + "Indicator Removal from Tools", + "Indicator Removal on Host", + "Input Capture", + "InstallUtil", + "Legitimate Credentials", + "Local Network Configuration Discovery", + "Local Network Connections Discovery", + "Local Port Monitor", + "Logon Scripts", + "MSBuild", + "Masquerading", + "Modify Existing Service", + "Modify Registry", + "Multi-Stage Channels", + "Multiband Communication", + "Multilayer Encryption", + "NTFS Extended Attributes", + "Network Service Scanning", + "Network Share Connection Removal", + "Network Sniffing", + "New Service", + "Obfuscated Files or Information", + "Pass the Hash", + "Pass the Ticket", + "Path Interception", + "Peripheral Device Discovery", + "Permission Groups Discovery", + "PowerShell", + "Process Discovery", + "Process Hollowing", + "Query Registry", + "Redundant Access", + "Registry Run Keys / Start Folder", + "Regsvcs/Regasm", + "Regsvr32", + "Remote Desktop Protocol", + "Create Account", + "Remote File Copy", + "Remote Services", + "Remote System Discovery", + "Replication Through Removable Media", + "Rootkit", + "Rundll32", + "Scheduled Task", + "Scheduled Transfer", + "Screen Capture", + "Scripting", + "Security Software Discovery", + "Security Support Provider", + "Service Execution", + "Service Registry Permissions Weakness", + "Shared Webroot", + "Shortcut Modification", + "Software Packing", + "Standard Application Layer Protocol", + "Standard Cryptographic Protocol", + "Standard Non-Application Layer Protocol", + "System Information Discovery", + "System Owner/User Discovery", + "System Service Discovery", + "System Time Discovery", + "Taint Shared Content", + "Third-party Software", + "Timestomp", + "Two-Factor Authentication Interception", + "Uncommonly Used Port", + "Video Capture", + "Valid Accounts", + "Web Service", + "Web Shell", + "Windows Admin Shares", + "Windows Management Instrumentation Event Subscription", + "Windows Management Instrumentation", + "Windows Remote Management", + "Winlogon Helper DLL", + "Initial Access", + "Exploitation for Privilege Escalation" + ] + }, "minItems": 0, "uniqueItems": true @@ -144,7 +287,11 @@ "description": "A list of the NIST controls the search helps you implement", "type": "array", "items": { - "type": "string" + "enum": [ + "ID.AM", "ID.RA", "PR.DS", "PR.IP", "PR.AC", "PR.PT", "PR.AT", "PR.MA", + "DE.CM", "DE.DP", "DE.AE", "RS.MI", "RS.AN", "RS.RP", "RS.IM", "RS.CO", + "RC.IM", "RC.CO" + ] }, "minItems": 0, "uniqueItems": true @@ -210,7 +357,7 @@ "type": "object", "properties": { "type": { - "type": "string", + "product_type": "string", "description": "Type of baseline to execute", "enum": [ "phantom", @@ -220,7 +367,7 @@ }, "name": { "type": "string", - "description": "name of baseline" + "description": "name of baseline object" }, "id": { "type": "string", @@ -229,7 +376,7 @@ }, "additionalProperties": false, "required": [ - "type", + "product_type", "name", "id" ] @@ -241,7 +388,7 @@ "items": { "type": "object", "properties": { - "type": { + "product_type": { "type": "string", "description": "Type of baseline to execute", "enum": [ @@ -252,7 +399,7 @@ }, "name": { "type": "string", - "description": "name of baseline" + "description": "Name of baseline" }, "id": { "type": "string", @@ -261,7 +408,7 @@ }, "additionalProperties": false, "required": [ - "type", + "product_type", "name", "id" ] @@ -273,8 +420,8 @@ "items": { "type": "object", "properties": { - "type": { - "type": "string", + "product_type": { + "product_type": "string", "description": "Type of baseline to execute", "enum": [ "phantom", @@ -293,7 +440,7 @@ }, "additionalProperties": false, "required": [ - "type", + "product_type", "name", "id" ] diff --git a/spec/v2/example/detection_phantom.json.example b/spec/v2/example/detection_phantom.json.example index fe3f2a4862..c17cafae1a 100644 --- a/spec/v2/example/detection_phantom.json.example +++ b/spec/v2/example/detection_phantom.json.example @@ -1,8 +1,4 @@ { - "asset_type": "Endpoint", - "baselines": [], - "confidence": "medium", - "creation_date": "2019-02-14", "data_metadata": { "data_models": [ "Network_Resolution" @@ -15,51 +11,6 @@ "Bro" ] }, - "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", - "detect": { - "splunk": { - "correlation_rule": { - "notable": { - "nes_fields": "src", - "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", - "rule_title": "DNS record changed" - }, - "risk": { - "risk_object": "src", - "risk_object_type": [ - "system" - ], - "risk_score": 40 - }, - "suppress": { - "suppress_fields": "src", - "suppress_period": "28800s" - } - }, - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m" - }, - "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" - } - }, - "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", - "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", - "id": "1229w27b-ef78-4w59-aae8-5369073014e1", - "investigations": [ - { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", - "name": "Discover DNS records,", - "type": "splunk" - }, - { - "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", - "name": "DNS record change investigation", - "type": "phantom" - } - ], - "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", "maintainers": [ { "company": "Splunk", @@ -91,8 +42,6 @@ "DE.CM" ] }, - "modification_date": "2019-02-14", - "name": "Playbook that detects DNS Hijacks", "original_authors": [ { "company": "Splunk", @@ -100,9 +49,60 @@ "name": "Jose Hernandez" } ], - "responses": [], + "creation_date": "2019-02-14", + "modification_date": "2019-02-14", + "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", + "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", + "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", + "id": "1229w27b-ef78-4w59-aae8-5369073014e1", + "name": "Playbook that detects DNS Hijacks", + "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", + "product_type": "splunk", + "asset_type": "Endpoint", + "confidence": "medium", "security_domain": "network", "spec_version": 2, - "product_type": "phantom", - "version": "1.0" -} + "version": "1.0", + "baselines": [], + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "src", + "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", + "rule_title": "DNS record changed" + }, + "risk": { + "risk_object": "src", + "risk_object_type": [ + "system" + ], + "risk_score": 40 + }, + "suppress": { + "suppress_fields": "src", + "suppress_period": "28800s" + } + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + } + }, + "investigations": [ + { + "name": "Discover DNS records,", + "product_type": "splunk", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3" + }, + { + "name": "DNS record change investigation", + "product_type": "phantom", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b711" + } + ], + "responses": [] +} \ No newline at end of file diff --git a/spec/v2/example/detection_splunk.json.example b/spec/v2/example/detection_splunk.json.example index 8ab0583809..31005efecf 100644 --- a/spec/v2/example/detection_splunk.json.example +++ b/spec/v2/example/detection_splunk.json.example @@ -1,49 +1,114 @@ { - "category": "Malware", - "channel": "ESCU", - "creation_date": "2017-11-21", - "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", - "detections": [ + "asset_type": "Endpoint", + "baselines": [ { - "detection_id": "1169w17b-ef78-4b59-aae8-5369073014e1", - "name": "DNS record changed", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", + "name": "Discover DNS records,", "product_type": "splunk" - }, + } + ], + "confidence": "medium", + "creation_date": "2019-02-14", + "data_metadata": { + "data_models": [ + "Network_Resolution" + ], + "data_source": [ + "DNS" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "src", + "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", + "rule_title": "DNS record changed" + }, + "risk": { + "risk_object": "src", + "risk_object_type": [ + "system" + ], + "risk_score": 40 + }, + "suppress": { + "suppress_fields": "src", + "suppress_period": "28800s" + } + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + } + }, + "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", + "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", + "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", + "investigations": [ { - "detection_id": "8129w27b-ef78-4w59-aae8-5369073014e1", - "name": "Lateral Movement detected", - "product_type": "uba" + "id": "bc11a8cf-35e7-4bb2-8140-e756cc06fd72", + "name": "Get DNS Server History for a host", + "product_type": "splunk" }, { - "detection_id": "1229w27b-ef78-4w59-aae8-5369073014e1", - "name": "Playbook that detects DNS Hijacks", + "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", + "name": "DNS record change investigation", "product_type": "phantom" } ], - "id": "8169f17b-ef68-4b59-aae8-5869073014e1", + "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", "maintainers": [ { "company": "Splunk", - "email": "bpatel@splunk.com", - "name": "Bhavin Patel" + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" } ], - "modification_date": "2018-09-06", - "name": "Dynamic DNS", - "narrative": "Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.", + "mappings": { + "cis20": [ + "CIS 1", + "CIS 3", + "CIS 8", + "CIS 12" + ], + "kill_chain_phases": [ + "Command and Control" + ], + "mitre_attack": [ + "Exfiltration", + "Command and Control", + "Defense Evasion", + "Commonly Used Port" + ], + "nist": [ + "ID.AM", + "PR.DS", + "PR.IP", + "DE.AE", + "DE.CM" + ] + }, + "modification_date": "2019-02-14", + "name": "DNS record changed", "original_authors": [ { "company": "Splunk", - "email": "bpatel@splunk.com", - "name": "Bhavin Patel" + "email": "jhernandez@splunk.com", + "name": "Jose Hernandez" } ], - "references": [ - "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", - "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", - "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", - "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html" - ], + "responses": [], + "security_domain": "network", "spec_version": 2, + "product_type": "splunk", "version": "1.0" -} +} \ No newline at end of file From c17a1693672b18a67d17b4561c05c3680e22a5f3 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 14:00:29 -0400 Subject: [PATCH 26/74] baseline updates --- spec/v2/baselines.json.spec | 7 ++++--- spec/v2/example/baseline_dns_record_changed.json.example | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec index a945032cb2..c83ef7aacd 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.json.spec @@ -13,11 +13,12 @@ "description": "The unique identifier for the search", "type": "string" }, - "type": { + "product_type": { "description": "The type of baseline", "enum": [ "splunk", - "phantom" + "phantom", + "uba" ] }, "description": { @@ -264,7 +265,7 @@ "original_authors", "name", "description", - "type", + "product_type", "spec_version", "version", "baseline" diff --git a/spec/v2/example/baseline_dns_record_changed.json.example b/spec/v2/example/baseline_dns_record_changed.json.example index 458ee5c0f9..4ab8a14480 100644 --- a/spec/v2/example/baseline_dns_record_changed.json.example +++ b/spec/v2/example/baseline_dns_record_changed.json.example @@ -43,6 +43,6 @@ } ], "spec_version": 2, - "type": "baseline", + "product_type": "baseline", "version": "1.0" } From db8ce1a9cd13cd14e4c53f9288d63df32aeb9599 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 14:26:17 -0400 Subject: [PATCH 27/74] emojis and stuff --- spec/v2/detections.json.spec | 368 +++++++++++------- .../investigation_phantom.json.example | 2 +- .../example/investigation_search.json.example | 2 +- spec/v2/investigations.json.spec | 147 +++---- 4 files changed, 295 insertions(+), 224 deletions(-) diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index a80bee0bc4..61ad7659a2 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -34,24 +34,24 @@ "type": "array", "items": { "enum": [ - "Alerts", - "Application_State", - "Authentication", - "Certificates", - "Change_Analysis", - "Change", - "Malware", - "Email", - "Identity_Management", - "Network_Resolution", - "Network_Traffic", - "Vulnerabilities", - "Web", - "Network_Sessions", - "Updates", - "Risk", - "Endpoint" - ] + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, "minItems": 0, "uniqueItems": true @@ -136,9 +136,28 @@ "type": "array", "items": { "enum": [ - "CIS 1", "CIS 2", "CIS 3", "CIS 4", "CIS 5", "CIS 6", "CIS 7", "CIS 8","CIS 9", "CIS 10", "CIS 11", "CIS 12", "CIS 13", "CIS 14", "CIS 15","CIS 16", "CIS 17", "CIS 18", "CIS 19", "CIS 20" - ] - }, + "CIS 1", + "CIS 2", + "CIS 3", + "CIS 4", + "CIS 5", + "CIS 6", + "CIS 7", + "CIS 8", + "CIS 9", + "CIS 10", + "CIS 11", + "CIS 12", + "CIS 13", + "CIS 14", + "CIS 15", + "CIS 16", + "CIS 17", + "CIS 18", + "CIS 19", + "CIS 20" + ] + }, "minItems": 0, "uniqueItems": true }, @@ -146,10 +165,15 @@ "description": "A list of kill-chain phases to which the search applies", "type": "array", "items": { - "enum":[ - "Reconnaissance", "Weaponization", "Delivery", "Exploitation", - "Installation", "Command and Control", "Actions on Objectives" - ] + "enum": [ + "Reconnaissance", + "Weaponization", + "Delivery", + "Exploitation", + "Installation", + "Command and Control", + "Actions on Objectives" + ] }, "minItems": 0, "uniqueItems": true @@ -158,127 +182,126 @@ "description": "A list of the techniques and tactics identified by the search", "type": "array", "items": { - "enum": [ - "Initial Access", - "Execution", - "Persistence", - "Privilege Escalation", - "Defense Evasion", - "Credential Access", - "Discovery", - "Lateral Movement", - "Collection", - "Exfiltration", - "Command and Control", - "Command and Control Protocol", - "Commonly Used Port", - "Custom Cryptographic Protocol", - "DLL Injection", - "DLL Search Order Hijacking", - "DLL Side-Loading", - "Data Compressed", - "Data Encrypted", - "Data Obfuscation", - "Data Staged", - "Data Transfer Size Limits", - "Data from Local System", - "Data from Network Shared Drive", - "Data from Removable Media", - "Disabling Security Tools", - "Email Collection", - "Execution through API", - "Exfiltration Over Alternative Protocol", - "Exfiltration Over Command and Control Channel", - "Exfiltration Over Other Network Medium", - "Exfiltration Over Physical Medium", - "Exploitation of Vulnerability", - "Fallback Channels", - "File Deletion", - "File System Logical Offsets", - "File System Permissions Weakness", - "File and Directory Discovery", - "Graphical User Interface", - "Hypervisor", - "Indicator Blocking", - "Indicator Removal from Tools", - "Indicator Removal on Host", - "Input Capture", - "InstallUtil", - "Legitimate Credentials", - "Local Network Configuration Discovery", - "Local Network Connections Discovery", - "Local Port Monitor", - "Logon Scripts", - "MSBuild", - "Masquerading", - "Modify Existing Service", - "Modify Registry", - "Multi-Stage Channels", - "Multiband Communication", - "Multilayer Encryption", - "NTFS Extended Attributes", - "Network Service Scanning", - "Network Share Connection Removal", - "Network Sniffing", - "New Service", - "Obfuscated Files or Information", - "Pass the Hash", - "Pass the Ticket", - "Path Interception", - "Peripheral Device Discovery", - "Permission Groups Discovery", - "PowerShell", - "Process Discovery", - "Process Hollowing", - "Query Registry", - "Redundant Access", - "Registry Run Keys / Start Folder", - "Regsvcs/Regasm", - "Regsvr32", - "Remote Desktop Protocol", - "Create Account", - "Remote File Copy", - "Remote Services", - "Remote System Discovery", - "Replication Through Removable Media", - "Rootkit", - "Rundll32", - "Scheduled Task", - "Scheduled Transfer", - "Screen Capture", - "Scripting", - "Security Software Discovery", - "Security Support Provider", - "Service Execution", - "Service Registry Permissions Weakness", - "Shared Webroot", - "Shortcut Modification", - "Software Packing", - "Standard Application Layer Protocol", - "Standard Cryptographic Protocol", - "Standard Non-Application Layer Protocol", - "System Information Discovery", - "System Owner/User Discovery", - "System Service Discovery", - "System Time Discovery", - "Taint Shared Content", - "Third-party Software", - "Timestomp", - "Two-Factor Authentication Interception", - "Uncommonly Used Port", - "Video Capture", - "Valid Accounts", - "Web Service", - "Web Shell", - "Windows Admin Shares", - "Windows Management Instrumentation Event Subscription", - "Windows Management Instrumentation", - "Windows Remote Management", - "Winlogon Helper DLL", - "Initial Access", - "Exploitation for Privilege Escalation" - ] - + "enum": [ + "Initial Access", + "Execution", + "Persistence", + "Privilege Escalation", + "Defense Evasion", + "Credential Access", + "Discovery", + "Lateral Movement", + "Collection", + "Exfiltration", + "Command and Control", + "Command and Control Protocol", + "Commonly Used Port", + "Custom Cryptographic Protocol", + "DLL Injection", + "DLL Search Order Hijacking", + "DLL Side-Loading", + "Data Compressed", + "Data Encrypted", + "Data Obfuscation", + "Data Staged", + "Data Transfer Size Limits", + "Data from Local System", + "Data from Network Shared Drive", + "Data from Removable Media", + "Disabling Security Tools", + "Email Collection", + "Execution through API", + "Exfiltration Over Alternative Protocol", + "Exfiltration Over Command and Control Channel", + "Exfiltration Over Other Network Medium", + "Exfiltration Over Physical Medium", + "Exploitation of Vulnerability", + "Fallback Channels", + "File Deletion", + "File System Logical Offsets", + "File System Permissions Weakness", + "File and Directory Discovery", + "Graphical User Interface", + "Hypervisor", + "Indicator Blocking", + "Indicator Removal from Tools", + "Indicator Removal on Host", + "Input Capture", + "InstallUtil", + "Legitimate Credentials", + "Local Network Configuration Discovery", + "Local Network Connections Discovery", + "Local Port Monitor", + "Logon Scripts", + "MSBuild", + "Masquerading", + "Modify Existing Service", + "Modify Registry", + "Multi-Stage Channels", + "Multiband Communication", + "Multilayer Encryption", + "NTFS Extended Attributes", + "Network Service Scanning", + "Network Share Connection Removal", + "Network Sniffing", + "New Service", + "Obfuscated Files or Information", + "Pass the Hash", + "Pass the Ticket", + "Path Interception", + "Peripheral Device Discovery", + "Permission Groups Discovery", + "PowerShell", + "Process Discovery", + "Process Hollowing", + "Query Registry", + "Redundant Access", + "Registry Run Keys / Start Folder", + "Regsvcs/Regasm", + "Regsvr32", + "Remote Desktop Protocol", + "Create Account", + "Remote File Copy", + "Remote Services", + "Remote System Discovery", + "Replication Through Removable Media", + "Rootkit", + "Rundll32", + "Scheduled Task", + "Scheduled Transfer", + "Screen Capture", + "Scripting", + "Security Software Discovery", + "Security Support Provider", + "Service Execution", + "Service Registry Permissions Weakness", + "Shared Webroot", + "Shortcut Modification", + "Software Packing", + "Standard Application Layer Protocol", + "Standard Cryptographic Protocol", + "Standard Non-Application Layer Protocol", + "System Information Discovery", + "System Owner/User Discovery", + "System Service Discovery", + "System Time Discovery", + "Taint Shared Content", + "Third-party Software", + "Timestomp", + "Two-Factor Authentication Interception", + "Uncommonly Used Port", + "Video Capture", + "Valid Accounts", + "Web Service", + "Web Shell", + "Windows Admin Shares", + "Windows Management Instrumentation Event Subscription", + "Windows Management Instrumentation", + "Windows Remote Management", + "Winlogon Helper DLL", + "Initial Access", + "Exploitation for Privilege Escalation" + ] }, "minItems": 0, "uniqueItems": true @@ -288,10 +311,44 @@ "type": "array", "items": { "enum": [ - "ID.AM", "ID.RA", "PR.DS", "PR.IP", "PR.AC", "PR.PT", "PR.AT", "PR.MA", - "DE.CM", "DE.DP", "DE.AE", "RS.MI", "RS.AN", "RS.RP", "RS.IM", "RS.CO", - "RC.IM", "RC.CO" - ] + "ID.AM", + "ID.RA", + "PR.DS", + "PR.IP", + "PR.AC", + "PR.PT", + "PR.AT", + "PR.MA", + "DE.CM", + "DE.DP", + "DE.AE", + "RS.MI", + "RS.AN", + "RS.RP", + "RS.IM", + "RS.CO", + "RC.IM", + "RC.CO" + ] + }, + "minItems": 0, + "uniqueItems": true + }, + "emoji": { + "description": "A list of security emojis that will help UBA understand this alert as an external alarm", + "type": "array", + "items": { + "enum": [ + "EndPoint", + "AD", + "Firewall", + "ApplicationLog", + "IPS", + "CloudData", + "Correlation", + "Printer", + "Badge" + ] }, "minItems": 0, "uniqueItems": true @@ -319,6 +376,15 @@ "description": "Designates the type of asset being investigated", "type": "string" }, + "entities": { + "description": "A list of entities that is outputed by the search...", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, "known_false_positives": { "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", "type": "string" @@ -704,4 +770,4 @@ "version", "detect" ] -} +} \ No newline at end of file diff --git a/spec/v2/example/investigation_phantom.json.example b/spec/v2/example/investigation_phantom.json.example index bb353961e3..b6e82c0dc9 100644 --- a/spec/v2/example/investigation_phantom.json.example +++ b/spec/v2/example/investigation_phantom.json.example @@ -39,6 +39,6 @@ } ], "spec_version": 2, - "type": "investigative", + "product_type": "splunk", "version": "1.0" } diff --git a/spec/v2/example/investigation_search.json.example b/spec/v2/example/investigation_search.json.example index eee20a3e96..53dfd59c7b 100644 --- a/spec/v2/example/investigation_search.json.example +++ b/spec/v2/example/investigation_search.json.example @@ -42,6 +42,6 @@ } ], "spec_version": 2, - "type": "investigative", + "product_type": "splunk", "version": "1.0" } diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec index 972ae208f5..29dd070991 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.json.spec @@ -1,14 +1,22 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Investigative Search Manifest", - "$id": "https://api.splunkresearch.com/schemas/investigations.json", "description": "The fields that make up the manifest of a version 1 investigative earch", "type": "object", + "$id": "https://api.splunkresearch.com/schemas/investigations.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "Investigative Search Manifest", "properties": { + "name": { + "description": "The name of the search", + "type": "string" + }, "id": { "description": "The unique identifier for the search", "type": "string" }, + "description": { + "description": "A description of what the search is designed to detect", + "type": "string" + }, "data_metadata": { "type": "object", "description": "Information about the date being ingested", @@ -22,8 +30,8 @@ "minItems": 0, "uniqueItems": true }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", "type": "array", "items": { "type": "string" @@ -31,8 +39,8 @@ "minItems": 0, "uniqueItems": true }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", "type": "array", "items": { "type": "string" @@ -40,8 +48,8 @@ "minItems": 0, "uniqueItems": true }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", "type": "array", "items": { "type": "string" @@ -88,23 +96,14 @@ "providing_technologies" ] }, - "fields_required": { - "description": "A list of fields that need to be in the result of the detection search for the search to be successful", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" }, "how_to_implement": { "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", "type": "string" }, - "creation_date": { - "description": "The date the story manifest was created", - "type": "string" - }, "maintainers": { "description": "An array of the current maintainers of the Analytic Story.", "type": "array", @@ -163,27 +162,6 @@ ] } }, - "search": { - "description": "The search (in SPL) executed within core Splunk", - "type": "string" - }, - "description": { - "description": "A description of what the search is designed to detect", - "type": "string" - }, - "name": { - "description": "The name of the search", - "type": "string" - }, - "type": { - "description": "The type of the search", - "enum": [ - "detection", - "investigative", - "contextual", - "baseline" - ] - }, "spec_version": { "description": "The version of the investigative search specification this manifest follows", "type": "integer" @@ -192,6 +170,24 @@ "description": "The version of the search", "type": "string" }, + "entities": { + "description": "A list of entities that is outputed by the search...", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, + "fields_required": { + "description": "A list of fields that need to be in the result of the detection search for the search to be successful", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, "investigate": { "oneOf": [ { @@ -205,6 +201,34 @@ }, "additionalProperties": false, "definitions": { + "splunk": { + "type": "object", + "properties": { + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" + }, + "investigate_window": { + "type": "object", + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "additionalProperties": false, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ] + } + } + }, "phantom": { "type": "object", "properties": { @@ -231,34 +255,15 @@ "severity": { "type": "string", "description": "Severity in phantom (High, Medium, Low)" - } - } - }, - "splunk": { - "type": "object", - "properties": { - "investigate_window": { - "type": "object", - "description": "The fields associated on when this search should run relative to the detection event", - "properties": { - "earliest_time_offset": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" - }, - "latest_time_offset": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" - } - }, - "additionalProperties": false, - "required": [ - "latest_time_offset", - "earliest_time_offset" - ] }, - "search": { - "description": "The search (in SPL) executed within core Splunk", - "type": "string" + "product_type": { + "product_type": "string", + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ] } } } @@ -274,10 +279,10 @@ "search", "description", "id", - "type", + "product_type", "investigate_window", "spec_version", "version", "investigate" ] -} +} \ No newline at end of file From c7cb162ecd01d8f32091b828a176c77e1e83834a Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 16:38:29 -0400 Subject: [PATCH 28/74] response --- spec/v2/analytic_story.json.spec | 44 ++- spec/v2/investigations.json.spec | 479 ++++++++++++++++--------------- spec/v2/responses.json.spec | 295 +++++++++++++++++++ 3 files changed, 582 insertions(+), 236 deletions(-) create mode 100644 spec/v2/responses.json.spec diff --git a/spec/v2/analytic_story.json.spec b/spec/v2/analytic_story.json.spec index b0132c92dc..f68343507d 100644 --- a/spec/v2/analytic_story.json.spec +++ b/spec/v2/analytic_story.json.spec @@ -11,14 +11,46 @@ "category": { "description": "The category to which the Analytic Story belongs", "enum": [ - "Abuse", - "Adversary Tactics", - "Best Practices", - "Cloud Security", - "Malware", - "Vulnerability" + "Abuse", + "Account Compromise", + "Account Sharing", + "Adversary Tactics", + "Best Practices", + "Cloud Security", + "Command and Control", + "Compliance", + "Data Exfiltration", + "Denial of Service", + "Endpoint Compromise", + "GDPR", + "IAM Analytics", + "Insider Threat", + "Lateral Movement", + "Malware", + "Network Attack", + "Operations", + "Other", + "Privilege Escalation", + "Ransomware", + "SaaS", + "Scanning", + "Shadow IT", + "Threat Intelligence", + "Unauthorized Software", + "Vulnerability", + "Web Attack" ] }, + "use_cases": { + "description": "The usecases to which the Analytic Story belongs to.(SSE will leverage this as a mapping field", + "enum": [ + "Security Monitoring", + "Advanced Threat Detection", + "Insider Threat", + "Compliance", + "Fraud Detection" + ] + }, "channel": { "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", "type": "string" diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec index 29dd070991..7616191262 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.json.spec @@ -25,264 +25,283 @@ "description": "A list of data models, if any, used by this search", "type": "array", "items": { - "type": "string" + "items": { + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] + }, + "minItems": 0, + "uniqueItems": true }, - "minItems": 0, - "uniqueItems": true - }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "minItems": 0, - "uniqueItems": true - }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", - "items": { - "type": "string" + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "minItems": 0, - "uniqueItems": true - }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "minItems": 0, - "uniqueItems": true + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "uniqueItems": true + } }, - "providing_technologies": { - "description": "A list of technologies that provide this data", - "type": "array", - "items": { - "enum": [ - "Apache", - "AWS", - "Bro", - "Microsoft Windows", - "Linux", - "macOS", - "Netbackup", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Stream", - "Active Directory", - "Bluecoat", - "Carbon Black Response", - "Carbon Black Protect", - "CrowdStrike Falcon", - "Microsoft Exchange", - "Nessus", - "Palo Alto Firewall", - "Qualys", - "Sysmon", - "Tanium", - "Ziften" - ] + "additionalProperties": false, + "required": [ + "data_source", + "providing_technologies" + ] + }, + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } }, - "minItems": 0, - "uniqueItems": true + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] } }, - "additionalProperties": false, - "required": [ - "data_source", - "providing_technologies" - ] - }, - "creation_date": { - "description": "The date the story manifest was created", - "type": "string" + "original_authors": { + "description": "A list of the original authors of the search", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "spec_version": { + "description": "The version of the investigative search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + }, + "entities": { + "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, + "investigate": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + } }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", - "type": "string" + "product_type": { + "description": "Type of product that will support this investigate object.", + "enum": [ + "phantom", + "splunk", + "uba" + ], + "product_type": "string" }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", - "items": { + "additionalProperties": false, + "definitions": { + "splunk": { "type": "object", "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" - }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this search" + "search": { + "description": "The search (in SPL) executed within core Splunk for investgation.", + "type": "string" }, - "name": { - "type": "string", - "description": "Name of the person maintaining this search" + "investigate_window": { + "type": "object", + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "additionalProperties": false, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ] } }, - "additionalProperties": false, "required": [ - "name", - "email", - "company" + "search", + "investigate_window" ] - } - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "original_authors": { - "description": "A list of the original authors of the search", - "type": "array", - "items": { + }, + "phantom": { "type": "object", "properties": { - "company": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { "type": "string", - "description": "Company associated with the person who originally authored the search" + "description": "Url of the playbook on Phantom website." }, - "email": { + "sensitivity": { "type": "string", - "description": "Email address of the person who originally authored the search" + "description": "TLP colors (White, Green, Amber or Red)" }, - "name": { + "severity": { "type": "string", - "description": "Name of the person who originally authored the search" + "description": "Severity in phantom (High, Medium, Low)" } }, - "additionalProperties": false, "required": [ - "name", - "email", - "company" + "phantom_server", + "playbook_name", + "playbook_url", + "playbook_display_name" ] } }, - "spec_version": { - "description": "The version of the investigative search specification this manifest follows", - "type": "integer" - }, - "version": { - "description": "The version of the search", - "type": "string" - }, - "entities": { - "description": "A list of entities that is outputed by the search...", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, - "fields_required": { - "description": "A list of fields that need to be in the result of the detection search for the search to be successful", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "investigate": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" - } - ] - } - }, - "additionalProperties": false, - "definitions": { - "splunk": { - "type": "object", - "properties": { - "search": { - "description": "The search (in SPL) executed within core Splunk", - "type": "string" - }, - "investigate_window": { - "type": "object", - "description": "The fields associated on when this search should run relative to the detection event", - "properties": { - "earliest_time_offset": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" - }, - "latest_time_offset": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" - } - }, - "additionalProperties": false, - "required": [ - "latest_time_offset", - "earliest_time_offset" - ] - } - } - }, - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" - }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - }, - "product_type": { - "product_type": "string", - "description": "Type of baseline to execute", - "enum": [ - "phantom", - "splunk", - "uba" - ] - } - } - } - }, - "required": [ - "creation_date", - "data_metadata", - "fields_required", - "how_to_implement", - "maintainers", - "modification_date", - "original_authors", - "search", - "description", - "id", - "product_type", - "investigate_window", - "spec_version", - "version", - "investigate" - ] + "required": [ + "creation_date", + "data_metadata", + "fields_required", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "description", + "id", + "product_type", + "spec_version", + "version", + "investigate" + ] + } } \ No newline at end of file diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec new file mode 100644 index 0000000000..270f0ba2cb --- /dev/null +++ b/spec/v2/responses.json.spec @@ -0,0 +1,295 @@ +{ + "description": "The fields that make up the manifest of a version 1 reponse spec", + "type": "object", + "$id": "https://api.splunkresearch.com/schemas/investigations.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "Response Manifest", + "properties": { + "name": { + "description": "The name of the search", + "type": "string" + }, + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "description": { + "description": "A description of what this reponse object will do ", + "type": "string" + }, + "data_metadata": { + "type": "object", + "description": "Information about the date being used to run the response", + "properties": { + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "uniqueItems": true + } + }, + "additionalProperties": false, + "required": [ + "data_source", + "providing_technologies" + ] + }, + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "how_to_implement": { + "description": "A discussion on how to implement this reponse object, the config files, etc", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the reponse spec", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "original_authors": { + "description": "A list of the original authors of the reponse object", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" + }, + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] + } + }, + "spec_version": { + "description": "The version of the investigative search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + }, + "entities": { + "description": "A list of entities that is either an input or an output for the security workflow.", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, + "product_type": { + "description": "The type of detection", + "enum": [ + "splunk", + "phantom" + ] + }, + "fields_required": { + "description": "A list of fields that need to be in the result of the detection search for the search to be successful", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true + }, + "response": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + } + }, + "additionalProperties": false, + "definitions": { + "splunk": { + "type": "object", + "properties": { + "search": { + "description": "A reponse action exectued in splunk", + "type": "string" + }, + "investigate_window": { + "type": "object", + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "additionalProperties": false, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ] + } + } + }, + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." + }, + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" + }, + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" + }, + "product_type": { + "product_type": "string", + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ] + } + } + } + }, + "required": [ + "creation_date", + "data_metadata", + "fields_required", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "search", + "description", + "id", + "product_type", + "investigate_window", + "spec_version", + "version", + "investigate" + ] +} \ No newline at end of file From af17d1ea197edd038678b17d42c57c721c94fea5 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 16:43:29 -0400 Subject: [PATCH 29/74] fixes --- spec/v2/detections.json.spec | 1 + .../baseline_dns_record_changed.json.example | 3 +- spec/v2/investigations.json.spec | 3 +- spec/v2/responses.json.spec | 532 +++++++++--------- 4 files changed, 270 insertions(+), 269 deletions(-) diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index 61ad7659a2..58c9a362e5 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -21,6 +21,7 @@ "phantom" ] }, + "description": { "description": "A description of what the detection is designed to find", "type": "string" diff --git a/spec/v2/example/baseline_dns_record_changed.json.example b/spec/v2/example/baseline_dns_record_changed.json.example index 4ab8a14480..716d26308e 100644 --- a/spec/v2/example/baseline_dns_record_changed.json.example +++ b/spec/v2/example/baseline_dns_record_changed.json.example @@ -8,6 +8,7 @@ "search": "| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \"\\*\", \"\")) | join domain [|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records.csv" } }, + "product_type": "splunk", "creation_date": "2019-02-14", "data_metadata": { "data_models": [ @@ -43,6 +44,6 @@ } ], "spec_version": 2, - "product_type": "baseline", + "version": "1.0" } diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec index 7616191262..23a09c2731 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.json.spec @@ -215,8 +215,7 @@ "phantom", "splunk", "uba" - ], - "product_type": "string" + ] }, "additionalProperties": false, "definitions": { diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec index 270f0ba2cb..e23dd95502 100644 --- a/spec/v2/responses.json.spec +++ b/spec/v2/responses.json.spec @@ -1,295 +1,295 @@ -{ - "description": "The fields that make up the manifest of a version 1 reponse spec", - "type": "object", - "$id": "https://api.splunkresearch.com/schemas/investigations.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Response Manifest", - "properties": { - "name": { - "description": "The name of the search", - "type": "string" - }, - "id": { - "description": "The unique identifier for the search", - "type": "string" - }, - "description": { - "description": "A description of what this reponse object will do ", - "type": "string" - }, - "data_metadata": { - "type": "object", - "description": "Information about the date being used to run the response", - "properties": { - "data_models": { - "description": "A list of data models, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "providing_technologies": { - "description": "A list of technologies that provide this data", - "type": "array", - "items": { - "enum": [ - "Apache", - "AWS", - "Bro", - "Microsoft Windows", - "Linux", - "macOS", - "Netbackup", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Stream", - "Active Directory", - "Bluecoat", - "Carbon Black Response", - "Carbon Black Protect", - "CrowdStrike Falcon", - "Microsoft Exchange", - "Nessus", - "Palo Alto Firewall", - "Qualys", - "Sysmon", - "Tanium", - "Ziften" - ] - }, - "minItems": 0, - "uniqueItems": true - } + { + "description": "The fields that make up the manifest of a version 1 reponse spec", + "type": "object", + "$id": "https://api.splunkresearch.com/schemas/investigations.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "Response Manifest", + "properties": { + "name": { + "description": "The name of the search", + "type": "string" }, - "additionalProperties": false, - "required": [ - "data_source", - "providing_technologies" - ] - }, - "creation_date": { - "description": "The date the story manifest was created", - "type": "string" - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "how_to_implement": { - "description": "A discussion on how to implement this reponse object, the config files, etc", - "type": "string" - }, - "maintainers": { - "description": "An array of the current maintainers of the reponse spec", - "type": "array", - "items": { + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "description": { + "description": "A description of what this reponse object will do ", + "type": "string" + }, + "data_metadata": { "type": "object", + "description": "Information about the date being used to run the response", "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" + "data_models": { + "description": "A list of data models, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this search" + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "name": { - "type": "string", - "description": "Name of the person maintaining this search" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "original_authors": { - "description": "A list of the original authors of the reponse object", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 0, + "uniqueItems": true }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the search" + "providing_technologies": { + "description": "A list of technologies that provide this data", + "type": "array", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "uniqueItems": true } }, "additionalProperties": false, "required": [ - "name", - "email", - "company" + "data_source", + "providing_technologies" ] - } - }, - "spec_version": { - "description": "The version of the investigative search specification this manifest follows", - "type": "integer" - }, - "version": { - "description": "The version of the search", - "type": "string" - }, - "entities": { - "description": "A list of entities that is either an input or an output for the security workflow.", - "type": "array", - "items": { - "enum": [] }, - "minItems": 0, - "uniqueItems": true - }, - "product_type": { - "description": "The type of detection", - "enum": [ - "splunk", - "phantom" - ] - }, - "fields_required": { - "description": "A list of fields that need to be in the result of the detection search for the search to be successful", - "type": "array", - "items": { + "creation_date": { + "description": "The date the story manifest was created", "type": "string" }, - "minItems": 0, - "uniqueItems": true - }, - "response": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "how_to_implement": { + "description": "A discussion on how to implement this reponse object, the config files, etc", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the reponse spec", + "type": "array", + "items": { + "type": "object", + "properties": { + "company": { + "type": "string", + "description": "Company associated with the person maintaining this search" + }, + "email": { + "type": "string", + "description": "Email address of the person maintaining this search" + }, + "name": { + "type": "string", + "description": "Name of the person maintaining this search" + } + }, + "additionalProperties": false, + "required": [ + "name", + "email", + "company" + ] } - ] - } - }, - "additionalProperties": false, - "definitions": { - "splunk": { - "type": "object", - "properties": { - "search": { - "description": "A reponse action exectued in splunk", - "type": "string" - }, - "investigate_window": { + }, + "original_authors": { + "description": "A list of the original authors of the reponse object", + "type": "array", + "items": { "type": "object", - "description": "The fields associated on when this search should run relative to the detection event", "properties": { - "earliest_time_offset": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" + "company": { + "type": "string", + "description": "Company associated with the person who originally authored the search" + }, + "email": { + "type": "string", + "description": "Email address of the person who originally authored the search" }, - "latest_time_offset": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" + "name": { + "type": "string", + "description": "Name of the person who originally authored the search" } }, "additionalProperties": false, "required": [ - "latest_time_offset", - "earliest_time_offset" + "name", + "email", + "company" ] } - } - }, - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" + }, + "spec_version": { + "description": "The version of the investigative search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + }, + "entities": { + "description": "A list of entities that is either an input or an output for the security workflow.", + "type": "array", + "items": { + "enum": [] }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" + "minItems": 0, + "uniqueItems": true + }, + "product_type": { + "description": "The type of detection", + "enum": [ + "splunk", + "phantom" + ] + }, + "fields_required": { + "description": "A list of fields that need to be in the result of the detection search for the search to be successful", + "type": "array", + "items": { + "type": "string" }, - "product_type": { - "product_type": "string", - "description": "Type of baseline to execute", - "enum": [ - "phantom", - "splunk", - "uba" - ] + "minItems": 0, + "uniqueItems": true + }, + "response": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + } + }, + "additionalProperties": false, + "definitions": { + "splunk": { + "type": "object", + "properties": { + "search": { + "description": "A reponse action exectued in splunk", + "type": "string" + }, + "investigate_window": { + "type": "object", + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "additionalProperties": false, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ] + } + } + }, + "phantom": { + "type": "object", + "properties": { + "phantom_server": { + "type": "string", + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" + }, + "playbook_name": { + "type": "string", + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" + }, + "playbook_display_name": { + "type": "string", + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" + }, + "playbook_url": { + "type": "string", + "description": "Url of the playbook on Phantom website." + }, + "sensitivity": { + "type": "string", + "description": "TLP colors (White, Green, Amber or Red)" + }, + "severity": { + "type": "string", + "description": "Severity in phantom (High, Medium, Low)" + }, + "product_type": { + "product_type": "string", + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ] + } } } - } - }, - "required": [ - "creation_date", - "data_metadata", - "fields_required", - "how_to_implement", - "maintainers", - "modification_date", - "original_authors", - "search", - "description", - "id", - "product_type", - "investigate_window", - "spec_version", - "version", - "investigate" - ] -} \ No newline at end of file + }, + "required": [ + "creation_date", + "data_metadata", + "fields_required", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "search", + "description", + "id", + "product_type", + "investigate_window", + "spec_version", + "version", + "investigate" + ] + } \ No newline at end of file From cbcd0371c52cec32455d8b3c32f072a30c1ab978 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 16:47:56 -0400 Subject: [PATCH 30/74] entitirees --- spec/v2/baselines.json.spec | 29 ++++++++++++++++++++++++++++- spec/v2/responses.json.spec | 9 +++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec index c83ef7aacd..b0c44e3948 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.json.spec @@ -33,7 +33,25 @@ "description": "A list of data models, if any, used by this search", "type": "array", "items": { - "type": "string" + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, "minItems": 0, "uniqueItems": true @@ -108,6 +126,15 @@ "description": "The date the baseline manifest was created", "type": "string" }, + "entities": { + "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, "modification_date": { "description": "The date of the most recent modification to the search", "type": "string" diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec index e23dd95502..92b50a6f53 100644 --- a/spec/v2/responses.json.spec +++ b/spec/v2/responses.json.spec @@ -17,6 +17,15 @@ "description": "A description of what this reponse object will do ", "type": "string" }, + "entities": { + "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, "data_metadata": { "type": "object", "description": "Information about the date being used to run the response", From c57c7b5357857145c16e7063e39829324ca51818 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 16:53:27 -0400 Subject: [PATCH 31/74] more spec jdpate --- spec/v2/baselines.json.spec | 9 +++++++++ spec/v2/investigations.json.spec | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec index b0c44e3948..831909c5fe 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.json.spec @@ -21,6 +21,15 @@ "uba" ] }, + "entities": { + "description": "A list of entities that is outputed by the search...", + "type": "array", + "items": { + "enum": [] + }, + "minItems": 0, + "uniqueItems": true + }, "description": { "description": "A description of what the search is is doing to create a baseline", "type": "string" diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec index 23a09c2731..9281d33db9 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.json.spec @@ -1,4 +1,4 @@ -{ +ent "description": "The fields that make up the manifest of a version 1 investigative earch", "type": "object", "$id": "https://api.splunkresearch.com/schemas/investigations.json", From 28239d67058af32e40bb26c2e5136cc41e473461 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 17:22:44 -0400 Subject: [PATCH 32/74] added docs for specs --- docs/story.spec.md | 582 +++++++++++++++++++ spec/v2/analytic_story.json.spec | 164 ------ spec/v2/{story.json.spec => story.spec.json} | 163 +++--- 3 files changed, 662 insertions(+), 247 deletions(-) create mode 100644 docs/story.spec.md delete mode 100644 spec/v2/analytic_story.json.spec rename spec/v2/{story.json.spec => story.spec.json} (76%) diff --git a/docs/story.spec.md b/docs/story.spec.md new file mode 100644 index 0000000000..8be1ccdc24 --- /dev/null +++ b/docs/story.spec.md @@ -0,0 +1,582 @@ + +# Analytic Story Manifest Schema + +``` +https://api.splunkresearch.com/schemas/story.json +``` + +The fields that make up the manifest of a version 2 Analytic Story + +| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In | +|----------|------------|--------|--------------|-------------------|-----------------------|------------| +| Can be instantiated | No | Experimental | No | Forbidden | Permitted | | + +# Analytic Story Manifest Properties + +| Property | Type | Required | Nullable | Defined by | +|----------|------|----------|----------|------------| +| [category](#category) | `enum` | Optional | No | Analytic Story Manifest (this schema) | +| [channel](#channel) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [creation_date](#creation_date) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [description](#description) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [detections](#detections) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | +| [id](#id) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [maintainers](#maintainers) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | +| [modification_date](#modification_date) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [name](#name) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [narrative](#narrative) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [original_authors](#original_authors) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | +| [references](#references) | `string[]` | Optional | No | Analytic Story Manifest (this schema) | +| [spec_version](#spec_version) | `integer` | Optional | No | Analytic Story Manifest (this schema) | +| [version](#version) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| `*` | any | Additional | Yes | this schema *allows* additional properties | + +## category + +The category to which the Analytic Story belongs + +`category` + +* is optional +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#category-known-values). + +### category Known Values +| Value | Description | +|-------|-------------| +| `Abuse` | | +| `Adversary Tactics` | | +| `Best Practices` | | +| `Cloud Security` | | +| `Malware` | | +| `Vulnerability` | | + + + + +## channel + +A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel + +`channel` + +* is optional +* type: `string` +* defined in this schema + +### channel Type + + +`string` + + + + + + + +## creation_date + +The date this story was created + +`creation_date` + +* is optional +* type: `string` +* defined in this schema + +### creation_date Type + + +`string` + + + + + + + +## description + +A high-level description or goal of the Analytic Story + +`description` + +* is optional +* type: `string` +* defined in this schema + +### description Type + + +`string` + + + + + + + +## detections + +An array of detection mechanisms from Splunk, UBA and phantom. + +`detections` + +* is optional +* type: `object[]` +* defined in this schema + +### detections Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `detection_id`| string | **Required** | +| `name`| string | **Required** | +| `type`| string | **Required** | + + + +#### detection_id + +unique identifier of the detection, in the form of UUID + +`detection_id` + +* is **required** +* type: `string` + +##### detection_id Type + + +`string` + + + + + + + + + +#### name + +Name of the Detection. It can be a name of a Splunk correlation search name, a UBA threat or a Phantom detection playbook. + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + +#### type + +What product gives you a detection + +`type` + +* is **required** +* type: `enum` + +The value of this property **must** be equal to one of the [known values below](#detections-known-values). + +##### type Known Values +| Value | Description | +|-------|-------------| +| `splunk` | | +| `uba` | | +| `phantom` | | + + + + + + + + + + + + +## id + +A unique identifier for the Analytic Story + +`id` + +* is optional +* type: `string` +* defined in this schema + +### id Type + + +`string` + + + + + + + +## maintainers + +An array of the current maintainers of the Analytic Story. + +`maintainers` + +* is optional +* type: `object[]` +* defined in this schema + +### maintainers Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person maintaining this Analytic Story + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person maintaining this Analytic Story + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person maintaining this Analytic Story + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## modification_date + +The date of the most recent modification to this Analytic Story + +`modification_date` + +* is optional +* type: `string` +* defined in this schema + +### modification_date Type + + +`string` + + + + + + + +## name + +The name of the Analytic Story + +`name` + +* is optional +* type: `string` +* defined in this schema + +### name Type + + +`string` + + + + + + + +## narrative + +Long-form text that describes the Analytic Story and the rationale behind it, as well as an overview of the included searches, and how they enable the story + +`narrative` + +* is optional +* type: `string` +* defined in this schema + +### narrative Type + + +`string` + + + + + + + +## original_authors + +An array of the original authors of the Analytic Story + +`original_authors` + +* is optional +* type: `object[]` +* defined in this schema + +### original_authors Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person who originally authored the Analytic Story + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person who originally authored the Analytic Story + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person who originally authored the Analytic Story + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## references + +An array of URLs that give information about the problem the story is addressing + +`references` + +* is optional +* type: `string[]` +* at least `0` items in the array +* defined in this schema + +### references Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + +## spec_version + +The version of the Analytic Story specification this manifest follows + +`spec_version` + +* is optional +* type: `integer` +* defined in this schema + +### spec_version Type + + +`integer` + + + + + + + +## version + +The version of the Analytic Story + +`version` + +* is optional +* type: `string` +* defined in this schema + +### version Type + + +`string` + + + + + + + + +**All** of the following *requirements* need to be fulfilled. + + +#### Requirement 1 + + +* []() – `#/definitions/id` + diff --git a/spec/v2/analytic_story.json.spec b/spec/v2/analytic_story.json.spec deleted file mode 100644 index b0132c92dc..0000000000 --- a/spec/v2/analytic_story.json.spec +++ /dev/null @@ -1,164 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-04/schema#", - "title": "Analytic Story Manifest", - "description": "The fields that make up the manifest of a version 2 Analytic Story", - "type": "object", - "properties": { - "id": { - "description": "A unique identifier for the Analytic Story", - "type": "string" - }, - "category": { - "description": "The category to which the Analytic Story belongs", - "enum": [ - "Abuse", - "Adversary Tactics", - "Best Practices", - "Cloud Security", - "Malware", - "Vulnerability" - ] - }, - "channel": { - "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", - "type": "string" - }, - "original_authors": { - "description": "An array of the original authors of the Analytic Story", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the Analytic Story" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the Analytic Story" - }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the Analytic Story" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this Analytic Story" - }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this Analytic Story" - }, - "name": { - "type": "string", - "description": "Name of the person maintaining this Analytic Story" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "creation_date": { - "description": "The date this story was created", - "type": "string" - }, - "modification_date": { - "description": "The date of the most recent modification to this Analytic Story", - "type": "string" - }, - "name": { - "description": "The name of the Analytic Story", - "type": "string" - }, - "description": { - "description": "A high-level description or goal of the Analytic Story", - "type": "string" - }, - "narrative": { - "description": "Long-form text that describes the Analytic Story and the rationale behind it, as well as an overview of the included searches, and how they enable the story", - "type": "string" - }, - "detections": { - "description": "An array of detection mechanisms from Splunk, UBA and phantom. ", - "type": "array", - "items": { - "type": "object", - "properties": { - "detection_id": { - "type": "string", - "description": "unique identifier of the detection, in the form of UUID" - }, - "product_type": { - "product_type": "string", - "description": "What product gives you a detection", - "enum": ["splunk", "uba", "phantom"] - }, - "name": { - "type": "string", - "description": "Name of the Detection. It can be a name of a Splunk correlation search name, a UBA threat or a Phantom detection playbook." - } - }, - "additionalProperties": false, - "required": [ - "detection_id", - "product_type", - "name" - ] - } - }, - "references": { - "description": "An array of URLs that give information about the problem the story is addressing", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - - "spec_version": { - "description": "The version of the Analytic Story specification this manifest follows", - "type": "integer" - }, - "version": { - "description": "The version of the Analytic Story", - "type": "string" - } - }, - "additionalProperties": false, - "required": [ - "category", - "channel", - "creation_date", - "description", - "id", - "maintainers", - "modification_date", - "narrative", - "original_authors", - "name", - "references", - "detections", - "spec_version", - "version" - ] -} \ No newline at end of file diff --git a/spec/v2/story.json.spec b/spec/v2/story.spec.json similarity index 76% rename from spec/v2/story.json.spec rename to spec/v2/story.spec.json index 2e7ca93b7c..e885544674 100644 --- a/spec/v2/story.json.spec +++ b/spec/v2/story.spec.json @@ -1,14 +1,18 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Analytic Story Manifest", "$id": "https://api.splunkresearch.com/schemas/story.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "allOf": [ + { + "$ref": "#/definitions/id" + } + ], "description": "The fields that make up the manifest of a version 2 Analytic Story", - "type": "object", + "meta:license": [ + "This file is licensed to you under the Apache License, Version 2.0 (the 'License');", + "you may not use this file except in compliance with the License. You may obtain a copy", + "of the License at http://www.apache.org/licenses/LICENSE-2.0" + ], "properties": { - "id": { - "description": "A unique identifier for the Analytic Story", - "type": "string" - }, "category": { "description": "The category to which the Analytic Story belongs", "enum": [ @@ -24,63 +28,77 @@ "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", "type": "string" }, - "original_authors": { - "description": "An array of the original authors of the Analytic Story", - "type": "array", + "creation_date": { + "description": "The date this story was created", + "type": "string" + }, + "description": { + "description": "A high-level description or goal of the Analytic Story", + "type": "string" + }, + "detections": { + "description": "An array of detection mechanisms from Splunk, UBA and phantom. ", "items": { - "type": "object", + "additionalProperties": false, "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the Analytic Story" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the Analytic Story" + "detection_id": { + "description": "unique identifier of the detection, in the form of UUID", + "type": "string" }, "name": { - "type": "string", - "description": "Name of the person who originally authored the Analytic Story" + "description": "Name of the Detection. It can be a name of a Splunk correlation search name, a UBA threat or a Phantom detection playbook.", + "type": "string" + }, + "type": { + "description": "What product gives you a detection", + "enum": [ + "splunk", + "uba", + "phantom" + ], + "type": "string" } }, - "additionalProperties": false, "required": [ - "name", - "email", - "company" - ] - } + "detection_id", + "type", + "name" + ], + "type": "object" + }, + "type": "array" + }, + "id": { + "description": "A unique identifier for the Analytic Story", + "format": "uuid", + "type": "string" }, "maintainers": { "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", "items": { - "type": "object", + "additionalProperties": false, "properties": { "company": { - "type": "string", - "description": "Company associated with the person maintaining this Analytic Story" + "description": "Company associated with the person maintaining this Analytic Story", + "type": "string" }, "email": { - "type": "string", - "description": "Email address of the person maintaining this Analytic Story" + "description": "Email address of the person maintaining this Analytic Story", + "type": "string" }, "name": { - "type": "string", - "description": "Name of the person maintaining this Analytic Story" + "description": "Name of the person maintaining this Analytic Story", + "type": "string" } }, - "additionalProperties": false, "required": [ "name", "email", "company" - ] - } - }, - "creation_date": { - "description": "The date this story was created", - "type": "string" + ], + "type": "object" + }, + "type": "array" }, "modification_date": { "description": "The date of the most recent modification to this Analytic Story", @@ -90,52 +108,46 @@ "description": "The name of the Analytic Story", "type": "string" }, - "description": { - "description": "A high-level description or goal of the Analytic Story", - "type": "string" - }, "narrative": { "description": "Long-form text that describes the Analytic Story and the rationale behind it, as well as an overview of the included searches, and how they enable the story", "type": "string" }, - "detections": { - "description": "An array of detection mechanisms from Splunk, UBA and phantom. ", - "type": "array", + "original_authors": { + "description": "An array of the original authors of the Analytic Story", "items": { - "type": "object", + "additionalProperties": false, "properties": { - "detection_id": { - "type": "string", - "description": "unique identifier of the detection, in the form of UUID" + "company": { + "description": "Company associated with the person who originally authored the Analytic Story", + "type": "string" }, - "type": { - "type": "string", - "description": "What product gives you a detection", - "enum": ["splunk", "uba", "phantom"] + "email": { + "description": "Email address of the person who originally authored the Analytic Story", + "type": "string" }, "name": { - "type": "string", - "description": "Name of the Detection. It can be a name of a Splunk correlation search name, a UBA threat or a Phantom detection playbook." + "description": "Name of the person who originally authored the Analytic Story", + "type": "string" } }, - "additionalProperties": false, "required": [ - "detection_id", - "type", - "name" - ] - } + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" }, "references": { "description": "An array of URLs that give information about the problem the story is addressing", - "type": "array", "items": { "type": "string" }, "minItems": 0, + "type": "array", "uniqueItems": true }, - "spec_version": { "description": "The version of the Analytic Story specification this manifest follows", "type": "integer" @@ -145,21 +157,6 @@ "type": "string" } }, - "additionalProperties": false, - "required": [ - "category", - "channel", - "creation_date", - "description", - "id", - "maintainers", - "modification_date", - "narrative", - "original_authors", - "name", - "references", - "detections", - "spec_version", - "version" - ] + "title": "Analytic Story Manifest", + "type": "object" } From 2c3ee036b85e5b7e605bb9f4432c336687d0026c Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 18:20:53 -0400 Subject: [PATCH 33/74] updated readme with doc gen instructions --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 58d2c66225..90900ac359 100644 --- a/README.md +++ b/README.md @@ -37,3 +37,6 @@ For getting pre-commit checks, install the hooks see below for steps: To test a local change to CI or build make sure you are running docker and then `circleci local execute -e GITHUB_TOKEN=$GITHUB_TOKEN --branch ` +To generate docs from schema automatically +1. install https://github.com/adobe/jsonschema2md +2. jsonschema2md -d spec/v2/detections.json.spec -o docs From 5b10971172b1702e1e9f49ff9748004ae388efc5 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 18:37:39 -0400 Subject: [PATCH 34/74] naming changed --- spec/v2/baselines.json.spec | 48 ++++++++++---------- spec/v2/detections.json.spec | 14 ++++-- spec/v2/responses.json.spec | 2 +- spec/v2/{story.spec.json => story.json.spec} | 0 4 files changed, 34 insertions(+), 30 deletions(-) rename spec/v2/{story.spec.json => story.json.spec} (100%) diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec index 831909c5fe..ceaff21e9d 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.json.spec @@ -2,36 +2,28 @@ "$schema": "http://json-schema.org/draft-07/schema#", "title": "Baseline Manifest", "$id": "https://api.splunkresearch.com/schemas/baselines.json", - "description": "The fields that make up the manifest of a version 2 baseline search", + "description": "The fields that make up the manifest of a version 2 baseline object.", "type": "object", "properties": { "name": { - "description": "The name of the search that creates the baseline", + "description": "The name of the search/phantom playbook that creates the baseline.", "type": "string" }, "id": { - "description": "The unique identifier for the search", + "description": "The unique identifier for this baselining object.", "type": "string" }, "product_type": { - "description": "The type of baseline", + "description": "The type of product that will create the baseline.", "enum": [ "splunk", "phantom", "uba" ] }, - "entities": { - "description": "A list of entities that is outputed by the search...", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, + "description": { - "description": "A description of what the search is is doing to create a baseline", + "description": "A description of what the object is is doing to create a baseline.", "type": "string" }, "data_metadata": { @@ -75,7 +67,7 @@ "uniqueItems": true }, "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", + "description": "A high-level description of the type of data needed by the object.", "type": "array", "items": { "type": "string" @@ -136,14 +128,14 @@ "type": "string" }, "entities": { - "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true + "description": "A list of entities(important fields) that are in baseline output, which will be used by detections and are relevant to the story flow", + "type": "array", + "items": { + "enum": [] }, + "minItems": 0, + "uniqueItems": true + }, "modification_date": { "description": "The date of the most recent modification to the search", "type": "string" @@ -203,7 +195,7 @@ } }, "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "description": "A discussion on how to implement this baseline object, from what needs to be ingested, config files modified, and suggested per site modifications", "type": "string" }, "known_false_positives": { @@ -211,7 +203,7 @@ "type": "string" }, "eli5": { - "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "description": "Explain it like I’m 5 - A detail description of the baseline object, written in a style that can be understood by a future Splunk expert", "type": "string" }, "spec_version": { @@ -262,7 +254,13 @@ "type": "string", "description": "Severity in phantom (High, Medium, Low)" } - } + }, + "required": [ + "phantom_server", + "playbook_name", + "playbook_url", + "playbook_display_name" + ] }, "splunk": { "type": "object", diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index 58c9a362e5..d61fd3c054 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -489,7 +489,7 @@ "properties": { "product_type": { "product_type": "string", - "description": "Type of baseline to execute", + "description": " Product that will execute the response", "enum": [ "phantom", "splunk", @@ -498,7 +498,7 @@ }, "name": { "type": "string", - "description": "name of baseline" + "description": "Name of baseline object" }, "id": { "type": "string", @@ -694,7 +694,7 @@ "additionalProperties": false }, "search": { - "description": "The search (in SPL) executed within core Splunk", + "description": "The search (in SPL) executed within Splunk", "type": "string" } } @@ -726,7 +726,13 @@ "type": "string", "description": "Severity in phantom (High, Medium, Low)" } - } + }, + "required": [ + "phantom_server", + "playbook_name", + "playbook_url", + "playbook_display_name" + ] }, "uba": { "type": "object", diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec index 92b50a6f53..92b9205248 100644 --- a/spec/v2/responses.json.spec +++ b/spec/v2/responses.json.spec @@ -18,7 +18,7 @@ "type": "string" }, "entities": { - "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", + "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", "type": "array", "items": { "enum": [] diff --git a/spec/v2/story.spec.json b/spec/v2/story.json.spec similarity index 100% rename from spec/v2/story.spec.json rename to spec/v2/story.json.spec From a5d8d2cad7f98eae239cf669cc95eb3f0ccafef8 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 18:54:42 -0400 Subject: [PATCH 35/74] updates to enum --- spec/v2/baselines.json.spec | 27 ++++++++++++++++++++++++++- spec/v2/detections.json.spec | 28 +++++++++++++++++++++++++++- spec/v2/investigations.json.spec | 27 ++++++++++++++++++++++++++- spec/v2/responses.json.spec | 29 +++++++++++++++++++++++++++-- 4 files changed, 106 insertions(+), 5 deletions(-) diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec index ceaff21e9d..184a5ce7d2 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.json.spec @@ -131,7 +131,32 @@ "description": "A list of entities(important fields) that are in baseline output, which will be used by detections and are relevant to the story flow", "type": "array", "items": { - "enum": [] + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "uniqueItems": true diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec index d61fd3c054..b808b26862 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.json.spec @@ -381,7 +381,33 @@ "description": "A list of entities that is outputed by the search...", "type": "array", "items": { - "enum": [] + + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "uniqueItems": true diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec index 9281d33db9..5fc8dc8a81 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.json.spec @@ -193,7 +193,32 @@ ent "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", "type": "array", "items": { - "enum": [] + "enum": [ + ] "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "uniqueItems": true diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec index 92b9205248..28114eb6b7 100644 --- a/spec/v2/responses.json.spec +++ b/spec/v2/responses.json.spec @@ -183,13 +183,38 @@ "description": "A list of entities that is either an input or an output for the security workflow.", "type": "array", "items": { - "enum": [] + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "uniqueItems": true }, "product_type": { - "description": "The type of detection", + "description": "The type of product that does the reponse", "enum": [ "splunk", "phantom" From 048784ad6646327ac0ac823e478a90fcc916f600 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 19:05:48 -0400 Subject: [PATCH 36/74] updating story spec and others name to prep for auto doc generationgit status --- docs/story.spec.md | 34 +- ...aselines.json.spec => baselines.spec.json} | 307 ++++--- ...ections.json.spec => detections.spec.json} | 833 +++++++++--------- ...ons.json.spec => investigations.spec.json} | 374 ++++---- spec/v2/responses.json.spec | 304 ------- spec/v2/responses.spec.json | 295 +++++++ spec/v2/story.spec.json | 14 +- 7 files changed, 1068 insertions(+), 1093 deletions(-) rename spec/v2/{baselines.json.spec => baselines.spec.json} (84%) rename spec/v2/{detections.json.spec => detections.spec.json} (89%) rename spec/v2/{investigations.json.spec => investigations.spec.json} (89%) delete mode 100644 spec/v2/responses.json.spec create mode 100644 spec/v2/responses.spec.json diff --git a/docs/story.spec.md b/docs/story.spec.md index 8be1ccdc24..9af7cec781 100644 --- a/docs/story.spec.md +++ b/docs/story.spec.md @@ -15,20 +15,20 @@ The fields that make up the manifest of a version 2 Analytic Story | Property | Type | Required | Nullable | Defined by | |----------|------|----------|----------|------------| -| [category](#category) | `enum` | Optional | No | Analytic Story Manifest (this schema) | +| [category](#category) | `enum` | **Required** | No | Analytic Story Manifest (this schema) | | [channel](#channel) | `string` | Optional | No | Analytic Story Manifest (this schema) | | [creation_date](#creation_date) | `string` | Optional | No | Analytic Story Manifest (this schema) | -| [description](#description) | `string` | Optional | No | Analytic Story Manifest (this schema) | -| [detections](#detections) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | -| [id](#id) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [description](#description) | `string` | **Required** | No | Analytic Story Manifest (this schema) | +| [detections](#detections) | `object[]` | **Required** | No | Analytic Story Manifest (this schema) | +| [id](#id) | `string` | **Required** | No | Analytic Story Manifest (this schema) | | [maintainers](#maintainers) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | | [modification_date](#modification_date) | `string` | Optional | No | Analytic Story Manifest (this schema) | -| [name](#name) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [name](#name) | `string` | **Required** | No | Analytic Story Manifest (this schema) | | [narrative](#narrative) | `string` | Optional | No | Analytic Story Manifest (this schema) | | [original_authors](#original_authors) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | | [references](#references) | `string[]` | Optional | No | Analytic Story Manifest (this schema) | | [spec_version](#spec_version) | `integer` | Optional | No | Analytic Story Manifest (this schema) | -| [version](#version) | `string` | Optional | No | Analytic Story Manifest (this schema) | +| [version](#version) | `string` | **Required** | No | Analytic Story Manifest (this schema) | | `*` | any | Additional | Yes | this schema *allows* additional properties | ## category @@ -37,7 +37,7 @@ The category to which the Analytic Story belongs `category` -* is optional +* is **required** * type: `enum` * defined in this schema @@ -104,7 +104,7 @@ A high-level description or goal of the Analytic Story `description` -* is optional +* is **required** * type: `string` * defined in this schema @@ -125,7 +125,7 @@ An array of detection mechanisms from Splunk, UBA and phantom. `detections` -* is optional +* is **required** * type: `object[]` * defined in this schema @@ -225,7 +225,7 @@ A unique identifier for the Analytic Story `id` -* is optional +* is **required** * type: `string` * defined in this schema @@ -366,7 +366,7 @@ The name of the Analytic Story `name` -* is optional +* is **required** * type: `string` * defined in this schema @@ -556,7 +556,7 @@ The version of the Analytic Story `version` -* is optional +* is **required** * type: `string` * defined in this schema @@ -570,13 +570,3 @@ The version of the Analytic Story - - -**All** of the following *requirements* need to be fulfilled. - - -#### Requirement 1 - - -* []() – `#/definitions/id` - diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.spec.json similarity index 84% rename from spec/v2/baselines.json.spec rename to spec/v2/baselines.spec.json index 831909c5fe..446646323f 100644 --- a/spec/v2/baselines.json.spec +++ b/spec/v2/baselines.spec.json @@ -1,46 +1,93 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Baseline Manifest", "$id": "https://api.splunkresearch.com/schemas/baselines.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "definitions": { + "phantom": { + "properties": { + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_display_name": { + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", + "type": "string" + }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "type": "object" + }, + "splunk": { + "properties": { + "scheduling": { + "additionalProperties": false, + "description": "Various fields to assist in scheduling the search", + "properties": { + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for creating a baseline", + "type": "string" + } + }, + "type": "object" + } + }, "description": "The fields that make up the manifest of a version 2 baseline search", - "type": "object", "properties": { - "name": { - "description": "The name of the search that creates the baseline", - "type": "string" - }, - "id": { - "description": "The unique identifier for the search", - "type": "string" - }, - "product_type": { - "description": "The type of baseline", - "enum": [ - "splunk", - "phantom", - "uba" + "baseline": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } ] }, - "entities": { - "description": "A list of entities that is outputed by the search...", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, - "description": { - "description": "A description of what the search is is doing to create a baseline", + "creation_date": { + "description": "The date the baseline manifest was created", "type": "string" }, "data_metadata": { - "type": "object", + "additionalProperties": false, "description": "Information about the date being ingested", "properties": { + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, "data_models": { "description": "A list of data models, if any, used by this search", - "type": "array", "items": { "enum": [ "Alerts", @@ -63,38 +110,29 @@ ] }, "minItems": 0, - "uniqueItems": true - }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, "uniqueItems": true }, "data_source": { "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", "items": { "type": "string" }, "minItems": 0, + "type": "array", "uniqueItems": true }, "data_sourcetypes": { "description": "The list of sourcetypes, if any, used by this search", - "type": "array", "items": { "type": "string" }, "minItems": 0, + "type": "array", "uniqueItems": true }, "providing_technologies": { "description": "A list of technologies that provide this data", - "type": "array", "items": { "enum": [ "Apache", @@ -122,97 +160,114 @@ ] }, "minItems": 0, + "type": "array", "uniqueItems": true } }, - "additionalProperties": false, "required": [ "data_source", "providing_technologies" - ] + ], + "type": "object" }, - "creation_date": { - "description": "The date the baseline manifest was created", + "description": { + "description": "A description of what the search is is doing to create a baseline", + "type": "string" + }, + "eli5": { + "description": "Explain it like I\u2019m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", "type": "string" }, "entities": { - "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true + "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", + "items": { + "enum": [] }, - "modification_date": { - "description": "The date of the most recent modification to the search", + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", "type": "string" }, - "original_authors": { - "description": "A list of the original authors of the search", - "type": "array", + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "known_false_positives": { + "description": "Describe the known false postives while the analyst builds the baseline.", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", "items": { - "type": "object", + "additionalProperties": false, "properties": { "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" + "description": "Company associated with the person maintaining this search", + "type": "string" }, "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" + "description": "Email address of the person maintaining this search", + "type": "string" }, "name": { - "type": "string", - "description": "Name of the person who originally authored the search" + "description": "Name of the person maintaining this search", + "type": "string" } }, - "additionalProperties": false, "required": [ "name", "email", "company" - ] - } + ], + "type": "object" + }, + "type": "array" }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "name": { + "description": "The name of the search that creates the baseline", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the search", "items": { - "type": "object", + "additionalProperties": false, "properties": { "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" + "description": "Company associated with the person who originally authored the search", + "type": "string" }, "email": { - "type": "string", - "description": "Email address of the person maintaining this search" + "description": "Email address of the person who originally authored the search", + "type": "string" }, "name": { - "type": "string", - "description": "Name of the person maintaining this search" + "description": "Name of the person who originally authored the search", + "type": "string" } }, - "additionalProperties": false, "required": [ "name", "email", "company" - ] - } - }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", - "type": "string" - }, - "known_false_positives": { - "description": "Describe the known false postives while the analyst builds the baseline.", - "type": "string" + ], + "type": "object" + }, + "type": "array" }, - "eli5": { - "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", - "type": "string" + "product_type": { + "description": "The type of baseline", + "enum": [ + "splunk", + "phantom", + "uba" + ] }, "spec_version": { "description": "The version of the detection search specification this manifest follows", @@ -221,72 +276,6 @@ "version": { "description": "The version of the search", "type": "string" - }, - "baseline": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" - } - ] - } - }, - "additionalProperties": false, - "definitions": { - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" - }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - } - } - }, - "splunk": { - "type": "object", - "properties": { - "scheduling": { - "type": "object", - "description": "Various fields to assist in scheduling the search", - "properties": { - "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" - }, - "latest_time": { - "description": "The latest time tes search should run against in Splunk format", - "type": "string" - } - }, - "additionalProperties": false - }, - "search": { - "description": "The search (in SPL) executed within core Splunk for creating a baseline", - "type": "string" - } - } } }, "required": [ @@ -305,5 +294,7 @@ "spec_version", "version", "baseline" - ] + ], + "title": "Baseline Manifest", + "type": "object" } diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.spec.json similarity index 89% rename from spec/v2/detections.json.spec rename to spec/v2/detections.spec.json index 58c9a362e5..b6df07f3f1 100644 --- a/spec/v2/detections.json.spec +++ b/spec/v2/detections.spec.json @@ -1,38 +1,241 @@ { - "description": "A object that defines the parameters for detecting things using various Splunk capabilities", - "type": "object", "$id": "https://api.splunkresearch.com/schemas/detections.json", "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Detection Manifest", + "additionalProperties": false, + "definitions": { + "phantom": { + "properties": { + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_display_name": { + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", + "type": "string" + }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "type": "object" + }, + "splunk": { + "properties": { + "correlation_rule": { + "additionalProperties": false, + "description": "Various fields to enhance usability in Enterprise Security", + "properties": { + "notable": { + "additionalProperties": false, + "description": "Various fields associated with creating a notable event", + "properties": { + "nes_fields": { + "description": "A list of suggested fields to be used for notable-event suppression", + "type": "string" + }, + "rule_description": { + "description": "Description of the notable event that will display in Incident Review", + "type": "string" + }, + "rule_title": { + "description": "Title of the notable event that will display in Incident Review", + "type": "string" + } + }, + "required": [ + "rule_description", + "rule_title", + "nes_fields" + ], + "type": "object" + }, + "risk": { + "additionalProperties": false, + "description": "Fields associated with assigning risk to objects", + "properties": { + "risk_object": { + "description": "TThe field to which you are assigning risk", + "type": "string" + }, + "risk_object_type": { + "description": "The type of object to which you\u2019re assigning risk", + "items": { + "enum": [ + "system", + "user", + "other" + ], + "type": "string" + }, + "maxItems": 1, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "risk_score": { + "description": "Score assigned to risk_object", + "type": "integer" + } + }, + "required": [ + "risk_score", + "risk_object", + "risk_object_type" + ], + "type": "object" + }, + "suppress": { + "additionalProperties": false, + "description": "Fields associated with suppressing the creation of multiple alerts", + "properties": { + "suppress_fields": { + "description": "The fields to base the suppression on", + "type": "string" + }, + "suppress_period": { + "description": "The length of time the suppression should be in effect", + "type": "string" + } + }, + "required": [ + "suppress_fields", + "suppress_period" + ], + "type": "object" + } + }, + "type": "object" + }, + "scheduling": { + "additionalProperties": false, + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" + } + }, + "type": "object" + }, + "uba": { + "properties": { + "event_type": { + "description": "An anomaly or threat.", + "type": "string" + }, + "model": { + "description": "The name of the Splunk UBA model that detected the anomaly.", + "type": "string" + }, + "model_version": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "search": { + "description": "The search you will run against the UEBA index to idenfiy the threat.", + "type": "string" + }, + "threat_category": { + "description": "The category of a threat in Splunk UBA.", + "type": "string" + } + }, + "type": "object" + } + }, + "description": "A object that defines the parameters for detecting things using various Splunk capabilities", "properties": { - "name": { - "description": "The name of the detection", + "asset_type": { + "description": "Designates the type of asset being investigated", "type": "string" }, - "id": { - "description": "The unique identifier for the detection", - "type": "string" + "baselines": { + "description": "An array of the baseline objects to exectute before the detection ", + "items": { + "additionalProperties": false, + "properties": { + "id": { + "description": "UUID of the baseline object", + "type": "string" + }, + "name": { + "description": "name of baseline object", + "type": "string" + }, + "type": { + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ], + "product_type": "string" + } + }, + "required": [ + "product_type", + "name", + "id" + ], + "type": "object" + }, + "type": "array" }, - "product_type": { - "description": "The type of detection", + "confidence": { + "description": "Confidence that detected behavior is malicious", "enum": [ - "uba", - "splunk", - "phantom" + "high", + "medium", + "low" ] }, - - "description": { - "description": "A description of what the detection is designed to find", + "creation_date": { + "description": "The date the story manifest was created", "type": "string" }, "data_metadata": { - "type": "object", + "additionalProperties": false, "description": "Information about the date being ingested", "properties": { + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, "data_models": { "description": "A list of data models, if any, used by this search", - "type": "array", "items": { "enum": [ "Alerts", @@ -55,38 +258,29 @@ ] }, "minItems": 0, - "uniqueItems": true - }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, "uniqueItems": true }, "data_source": { "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", "items": { "type": "string" }, "minItems": 0, + "type": "array", "uniqueItems": true }, "data_sourcetypes": { "description": "The list of sourcetypes, if any, used by this search", - "type": "array", "items": { "type": "string" }, "minItems": 0, + "type": "array", "uniqueItems": true }, "providing_technologies": { "description": "A list of technologies that provide this data", - "type": "array", "items": { "enum": [ "Apache", @@ -115,40 +309,137 @@ ] }, "minItems": 0, + "type": "array", "uniqueItems": true } }, - "additionalProperties": false, "required": [ "data_source", "providing_technologies" + ], + "type": "object" + }, + "description": { + "description": "A description of what the detection is designed to find", + "type": "string" + }, + "detect": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + }, + { + "$ref": "#/definitions/uba" + } ] }, - "creation_date": { - "description": "The date the story manifest was created", + "eli5": { + "description": "Explain it like I\u2019m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", "type": "string" }, - "mappings": { - "type": "object", - "description": "Mappings to various industry standards and frameworks", - "properties": { - "cis20": { - "description": "A list of critical security controls this search helps you implement", - "type": "array", - "items": { - "enum": [ - "CIS 1", - "CIS 2", - "CIS 3", - "CIS 4", - "CIS 5", - "CIS 6", - "CIS 7", - "CIS 8", - "CIS 9", - "CIS 10", - "CIS 11", - "CIS 12", + "entities": { + "description": "A list of entities that is outputed by the search...", + "items": { + "enum": [] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "id": { + "description": "The unique identifier for the detection", + "type": "string" + }, + "investigations": { + "description": "An array of the investigation objects to exectute on the detection results ", + "items": { + "additionalProperties": false, + "properties": { + "id": { + "description": "UUID of the baseline object", + "type": "string" + }, + "name": { + "description": "Name of baseline", + "type": "string" + }, + "product_type": { + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ], + "type": "string" + } + }, + "required": [ + "product_type", + "name", + "id" + ], + "type": "object" + }, + "type": "array" + }, + "known_false_positives": { + "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person maintaining this search", + "type": "string" + }, + "email": { + "description": "Email address of the person maintaining this search", + "type": "string" + }, + "name": { + "description": "Name of the person maintaining this search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, + "mappings": { + "additionalProperties": false, + "description": "Mappings to various industry standards and frameworks", + "properties": { + "cis20": { + "description": "A list of critical security controls this search helps you implement", + "items": { + "enum": [ + "CIS 1", + "CIS 2", + "CIS 3", + "CIS 4", + "CIS 5", + "CIS 6", + "CIS 7", + "CIS 8", + "CIS 9", + "CIS 10", + "CIS 11", + "CIS 12", "CIS 13", "CIS 14", "CIS 15", @@ -160,11 +451,30 @@ ] }, "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "emoji": { + "description": "A list of security emojis that will help UBA understand this alert as an external alarm", + "items": { + "enum": [ + "EndPoint", + "AD", + "Firewall", + "ApplicationLog", + "IPS", + "CloudData", + "Correlation", + "Printer", + "Badge" + ] + }, + "minItems": 0, + "type": "array", "uniqueItems": true }, "kill_chain_phases": { "description": "A list of kill-chain phases to which the search applies", - "type": "array", "items": { "enum": [ "Reconnaissance", @@ -177,11 +487,11 @@ ] }, "minItems": 0, + "type": "array", "uniqueItems": true }, "mitre_attack": { "description": "A list of the techniques and tactics identified by the search", - "type": "array", "items": { "enum": [ "Initial Access", @@ -305,11 +615,11 @@ ] }, "minItems": 0, + "type": "array", "uniqueItems": true }, "nist": { "description": "A list of the NIST controls the search helps you implement", - "type": "array", "items": { "enum": [ "ID.AM", @@ -333,225 +643,95 @@ ] }, "minItems": 0, - "uniqueItems": true - }, - "emoji": { - "description": "A list of security emojis that will help UBA understand this alert as an external alarm", "type": "array", - "items": { - "enum": [ - "EndPoint", - "AD", - "Firewall", - "ApplicationLog", - "IPS", - "CloudData", - "Correlation", - "Printer", - "Badge" - ] - }, - "minItems": 0, "uniqueItems": true } }, - "additionalProperties": false + "type": "object" }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", - "type": "string" - }, - "eli5": { - "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", - "type": "string" - }, - "confidence": { - "description": "Confidence that detected behavior is malicious", - "enum": [ - "high", - "medium", - "low" - ] - }, - "asset_type": { - "description": "Designates the type of asset being investigated", + "modification_date": { + "description": "The date of the most recent modification to the search", "type": "string" }, - "entities": { - "description": "A list of entities that is outputed by the search...", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, - "known_false_positives": { - "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", + "name": { + "description": "The name of the detection", "type": "string" }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", + "original_authors": { + "description": "A list of the original authors of the search", "items": { - "type": "object", + "additionalProperties": false, "properties": { "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" + "description": "Company associated with the person who originally authored the search", + "type": "string" }, "email": { - "type": "string", - "description": "Email address of the person maintaining this search" + "description": "Email address of the person who originally authored the search", + "type": "string" }, "name": { - "type": "string", - "description": "Name of the person maintaining this search" + "description": "Name of the person who originally authored the search", + "type": "string" } }, - "additionalProperties": false, "required": [ "name", "email", "company" - ] - } + ], + "type": "object" + }, + "type": "array" }, - "baselines": { - "description": "An array of the baseline objects to exectute before the detection ", - "type": "array", - "items": { - "type": "object", - "properties": { - "type": { - "product_type": "string", - "description": "Type of baseline to execute", - "enum": [ - "phantom", - "splunk", - "uba" - ] - }, - "name": { - "type": "string", - "description": "name of baseline object" - }, - "id": { - "type": "string", - "description": "UUID of the baseline object" - } - }, - "additionalProperties": false, - "required": [ - "product_type", - "name", - "id" - ] - } + "product_type": { + "description": "The type of detection", + "enum": [ + "uba", + "splunk", + "phantom" + ] }, - "investigations": { - "description": "An array of the investigation objects to exectute on the detection results ", - "type": "array", + "references": { + "description": "A list of URLs that give more information about the search", "items": { - "type": "object", - "properties": { - "product_type": { - "type": "string", - "description": "Type of baseline to execute", - "enum": [ - "phantom", - "splunk", - "uba" - ] - }, - "name": { - "type": "string", - "description": "Name of baseline" - }, - "id": { - "type": "string", - "description": "UUID of the baseline object" - } - }, - "additionalProperties": false, - "required": [ - "product_type", - "name", - "id" - ] - } + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true }, "responses": { "description": "An array of the response objects to exectute on the detection results ", - "type": "array", "items": { - "type": "object", + "additionalProperties": false, "properties": { + "id": { + "description": "UUID of the baseline object", + "type": "string" + }, + "name": { + "description": "name of baseline", + "type": "string" + }, "product_type": { - "product_type": "string", "description": "Type of baseline to execute", "enum": [ "phantom", "splunk", "uba" - ] - }, - "name": { - "type": "string", - "description": "name of baseline" - }, - "id": { - "type": "string", - "description": "UUID of the baseline object" + ], + "product_type": "string" } }, - "additionalProperties": false, "required": [ "product_type", "name", "id" - ] - } - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "original_authors": { - "description": "A list of the original authors of the search", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" - }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the search" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "references": { - "description": "A list of URLs that give more information about the search", - "type": "array", - "items": { - "type": "string" + ], + "type": "object" }, - "minItems": 0, - "uniqueItems": true + "type": "array" }, "security_domain": { "description": "The high-level security area to which the search belongs", @@ -569,189 +749,6 @@ "version": { "description": "The version of the detection", "type": "string" - }, - "detect": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" - }, - { - "$ref": "#/definitions/uba" - } - ] - } - }, - "additionalProperties": false, - "definitions": { - "splunk": { - "type": "object", - "properties": { - "correlation_rule": { - "type": "object", - "description": "Various fields to enhance usability in Enterprise Security", - "properties": { - "notable": { - "type": "object", - "description": "Various fields associated with creating a notable event", - "properties": { - "rule_description": { - "description": "Description of the notable event that will display in Incident Review", - "type": "string" - }, - "rule_title": { - "description": "Title of the notable event that will display in Incident Review", - "type": "string" - }, - "nes_fields": { - "description": "A list of suggested fields to be used for notable-event suppression", - "type": "string" - } - }, - "additionalProperties": false, - "required": [ - "rule_description", - "rule_title", - "nes_fields" - ] - }, - "risk": { - "type": "object", - "description": "Fields associated with assigning risk to objects", - "properties": { - "risk_object": { - "description": "TThe field to which you are assigning risk", - "type": "string" - }, - "risk_object_type": { - "description": "The type of object to which you’re assigning risk", - "type": "array", - "items": { - "type": "string", - "enum": [ - "system", - "user", - "other" - ] - }, - "minItems": 0, - "maxItems": 1, - "uniqueItems": true - }, - "risk_score": { - "description": "Score assigned to risk_object", - "type": "integer" - } - }, - "additionalProperties": false, - "required": [ - "risk_score", - "risk_object", - "risk_object_type" - ] - }, - "suppress": { - "type": "object", - "description": "Fields associated with suppressing the creation of multiple alerts", - "properties": { - "suppress_fields": { - "description": "The fields to base the suppression on", - "type": "string" - }, - "suppress_period": { - "description": "The length of time the suppression should be in effect", - "type": "string" - } - }, - "additionalProperties": false, - "required": [ - "suppress_fields", - "suppress_period" - ] - } - }, - "additionalProperties": false - }, - "scheduling": { - "type": "object", - "description": "Various fields to assist in scheduling the search", - "properties": { - "cron_schedule": { - "description": "Schedule of the search in cron format", - "type": "string" - }, - "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" - }, - "latest_time": { - "description": "The latest time tes search should run against in Splunk format", - "type": "string" - } - }, - "additionalProperties": false - }, - "search": { - "description": "The search (in SPL) executed within core Splunk", - "type": "string" - } - } - }, - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" - }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - } - } - }, - "uba": { - "type": "object", - "properties": { - "threat_category": { - "type": "string", - "description": "The category of a threat in Splunk UBA." - }, - "search": { - "type": "string", - "description": "The search you will run against the UEBA index to idenfiy the threat." - }, - "event_type": { - "type": "string", - "description": "An anomaly or threat." - }, - "model": { - "type": "string", - "description": "The name of the Splunk UBA model that detected the anomaly." - }, - "model_version": { - "type": "string", - "description": "Url of the playbook on Phantom website." - } - } } }, "required": [ @@ -770,5 +767,7 @@ "security_domain", "version", "detect" - ] -} \ No newline at end of file + ], + "title": "Detection Manifest", + "type": "object" +} diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.spec.json similarity index 89% rename from spec/v2/investigations.json.spec rename to spec/v2/investigations.spec.json index 9281d33db9..f81d6f01b8 100644 --- a/spec/v2/investigations.json.spec +++ b/spec/v2/investigations.spec.json @@ -1,29 +1,127 @@ -ent - "description": "The fields that make up the manifest of a version 1 investigative earch", - "type": "object", +{ "$id": "https://api.splunkresearch.com/schemas/investigations.json", "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Investigative Search Manifest", + "description": "The fields that make up the manifest of a version 1 investigative earch", "properties": { - "name": { - "description": "The name of the search", - "type": "string" - }, - "id": { - "description": "The unique identifier for the search", - "type": "string" - }, - "description": { - "description": "A description of what the search is designed to detect", - "type": "string" - }, + "additionalProperties": false, "data_metadata": { - "type": "object", + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, "description": "Information about the date being ingested", + "entities": { + "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", + "items": { + "enum": [] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, + "investigate": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person maintaining this search", + "type": "string" + }, + "email": { + "description": "Email address of the person maintaining this search", + "type": "string" + }, + "name": { + "description": "Name of the person maintaining this search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the search", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person who originally authored the search", + "type": "string" + }, + "email": { + "description": "Email address of the person who originally authored the search", + "type": "string" + }, + "name": { + "description": "Name of the person who originally authored the search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, "properties": { + "additionalProperties": false, "data_models": { + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, "description": "A list of data models, if any, used by this search", - "type": "array", "items": { "items": { "enum": [ @@ -49,36 +147,8 @@ ent "minItems": 0, "uniqueItems": true }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, "providing_technologies": { "description": "A list of technologies that provide this data", - "type": "array", "items": { "enum": [ "Apache", @@ -106,128 +176,66 @@ ent ] }, "minItems": 0, + "type": "array", "uniqueItems": true - } + }, + "type": "array" }, - "additionalProperties": false, "required": [ "data_source", "providing_technologies" ] }, - "creation_date": { - "description": "The date the story manifest was created", - "type": "string" - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", - "type": "string" - }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" - }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this search" - }, - "name": { - "type": "string", - "description": "Name of the person maintaining this search" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "original_authors": { - "description": "A list of the original authors of the search", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" - }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the search" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, "spec_version": { "description": "The version of the investigative search specification this manifest follows", "type": "integer" }, + "type": "object", "version": { "description": "The version of the search", "type": "string" - }, - "entities": { - "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, - "investigate": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" - } - ] } }, - "product_type": { - "description": "Type of product that will support this investigate object.", - "enum": [ - "phantom", - "splunk", - "uba" - ] - }, - "additionalProperties": false, "definitions": { - "splunk": { - "type": "object", + "phantom": { "properties": { - "search": { - "description": "The search (in SPL) executed within core Splunk for investgation.", + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_display_name": { + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", "type": "string" }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "required": [ + "phantom_server", + "playbook_name", + "playbook_url", + "playbook_display_name" + ], + "type": "object" + }, + "splunk": { + "properties": { "investigate_window": { - "type": "object", + "additionalProperties": false, "description": "The fields associated on when this search should run relative to the detection event", "properties": { "earliest_time_offset": { @@ -239,54 +247,44 @@ ent "type": "integer" } }, - "additionalProperties": false, "required": [ "latest_time_offset", "earliest_time_offset" - ] + ], + "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for investgation.", + "type": "string" } }, "required": [ "search", "investigate_window" - ] - }, - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" - }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - } - }, - "required": [ - "phantom_server", - "playbook_name", - "playbook_url", - "playbook_display_name" - ] + ], + "type": "object" } }, + "description": { + "description": "A description of what the search is designed to detect", + "type": "string" + }, + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "name": { + "description": "The name of the search", + "type": "string" + }, + "product_type": { + "description": "Type of product that will support this investigate object.", + "enum": [ + "phantom", + "splunk", + "uba" + ] + }, "required": [ "creation_date", "data_metadata", @@ -302,5 +300,7 @@ ent "version", "investigate" ] - } -} \ No newline at end of file + }, + "title": "Investigative Search Manifest", + "type": "object" +} diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec deleted file mode 100644 index 92b50a6f53..0000000000 --- a/spec/v2/responses.json.spec +++ /dev/null @@ -1,304 +0,0 @@ - { - "description": "The fields that make up the manifest of a version 1 reponse spec", - "type": "object", - "$id": "https://api.splunkresearch.com/schemas/investigations.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "title": "Response Manifest", - "properties": { - "name": { - "description": "The name of the search", - "type": "string" - }, - "id": { - "description": "The unique identifier for the search", - "type": "string" - }, - "description": { - "description": "A description of what this reponse object will do ", - "type": "string" - }, - "entities": { - "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, - "data_metadata": { - "type": "object", - "description": "Information about the date being used to run the response", - "properties": { - "data_models": { - "description": "A list of data models, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "providing_technologies": { - "description": "A list of technologies that provide this data", - "type": "array", - "items": { - "enum": [ - "Apache", - "AWS", - "Bro", - "Microsoft Windows", - "Linux", - "macOS", - "Netbackup", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Stream", - "Active Directory", - "Bluecoat", - "Carbon Black Response", - "Carbon Black Protect", - "CrowdStrike Falcon", - "Microsoft Exchange", - "Nessus", - "Palo Alto Firewall", - "Qualys", - "Sysmon", - "Tanium", - "Ziften" - ] - }, - "minItems": 0, - "uniqueItems": true - } - }, - "additionalProperties": false, - "required": [ - "data_source", - "providing_technologies" - ] - }, - "creation_date": { - "description": "The date the story manifest was created", - "type": "string" - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "how_to_implement": { - "description": "A discussion on how to implement this reponse object, the config files, etc", - "type": "string" - }, - "maintainers": { - "description": "An array of the current maintainers of the reponse spec", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person maintaining this search" - }, - "email": { - "type": "string", - "description": "Email address of the person maintaining this search" - }, - "name": { - "type": "string", - "description": "Name of the person maintaining this search" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "original_authors": { - "description": "A list of the original authors of the reponse object", - "type": "array", - "items": { - "type": "object", - "properties": { - "company": { - "type": "string", - "description": "Company associated with the person who originally authored the search" - }, - "email": { - "type": "string", - "description": "Email address of the person who originally authored the search" - }, - "name": { - "type": "string", - "description": "Name of the person who originally authored the search" - } - }, - "additionalProperties": false, - "required": [ - "name", - "email", - "company" - ] - } - }, - "spec_version": { - "description": "The version of the investigative search specification this manifest follows", - "type": "integer" - }, - "version": { - "description": "The version of the search", - "type": "string" - }, - "entities": { - "description": "A list of entities that is either an input or an output for the security workflow.", - "type": "array", - "items": { - "enum": [] - }, - "minItems": 0, - "uniqueItems": true - }, - "product_type": { - "description": "The type of detection", - "enum": [ - "splunk", - "phantom" - ] - }, - "fields_required": { - "description": "A list of fields that need to be in the result of the detection search for the search to be successful", - "type": "array", - "items": { - "type": "string" - }, - "minItems": 0, - "uniqueItems": true - }, - "response": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" - } - ] - } - }, - "additionalProperties": false, - "definitions": { - "splunk": { - "type": "object", - "properties": { - "search": { - "description": "A reponse action exectued in splunk", - "type": "string" - }, - "investigate_window": { - "type": "object", - "description": "The fields associated on when this search should run relative to the detection event", - "properties": { - "earliest_time_offset": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" - }, - "latest_time_offset": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" - } - }, - "additionalProperties": false, - "required": [ - "latest_time_offset", - "earliest_time_offset" - ] - } - } - }, - "phantom": { - "type": "object", - "properties": { - "phantom_server": { - "type": "string", - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)" - }, - "playbook_name": { - "type": "string", - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment" - }, - "playbook_display_name": { - "type": "string", - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment" - }, - "playbook_url": { - "type": "string", - "description": "Url of the playbook on Phantom website." - }, - "sensitivity": { - "type": "string", - "description": "TLP colors (White, Green, Amber or Red)" - }, - "severity": { - "type": "string", - "description": "Severity in phantom (High, Medium, Low)" - }, - "product_type": { - "product_type": "string", - "description": "Type of baseline to execute", - "enum": [ - "phantom", - "splunk", - "uba" - ] - } - } - } - }, - "required": [ - "creation_date", - "data_metadata", - "fields_required", - "how_to_implement", - "maintainers", - "modification_date", - "original_authors", - "search", - "description", - "id", - "product_type", - "investigate_window", - "spec_version", - "version", - "investigate" - ] - } \ No newline at end of file diff --git a/spec/v2/responses.spec.json b/spec/v2/responses.spec.json new file mode 100644 index 0000000000..b1349b9210 --- /dev/null +++ b/spec/v2/responses.spec.json @@ -0,0 +1,295 @@ +{ + "$id": "https://api.splunkresearch.com/schemas/investigations.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "definitions": { + "phantom": { + "properties": { + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_display_name": { + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", + "type": "string" + }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "product_type": { + "description": "Type of baseline to execute", + "enum": [ + "phantom", + "splunk", + "uba" + ], + "product_type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "type": "object" + }, + "splunk": { + "properties": { + "investigate_window": { + "additionalProperties": false, + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ], + "type": "object" + }, + "search": { + "description": "A reponse action exectued in splunk", + "type": "string" + } + }, + "type": "object" + } + }, + "description": "The fields that make up the manifest of a version 1 reponse spec", + "properties": { + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, + "data_metadata": { + "additionalProperties": false, + "description": "Information about the date being used to run the response", + "properties": { + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "data_models": { + "description": "A list of data models, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "data_source", + "providing_technologies" + ], + "type": "object" + }, + "description": { + "description": "A description of what this reponse object will do ", + "type": "string" + }, + "entities": { + "description": "A list of entities that is either an input or an output for the security workflow.", + "items": { + "enum": [] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "fields_required": { + "description": "A list of fields that need to be in the result of the detection search for the search to be successful", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "how_to_implement": { + "description": "A discussion on how to implement this reponse object, the config files, etc", + "type": "string" + }, + "id": { + "description": "The unique identifier for the search", + "type": "string" + }, + "maintainers": { + "description": "An array of the current maintainers of the reponse spec", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person maintaining this search", + "type": "string" + }, + "email": { + "description": "Email address of the person maintaining this search", + "type": "string" + }, + "name": { + "description": "Name of the person maintaining this search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, + "name": { + "description": "The name of the search", + "type": "string" + }, + "original_authors": { + "description": "A list of the original authors of the reponse object", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person who originally authored the search", + "type": "string" + }, + "email": { + "description": "Email address of the person who originally authored the search", + "type": "string" + }, + "name": { + "description": "Name of the person who originally authored the search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, + "product_type": { + "description": "The type of detection", + "enum": [ + "splunk", + "phantom" + ] + }, + "response": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + }, + "spec_version": { + "description": "The version of the investigative search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + } + }, + "required": [ + "creation_date", + "data_metadata", + "fields_required", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "search", + "description", + "id", + "product_type", + "investigate_window", + "spec_version", + "version", + "investigate" + ], + "title": "Response Manifest", + "type": "object" +} diff --git a/spec/v2/story.spec.json b/spec/v2/story.spec.json index e885544674..47b963d1eb 100644 --- a/spec/v2/story.spec.json +++ b/spec/v2/story.spec.json @@ -1,11 +1,6 @@ { "$id": "https://api.splunkresearch.com/schemas/story.json", "$schema": "http://json-schema.org/draft-07/schema#", - "allOf": [ - { - "$ref": "#/definitions/id" - } - ], "description": "The fields that make up the manifest of a version 2 Analytic Story", "meta:license": [ "This file is licensed to you under the Apache License, Version 2.0 (the 'License');", @@ -70,6 +65,7 @@ }, "id": { "description": "A unique identifier for the Analytic Story", + "example": "8169f17b-ef68-4b59-aae8-5869073014e1", "format": "uuid", "type": "string" }, @@ -157,6 +153,14 @@ "type": "string" } }, + "required": [ + "id", + "category", + "name", + "description", + "detections", + "version" + ], "title": "Analytic Story Manifest", "type": "object" } From ba9b46e00933701bdc7a6412d8f99225d0b5571d Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 27 Mar 2019 19:25:06 -0400 Subject: [PATCH 37/74] updating --- spec/v2/baselines.spec.json | 27 ++++++++++++++++++++++++++- spec/v2/detections.spec.json | 27 ++++++++++++++++++++++++++- spec/v2/investigations.spec.json | 27 ++++++++++++++++++++++++++- spec/v2/responses.spec.json | 27 ++++++++++++++++++++++++++- 4 files changed, 104 insertions(+), 4 deletions(-) diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index 446646323f..5862c196e7 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -181,7 +181,32 @@ "entities": { "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", "items": { - "enum": [] + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "type": "array", diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index b6df07f3f1..483997e2ca 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -343,7 +343,32 @@ "entities": { "description": "A list of entities that is outputed by the search...", "items": { - "enum": [] + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "type": "array", diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index f81d6f01b8..927fe92eb7 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -13,7 +13,32 @@ "entities": { "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", "items": { - "enum": [] + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "type": "array", diff --git a/spec/v2/responses.spec.json b/spec/v2/responses.spec.json index b1349b9210..8609b9d448 100644 --- a/spec/v2/responses.spec.json +++ b/spec/v2/responses.spec.json @@ -162,7 +162,32 @@ "entities": { "description": "A list of entities that is either an input or an output for the security workflow.", "items": { - "enum": [] + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] }, "minItems": 0, "type": "array", From 10238a1cf6bcf4c1216aca0782edcfd187a17e1f Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 19:29:02 -0400 Subject: [PATCH 38/74] fixing baseline --- docs/baselines.spec.md | 1095 +++++++++++++++++++++++++++++++++++ spec/v2/baselines.spec.json | 3 +- 2 files changed, 1096 insertions(+), 2 deletions(-) create mode 100644 docs/baselines.spec.md diff --git a/docs/baselines.spec.md b/docs/baselines.spec.md new file mode 100644 index 0000000000..daa59817d9 --- /dev/null +++ b/docs/baselines.spec.md @@ -0,0 +1,1095 @@ + +# Baseline Manifest Schema + +``` +https://api.splunkresearch.com/schemas/baselines.json +``` + +The fields that make up the manifest of a version 2 baseline search + +| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In | +|----------|------------|--------|--------------|-------------------|-----------------------|------------| +| Can be instantiated | Yes | Experimental | No | Forbidden | Forbidden | | + +# Baseline Manifest Properties + +| Property | Type | Required | Nullable | Defined by | +|----------|------|----------|----------|------------| +| [baseline](#baseline) | complex | **Required** | No | Baseline Manifest (this schema) | +| [creation_date](#creation_date) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [data_metadata](#data_metadata) | `object` | **Required** | No | Baseline Manifest (this schema) | +| [description](#description) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [eli5](#eli5) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [entities](#entities) | `enum[]` | Optional | No | Baseline Manifest (this schema) | +| [how_to_implement](#how_to_implement) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [id](#id) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [known_false_positives](#known_false_positives) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [maintainers](#maintainers) | `object[]` | **Required** | No | Baseline Manifest (this schema) | +| [modification_date](#modification_date) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [name](#name) | `string` | **Required** | No | Baseline Manifest (this schema) | +| [original_authors](#original_authors) | `object[]` | **Required** | No | Baseline Manifest (this schema) | +| [product_type](#product_type) | `enum` | **Required** | No | Baseline Manifest (this schema) | +| [spec_version](#spec_version) | `integer` | **Required** | No | Baseline Manifest (this schema) | +| [version](#version) | `string` | **Required** | No | Baseline Manifest (this schema) | + +## baseline + + +`baseline` + +* is **required** +* type: complex +* defined in this schema + +### baseline Type + + +**One** of the following *conditions* need to be fulfilled. + + +#### Condition 1 + + +* []() – `#/definitions/splunk` + + +#### Condition 2 + + +* []() – `#/definitions/phantom` + + + + + + +## creation_date + +The date the baseline manifest was created + +`creation_date` + +* is **required** +* type: `string` +* defined in this schema + +### creation_date Type + + +`string` + + + + + + + +## data_metadata + +Information about the date being ingested + +`data_metadata` + +* is **required** +* type: `object` +* defined in this schema + +### data_metadata Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `data_eventtypes`| array | Optional | +| `data_models`| array | Optional | +| `data_source`| array | **Required** | +| `data_sourcetypes`| array | Optional | +| `providing_technologies`| array | **Required** | + + + +#### data_eventtypes + +A list of eventtypes, if any, used by this search + +`data_eventtypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_eventtypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_models + +A list of data models, if any, used by this search + +`data_models` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### data_models Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of data models, if any, used by this search", + "items": { + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ], + "simpletype": "`enum`", + "meta:enum": { + "Alerts": "", + "Application_State": "", + "Authentication": "", + "Certificates": "", + "Change_Analysis": "", + "Change": "", + "Malware": "", + "Email": "", + "Identity_Management": "", + "Network_Resolution": "", + "Network_Traffic": "", + "Vulnerabilities": "", + "Web": "", + "Network_Sessions": "", + "Updates": "", + "Risk": "", + "Endpoint": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### data_source + +A high-level description of the type of data needed for this search to complete + +`data_source` + +* is **required** +* type: `string[]`* at least `0` items in the array + + +##### data_source Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_sourcetypes + +The list of sourcetypes, if any, used by this search + +`data_sourcetypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_sourcetypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### providing_technologies + +A list of technologies that provide this data + +`providing_technologies` + +* is **required** +* type: `enum[]`* at least `0` items in the array + + +##### providing_technologies Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of technologies that provide this data", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ], + "simpletype": "`enum`", + "meta:enum": { + "Apache": "", + "AWS": "", + "Bro": "", + "Microsoft Windows": "", + "Linux": "", + "macOS": "", + "Netbackup": "", + "Splunk Enterprise": "", + "Splunk Enterprise Security": "", + "Splunk Stream": "", + "Active Directory": "", + "Bluecoat": "", + "Carbon Black Response": "", + "Carbon Black Protect": "", + "CrowdStrike Falcon": "", + "Microsoft Exchange": "", + "Nessus": "", + "Palo Alto Firewall": "", + "Qualys": "", + "Sysmon": "", + "Tanium": "", + "Ziften": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + + + + +## description + +A description of what the search is is doing to create a baseline + +`description` + +* is **required** +* type: `string` +* defined in this schema + +### description Type + + +`string` + + + + + + + +## eli5 + +Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert + +`eli5` + +* is **required** +* type: `string` +* defined in this schema + +### eli5 Type + + +`string` + + + + + + + +## entities + +A list of entities that will used in the story flow or are relevant to the security investigation. + +`entities` + +* is optional +* type: `enum[]` +* at least `0` items in the array +* defined in this schema + +### entities Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", + "items": { + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ], + "simpletype": "`enum`", + "meta:enum": { + "accessKeyId": "", + "arn": "", + "awsRegion": "", + "bucketName": "", + "City": "", + "Country": "", + "dest_port": "", + "dest": "", + "event_id": "", + "instanceId": "", + "message_id": "", + "networkAclId": "", + "process_name": "", + "process": "", + "recipient": "", + "Region": "", + "resourceId": "", + "session_id": "", + "src_ip": "", + "src_mac": "", + "src_user": "", + "src": "", + "user": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + +## how_to_implement + +A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications + +`how_to_implement` + +* is **required** +* type: `string` +* defined in this schema + +### how_to_implement Type + + +`string` + + + + + + + +## id + +The unique identifier for the search + +`id` + +* is **required** +* type: `string` +* defined in this schema + +### id Type + + +`string` + + + + + + + +## known_false_positives + +Describe the known false postives while the analyst builds the baseline. + +`known_false_positives` + +* is **required** +* type: `string` +* defined in this schema + +### known_false_positives Type + + +`string` + + + + + + + +## maintainers + +An array of the current maintainers of the Analytic Story. + +`maintainers` + +* is **required** +* type: `object[]` +* defined in this schema + +### maintainers Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person maintaining this search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person maintaining this search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person maintaining this search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## modification_date + +The date of the most recent modification to the search + +`modification_date` + +* is **required** +* type: `string` +* defined in this schema + +### modification_date Type + + +`string` + + + + + + + +## name + +The name of the search that creates the baseline + +`name` + +* is **required** +* type: `string` +* defined in this schema + +### name Type + + +`string` + + + + + + + +## original_authors + +A list of the original authors of the search + +`original_authors` + +* is **required** +* type: `object[]` +* defined in this schema + +### original_authors Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person who originally authored the search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person who originally authored the search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person who originally authored the search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## product_type + +The type of baseline + +`product_type` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#product_type-known-values). + +### product_type Known Values +| Value | Description | +|-------|-------------| +| `splunk` | | +| `phantom` | | +| `uba` | | + + + + +## spec_version + +The version of the detection search specification this manifest follows + +`spec_version` + +* is **required** +* type: `integer` +* defined in this schema + +### spec_version Type + + +`integer` + + + + + + + +## version + +The version of the search + +`version` + +* is **required** +* type: `string` +* defined in this schema + +### version Type + + +`string` + + + + + + + +# Baseline Manifest Definitions + +| Property | Type | Group | +|----------|------|-------| +| [phantom_server](#phantom_server) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | +| [playbook_display_name](#playbook_display_name) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | +| [playbook_name](#playbook_name) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | +| [playbook_url](#playbook_url) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | +| [scheduling](#scheduling) | `object` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` | +| [search](#search) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` | +| [sensitivity](#sensitivity) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | +| [severity](#severity) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | + +## phantom_server + +IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname) + +`phantom_server` + +* is optional +* type: `string` +* defined in this schema + +### phantom_server Type + + +`string` + + + + + + + +## playbook_display_name + +Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment + +`playbook_display_name` + +* is optional +* type: `string` +* defined in this schema + +### playbook_display_name Type + + +`string` + + + + + + + +## playbook_name + +Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment + +`playbook_name` + +* is optional +* type: `string` +* defined in this schema + +### playbook_name Type + + +`string` + + + + + + + +## playbook_url + +Url of the playbook on Phantom website. + +`playbook_url` + +* is optional +* type: `string` +* defined in this schema + +### playbook_url Type + + +`string` + + + + + + + +## scheduling + +Various fields to assist in scheduling the search + +`scheduling` + +* is optional +* type: `object` +* defined in this schema + +### scheduling Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `earliest_time`| string | Optional | +| `latest_time`| string | Optional | + + + +#### earliest_time + +The earliest time the search should run in Splunk format + +`earliest_time` + +* is optional +* type: `string` + +##### earliest_time Type + + +`string` + + + + + + + + + +#### latest_time + +The latest time tes search should run against in Splunk format + +`latest_time` + +* is optional +* type: `string` + +##### latest_time Type + + +`string` + + + + + + + + + + + + +## search + +The search (in SPL) executed within core Splunk for creating a baseline + +`search` + +* is optional +* type: `string` +* defined in this schema + +### search Type + + +`string` + + + + + + + +## sensitivity + +TLP colors (White, Green, Amber or Red) + +`sensitivity` + +* is optional +* type: `string` +* defined in this schema + +### sensitivity Type + + +`string` + + + + + + + +## severity + +Severity in phantom (High, Medium, Low) + +`severity` + +* is optional +* type: `string` +* defined in this schema + +### severity Type + + +`string` + + + + + + diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index 5862c196e7..c48e6b6fba 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -175,7 +175,7 @@ "type": "string" }, "eli5": { - "description": "Explain it like I\u2019m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", "type": "string" }, "entities": { @@ -201,7 +201,6 @@ "resourceId", "session_id", "src_ip", - "src_ip", "src_mac", "src_user", "src", From eab7cea48f41dfd1110661c32cc3bbc4879a90f2 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 22:57:38 -0400 Subject: [PATCH 39/74] updated spec and docs for investigations --- docs/detections.spec.md | 2502 ++++++++++++++++++++++++++++++++++ spec/v2/detections.spec.json | 19 +- 2 files changed, 2504 insertions(+), 17 deletions(-) create mode 100644 docs/detections.spec.md diff --git a/docs/detections.spec.md b/docs/detections.spec.md new file mode 100644 index 0000000000..968ba2d57c --- /dev/null +++ b/docs/detections.spec.md @@ -0,0 +1,2502 @@ + +# Detection Manifest Schema + +``` +https://api.splunkresearch.com/schemas/detections.json +``` + +A object that defines the parameters for detecting things using various Splunk capabilities + +| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In | +|----------|------------|--------|--------------|-------------------|-----------------------|------------| +| Can be instantiated | Yes | Experimental | No | Forbidden | Permitted | | + +# Detection Manifest Properties + +| Property | Type | Required | Nullable | Defined by | +|----------|------|----------|----------|------------| +| [asset_type](#asset_type) | `string` | Optional | No | Detection Manifest (this schema) | +| [baselines](#baselines) | `object[]` | Optional | No | Detection Manifest (this schema) | +| [confidence](#confidence) | `enum` | **Required** | No | Detection Manifest (this schema) | +| [creation_date](#creation_date) | `string` | **Required** | No | Detection Manifest (this schema) | +| [data_metadata](#data_metadata) | `object` | **Required** | No | Detection Manifest (this schema) | +| [description](#description) | `string` | **Required** | No | Detection Manifest (this schema) | +| [detect](#detect) | complex | **Required** | No | Detection Manifest (this schema) | +| [eli5](#eli5) | `string` | **Required** | No | Detection Manifest (this schema) | +| [entities](#entities) | `enum[]` | Optional | No | Detection Manifest (this schema) | +| [how_to_implement](#how_to_implement) | `string` | **Required** | No | Detection Manifest (this schema) | +| [id](#id) | `string` | **Required** | No | Detection Manifest (this schema) | +| [investigations](#investigations) | `object[]` | Optional | No | Detection Manifest (this schema) | +| [known_false_positives](#known_false_positives) | `string` | **Required** | No | Detection Manifest (this schema) | +| [maintainers](#maintainers) | `object[]` | **Required** | No | Detection Manifest (this schema) | +| [mappings](#mappings) | `object` | Optional | No | Detection Manifest (this schema) | +| [modification_date](#modification_date) | `string` | **Required** | No | Detection Manifest (this schema) | +| [name](#name) | `string` | Optional | No | Detection Manifest (this schema) | +| [original_authors](#original_authors) | `object[]` | **Required** | No | Detection Manifest (this schema) | +| [product_type](#product_type) | `enum` | **Required** | No | Detection Manifest (this schema) | +| [references](#references) | `string[]` | Optional | No | Detection Manifest (this schema) | +| [responses](#responses) | `object[]` | Optional | No | Detection Manifest (this schema) | +| [security_domain](#security_domain) | `enum` | **Required** | No | Detection Manifest (this schema) | +| [spec_version](#spec_version) | `integer` | Optional | No | Detection Manifest (this schema) | +| [version](#version) | `string` | **Required** | No | Detection Manifest (this schema) | +| `*` | any | Additional | Yes | this schema *allows* additional properties | + +## asset_type + +Designates the type of asset being investigated + +`asset_type` + +* is optional +* type: `string` +* defined in this schema + +### asset_type Type + + +`string` + + + + + + + +## baselines + +An array of the baseline objects to exectute before the detection + +`baselines` + +* is optional +* type: `object[]` +* defined in this schema + +### baselines Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `id`| string | **Required** | +| `name`| string | **Required** | +| `type`| | Optional | + + + +#### id + +UUID of the baseline object + +`id` + +* is **required** +* type: `string` + +##### id Type + + +`string` + + + + + + + + + +#### name + +name of baseline object + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + +#### type + +Type of baseline to execute + +`type` + +* is optional +* type: `enum` + +The value of this property **must** be equal to one of the [known values below](#baselines-known-values). + +##### type Known Values +| Value | Description | +|-------|-------------| +| `phantom` | | +| `splunk` | | +| `uba` | | + + + + + + + + + + + + +## confidence + +Confidence that detected behavior is malicious + +`confidence` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#confidence-known-values). + +### confidence Known Values +| Value | Description | +|-------|-------------| +| `high` | | +| `medium` | | +| `low` | | + + + + +## creation_date + +The date the story manifest was created + +`creation_date` + +* is **required** +* type: `string` +* defined in this schema + +### creation_date Type + + +`string` + + + + + + + +## data_metadata + +Information about the date being ingested + +`data_metadata` + +* is **required** +* type: `object` +* defined in this schema + +### data_metadata Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `data_eventtypes`| array | Optional | +| `data_models`| array | Optional | +| `data_source`| array | **Required** | +| `data_sourcetypes`| array | Optional | +| `providing_technologies`| array | **Required** | + + + +#### data_eventtypes + +A list of eventtypes, if any, used by this search + +`data_eventtypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_eventtypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_models + +A list of data models, if any, used by this search + +`data_models` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### data_models Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of data models, if any, used by this search", + "items": { + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ], + "simpletype": "`enum`", + "meta:enum": { + "Alerts": "", + "Application_State": "", + "Authentication": "", + "Certificates": "", + "Change_Analysis": "", + "Change": "", + "Malware": "", + "Email": "", + "Identity_Management": "", + "Network_Resolution": "", + "Network_Traffic": "", + "Vulnerabilities": "", + "Web": "", + "Network_Sessions": "", + "Updates": "", + "Risk": "", + "Endpoint": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### data_source + +A high-level description of the type of data needed for this search to complete + +`data_source` + +* is **required** +* type: `string[]`* at least `0` items in the array + + +##### data_source Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_sourcetypes + +The list of sourcetypes, if any, used by this search + +`data_sourcetypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_sourcetypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### providing_technologies + +A list of technologies that provide this data + +`providing_technologies` + +* is **required** +* type: `enum[]`* at least `0` items in the array + + +##### providing_technologies Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of technologies that provide this data", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften", + "OSquery" + ], + "simpletype": "`enum`", + "meta:enum": { + "Apache": "", + "AWS": "", + "Bro": "", + "Microsoft Windows": "", + "Linux": "", + "macOS": "", + "Netbackup": "", + "Splunk Enterprise": "", + "Splunk Enterprise Security": "", + "Splunk Stream": "", + "Active Directory": "", + "Bluecoat": "", + "Carbon Black Response": "", + "Carbon Black Protect": "", + "CrowdStrike Falcon": "", + "Microsoft Exchange": "", + "Nessus": "", + "Palo Alto Firewall": "", + "Qualys": "", + "Sysmon": "", + "Tanium": "", + "Ziften": "", + "OSquery": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + + + + +## description + +A description of what the detection is designed to find + +`description` + +* is **required** +* type: `string` +* defined in this schema + +### description Type + + +`string` + + + + + + + +## detect + + +`detect` + +* is **required** +* type: complex +* defined in this schema + +### detect Type + + +**One** of the following *conditions* need to be fulfilled. + + +#### Condition 1 + + +* []() – `#/definitions/splunk` + + +#### Condition 2 + + +* []() – `#/definitions/phantom` + + +#### Condition 3 + + +* []() – `#/definitions/uba` + + + + + + +## eli5 + +Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert + +`eli5` + +* is **required** +* type: `string` +* defined in this schema + +### eli5 Type + + +`string` + + + + + + + +## entities + +A list of entities that is outputed by the search... + +`entities` + +* is optional +* type: `enum[]` +* at least `0` items in the array +* defined in this schema + +### entities Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of entities that is outputed by the search...", + "items": { + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ], + "simpletype": "`enum`", + "meta:enum": { + "accessKeyId": "", + "arn": "", + "awsRegion": "", + "bucketName": "", + "City": "", + "Country": "", + "dest_port": "", + "dest": "", + "event_id": "", + "instanceId": "", + "message_id": "", + "networkAclId": "", + "process_name": "", + "process": "", + "recipient": "", + "Region": "", + "resourceId": "", + "session_id": "", + "src_ip": "", + "src_mac": "", + "src_user": "", + "src": "", + "user": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + +## how_to_implement + +A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications + +`how_to_implement` + +* is **required** +* type: `string` +* defined in this schema + +### how_to_implement Type + + +`string` + + + + + + + +## id + +The unique identifier for the detection + +`id` + +* is **required** +* type: `string` +* defined in this schema + +### id Type + + +`string` + + + + + + + +## investigations + +An array of the investigation objects to exectute on the detection results + +`investigations` + +* is optional +* type: `object[]` +* defined in this schema + +### investigations Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `id`| string | **Required** | +| `name`| string | **Required** | +| `product_type`| string | **Required** | + + + +#### id + +UUID of the baseline object + +`id` + +* is **required** +* type: `string` + +##### id Type + + +`string` + + + + + + + + + +#### name + +Name of baseline + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + +#### product_type + +Type of baseline to execute + +`product_type` + +* is **required** +* type: `enum` + +The value of this property **must** be equal to one of the [known values below](#investigations-known-values). + +##### product_type Known Values +| Value | Description | +|-------|-------------| +| `phantom` | | +| `splunk` | | +| `uba` | | + + + + + + + + + + + + +## known_false_positives + +Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior + +`known_false_positives` + +* is **required** +* type: `string` +* defined in this schema + +### known_false_positives Type + + +`string` + + + + + + + +## maintainers + +An array of the current maintainers of the Analytic Story. + +`maintainers` + +* is **required** +* type: `object[]` +* defined in this schema + +### maintainers Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person maintaining this search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person maintaining this search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person maintaining this search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## mappings + +Mappings to various industry standards and frameworks + +`mappings` + +* is optional +* type: `object` +* defined in this schema + +### mappings Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `cis20`| array | Optional | +| `emoji`| array | Optional | +| `kill_chain_phases`| array | Optional | +| `mitre_attack`| array | Optional | +| `nist`| array | Optional | + + + +#### cis20 + +A list of critical security controls this search helps you implement + +`cis20` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### cis20 Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of critical security controls this search helps you implement", + "items": { + "enum": [ + "CIS 1", + "CIS 2", + "CIS 3", + "CIS 4", + "CIS 5", + "CIS 6", + "CIS 7", + "CIS 8", + "CIS 9", + "CIS 10", + "CIS 11", + "CIS 12", + "CIS 13", + "CIS 14", + "CIS 15", + "CIS 16", + "CIS 17", + "CIS 18", + "CIS 19", + "CIS 20" + ], + "simpletype": "`enum`", + "meta:enum": { + "CIS 1": "", + "CIS 2": "", + "CIS 3": "", + "CIS 4": "", + "CIS 5": "", + "CIS 6": "", + "CIS 7": "", + "CIS 8": "", + "CIS 9": "", + "CIS 10": "", + "CIS 11": "", + "CIS 12": "", + "CIS 13": "", + "CIS 14": "", + "CIS 15": "", + "CIS 16": "", + "CIS 17": "", + "CIS 18": "", + "CIS 19": "", + "CIS 20": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### emoji + +A list of security emojis that will help UBA understand this alert as an external alarm + +`emoji` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### emoji Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of security emojis that will help UBA understand this alert as an external alarm", + "items": { + "enum": [ + "EndPoint", + "AD", + "Firewall", + "ApplicationLog", + "IPS", + "CloudData", + "Correlation", + "Printer", + "Badge" + ], + "simpletype": "`enum`", + "meta:enum": { + "EndPoint": "", + "AD": "", + "Firewall": "", + "ApplicationLog": "", + "IPS": "", + "CloudData": "", + "Correlation": "", + "Printer": "", + "Badge": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### kill_chain_phases + +A list of kill-chain phases to which the search applies + +`kill_chain_phases` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### kill_chain_phases Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of kill-chain phases to which the search applies", + "items": { + "enum": [ + "Reconnaissance", + "Weaponization", + "Delivery", + "Exploitation", + "Installation", + "Command and Control", + "Actions on Objectives" + ], + "simpletype": "`enum`", + "meta:enum": { + "Reconnaissance": "", + "Weaponization": "", + "Delivery": "", + "Exploitation": "", + "Installation": "", + "Command and Control": "", + "Actions on Objectives": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### mitre_attack + +A list of the techniques and tactics identified by the search + +`mitre_attack` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### mitre_attack Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of the techniques and tactics identified by the search", + "items": { + "enum": [ + "Initial Access", + "Execution", + "Persistence", + "Privilege Escalation", + "Defense Evasion", + "Credential Access", + "Discovery", + "Lateral Movement", + "Collection", + "Exfiltration", + "Command and Control", + "Command and Control Protocol", + "Commonly Used Port", + "Custom Cryptographic Protocol", + "DLL Injection", + "DLL Search Order Hijacking", + "DLL Side-Loading", + "Data Compressed", + "Data Encrypted", + "Data Obfuscation", + "Data Staged", + "Data Transfer Size Limits", + "Data from Local System", + "Data from Network Shared Drive", + "Data from Removable Media", + "Disabling Security Tools", + "Email Collection", + "Execution through API", + "Exfiltration Over Alternative Protocol", + "Exfiltration Over Command and Control Channel", + "Exfiltration Over Other Network Medium", + "Exfiltration Over Physical Medium", + "Exploitation of Vulnerability", + "Fallback Channels", + "File Deletion", + "File System Logical Offsets", + "File System Permissions Weakness", + "File and Directory Discovery", + "Graphical User Interface", + "Hypervisor", + "Indicator Blocking", + "Indicator Removal from Tools", + "Indicator Removal on Host", + "Input Capture", + "InstallUtil", + "Legitimate Credentials", + "Local Network Configuration Discovery", + "Local Network Connections Discovery", + "Local Port Monitor", + "Logon Scripts", + "MSBuild", + "Masquerading", + "Modify Existing Service", + "Modify Registry", + "Multi-Stage Channels", + "Multiband Communication", + "Multilayer Encryption", + "NTFS Extended Attributes", + "Network Service Scanning", + "Network Share Connection Removal", + "Network Sniffing", + "New Service", + "Obfuscated Files or Information", + "Pass the Hash", + "Pass the Ticket", + "Path Interception", + "Peripheral Device Discovery", + "Permission Groups Discovery", + "PowerShell", + "Process Discovery", + "Process Hollowing", + "Query Registry", + "Redundant Access", + "Registry Run Keys / Start Folder", + "Regsvcs/Regasm", + "Regsvr32", + "Remote Desktop Protocol", + "Create Account", + "Remote File Copy", + "Remote Services", + "Remote System Discovery", + "Replication Through Removable Media", + "Rootkit", + "Rundll32", + "Scheduled Task", + "Scheduled Transfer", + "Screen Capture", + "Scripting", + "Security Software Discovery", + "Security Support Provider", + "Service Execution", + "Service Registry Permissions Weakness", + "Shared Webroot", + "Shortcut Modification", + "Software Packing", + "Standard Application Layer Protocol", + "Standard Cryptographic Protocol", + "Standard Non-Application Layer Protocol", + "System Information Discovery", + "System Owner/User Discovery", + "System Service Discovery", + "System Time Discovery", + "Taint Shared Content", + "Third-party Software", + "Timestomp", + "Two-Factor Authentication Interception", + "Uncommonly Used Port", + "Video Capture", + "Valid Accounts", + "Web Service", + "Web Shell", + "Windows Admin Shares", + "Windows Management Instrumentation Event Subscription", + "Windows Management Instrumentation", + "Windows Remote Management", + "Winlogon Helper DLL", + "Exploitation for Privilege Escalation" + ], + "simpletype": "`enum`", + "meta:enum": { + "Initial Access": "", + "Execution": "", + "Persistence": "", + "Privilege Escalation": "", + "Defense Evasion": "", + "Credential Access": "", + "Discovery": "", + "Lateral Movement": "", + "Collection": "", + "Exfiltration": "", + "Command and Control": "", + "Command and Control Protocol": "", + "Commonly Used Port": "", + "Custom Cryptographic Protocol": "", + "DLL Injection": "", + "DLL Search Order Hijacking": "", + "DLL Side-Loading": "", + "Data Compressed": "", + "Data Encrypted": "", + "Data Obfuscation": "", + "Data Staged": "", + "Data Transfer Size Limits": "", + "Data from Local System": "", + "Data from Network Shared Drive": "", + "Data from Removable Media": "", + "Disabling Security Tools": "", + "Email Collection": "", + "Execution through API": "", + "Exfiltration Over Alternative Protocol": "", + "Exfiltration Over Command and Control Channel": "", + "Exfiltration Over Other Network Medium": "", + "Exfiltration Over Physical Medium": "", + "Exploitation of Vulnerability": "", + "Fallback Channels": "", + "File Deletion": "", + "File System Logical Offsets": "", + "File System Permissions Weakness": "", + "File and Directory Discovery": "", + "Graphical User Interface": "", + "Hypervisor": "", + "Indicator Blocking": "", + "Indicator Removal from Tools": "", + "Indicator Removal on Host": "", + "Input Capture": "", + "InstallUtil": "", + "Legitimate Credentials": "", + "Local Network Configuration Discovery": "", + "Local Network Connections Discovery": "", + "Local Port Monitor": "", + "Logon Scripts": "", + "MSBuild": "", + "Masquerading": "", + "Modify Existing Service": "", + "Modify Registry": "", + "Multi-Stage Channels": "", + "Multiband Communication": "", + "Multilayer Encryption": "", + "NTFS Extended Attributes": "", + "Network Service Scanning": "", + "Network Share Connection Removal": "", + "Network Sniffing": "", + "New Service": "", + "Obfuscated Files or Information": "", + "Pass the Hash": "", + "Pass the Ticket": "", + "Path Interception": "", + "Peripheral Device Discovery": "", + "Permission Groups Discovery": "", + "PowerShell": "", + "Process Discovery": "", + "Process Hollowing": "", + "Query Registry": "", + "Redundant Access": "", + "Registry Run Keys / Start Folder": "", + "Regsvcs/Regasm": "", + "Regsvr32": "", + "Remote Desktop Protocol": "", + "Create Account": "", + "Remote File Copy": "", + "Remote Services": "", + "Remote System Discovery": "", + "Replication Through Removable Media": "", + "Rootkit": "", + "Rundll32": "", + "Scheduled Task": "", + "Scheduled Transfer": "", + "Screen Capture": "", + "Scripting": "", + "Security Software Discovery": "", + "Security Support Provider": "", + "Service Execution": "", + "Service Registry Permissions Weakness": "", + "Shared Webroot": "", + "Shortcut Modification": "", + "Software Packing": "", + "Standard Application Layer Protocol": "", + "Standard Cryptographic Protocol": "", + "Standard Non-Application Layer Protocol": "", + "System Information Discovery": "", + "System Owner/User Discovery": "", + "System Service Discovery": "", + "System Time Discovery": "", + "Taint Shared Content": "", + "Third-party Software": "", + "Timestomp": "", + "Two-Factor Authentication Interception": "", + "Uncommonly Used Port": "", + "Video Capture": "", + "Valid Accounts": "", + "Web Service": "", + "Web Shell": "", + "Windows Admin Shares": "", + "Windows Management Instrumentation Event Subscription": "", + "Windows Management Instrumentation": "", + "Windows Remote Management": "", + "Winlogon Helper DLL": "", + "Exploitation for Privilege Escalation": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### nist + +A list of the NIST controls the search helps you implement + +`nist` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### nist Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of the NIST controls the search helps you implement", + "items": { + "enum": [ + "ID.AM", + "ID.RA", + "PR.DS", + "PR.IP", + "PR.AC", + "PR.PT", + "PR.AT", + "PR.MA", + "DE.CM", + "DE.DP", + "DE.AE", + "RS.MI", + "RS.AN", + "RS.RP", + "RS.IM", + "RS.CO", + "RC.IM", + "RC.CO" + ], + "simpletype": "`enum`", + "meta:enum": { + "ID.AM": "", + "ID.RA": "", + "PR.DS": "", + "PR.IP": "", + "PR.AC": "", + "PR.PT": "", + "PR.AT": "", + "PR.MA": "", + "DE.CM": "", + "DE.DP": "", + "DE.AE": "", + "RS.MI": "", + "RS.AN": "", + "RS.RP": "", + "RS.IM": "", + "RS.CO": "", + "RC.IM": "", + "RC.CO": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + + + + +## modification_date + +The date of the most recent modification to the search + +`modification_date` + +* is **required** +* type: `string` +* defined in this schema + +### modification_date Type + + +`string` + + + + + + + +## name + +The name of the detection + +`name` + +* is optional +* type: `string` +* defined in this schema + +### name Type + + +`string` + + + + + + + +## original_authors + +A list of the original authors of the search + +`original_authors` + +* is **required** +* type: `object[]` +* defined in this schema + +### original_authors Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person who originally authored the search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person who originally authored the search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person who originally authored the search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## product_type + +The type of detection + +`product_type` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#product_type-known-values). + +### product_type Known Values +| Value | Description | +|-------|-------------| +| `uba` | | +| `splunk` | | +| `phantom` | | + + + + +## references + +A list of URLs that give more information about the search + +`references` + +* is optional +* type: `string[]` +* at least `0` items in the array +* defined in this schema + +### references Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + +## responses + +An array of the response objects to exectute on the detection results + +`responses` + +* is optional +* type: `object[]` +* defined in this schema + +### responses Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `id`| string | **Required** | +| `name`| string | **Required** | +| `product_type`| | **Required** | + + + +#### id + +UUID of the baseline object + +`id` + +* is **required** +* type: `string` + +##### id Type + + +`string` + + + + + + + + + +#### name + +name of baseline + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + +#### product_type + +Type of baseline to execute + +`product_type` + +* is **required** +* type: `enum` + +The value of this property **must** be equal to one of the [known values below](#responses-known-values). + +##### product_type Known Values +| Value | Description | +|-------|-------------| +| `phantom` | | +| `splunk` | | +| `uba` | | + + + + + + + + + + + + +## security_domain + +The high-level security area to which the search belongs + +`security_domain` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#security_domain-known-values). + +### security_domain Known Values +| Value | Description | +|-------|-------------| +| `access` | | +| `endpoint` | | +| `network` | | +| `threat` | | + + + + +## spec_version + +The version of the detection specification this manifest follows + +`spec_version` + +* is optional +* type: `integer` +* defined in this schema + +### spec_version Type + + +`integer` + + + + + + + +## version + +The version of the detection + +`version` + +* is **required** +* type: `string` +* defined in this schema + +### version Type + + +`string` + + + + + + + +# Detection Manifest Definitions + +| Property | Type | Group | +|----------|------|-------| +| [correlation_rule](#correlation_rule) | `object` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/splunk` | +| [event_type](#event_type) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | +| [model](#model) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | +| [model_version](#model_version) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | +| [phantom_server](#phantom_server) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | +| [playbook_display_name](#playbook_display_name) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | +| [playbook_name](#playbook_name) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | +| [playbook_url](#playbook_url) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | +| [scheduling](#scheduling) | `object` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/splunk` | +| [search](#search) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | +| [sensitivity](#sensitivity) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | +| [severity](#severity) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | +| [threat_category](#threat_category) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | + +## correlation_rule + +Various fields to enhance usability in Enterprise Security + +`correlation_rule` + +* is optional +* type: `object` +* defined in this schema + +### correlation_rule Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `notable`| object | Optional | +| `risk`| object | Optional | +| `suppress`| object | Optional | + + + +#### notable + +Various fields associated with creating a notable event + +`notable` + +* is optional +* type: `object` + +##### notable Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `nes_fields`| string | **Required** | +| `rule_description`| string | **Required** | +| `rule_title`| string | **Required** | + + + +#### nes_fields + +A list of suggested fields to be used for notable-event suppression + +`nes_fields` + +* is **required** +* type: `string` + +##### nes_fields Type + + +`string` + + + + + + + + + +#### rule_description + +Description of the notable event that will display in Incident Review + +`rule_description` + +* is **required** +* type: `string` + +##### rule_description Type + + +`string` + + + + + + + + + +#### rule_title + +Title of the notable event that will display in Incident Review + +`rule_title` + +* is **required** +* type: `string` + +##### rule_title Type + + +`string` + + + + + + + + + + + + + + +#### risk + +Fields associated with assigning risk to objects + +`risk` + +* is optional +* type: `object` + +##### risk Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `risk_object`| string | **Required** | +| `risk_object_type`| array | **Required** | +| `risk_score`| integer | **Required** | + + + +#### risk_object + +TThe field to which you are assigning risk + +`risk_object` + +* is **required** +* type: `string` + +##### risk_object Type + + +`string` + + + + + + + + + +#### risk_object_type + +The type of object to which you are assigning risk + +`risk_object_type` + +* is **required** +* type: `enum[]`* between `0` and `1` items in the array + + +##### risk_object_type Type + + +Array type: `enum[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### risk_score + +Score assigned to risk_object + +`risk_score` + +* is **required** +* type: `integer` + +##### risk_score Type + + +`integer` + + + + + + + + + + + + + + +#### suppress + +Fields associated with suppressing the creation of multiple alerts + +`suppress` + +* is optional +* type: `object` + +##### suppress Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `suppress_fields`| string | **Required** | +| `suppress_period`| string | **Required** | + + + +#### suppress_fields + +The fields to base the suppression on + +`suppress_fields` + +* is **required** +* type: `string` + +##### suppress_fields Type + + +`string` + + + + + + + + + +#### suppress_period + +The length of time the suppression should be in effect + +`suppress_period` + +* is **required** +* type: `string` + +##### suppress_period Type + + +`string` + + + + + + + + + + + + + + + + + +## event_type + +An anomaly or threat. + +`event_type` + +* is optional +* type: `string` +* defined in this schema + +### event_type Type + + +`string` + + + + + + + +## model + +The name of the Splunk UBA model that detected the anomaly. + +`model` + +* is optional +* type: `string` +* defined in this schema + +### model Type + + +`string` + + + + + + + +## model_version + +Url of the playbook on Phantom website. + +`model_version` + +* is optional +* type: `string` +* defined in this schema + +### model_version Type + + +`string` + + + + + + + +## phantom_server + +IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname) + +`phantom_server` + +* is optional +* type: `string` +* defined in this schema + +### phantom_server Type + + +`string` + + + + + + + +## playbook_display_name + +Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment + +`playbook_display_name` + +* is optional +* type: `string` +* defined in this schema + +### playbook_display_name Type + + +`string` + + + + + + + +## playbook_name + +Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment + +`playbook_name` + +* is optional +* type: `string` +* defined in this schema + +### playbook_name Type + + +`string` + + + + + + + +## playbook_url + +Url of the playbook on Phantom website. + +`playbook_url` + +* is optional +* type: `string` +* defined in this schema + +### playbook_url Type + + +`string` + + + + + + + +## scheduling + +Various fields to assist in scheduling the search + +`scheduling` + +* is optional +* type: `object` +* defined in this schema + +### scheduling Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `cron_schedule`| string | Optional | +| `earliest_time`| string | Optional | +| `latest_time`| string | Optional | + + + +#### cron_schedule + +Schedule of the search in cron format + +`cron_schedule` + +* is optional +* type: `string` + +##### cron_schedule Type + + +`string` + + + + + + + + + +#### earliest_time + +The earliest time the search should run in Splunk format + +`earliest_time` + +* is optional +* type: `string` + +##### earliest_time Type + + +`string` + + + + + + + + + +#### latest_time + +The latest time tes search should run against in Splunk format + +`latest_time` + +* is optional +* type: `string` + +##### latest_time Type + + +`string` + + + + + + + + + + + + +## search + +The search you will run against the UEBA index to idenfiy the threat. + +`search` + +* is optional +* type: `string` +* defined in this schema + +### search Type + + +`string` + + + + + + + +## sensitivity + +TLP colors (White, Green, Amber or Red) + +`sensitivity` + +* is optional +* type: `string` +* defined in this schema + +### sensitivity Type + + +`string` + + + + + + + +## severity + +Severity in phantom (High, Medium, Low) + +`severity` + +* is optional +* type: `string` +* defined in this schema + +### severity Type + + +`string` + + + + + + + +## threat_category + +The category of a threat in Splunk UBA. + +`threat_category` + +* is optional +* type: `string` +* defined in this schema + +### threat_category Type + + +`string` + + + + + + diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 483997e2ca..8349735b1b 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -1,7 +1,6 @@ { "$id": "https://api.splunkresearch.com/schemas/detections.json", "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, "definitions": { "phantom": { "properties": { @@ -35,11 +34,9 @@ "splunk": { "properties": { "correlation_rule": { - "additionalProperties": false, "description": "Various fields to enhance usability in Enterprise Security", "properties": { "notable": { - "additionalProperties": false, "description": "Various fields associated with creating a notable event", "properties": { "nes_fields": { @@ -63,7 +60,6 @@ "type": "object" }, "risk": { - "additionalProperties": false, "description": "Fields associated with assigning risk to objects", "properties": { "risk_object": { @@ -71,7 +67,7 @@ "type": "string" }, "risk_object_type": { - "description": "The type of object to which you\u2019re assigning risk", + "description": "The type of object to which you are assigning risk", "items": { "enum": [ "system", @@ -98,7 +94,6 @@ "type": "object" }, "suppress": { - "additionalProperties": false, "description": "Fields associated with suppressing the creation of multiple alerts", "properties": { "suppress_fields": { @@ -120,7 +115,6 @@ "type": "object" }, "scheduling": { - "additionalProperties": false, "description": "Various fields to assist in scheduling the search", "properties": { "cron_schedule": { @@ -180,7 +174,6 @@ "baselines": { "description": "An array of the baseline objects to exectute before the detection ", "items": { - "additionalProperties": false, "properties": { "id": { "description": "UUID of the baseline object", @@ -222,7 +215,6 @@ "type": "string" }, "data_metadata": { - "additionalProperties": false, "description": "Information about the date being ingested", "properties": { "data_eventtypes": { @@ -337,7 +329,7 @@ ] }, "eli5": { - "description": "Explain it like I\u2019m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", "type": "string" }, "entities": { @@ -363,7 +355,6 @@ "resourceId", "session_id", "src_ip", - "src_ip", "src_mac", "src_user", "src", @@ -385,7 +376,6 @@ "investigations": { "description": "An array of the investigation objects to exectute on the detection results ", "items": { - "additionalProperties": false, "properties": { "id": { "description": "UUID of the baseline object", @@ -421,7 +411,6 @@ "maintainers": { "description": "An array of the current maintainers of the Analytic Story.", "items": { - "additionalProperties": false, "properties": { "company": { "description": "Company associated with the person maintaining this search", @@ -446,7 +435,6 @@ "type": "array" }, "mappings": { - "additionalProperties": false, "description": "Mappings to various industry standards and frameworks", "properties": { "cis20": { @@ -635,7 +623,6 @@ "Windows Management Instrumentation", "Windows Remote Management", "Winlogon Helper DLL", - "Initial Access", "Exploitation for Privilege Escalation" ] }, @@ -685,7 +672,6 @@ "original_authors": { "description": "A list of the original authors of the search", "items": { - "additionalProperties": false, "properties": { "company": { "description": "Company associated with the person who originally authored the search", @@ -729,7 +715,6 @@ "responses": { "description": "An array of the response objects to exectute on the detection results ", "items": { - "additionalProperties": false, "properties": { "id": { "description": "UUID of the baseline object", From bd4849a25609a1a5f5a46d1dbe5b26292229d2ff Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:05:07 -0400 Subject: [PATCH 40/74] updated spec and docs for investigations --- docs/investigations.spec.md | 915 +++++++++++++++++++++++++++++++ spec/v2/investigations.spec.json | 439 ++++++++------- 2 files changed, 1132 insertions(+), 222 deletions(-) create mode 100644 docs/investigations.spec.md diff --git a/docs/investigations.spec.md b/docs/investigations.spec.md new file mode 100644 index 0000000000..934ac9dc37 --- /dev/null +++ b/docs/investigations.spec.md @@ -0,0 +1,915 @@ + +# Investigative Search Manifest Schema + +``` +https://api.splunkresearch.com/schemas/investigations.json +``` + +The fields that make up the manifest of a version 2 investigative object + +| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In | +|----------|------------|--------|--------------|-------------------|-----------------------|------------| +| Can be instantiated | No | Experimental | No | Forbidden | Permitted | | + +# Investigative Search Manifest Properties + +| Property | Type | Required | Nullable | Defined by | +|----------|------|----------|----------|------------| +| [creation_date](#creation_date) | `string` | **Required** | No | Investigative Search Manifest (this schema) | +| [data_metadata](#data_metadata) | `object` | **Required** | No | Investigative Search Manifest (this schema) | +| [definitions](#definitions) | complex | Optional | No | Investigative Search Manifest (this schema) | +| [description](#description) | `string` | **Required** | No | Investigative Search Manifest (this schema) | +| [entities](#entities) | `enum[]` | Optional | No | Investigative Search Manifest (this schema) | +| [how_to_implement](#how_to_implement) | `string` | **Required** | No | Investigative Search Manifest (this schema) | +| [id](#id) | `string` | **Required** | No | Investigative Search Manifest (this schema) | +| [investigate](#investigate) | complex | **Required** | No | Investigative Search Manifest (this schema) | +| [maintainers](#maintainers) | `object[]` | **Required** | No | Investigative Search Manifest (this schema) | +| [modification_date](#modification_date) | `string` | **Required** | No | Investigative Search Manifest (this schema) | +| [name](#name) | `string` | Optional | No | Investigative Search Manifest (this schema) | +| [original_authors](#original_authors) | `object[]` | **Required** | No | Investigative Search Manifest (this schema) | +| [product_type](#product_type) | `enum` | **Required** | No | Investigative Search Manifest (this schema) | +| [spec_version](#spec_version) | `integer` | **Required** | No | Investigative Search Manifest (this schema) | +| [version](#version) | `string` | **Required** | No | Investigative Search Manifest (this schema) | +| `*` | any | Additional | Yes | this schema *allows* additional properties | + +## creation_date + +The date the story manifest was created + +`creation_date` + +* is **required** +* type: `string` +* defined in this schema + +### creation_date Type + + +`string` + + + + + + + +## data_metadata + +Information about the date being ingested + +`data_metadata` + +* is **required** +* type: `object` +* defined in this schema + +### data_metadata Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `data_eventtypes`| array | Optional | +| `data_models`| array | Optional | +| `data_source`| array | **Required** | +| `data_sourcetypes`| array | Optional | +| `providing_technologies`| array | **Required** | + + + +#### data_eventtypes + +A list of eventtypes, if any, used by this search + +`data_eventtypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_eventtypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_models + +A list of data models, if any, used by this search + +`data_models` + +* is optional +* type: `enum[]`* at least `0` items in the array + + +##### data_models Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of data models, if any, used by this search", + "items": { + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ], + "simpletype": "`enum`", + "meta:enum": { + "Alerts": "", + "Application_State": "", + "Authentication": "", + "Certificates": "", + "Change_Analysis": "", + "Change": "", + "Malware": "", + "Email": "", + "Identity_Management": "", + "Network_Resolution": "", + "Network_Traffic": "", + "Vulnerabilities": "", + "Web": "", + "Network_Sessions": "", + "Updates": "", + "Risk": "", + "Endpoint": "" + } + }, + "type": "array", + "minItems": 0, + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + +#### data_source + +A high-level description of the type of data needed for this search to complete + +`data_source` + +* is **required** +* type: `string[]`* at least `0` items in the array + + +##### data_source Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_sourcetypes + +The list of sourcetypes, if any, used by this search + +`data_sourcetypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_sourcetypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### providing_technologies + +A list of technologies that provide this data + +`providing_technologies` + +* is **required** +* type: `enum[]`* at least `0` items in the array + + +##### providing_technologies Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of technologies that provide this data", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften", + "OSquery" + ], + "simpletype": "`enum`", + "meta:enum": { + "Apache": "", + "AWS": "", + "Bro": "", + "Microsoft Windows": "", + "Linux": "", + "macOS": "", + "Netbackup": "", + "Splunk Enterprise": "", + "Splunk Enterprise Security": "", + "Splunk Stream": "", + "Active Directory": "", + "Bluecoat": "", + "Carbon Black Response": "", + "Carbon Black Protect": "", + "CrowdStrike Falcon": "", + "Microsoft Exchange": "", + "Nessus": "", + "Palo Alto Firewall": "", + "Qualys": "", + "Sysmon": "", + "Tanium": "", + "Ziften": "", + "OSquery": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + + + + +## definitions + + +`definitions` + +* is optional +* type: complex +* defined in this schema + +### definitions Type + +Unknown type ``. + +```json +{ + "phantom": { + "properties": { + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_display_name": { + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", + "type": "string" + }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "required": [ + "phantom_server", + "playbook_name", + "playbook_url", + "playbook_display_name" + ], + "type": "object" + }, + "splunk": { + "properties": { + "investigate_window": { + "additionalProperties": false, + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ], + "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for investgation.", + "type": "string" + } + }, + "required": [ + "search", + "investigate_window" + ], + "type": "object" + }, + "simpletype": "complex" +} +``` + + + + + +## description + +A description of what the search is designed to detect + +`description` + +* is **required** +* type: `string` +* defined in this schema + +### description Type + + +`string` + + + + + + + +## entities + +A list of entities that will used in the story flow or are relevant to the security investigation. + +`entities` + +* is optional +* type: `enum[]` +* at least `0` items in the array +* defined in this schema + +### entities Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", + "items": { + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ], + "simpletype": "`enum`", + "meta:enum": { + "accessKeyId": "", + "arn": "", + "awsRegion": "", + "bucketName": "", + "City": "", + "Country": "", + "dest_port": "", + "dest": "", + "event_id": "", + "instanceId": "", + "message_id": "", + "networkAclId": "", + "process_name": "", + "process": "", + "recipient": "", + "Region": "", + "resourceId": "", + "session_id": "", + "src_ip": "", + "src_mac": "", + "src_user": "", + "src": "", + "user": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + +## how_to_implement + +A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications + +`how_to_implement` + +* is **required** +* type: `string` +* defined in this schema + +### how_to_implement Type + + +`string` + + + + + + + +## id + +The unique identifier for the search + +`id` + +* is **required** +* type: `string` +* defined in this schema + +### id Type + + +`string` + + + + + + + +## investigate + + +`investigate` + +* is **required** +* type: complex +* defined in this schema + +### investigate Type + + +**One** of the following *conditions* need to be fulfilled. + + +#### Condition 1 + + +* []() – `#/definitions/splunk` + + +#### Condition 2 + + +* []() – `#/definitions/phantom` + + + + + + +## maintainers + +An array of the current maintainers of the Analytic Story. + +`maintainers` + +* is **required** +* type: `object[]` +* defined in this schema + +### maintainers Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person maintaining this search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person maintaining this search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person maintaining this search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## modification_date + +The date of the most recent modification to the search + +`modification_date` + +* is **required** +* type: `string` +* defined in this schema + +### modification_date Type + + +`string` + + + + + + + +## name + +The name of the search + +`name` + +* is optional +* type: `string` +* defined in this schema + +### name Type + + +`string` + + + + + + + +## original_authors + +A list of the original authors of the search + +`original_authors` + +* is **required** +* type: `object[]` +* defined in this schema + +### original_authors Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person who originally authored the search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person who originally authored the search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person who originally authored the search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## product_type + +Type of product that will support this investigate object. + +`product_type` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#product_type-known-values). + +### product_type Known Values +| Value | Description | +|-------|-------------| +| `phantom` | | +| `splunk` | | +| `uba` | | + + + + +## spec_version + +The version of the investigative search specification this manifest follows + +`spec_version` + +* is **required** +* type: `integer` +* defined in this schema + +### spec_version Type + + +`integer` + + + + + + + +## version + +The version of the search + +`version` + +* is **required** +* type: `string` +* defined in this schema + +### version Type + + +`string` + + + + + + diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index 927fe92eb7..e1ccf1c5cf 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -1,225 +1,108 @@ { "$id": "https://api.splunkresearch.com/schemas/investigations.json", "$schema": "http://json-schema.org/draft-07/schema#", - "description": "The fields that make up the manifest of a version 1 investigative earch", + "description": "The fields that make up the manifest of a version 2 investigative object", "properties": { - "additionalProperties": false, + "creation_date": { + "description": "The date the story manifest was created", + "type": "string" + }, "data_metadata": { - "creation_date": { - "description": "The date the story manifest was created", - "type": "string" - }, "description": "Information about the date being ingested", - "entities": { - "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", - "items": { - "enum": [ - "accessKeyId", - "arn", - "awsRegion", - "bucketName", - "City", - "Country", - "dest_port", - "dest", - "event_id", - "instanceId", - "message_id", - "networkAclId", - "process_name", - "process", - "recipient", - "Region", - "resourceId", - "session_id", - "src_ip", - "src_ip", - "src_mac", - "src_user", - "src", - "user" - ] - }, - "minItems": 0, - "type": "array", - "uniqueItems": true - }, - "how_to_implement": { - "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", - "type": "string" - }, - "investigate": { - "oneOf": [ - { - "$ref": "#/definitions/splunk" - }, - { - "$ref": "#/definitions/phantom" - } - ] - }, - "maintainers": { - "description": "An array of the current maintainers of the Analytic Story.", - "items": { - "additionalProperties": false, - "properties": { - "company": { - "description": "Company associated with the person maintaining this search", - "type": "string" - }, - "email": { - "description": "Email address of the person maintaining this search", - "type": "string" - }, - "name": { - "description": "Name of the person maintaining this search", - "type": "string" - } - }, - "required": [ - "name", - "email", - "company" - ], - "type": "object" - }, - "type": "array" - }, - "modification_date": { - "description": "The date of the most recent modification to the search", - "type": "string" - }, - "original_authors": { - "description": "A list of the original authors of the search", - "items": { - "additionalProperties": false, - "properties": { - "company": { - "description": "Company associated with the person who originally authored the search", - "type": "string" - }, - "email": { - "description": "Email address of the person who originally authored the search", - "type": "string" - }, - "name": { - "description": "Name of the person who originally authored the search", - "type": "string" - } + "properties": { + "data_eventtypes": { + "description": "A list of eventtypes, if any, used by this search", + "items": { + "type": "string" }, - "required": [ - "name", - "email", - "company" - ], - "type": "object" + "minItems": 0, + "type": "array", + "uniqueItems": true }, - "type": "array" - }, - "properties": { - "additionalProperties": false, "data_models": { - "data_eventtypes": { - "description": "A list of eventtypes, if any, used by this search", - "items": { - "type": "string" - }, - "minItems": 0, - "type": "array", - "uniqueItems": true - }, - "data_source": { - "description": "A high-level description of the type of data needed for this search to complete", - "items": { - "type": "string" - }, - "minItems": 0, - "type": "array", - "uniqueItems": true - }, - "data_sourcetypes": { - "description": "The list of sourcetypes, if any, used by this search", - "items": { - "type": "string" - }, - "minItems": 0, - "type": "array", - "uniqueItems": true - }, "description": "A list of data models, if any, used by this search", "items": { - "items": { - "enum": [ - "Alerts", - "Application_State", - "Authentication", - "Certificates", - "Change_Analysis", - "Change", - "Malware", - "Email", - "Identity_Management", - "Network_Resolution", - "Network_Traffic", - "Vulnerabilities", - "Web", - "Network_Sessions", - "Updates", - "Risk", - "Endpoint" - ] - }, - "minItems": 0, - "uniqueItems": true + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, - "providing_technologies": { - "description": "A list of technologies that provide this data", - "items": { - "enum": [ - "Apache", - "AWS", - "Bro", - "Microsoft Windows", - "Linux", - "macOS", - "Netbackup", - "Splunk Enterprise", - "Splunk Enterprise Security", - "Splunk Stream", - "Active Directory", - "Bluecoat", - "Carbon Black Response", - "Carbon Black Protect", - "CrowdStrike Falcon", - "Microsoft Exchange", - "Nessus", - "Palo Alto Firewall", - "Qualys", - "Sysmon", - "Tanium", - "Ziften" - ] - }, - "minItems": 0, - "type": "array", - "uniqueItems": true + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "data_source": { + "description": "A high-level description of the type of data needed for this search to complete", + "items": { + "type": "string" }, - "type": "array" + "minItems": 0, + "type": "array", + "uniqueItems": true }, - "required": [ - "data_source", - "providing_technologies" - ] - }, - "spec_version": { - "description": "The version of the investigative search specification this manifest follows", - "type": "integer" + "data_sourcetypes": { + "description": "The list of sourcetypes, if any, used by this search", + "items": { + "type": "string" + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "providing_technologies": { + "description": "A list of technologies that provide this data", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften", + "OSquery" + ] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + } }, - "type": "object", - "version": { - "description": "The version of the search", - "type": "string" - } + "required": [ + "data_source", + "providing_technologies" + ], + "type": "object" }, "definitions": { "phantom": { @@ -294,14 +177,119 @@ "description": "A description of what the search is designed to detect", "type": "string" }, + "entities": { + "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", + "items": { + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "how_to_implement": { + "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "type": "string" + }, "id": { "description": "The unique identifier for the search", "type": "string" }, + "investigate": { + "oneOf": [ + { + "$ref": "#/definitions/splunk" + }, + { + "$ref": "#/definitions/phantom" + } + ] + }, + "maintainers": { + "description": "An array of the current maintainers of the Analytic Story.", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person maintaining this search", + "type": "string" + }, + "email": { + "description": "Email address of the person maintaining this search", + "type": "string" + }, + "name": { + "description": "Name of the person maintaining this search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, + "modification_date": { + "description": "The date of the most recent modification to the search", + "type": "string" + }, "name": { "description": "The name of the search", "type": "string" }, + "original_authors": { + "description": "A list of the original authors of the search", + "items": { + "additionalProperties": false, + "properties": { + "company": { + "description": "Company associated with the person who originally authored the search", + "type": "string" + }, + "email": { + "description": "Email address of the person who originally authored the search", + "type": "string" + }, + "name": { + "description": "Name of the person who originally authored the search", + "type": "string" + } + }, + "required": [ + "name", + "email", + "company" + ], + "type": "object" + }, + "type": "array" + }, "product_type": { "description": "Type of product that will support this investigate object.", "enum": [ @@ -310,22 +298,29 @@ "uba" ] }, - "required": [ - "creation_date", - "data_metadata", - "fields_required", - "how_to_implement", - "maintainers", - "modification_date", - "original_authors", - "description", - "id", - "product_type", - "spec_version", - "version", - "investigate" - ] + "spec_version": { + "description": "The version of the investigative search specification this manifest follows", + "type": "integer" + }, + "version": { + "description": "The version of the search", + "type": "string" + } }, + "required": [ + "creation_date", + "data_metadata", + "how_to_implement", + "maintainers", + "modification_date", + "original_authors", + "description", + "id", + "product_type", + "spec_version", + "version", + "investigate" + ], "title": "Investigative Search Manifest", "type": "object" } From b6ee0378cada5aa045141a1f7597fad28ce51da3 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:08:17 -0400 Subject: [PATCH 41/74] docs and updated response schema --- docs/responses.spec.md | 1030 +++++++++++++++++++++++++++++++++++ spec/v2/responses.spec.json | 6 +- 2 files changed, 1032 insertions(+), 4 deletions(-) create mode 100644 docs/responses.spec.md diff --git a/docs/responses.spec.md b/docs/responses.spec.md new file mode 100644 index 0000000000..e6a345f849 --- /dev/null +++ b/docs/responses.spec.md @@ -0,0 +1,1030 @@ + +# Response Manifest Schema + +``` +https://api.splunkresearch.com/schemas/investigations.json +``` + +The fields that make up the manifest of a version 1 reponse spec + +| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In | +|----------|------------|--------|--------------|-------------------|-----------------------|------------| +| Can be instantiated | Yes | Experimental | No | Forbidden | Forbidden | | + +# Response Manifest Properties + +| Property | Type | Required | Nullable | Defined by | +|----------|------|----------|----------|------------| +| [creation_date](#creation_date) | `string` | **Required** | No | Response Manifest (this schema) | +| [data_metadata](#data_metadata) | `object` | **Required** | No | Response Manifest (this schema) | +| [description](#description) | `string` | **Required** | No | Response Manifest (this schema) | +| [entities](#entities) | `enum[]` | Optional | No | Response Manifest (this schema) | +| [fields_required](#fields_required) | `string[]` | Optional | No | Response Manifest (this schema) | +| [how_to_implement](#how_to_implement) | `string` | **Required** | No | Response Manifest (this schema) | +| [id](#id) | `string` | **Required** | No | Response Manifest (this schema) | +| [maintainers](#maintainers) | `object[]` | **Required** | No | Response Manifest (this schema) | +| [modification_date](#modification_date) | `string` | **Required** | No | Response Manifest (this schema) | +| [name](#name) | `string` | Optional | No | Response Manifest (this schema) | +| [original_authors](#original_authors) | `object[]` | **Required** | No | Response Manifest (this schema) | +| [product_type](#product_type) | `enum` | **Required** | No | Response Manifest (this schema) | +| [response](#response) | complex | **Required** | No | Response Manifest (this schema) | +| [spec_version](#spec_version) | `integer` | **Required** | No | Response Manifest (this schema) | +| [version](#version) | `string` | **Required** | No | Response Manifest (this schema) | + +## creation_date + +The date the story manifest was created + +`creation_date` + +* is **required** +* type: `string` +* defined in this schema + +### creation_date Type + + +`string` + + + + + + + +## data_metadata + +Information about the date being used to run the response + +`data_metadata` + +* is **required** +* type: `object` +* defined in this schema + +### data_metadata Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `data_eventtypes`| array | Optional | +| `data_models`| array | Optional | +| `data_source`| array | **Required** | +| `data_sourcetypes`| array | Optional | +| `providing_technologies`| array | **Required** | + + + +#### data_eventtypes + +A list of eventtypes, if any, used by this search + +`data_eventtypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_eventtypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_models + +A list of data models, if any, used by this search + +`data_models` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_models Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_source + +A high-level description of the type of data needed for this search to complete + +`data_source` + +* is **required** +* type: `string[]`* at least `0` items in the array + + +##### data_source Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### data_sourcetypes + +The list of sourcetypes, if any, used by this search + +`data_sourcetypes` + +* is optional +* type: `string[]`* at least `0` items in the array + + +##### data_sourcetypes Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + + + +#### providing_technologies + +A list of technologies that provide this data + +`providing_technologies` + +* is **required** +* type: `enum[]`* at least `0` items in the array + + +##### providing_technologies Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of technologies that provide this data", + "items": { + "enum": [ + "Apache", + "AWS", + "Bro", + "Microsoft Windows", + "Linux", + "macOS", + "Netbackup", + "Splunk Enterprise", + "Splunk Enterprise Security", + "Splunk Stream", + "Active Directory", + "Bluecoat", + "Carbon Black Response", + "Carbon Black Protect", + "CrowdStrike Falcon", + "Microsoft Exchange", + "Nessus", + "Palo Alto Firewall", + "Qualys", + "Sysmon", + "Tanium", + "Ziften" + ], + "simpletype": "`enum`", + "meta:enum": { + "Apache": "", + "AWS": "", + "Bro": "", + "Microsoft Windows": "", + "Linux": "", + "macOS": "", + "Netbackup": "", + "Splunk Enterprise": "", + "Splunk Enterprise Security": "", + "Splunk Stream": "", + "Active Directory": "", + "Bluecoat": "", + "Carbon Black Response": "", + "Carbon Black Protect": "", + "CrowdStrike Falcon": "", + "Microsoft Exchange": "", + "Nessus": "", + "Palo Alto Firewall": "", + "Qualys": "", + "Sysmon": "", + "Tanium": "", + "Ziften": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + + + + + + +## description + +A description of what this reponse object will do + +`description` + +* is **required** +* type: `string` +* defined in this schema + +### description Type + + +`string` + + + + + + + +## entities + +A list of entities that is either an input or an output for the security workflow. + +`entities` + +* is optional +* type: `enum[]` +* at least `0` items in the array +* defined in this schema + +### entities Type + + +Array type: `enum[]` + +All items must be of the type: +Unknown type ``. + +```json +{ + "description": "A list of entities that is either an input or an output for the security workflow.", + "items": { + "enum": [ + "accessKeyId", + "arn", + "awsRegion", + "bucketName", + "City", + "Country", + "dest_port", + "dest", + "event_id", + "instanceId", + "message_id", + "networkAclId", + "process_name", + "process", + "recipient", + "Region", + "resourceId", + "session_id", + "src_ip", + "src_mac", + "src_user", + "src", + "user" + ], + "simpletype": "`enum`", + "meta:enum": { + "accessKeyId": "", + "arn": "", + "awsRegion": "", + "bucketName": "", + "City": "", + "Country": "", + "dest_port": "", + "dest": "", + "event_id": "", + "instanceId": "", + "message_id": "", + "networkAclId": "", + "process_name": "", + "process": "", + "recipient": "", + "Region": "", + "resourceId": "", + "session_id": "", + "src_ip": "", + "src_mac": "", + "src_user": "", + "src": "", + "user": "" + } + }, + "minItems": 0, + "type": "array", + "uniqueItems": true, + "simpletype": "`enum[]`" +} +``` + + + + + + + + +## fields_required + +A list of fields that need to be in the result of the detection search for the search to be successful + +`fields_required` + +* is optional +* type: `string[]` +* at least `0` items in the array +* defined in this schema + +### fields_required Type + + +Array type: `string[]` + +All items must be of the type: +`string` + + + + + + + + + + +## how_to_implement + +A discussion on how to implement this reponse object, the config files, etc + +`how_to_implement` + +* is **required** +* type: `string` +* defined in this schema + +### how_to_implement Type + + +`string` + + + + + + + +## id + +The unique identifier for the search + +`id` + +* is **required** +* type: `string` +* defined in this schema + +### id Type + + +`string` + + + + + + + +## maintainers + +An array of the current maintainers of the reponse spec + +`maintainers` + +* is **required** +* type: `object[]` +* defined in this schema + +### maintainers Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person maintaining this search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person maintaining this search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person maintaining this search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## modification_date + +The date of the most recent modification to the search + +`modification_date` + +* is **required** +* type: `string` +* defined in this schema + +### modification_date Type + + +`string` + + + + + + + +## name + +The name of the search + +`name` + +* is optional +* type: `string` +* defined in this schema + +### name Type + + +`string` + + + + + + + +## original_authors + +A list of the original authors of the reponse object + +`original_authors` + +* is **required** +* type: `object[]` +* defined in this schema + +### original_authors Type + + +Array type: `object[]` + +All items must be of the type: +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `company`| string | **Required** | +| `email`| string | **Required** | +| `name`| string | **Required** | + + + +#### company + +Company associated with the person who originally authored the search + +`company` + +* is **required** +* type: `string` + +##### company Type + + +`string` + + + + + + + + + +#### email + +Email address of the person who originally authored the search + +`email` + +* is **required** +* type: `string` + +##### email Type + + +`string` + + + + + + + + + +#### name + +Name of the person who originally authored the search + +`name` + +* is **required** +* type: `string` + +##### name Type + + +`string` + + + + + + + + + + + + + + + +## product_type + +The type of detection + +`product_type` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#product_type-known-values). + +### product_type Known Values +| Value | Description | +|-------|-------------| +| `splunk` | | +| `phantom` | | + + + + +## response + + +`response` + +* is **required** +* type: complex +* defined in this schema + +### response Type + + +**One** of the following *conditions* need to be fulfilled. + + +#### Condition 1 + + +* []() – `#/definitions/splunk` + + +#### Condition 2 + + +* []() – `#/definitions/phantom` + + + + + + +## spec_version + +The version of the investigative search specification this manifest follows + +`spec_version` + +* is **required** +* type: `integer` +* defined in this schema + +### spec_version Type + + +`integer` + + + + + + + +## version + +The version of the search + +`version` + +* is **required** +* type: `string` +* defined in this schema + +### version Type + + +`string` + + + + + + + +# Response Manifest Definitions + +| Property | Type | Group | +|----------|------|-------| +| [investigate_window](#investigate_window) | `object` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/splunk` | +| [phantom_server](#phantom_server) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/phantom` | +| [playbook_display_name](#playbook_display_name) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/phantom` | +| [playbook_name](#playbook_name) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/phantom` | +| [playbook_url](#playbook_url) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/phantom` | +| [search](#search) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/splunk` | +| [sensitivity](#sensitivity) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/phantom` | +| [severity](#severity) | `string` | `https://api.splunkresearch.com/schemas/investigations.json#/definitions/phantom` | + +## investigate_window + +The fields associated on when this search should run relative to the detection event + +`investigate_window` + +* is optional +* type: `object` +* defined in this schema + +### investigate_window Type + + +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `earliest_time_offset`| integer | **Required** | +| `latest_time_offset`| integer | **Required** | + + + +#### earliest_time_offset + +The number of seconds into the past from the event time the search should cover + +`earliest_time_offset` + +* is **required** +* type: `integer` + +##### earliest_time_offset Type + + +`integer` + + + + + + + + + +#### latest_time_offset + +The number of seconds into the future from the event time the search should cover + +`latest_time_offset` + +* is **required** +* type: `integer` + +##### latest_time_offset Type + + +`integer` + + + + + + + + + + + + +## phantom_server + +IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname) + +`phantom_server` + +* is optional +* type: `string` +* defined in this schema + +### phantom_server Type + + +`string` + + + + + + + +## playbook_display_name + +Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment + +`playbook_display_name` + +* is optional +* type: `string` +* defined in this schema + +### playbook_display_name Type + + +`string` + + + + + + + +## playbook_name + +Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment + +`playbook_name` + +* is optional +* type: `string` +* defined in this schema + +### playbook_name Type + + +`string` + + + + + + + +## playbook_url + +Url of the playbook on Phantom website. + +`playbook_url` + +* is optional +* type: `string` +* defined in this schema + +### playbook_url Type + + +`string` + + + + + + + +## search + +A reponse action exectued in splunk + +`search` + +* is optional +* type: `string` +* defined in this schema + +### search Type + + +`string` + + + + + + + +## sensitivity + +TLP colors (White, Green, Amber or Red) + +`sensitivity` + +* is optional +* type: `string` +* defined in this schema + +### sensitivity Type + + +`string` + + + + + + + +## severity + +Severity in phantom (High, Medium, Low) + +`severity` + +* is optional +* type: `string` +* defined in this schema + +### severity Type + + +`string` + + + + + + diff --git a/spec/v2/responses.spec.json b/spec/v2/responses.spec.json index 8609b9d448..0e1c788241 100644 --- a/spec/v2/responses.spec.json +++ b/spec/v2/responses.spec.json @@ -182,7 +182,6 @@ "resourceId", "session_id", "src_ip", - "src_ip", "src_mac", "src_user", "src", @@ -301,7 +300,7 @@ "required": [ "creation_date", "data_metadata", - "fields_required", + "entity", "how_to_implement", "maintainers", "modification_date", @@ -310,10 +309,9 @@ "description", "id", "product_type", - "investigate_window", "spec_version", "version", - "investigate" + "response" ], "title": "Response Manifest", "type": "object" From a0119654985e9762db8d5e85c034ee8be922a71a Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:16:26 -0400 Subject: [PATCH 42/74] added docs readme --- docs/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 docs/README.md diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 0000000000..75c05f2d47 --- /dev/null +++ b/docs/README.md @@ -0,0 +1,12 @@ +# Schema Documentation +-- + +* [Story](docs/story.spec.md) – `https://api.splunkresearch.com/spec/story.spec.json` +* [Detections](docs/detections.spec.md) – `https://api.splunkresearch.com/spec/detections.spec.json` +* [Investigations](docs/investigations.spec.md) – `https://api.splunkresearch.com/spec/investigations.spec.json` +* [Responses](docs/responses.spec.md) – `https://api.splunkresearch.com/spec/responses.spec.json` +* [Baselines](docs/baselines.spec.md) – `https://api.splunkresearch.com/spec/baselines.spec.json` + + + + From bc405a63adebe8b91bc912fb5ddba7f3b92308cb Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:17:30 -0400 Subject: [PATCH 43/74] updated readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 90900ac359..fba0f87fc8 100644 --- a/README.md +++ b/README.md @@ -39,4 +39,4 @@ To test a local change to CI or build make sure you are running docker and then To generate docs from schema automatically 1. install https://github.com/adobe/jsonschema2md -2. jsonschema2md -d spec/v2/detections.json.spec -o docs +2. `jsonschema2md -d spec/v2/detections.json.spec -o docs` From 66f1c68311bd073040d16027dce5f9186a2aad0e Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:19:31 -0400 Subject: [PATCH 44/74] updated readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index fba0f87fc8..84a315e2f3 100644 --- a/README.md +++ b/README.md @@ -26,9 +26,9 @@ Can be consumed using: * [src/](src/) - splunk content app source files, includes lookups, binaries, and defaul config files * [bin/](bin/) - where all binaries to produce, and test content lives * [spec/](spec/) - location of all spec files that describe ESCU content +* [docs/](docs/) - documentation for all of the spec files # Developing - For getting pre-commit checks, install the hooks see below for steps: 1. Install circleci [CLI Tool](https://circleci.com/docs/2.0/local-cli/#installation) 2. create virtualenv and install requirements: `virtualenv venv && source venv/bin/activate && pip install -r requirements.txt` From 6c44cc6054ddf966c418ed9f9e847e5bf0f3f9fe Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:20:36 -0400 Subject: [PATCH 45/74] updated readme --- docs/README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/README.md b/docs/README.md index 75c05f2d47..236bebe2c8 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,11 +1,11 @@ # Schema Documentation -- -* [Story](docs/story.spec.md) – `https://api.splunkresearch.com/spec/story.spec.json` -* [Detections](docs/detections.spec.md) – `https://api.splunkresearch.com/spec/detections.spec.json` -* [Investigations](docs/investigations.spec.md) – `https://api.splunkresearch.com/spec/investigations.spec.json` -* [Responses](docs/responses.spec.md) – `https://api.splunkresearch.com/spec/responses.spec.json` -* [Baselines](docs/baselines.spec.md) – `https://api.splunkresearch.com/spec/baselines.spec.json` +* [Story](story.spec.md) – `https://api.splunkresearch.com/spec/story.spec.json` +* [Detections](detections.spec.md) – `https://api.splunkresearch.com/spec/detections.spec.json` +* [Investigations](investigations.spec.md) – `https://api.splunkresearch.com/spec/investigations.spec.json` +* [Responses](responses.spec.md) – `https://api.splunkresearch.com/spec/responses.spec.json` +* [Baselines](baselines.spec.md) – `https://api.splunkresearch.com/spec/baselines.spec.json` From 57269d8cdb38f15456fc35b389639ceaf7a32d1d Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 27 Mar 2019 23:35:27 -0400 Subject: [PATCH 46/74] added example to story --- docs/story.spec.md | 6 ++++++ spec/v2/story.spec.json | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/story.spec.md b/docs/story.spec.md index 9af7cec781..3a14126951 100644 --- a/docs/story.spec.md +++ b/docs/story.spec.md @@ -239,6 +239,12 @@ A unique identifier for the Analytic Story +### id Example + +```json +"8169f17b-ef68-4b59-aae8-5869073014e1" +``` + ## maintainers diff --git a/spec/v2/story.spec.json b/spec/v2/story.spec.json index 47b963d1eb..41975602f1 100644 --- a/spec/v2/story.spec.json +++ b/spec/v2/story.spec.json @@ -65,7 +65,9 @@ }, "id": { "description": "A unique identifier for the Analytic Story", - "example": "8169f17b-ef68-4b59-aae8-5869073014e1", + "examples": [ + "8169f17b-ef68-4b59-aae8-5869073014e1" + ], "format": "uuid", "type": "string" }, From a5d69e8acce2cb1aa0f8a3c4c74f1653e9718a80 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 28 Mar 2019 10:55:53 -0400 Subject: [PATCH 47/74] update veuve categories in story: --- spec/v2/example/story_dns_hijack.json.example | 3 +- spec/v2/story.spec.json | 55 ++++++++++++++++--- 2 files changed, 49 insertions(+), 9 deletions(-) diff --git a/spec/v2/example/story_dns_hijack.json.example b/spec/v2/example/story_dns_hijack.json.example index 8def8bd053..3328c8d691 100644 --- a/spec/v2/example/story_dns_hijack.json.example +++ b/spec/v2/example/story_dns_hijack.json.example @@ -1,5 +1,6 @@ { - "category": "Malware", + "category": ["Malware","Other"], + "usecase": "Advanced Threat Detection", "channel": "ESCU", "creation_date": "2017-11-21", "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", diff --git a/spec/v2/story.spec.json b/spec/v2/story.spec.json index 41975602f1..01ac342a00 100644 --- a/spec/v2/story.spec.json +++ b/spec/v2/story.spec.json @@ -10,14 +10,42 @@ "properties": { "category": { "description": "The category to which the Analytic Story belongs", - "enum": [ - "Abuse", - "Adversary Tactics", - "Best Practices", - "Cloud Security", - "Malware", - "Vulnerability" - ] + "items": { + "enum": [ + "Abuse", + "Account Compromise", + "Account Sharing", + "Adversary Tactics", + "Best Practices", + "Cloud Security", + "Command and Control", + "Compliance", + "Data Exfiltration", + "Denial of Service", + "Endpoint Compromise", + "GDPR", + "IAM Analytics", + "Insider Threat", + "Lateral Movement", + "Malware", + "Network Attack", + "Operations", + "Other", + "Privilege Escalation", + "Phishing", + "Ransomware", + "SaaS", + "Scanning", + "Shadow IT", + "Threat Intelligence", + "Unauthorized Software", + "Vulnerability", + "Web Attack" + ] + }, + "minItems": 0, + "type": "array", + "uniqueItems": true }, "channel": { "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", @@ -150,6 +178,16 @@ "description": "The version of the Analytic Story specification this manifest follows", "type": "integer" }, + "usecase": { + "description": "The usecase to which the Analytic Story belongs to.", + "enum": [ + "Security Monitoring", + "Advanced Threat Detection", + "Insider Threat", + "Compliance", + "Fraud Detection" + ] + }, "version": { "description": "The version of the Analytic Story", "type": "string" @@ -158,6 +196,7 @@ "required": [ "id", "category", + "usecase", "name", "description", "detections", From fe3e471ffab9da6c24bff109f07efb52138c26ca Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 28 Mar 2019 12:00:14 -0400 Subject: [PATCH 48/74] validate story skeleton --- bin/validate.py | 90 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 bin/validate.py diff --git a/bin/validate.py b/bin/validate.py new file mode 100644 index 0000000000..47c2e99cc6 --- /dev/null +++ b/bin/validate.py @@ -0,0 +1,90 @@ +#!/usr/bin/python + +''' +Validates Manifest file under the security-content repo for correctness. +''' + +import glob +import json +import jsonschema +import sys +import argparse +from os import path + + +def validate_story(REPO_PATH, verbose): + ''' Validates Stories''' + + # retrive + v1_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v1/analytic_story.json.spec') + try: + v1_schema = json.loads(open(v1_schema_file, 'rb').read()) + except IOError: + print "Error reading version 1 story schema file {0}".format(v1_schema_file) + + v2_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v2/story.spec.json') + try: + v2_schema = json.loads(open(v2_schema_file, 'rb').read()) + except IOError: + print "Error reading version 2 story schema file {0}".format(v2_schema_file) + + error = False + story_manifest_files = path.join(path.expanduser(REPO_PATH), "stories/*.json") + + for story_manifest_file in glob.glob(story_manifest_files): + if verbose: + print "processing story {0}".format(story_manifest_file) + + # read in each story + try: + story = json.loads( + open(story_manifest_file, 'r').read()) + except IOError: + print "Error reading {0}".format(story_manifest_file) + error = True + continue + + # validate v1 stories + if story['spec_version'] == 1: + try: + jsonschema.validate(instance=story, schema=v1_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print story_manifest_file + print json_ve.message + error = True + continue + + elif story['spec_version'] == 2: + try: + jsonschema.validate(instance=story, schema=v2_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print story_manifest_file + print json_ve.message + error = True + continue + + else: + print "Story: {0} does not contain a spec_version which is required".format(story_manifest_file) + error = True + continue + + return error + + +if __name__ == "__main__": + # grab arguments + parser = argparse.ArgumentParser(description="validates security content manifest files", epilog=""" + Validates security manifest for correctness, adhering to spec and other common items.""") + parser.add_argument("-p", "--path", required=True, help="path to security-security content repo") + parser.add_argument("-v", "--verbose", required=False, action='store_true', help="prints verbose output") + # parse them + args = parser.parse_args() + REPO_PATH = args.path + verbose = args.verbose + + error = validate_story(REPO_PATH, verbose) + + if error: + sys.exit("Errors found") + else: + print "No errors found" From 33eff9361cf7bcd3c9d1de83d2e8d028afed5002 Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 28 Mar 2019 12:16:08 -0400 Subject: [PATCH 49/74] adding logic for checking story content --- bin/validate.py | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/bin/validate.py b/bin/validate.py index 47c2e99cc6..63c745cfdb 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -11,6 +11,33 @@ import argparse from os import path +ALL_UUIDS = [] + + +def validate_story_content(story): + ''' Validate that the content of a story manifest is correct''' + errors = [] + + if story['id'] == '': + errors.append('ERROR: Blank ID') + + if story['id'] in ALL_UUIDS: + errors.append('ERROR: Duplicate UUID found: %s' % story['id']) + else: + ALL_UUIDS.append(story['id']) + + try: + story['description'].encode('ascii') + except UnicodeEncodeError: + errors.append("description not ascii") + + try: + story['narrative'].encode('ascii') + except UnicodeEncodeError: + errors.append("narrative not ascii") + + return errors + def validate_story(REPO_PATH, verbose): ''' Validates Stories''' @@ -44,7 +71,7 @@ def validate_story(REPO_PATH, verbose): error = True continue - # validate v1 stories + # validate v1 and v2 stories against spec if story['spec_version'] == 1: try: jsonschema.validate(instance=story, schema=v1_schema) @@ -68,6 +95,14 @@ def validate_story(REPO_PATH, verbose): error = True continue + # now lets validate the content + story_errors = validate_story_content(story) + if story_errors: + error = True + for err in story_errors: + print path.basename(story_manifest_file) + print "\t%s" % err + return error From bdbe20f992ab6f1f7e6cfd32d27e382ddfbf7b03 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 28 Mar 2019 12:23:29 -0400 Subject: [PATCH 50/74] detection spec update --- spec/v2/detections.spec.json | 291 +++++++++++++++--- .../v2/example/detection_phantom.json.example | 33 +- spec/v2/example/detection_splunk.json.example | 18 +- spec/v2/example/story_dns_hijack.json.example | 8 +- 4 files changed, 290 insertions(+), 60 deletions(-) diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 8349735b1b..1227fd5fb2 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -4,14 +4,117 @@ "definitions": { "phantom": { "properties": { + "correlation_rule": { + "description": "Various fields to enhance usability in Enterprise Security", + "properties": { + "notable": { + "description": "Various fields associated with creating a notable event", + "properties": { + "nes_fields": { + "description": "A list of suggested fields to be used for notable-event suppression", + "type": "string" + }, + "rule_description": { + "description": "Description of the notable event that will display in Incident Review", + "type": "string" + }, + "rule_title": { + "description": "Title of the notable event that will display in Incident Review", + "type": "string" + } + }, + "required": [ + "rule_description", + "rule_title", + "nes_fields" + ], + "type": "object" + }, + "risk": { + "description": "Fields associated with assigning risk to objects", + "properties": { + "risk_object": { + "description": "TThe field to which you are assigning risk", + "type": "string" + }, + "risk_object_type": { + "description": "The type of object to which you are assigning risk", + "items": { + "enum": [ + "system", + "user", + "other" + ], + "type": "string" + }, + "maxItems": 1, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "risk_score": { + "description": "Score assigned to risk_object", + "type": "integer" + } + }, + "required": [ + "risk_score", + "risk_object", + "risk_object_type" + ], + "type": "object" + }, + "scheduling": { + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, + "search": { + "description": "The search that will trigger phantom playbook", + "type": "string" + }, + "suppress": { + "description": "Fields associated with suppressing the creation of multiple alerts", + "properties": { + "suppress_fields": { + "description": "The fields to base the suppression on", + "type": "string" + }, + "suppress_period": { + "description": "The length of time the suppression should be in effect", + "type": "string" + } + }, + "required": [ + "suppress_fields", + "suppress_period" + ], + "type": "object" + } + }, + "required": [ + "search", + "scheduling" + ], + "type": "object" + }, "phantom_server": { "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", "type": "string" }, - "playbook_display_name": { - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", - "type": "string" - }, "playbook_name": { "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", "type": "string" @@ -29,9 +132,125 @@ "type": "string" } }, + "required": [ + "correlation_rule", + "playbook_name", + "phantom_server", + "playbook_url" + ], "type": "object" }, "splunk": { + "correlation_rule": { + "description": "Various fields to enhance usability in Enterprise Security", + "properties": { + "notable": { + "description": "Various fields associated with creating a notable event", + "properties": { + "nes_fields": { + "description": "A list of suggested fields to be used for notable-event suppression", + "type": "string" + }, + "rule_description": { + "description": "Description of the notable event that will display in Incident Review", + "type": "string" + }, + "rule_title": { + "description": "Title of the notable event that will display in Incident Review", + "type": "string" + } + }, + "required": [ + "rule_description", + "rule_title", + "nes_fields" + ], + "type": "object" + }, + "risk": { + "description": "Fields associated with assigning risk to objects", + "properties": { + "risk_object": { + "description": "TThe field to which you are assigning risk", + "type": "string" + }, + "risk_object_type": { + "description": "The type of object to which you are assigning risk", + "items": { + "enum": [ + "system", + "user", + "other" + ], + "type": "string" + }, + "maxItems": 1, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "risk_score": { + "description": "Score assigned to risk_object", + "type": "integer" + } + }, + "required": [ + "risk_score", + "risk_object", + "risk_object_type" + ], + "type": "object" + }, + "scheduling": { + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, + "search": { + "description": "The search that will trigger phantom playbook", + "type": "string" + }, + "suppress": { + "description": "Fields associated with suppressing the creation of multiple alerts", + "properties": { + "suppress_fields": { + "description": "The fields to base the suppression on", + "type": "string" + }, + "suppress_period": { + "description": "The length of time the suppression should be in effect", + "type": "string" + } + }, + "required": [ + "suppress_fields", + "suppress_period" + ], + "type": "object" + } + }, + "required": [ + "search", + "scheduling" + ], + "type": "object" + }, + "type": "object" + }, + "uba": { "properties": { "correlation_rule": { "description": "Various fields to enhance usability in Enterprise Security", @@ -93,6 +312,28 @@ ], "type": "object" }, + "scheduling": { + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk", + "type": "string" + }, "suppress": { "description": "Fields associated with suppressing the creation of multiple alerts", "properties": { @@ -112,35 +353,12 @@ "type": "object" } }, + "required": [ + "search", + "scheduling" + ], "type": "object" }, - "scheduling": { - "description": "Various fields to assist in scheduling the search", - "properties": { - "cron_schedule": { - "description": "Schedule of the search in cron format", - "type": "string" - }, - "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" - }, - "latest_time": { - "description": "The latest time tes search should run against in Splunk format", - "type": "string" - } - }, - "type": "object" - }, - "search": { - "description": "The search (in SPL) executed within core Splunk", - "type": "string" - } - }, - "type": "object" - }, - "uba": { - "properties": { "event_type": { "description": "An anomaly or threat.", "type": "string" @@ -153,15 +371,18 @@ "description": "Url of the playbook on Phantom website.", "type": "string" }, - "search": { - "description": "The search you will run against the UEBA index to idenfiy the threat.", - "type": "string" - }, "threat_category": { "description": "The category of a threat in Splunk UBA.", "type": "string" } }, + "required": [ + "correlation_rule", + "event_type", + "model", + "model_version", + "threat_category" + ], "type": "object" } }, diff --git a/spec/v2/example/detection_phantom.json.example b/spec/v2/example/detection_phantom.json.example index c17cafae1a..6ddf5c88b6 100644 --- a/spec/v2/example/detection_phantom.json.example +++ b/spec/v2/example/detection_phantom.json.example @@ -51,13 +51,16 @@ ], "creation_date": "2019-02-14", "modification_date": "2019-02-14", - "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", - "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

Splunk>Phantom Playbook Integration

If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
(Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

", + "eli5": "This example phantom playbook will detect", + + "how_to_implement": "Splunk>Phantom Playbook Integration", "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.", + "id": "1229w27b-ef78-4w59-aae8-5369073014e1", + "name": "Playbook that detects DNS Hijacks", "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", - "product_type": "splunk", + "product_type": "phantom", "asset_type": "Endpoint", "confidence": "medium", "security_domain": "network", @@ -65,7 +68,13 @@ "version": "1.0", "baselines": [], "detect": { - "splunk": { + "phantom": { + "phantom_server": "automation (hostname)", + "playbook_display_name": "DNS record change investigation", + "playbook_name": "community/dns_hijack_investigation", + "playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/", + "sensitivity": "green", + "severity": "medium", "correlation_rule": { "notable": { "nes_fields": "src", @@ -79,17 +88,17 @@ ], "risk_score": 40 }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, "suppress": { "suppress_fields": "src", "suppress_period": "28800s" - } - }, - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m" - }, - "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + }, + "search": "|makeresults | sendalert sendtophantom" + } } }, "investigations": [ diff --git a/spec/v2/example/detection_splunk.json.example b/spec/v2/example/detection_splunk.json.example index 31005efecf..9b4b36fcaf 100644 --- a/spec/v2/example/detection_splunk.json.example +++ b/spec/v2/example/detection_splunk.json.example @@ -1,4 +1,5 @@ { + "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", "asset_type": "Endpoint", "baselines": [ { @@ -21,7 +22,6 @@ "Bro" ] }, - "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.", "detect": { "splunk": { "correlation_rule": { @@ -37,17 +37,17 @@ ], "risk_score": 40 }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, "suppress": { "suppress_fields": "src", "suppress_period": "28800s" - } - }, - "scheduling": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m" - }, - "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + }, + "search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + } } }, "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", diff --git a/spec/v2/example/story_dns_hijack.json.example b/spec/v2/example/story_dns_hijack.json.example index 3328c8d691..df6c3309f6 100644 --- a/spec/v2/example/story_dns_hijack.json.example +++ b/spec/v2/example/story_dns_hijack.json.example @@ -1,9 +1,9 @@ { - "category": ["Malware","Other"], + "category": ["Adversary Tactics","Other"], "usecase": "Advanced Threat Detection", "channel": "ESCU", "creation_date": "2017-11-21", - "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", + "description": "Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.", "detections": [ { "detection_id": "1169w17b-ef78-4b59-aae8-5369073014e1", @@ -30,8 +30,8 @@ } ], "modification_date": "2018-09-06", - "name": "Dynamic DNS", - "narrative": "Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.", + "name": "DNS Hijacking", + "narrative": "Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.

The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well.

On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity and Infrastructure Security Agency (CISA) raised awareness of some high-profile DNS hijacking attacks against infrastructure, both in the United States and abroad. It issued Emergency Directive 19-01 (see https://cyber.dhs.gov/ed/19-01/), which summarized the activity and required government agencies to take the following four actions, all within 10 days:
  1. For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers, verify that they resolve to the intended location or report them to CISA.
  2. Update the passwords for all accounts on systems that can make changes to each agency 2019's DNS records.
  3. Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency's 2019 DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.
  4. CISA will begin regular delivery of newly added certificates to Certificate Transparency (CT) logs for agency domains via the Cyber Hygiene service. Upon receipt, agencies must immediately begin monitoring CT log data for certificates issued that they did not request. If an agency confirms that a certificate was unauthorized, it must report the certificate to the issuing certificate authority and to CISA.
Of course, it makes sense to put equivalent actions in place within your environment, as well.

In DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.

The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment.", "original_authors": [ { "company": "Splunk", From 341ee8b0c21fcaedc77cc3459d2560a6fa1e9345 Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 28 Mar 2019 12:42:06 -0400 Subject: [PATCH 51/74] better printing for story --- bin/validate.py | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 63c745cfdb..7afd861234 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -29,12 +29,12 @@ def validate_story_content(story): try: story['description'].encode('ascii') except UnicodeEncodeError: - errors.append("description not ascii") + errors.append("ERROR: description not ascii") try: story['narrative'].encode('ascii') except UnicodeEncodeError: - errors.append("narrative not ascii") + errors.append("ERROR: narrative not ascii") return errors @@ -47,13 +47,13 @@ def validate_story(REPO_PATH, verbose): try: v1_schema = json.loads(open(v1_schema_file, 'rb').read()) except IOError: - print "Error reading version 1 story schema file {0}".format(v1_schema_file) + print "ERROR: reading version 1 story schema file {0}".format(v1_schema_file) v2_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v2/story.spec.json') try: v2_schema = json.loads(open(v2_schema_file, 'rb').read()) except IOError: - print "Error reading version 2 story schema file {0}".format(v2_schema_file) + print "ERROR: reading version 2 story schema file {0}".format(v2_schema_file) error = False story_manifest_files = path.join(path.expanduser(REPO_PATH), "stories/*.json") @@ -76,22 +76,20 @@ def validate_story(REPO_PATH, verbose): try: jsonschema.validate(instance=story, schema=v1_schema) except jsonschema.exceptions.ValidationError as json_ve: - print story_manifest_file - print json_ve.message + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), story_manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) error = True - continue elif story['spec_version'] == 2: try: jsonschema.validate(instance=story, schema=v2_schema) except jsonschema.exceptions.ValidationError as json_ve: - print story_manifest_file - print json_ve.message + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), story_manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) error = True - continue else: - print "Story: {0} does not contain a spec_version which is required".format(story_manifest_file) + print "ERROR: Story {0} does not contain a spec_version which is required".format(story_manifest_file) error = True continue @@ -100,8 +98,7 @@ def validate_story(REPO_PATH, verbose): if story_errors: error = True for err in story_errors: - print path.basename(story_manifest_file) - print "\t%s" % err + print "{0} at:\n\t {1}".format(err, story_manifest_file) return error From 6ce4f809af2654b86d51b262317195dae4a8240a Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 28 Mar 2019 12:46:04 -0400 Subject: [PATCH 52/74] updates --- spec/v2/investigations.spec.json | 144 ++++++++++++++++--------------- 1 file changed, 75 insertions(+), 69 deletions(-) diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index e1ccf1c5cf..07c6a40356 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -1,6 +1,81 @@ { "$id": "https://api.splunkresearch.com/schemas/investigations.json", "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "phantom": { + "properties": { + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_display_name": { + "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", + "type": "string" + }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "required": [ + "phantom_server", + "playbook_name", + "playbook_url", + "playbook_display_name" + ], + "type": "object" + }, + "splunk": { + "properties": { + "fields_required": { + "description": "A list of data models, if any, used by this search", + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "investigate_window": { + "additionalProperties": false, + "description": "The fields associated on when this search should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "required": [ + "latest_time_offset", + "earliest_time_offset" + ], + "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for investgation.", + "type": "string" + } + }, + "required": [ + "search", + "investigate_window" + ], + "type": "object" + } + }, "description": "The fields that make up the manifest of a version 2 investigative object", "properties": { "creation_date": { @@ -104,75 +179,6 @@ ], "type": "object" }, - "definitions": { - "phantom": { - "properties": { - "phantom_server": { - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", - "type": "string" - }, - "playbook_display_name": { - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", - "type": "string" - }, - "playbook_name": { - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", - "type": "string" - }, - "playbook_url": { - "description": "Url of the playbook on Phantom website.", - "type": "string" - }, - "sensitivity": { - "description": "TLP colors (White, Green, Amber or Red)", - "type": "string" - }, - "severity": { - "description": "Severity in phantom (High, Medium, Low)", - "type": "string" - } - }, - "required": [ - "phantom_server", - "playbook_name", - "playbook_url", - "playbook_display_name" - ], - "type": "object" - }, - "splunk": { - "properties": { - "investigate_window": { - "additionalProperties": false, - "description": "The fields associated on when this search should run relative to the detection event", - "properties": { - "earliest_time_offset": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" - }, - "latest_time_offset": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" - } - }, - "required": [ - "latest_time_offset", - "earliest_time_offset" - ], - "type": "object" - }, - "search": { - "description": "The search (in SPL) executed within core Splunk for investgation.", - "type": "string" - } - }, - "required": [ - "search", - "investigate_window" - ], - "type": "object" - } - }, "description": { "description": "A description of what the search is designed to detect", "type": "string" From a2f431b6cca8d5e4688257695e140df4e40acb87 Mon Sep 17 00:00:00 2001 From: bpatel Date: Fri, 29 Mar 2019 12:14:44 -0400 Subject: [PATCH 53/74] baseline update --- spec/v2/baselines.spec.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index c48e6b6fba..323946e191 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -9,10 +9,6 @@ "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", "type": "string" }, - "playbook_display_name": { - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", - "type": "string" - }, "playbook_name": { "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", "type": "string" From 6c24bb91d9f0924edf3fb3c029ed5487c8110032 Mon Sep 17 00:00:00 2001 From: bpatel Date: Fri, 29 Mar 2019 12:45:15 -0400 Subject: [PATCH 54/74] spec omne enums and v2 examples --- spec/v1/detection_search.json.spec | 194 +++++++++++++++++- spec/v1/investigative_search.json.spec | 20 +- spec/v1/support_search.json.spec | 20 +- .../investigation_phantom.json.example | 9 +- .../example/investigation_search.json.example | 2 +- spec/v2/investigations.spec.json | 42 ++-- 6 files changed, 260 insertions(+), 27 deletions(-) diff --git a/spec/v1/detection_search.json.spec b/spec/v1/detection_search.json.spec index 4157c99e19..d7b30fca88 100644 --- a/spec/v1/detection_search.json.spec +++ b/spec/v1/detection_search.json.spec @@ -155,7 +155,25 @@ "description": "A list of data models, if any, used by this search", "type": "array", "items": { - "type": "string" + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, "minItems": 0, "uniqueItems": true @@ -274,7 +292,28 @@ "description": "A list of critical security controls this search helps you implement", "type": "array", "items": { - "type": "string" + "enum": [ + "CIS 1", + "CIS 2", + "CIS 3", + "CIS 4", + "CIS 5", + "CIS 6", + "CIS 7", + "CIS 8", + "CIS 9", + "CIS 10", + "CIS 11", + "CIS 12", + "CIS 13", + "CIS 14", + "CIS 15", + "CIS 16", + "CIS 17", + "CIS 18", + "CIS 19", + "CIS 20" + ] }, "minItems": 0, "uniqueItems": true @@ -283,7 +322,15 @@ "description": "A list of kill-chain phases to which the search applies", "type": "array", "items": { - "type": "string" + "enum": [ + "Reconnaissance", + "Weaponization", + "Delivery", + "Exploitation", + "Installation", + "Command and Control", + "Actions on Objectives" + ] }, "minItems": 0, "uniqueItems": true @@ -292,7 +339,125 @@ "description": "A list of the techniques and tactics identified by the search", "type": "array", "items": { - "type": "string" + "enum": [ + "Initial Access", + "Execution", + "Persistence", + "Privilege Escalation", + "Defense Evasion", + "Credential Access", + "Discovery", + "Lateral Movement", + "Collection", + "Exfiltration", + "Command and Control", + "Command and Control Protocol", + "Commonly Used Port", + "Custom Cryptographic Protocol", + "DLL Injection", + "DLL Search Order Hijacking", + "DLL Side-Loading", + "Data Compressed", + "Data Encrypted", + "Data Obfuscation", + "Data Staged", + "Data Transfer Size Limits", + "Data from Local System", + "Data from Network Shared Drive", + "Data from Removable Media", + "Disabling Security Tools", + "Email Collection", + "Execution through API", + "Exfiltration Over Alternative Protocol", + "Exfiltration Over Command and Control Channel", + "Exfiltration Over Other Network Medium", + "Exfiltration Over Physical Medium", + "Exploitation of Vulnerability", + "Fallback Channels", + "File Deletion", + "File System Logical Offsets", + "File System Permissions Weakness", + "File and Directory Discovery", + "Graphical User Interface", + "Hypervisor", + "Indicator Blocking", + "Indicator Removal from Tools", + "Indicator Removal on Host", + "Input Capture", + "InstallUtil", + "Legitimate Credentials", + "Local Network Configuration Discovery", + "Local Network Connections Discovery", + "Local Port Monitor", + "Logon Scripts", + "MSBuild", + "Masquerading", + "Modify Existing Service", + "Modify Registry", + "Multi-Stage Channels", + "Multiband Communication", + "Multilayer Encryption", + "NTFS Extended Attributes", + "Network Service Scanning", + "Network Share Connection Removal", + "Network Sniffing", + "New Service", + "Obfuscated Files or Information", + "Pass the Hash", + "Pass the Ticket", + "Path Interception", + "Peripheral Device Discovery", + "Permission Groups Discovery", + "PowerShell", + "Process Discovery", + "Process Hollowing", + "Query Registry", + "Redundant Access", + "Registry Run Keys / Start Folder", + "Regsvcs/Regasm", + "Regsvr32", + "Remote Desktop Protocol", + "Create Account", + "Remote File Copy", + "Remote Services", + "Remote System Discovery", + "Replication Through Removable Media", + "Rootkit", + "Rundll32", + "Scheduled Task", + "Scheduled Transfer", + "Screen Capture", + "Scripting", + "Security Software Discovery", + "Security Support Provider", + "Service Execution", + "Service Registry Permissions Weakness", + "Shared Webroot", + "Shortcut Modification", + "Software Packing", + "Standard Application Layer Protocol", + "Standard Cryptographic Protocol", + "Standard Non-Application Layer Protocol", + "System Information Discovery", + "System Owner/User Discovery", + "System Service Discovery", + "System Time Discovery", + "Taint Shared Content", + "Third-party Software", + "Timestomp", + "Two-Factor Authentication Interception", + "Uncommonly Used Port", + "Video Capture", + "Valid Accounts", + "Web Service", + "Web Shell", + "Windows Admin Shares", + "Windows Management Instrumentation Event Subscription", + "Windows Management Instrumentation", + "Windows Remote Management", + "Winlogon Helper DLL", + "Exploitation for Privilege Escalation" + ] }, "minItems": 0, "uniqueItems": true @@ -301,7 +466,26 @@ "description": "A list of the NIST controls the search helps you implement", "type": "array", "items": { - "type": "string" + "enum": [ + "ID.AM", + "ID.RA", + "PR.DS", + "PR.IP", + "PR.AC", + "PR.PT", + "PR.AT", + "PR.MA", + "DE.CM", + "DE.DP", + "DE.AE", + "RS.MI", + "RS.AN", + "RS.RP", + "RS.IM", + "RS.CO", + "RC.IM", + "RC.CO" + ] }, "minItems": 0, "uniqueItems": true diff --git a/spec/v1/investigative_search.json.spec b/spec/v1/investigative_search.json.spec index 791461a1a9..908809e8bd 100644 --- a/spec/v1/investigative_search.json.spec +++ b/spec/v1/investigative_search.json.spec @@ -20,7 +20,25 @@ "description": "A list of data models, if any, used by this search", "type": "array", "items": { - "type": "string" + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, "minItems": 0, "uniqueItems": true diff --git a/spec/v1/support_search.json.spec b/spec/v1/support_search.json.spec index 6998d4c8aa..fdeee988b6 100644 --- a/spec/v1/support_search.json.spec +++ b/spec/v1/support_search.json.spec @@ -20,7 +20,25 @@ "description": "A list of data models, if any, used by this search", "type": "array", "items": { - "type": "string" + "enum": [ + "Alerts", + "Application_State", + "Authentication", + "Certificates", + "Change_Analysis", + "Change", + "Malware", + "Email", + "Identity_Management", + "Network_Resolution", + "Network_Traffic", + "Vulnerabilities", + "Web", + "Network_Sessions", + "Updates", + "Risk", + "Endpoint" + ] }, "minItems": 0, "uniqueItems": true diff --git a/spec/v2/example/investigation_phantom.json.example b/spec/v2/example/investigation_phantom.json.example index b6e82c0dc9..592472e58c 100644 --- a/spec/v2/example/investigation_phantom.json.example +++ b/spec/v2/example/investigation_phantom.json.example @@ -15,11 +15,14 @@ "investigate": { "phantom": { "phantom_server": "automation (hostname)", - "playbook_display_name": "DNS record change investigation", "playbook_name": "community/dns_hijack_investigation", "playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/", "sensitivity": "green", - "severity": "medium" + "severity": "medium", + "window": { + "earliest_time_offset": 0, + "latest_time_offset": 86400 + } } }, "maintainers": [ @@ -39,6 +42,6 @@ } ], "spec_version": 2, - "product_type": "splunk", + "product_type": "phantom", "version": "1.0" } diff --git a/spec/v2/example/investigation_search.json.example b/spec/v2/example/investigation_search.json.example index 53dfd59c7b..e171b4e4ff 100644 --- a/spec/v2/example/investigation_search.json.example +++ b/spec/v2/example/investigation_search.json.example @@ -19,7 +19,7 @@ "src_ip" ], "search": "| search tag=dns src_ip={src_ip} dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count", - "search_window": { + "window": { "earliest_time_offset": 0, "latest_time_offset": 86400 } diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index 07c6a40356..3423ed8349 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -8,10 +8,6 @@ "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", "type": "string" }, - "playbook_display_name": { - "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment", - "type": "string" - }, "playbook_name": { "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", "type": "string" @@ -27,14 +23,27 @@ "severity": { "description": "Severity in phantom (High, Medium, Low)", "type": "string" + }, + "window": { + "description": "The time associated on when this investigste object should run relative to the detection event", + "properties": { + "earliest_time_offset": { + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" + }, + "latest_time_offset": { + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" + } + }, + "required": [ + "playbook_name", + "phantom_server", + "playbook_url" + ], + "type": "object" } }, - "required": [ - "phantom_server", - "playbook_name", - "playbook_url", - "playbook_display_name" - ], "type": "object" }, "splunk": { @@ -45,7 +54,11 @@ "type": "array", "uniqueItems": true }, - "investigate_window": { + "search": { + "description": "The search (in SPL) executed within core Splunk for investgation.", + "type": "string" + }, + "window": { "additionalProperties": false, "description": "The fields associated on when this search should run relative to the detection event", "properties": { @@ -63,15 +76,12 @@ "earliest_time_offset" ], "type": "object" - }, - "search": { - "description": "The search (in SPL) executed within core Splunk for investgation.", - "type": "string" } }, "required": [ "search", - "investigate_window" + "fields_required", + "window" ], "type": "object" } From 1e965b3db52a47babd22fb5782419e3cd7cca401 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 29 Mar 2019 13:32:53 -0400 Subject: [PATCH 55/74] udpated validate script to check detections --- bin/validate.py | 246 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 238 insertions(+), 8 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 7afd861234..1854b67168 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -11,20 +11,179 @@ import argparse from os import path -ALL_UUIDS = [] +def validate_detection_contentv2(detection, DETECTION_UUIDS, errors): -def validate_story_content(story): + if detection['id'] == '': + errors.append('ERROR: Blank ID') + + if detection['id'] in DETECTION_UUIDS: + errors.append('ERROR: Duplicate UUID found: %s' % detection['id']) + else: + DETECTION_UUIDS.append(detection['id']) + + if detection['name'].endswith(" "): + errors.append( + "ERROR: Detection name has trailing spaces: '%s'" % + detection['search_name']) + + try: + detection['description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii") + + if 'how_to_implement' in detection: + try: + detection['how_to_implement'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: how_to_implement not ascii") + + if 'eli5' in detection: + try: + detection['eli5'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: eli5 not ascii") + + if 'known_false_positives' in detection: + try: + detection['known_false_positives'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: known_false_positives not ascii") + + if detection['detect']['splunk']: + + # do a regex match here instead of key values + if (detection['detect']['splunk']['correlation_rule']['search'].find('tstats') != -1) or \ + (detection['detect']['splunk']['correlation_rule']['search'].find('datamodel') != -1): + + print "found datamodel keyword" + + if 'data_models' not in detection['data_metadata']: + errors.append("ERROR: The Splunk search uses a data model but 'data_models' field is not set") + + if not detection['data_metadata']['data_models']: + errors.append("ERROR: The Splunk search uses a data model but 'data_models' is empty") + + # do a regex match here instead of key values + if (detection['detect']['splunk']['correlation_rule']['search'].find('sourcetype') != -1): + if 'data_sourcetypes' not in detection['data_metadata']: + errors.append("ERROR: The Splunk search specifies a sourcetype but 'data_sourcetypes' \ + field is not set") + + if not detection['data_metadata']['data_sourcetypes']: + errors.append("ERROR: The Splunk search specifies a sourcetype but \ + 'data_sourcetypes' is empty") + + return errors + + +def validate_detection_contentv1(detection, DETECTION_UUIDS, errors): + + try: + detection['search_description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii") + + if detection['search_name'].endswith(" "): + errors.append( + "ERROR: Detection name has trailing spaces: '%s'" % + detection['search_name']) + + if detection['search_id'] == '': + errors.append('ERROR: Blank ID') + + if detection['search_id'] in DETECTION_UUIDS: + errors.append('ERROR: Duplicate UUID found: %s' % detection['search_id']) + else: + DETECTION_UUIDS.append(detection['search_id']) + + if '| tstats' in detection['search'] or 'datamodel' in detection['search']: + if 'data_models' not in detection['data_metadata']: + errors.append( + "ERROR: The search uses a data model but 'data_models' \ + field is not set") + + if 'data_models' in detection and not \ + detection['data_metadata']['data_models']: + errors.append( + "ERROR: The search uses a data model but 'data_models' is empty") + + if 'sourcetype' in detection['search']: + if 'data_sourcetypes' not in detection['data_metadata']: + errors.append( + "ERROR: The search specifies a sourcetype but 'data_sourcetypes' \ + field is not set") + + if 'data_sourcetypes' in detection and not \ + detection['data_metadata']['data_sourcetypes']: + errors.append( + "ERROR: The search specifies a sourcetype but \ + 'data_sourcetypes' is empty") + + try: + detection['search_description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: search_description not ascii") + + if 'how_to_implement' in detection: + try: + detection['how_to_implement'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: how_to_implement not ascii") + + if 'eli5' in detection: + try: + detection['eli5'].encode('ascii') + except UnicodeEncodeError: + errors.append("eli5 not ascii") + + if 'known_false_positives' in detection: + try: + detection['known_false_positives'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: known_false_positives not ascii") + + if 'correlation_rule' in detection and 'notable' in \ + detection['correlation_rule']: + try: + detection['correlation_rule']['notable']['rule_title'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: rule_title not ascii") + + try: + detection['correlation_rule']['notable']['rule_description'].encode( + 'ascii') + except UnicodeEncodeError: + errors.append("ERROR: rule_description not ascii") + + return errors + + +def validate_detection_content(detection, DETECTION_UUIDS): + ''' Validate that the content of a detection manifest is correct''' + errors = [] + + # run v1 content validation + if detection["spec_version"] == 1: + errors = validate_detection_contentv1(detection, DETECTION_UUIDS, errors) + + if detection["spec_version"] == 2: + errors = validate_detection_contentv2(detection, DETECTION_UUIDS, errors) + + return errors + + +def validate_story_content(story, STORY_UUIDS): ''' Validate that the content of a story manifest is correct''' errors = [] if story['id'] == '': errors.append('ERROR: Blank ID') - if story['id'] in ALL_UUIDS: + if story['id'] in STORY_UUIDS: errors.append('ERROR: Duplicate UUID found: %s' % story['id']) else: - ALL_UUIDS.append(story['id']) + STORY_UUIDS.append(story['id']) try: story['description'].encode('ascii') @@ -39,9 +198,76 @@ def validate_story_content(story): return errors +def validate_detection(REPO_PATH, verbose): + ''' Validates Detections''' + + DETECTION_UUIDS = [] + # retrive + v1_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v1/detection_search.json.spec') + try: + v1_schema = json.loads(open(v1_schema_file, 'rb').read()) + except IOError: + print "ERROR: reading version 1 detection schema file {0}".format(v1_schema_file) + + v2_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v2/detections.spec.json') + try: + v2_schema = json.loads(open(v2_schema_file, 'rb').read()) + except IOError: + print "ERROR: reading version 2 detection schema file {0}".format(v2_schema_file) + + error = False + manifest_files = path.join(path.expanduser(REPO_PATH), "detections/*.json") + + for manifest_file in glob.glob(manifest_files): + if verbose: + print "processing detection {0}".format(manifest_file) + + # read in each story + try: + detection = json.loads( + open(manifest_file, 'r').read()) + except IOError: + print "Error reading {0}".format(manifest_file) + error = True + continue + + # validate v1 and v2 stories against spec + if detection['spec_version'] == 1: + try: + jsonschema.validate(instance=detection, schema=v1_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + elif detection['spec_version'] == 2: + try: + jsonschema.validate(instance=detection, schema=v2_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + else: + print "ERROR: Story {0} does not contain a spec_version which is required".format(manifest_file) + error = True + continue + + # now lets validate the content + detection_errors = validate_detection_content(detection, DETECTION_UUIDS) + if detection_errors: + error = True + for err in detection_errors: + print "{0} at:\n\t {1}".format(err, manifest_file) + + return error + + def validate_story(REPO_PATH, verbose): ''' Validates Stories''' + STORY_UUIDS = [] + # retrive v1_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v1/analytic_story.json.spec') try: @@ -94,7 +320,7 @@ def validate_story(REPO_PATH, verbose): continue # now lets validate the content - story_errors = validate_story_content(story) + story_errors = validate_story_content(story, STORY_UUIDS) if story_errors: error = True for err in story_errors: @@ -114,9 +340,13 @@ def validate_story(REPO_PATH, verbose): REPO_PATH = args.path verbose = args.verbose - error = validate_story(REPO_PATH, verbose) + story_error = validate_story(REPO_PATH, verbose) + + detection_error = validate_detection(REPO_PATH, verbose) - if error: + if story_error: + sys.exit("Errors found") + elif detection_error: sys.exit("Errors found") else: - print "No errors found" + print "No Errors found" From fd6a55d7f4cb82e0da6020d94354a1fd5bed8650 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 29 Mar 2019 13:44:40 -0400 Subject: [PATCH 56/74] updated mitre mappings --- spec/v1/detection_search.json.spec | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/spec/v1/detection_search.json.spec b/spec/v1/detection_search.json.spec index d7b30fca88..94e8ed943d 100644 --- a/spec/v1/detection_search.json.spec +++ b/spec/v1/detection_search.json.spec @@ -322,7 +322,7 @@ "description": "A list of kill-chain phases to which the search applies", "type": "array", "items": { - "enum": [ + "enum": [ "Reconnaissance", "Weaponization", "Delivery", @@ -341,6 +341,14 @@ "items": { "enum": [ "Initial Access", + "AppInit DLLs", + "Authentication Package", + "Change Default File Association", + "Credential Dumping", + "Application Shimming", + "Account Discovery", + "Accessibility Features", + "Command-Line Interface", "Execution", "Persistence", "Privilege Escalation", @@ -627,4 +635,4 @@ "scheduling", "version" ] -} +} \ No newline at end of file From f05f011e6bab02fe18cdcf9a5e5940cd4c9611ec Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 29 Mar 2019 22:59:27 -0400 Subject: [PATCH 57/74] added investigative check functions --- bin/validate.py | 235 ++++++++++++++++++++++++++++++- spec/v2/investigations.spec.json | 8 ++ 2 files changed, 239 insertions(+), 4 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 1854b67168..59fe771268 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -25,7 +25,7 @@ def validate_detection_contentv2(detection, DETECTION_UUIDS, errors): if detection['name'].endswith(" "): errors.append( "ERROR: Detection name has trailing spaces: '%s'" % - detection['search_name']) + detection['name']) try: detection['description'].encode('ascii') @@ -56,8 +56,6 @@ def validate_detection_contentv2(detection, DETECTION_UUIDS, errors): if (detection['detect']['splunk']['correlation_rule']['search'].find('tstats') != -1) or \ (detection['detect']['splunk']['correlation_rule']['search'].find('datamodel') != -1): - print "found datamodel keyword" - if 'data_models' not in detection['data_metadata']: errors.append("ERROR: The Splunk search uses a data model but 'data_models' field is not set") @@ -77,6 +75,69 @@ def validate_detection_contentv2(detection, DETECTION_UUIDS, errors): return errors +def validate_investigation_contentv2(investigation, investigation_uuids, errors): + + if investigation['id'] == '': + errors.append('ERROR: Blank ID') + + if investigation['id'] in investigation_uuids: + errors.append('ERROR: Duplicate UUID found: %s' % investigation['id']) + else: + investigation_uuids.append(investigation['id']) + + if investigation['name'].endswith(" "): + errors.append( + "ERROR: Investigation name has trailing spaces: '%s'" % + investigation['name']) + + try: + investigation['description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii") + + if 'how_to_implement' in investigation: + try: + investigation['how_to_implement'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: how_to_implement not ascii") + + if 'eli5' in investigation: + try: + investigation['eli5'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: eli5 not ascii") + + if 'known_false_positives' in investigation: + try: + investigation['known_false_positives'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: known_false_positives not ascii") + + if investigation['detect']['splunk']: + + # do a regex match here instead of key values + if (investigation['detect']['splunk']['correlation_rule']['search'].find('tstats') != -1) or \ + (investigation['detect']['splunk']['correlation_rule']['search'].find('datamodel') != -1): + + if 'data_models' not in investigation['data_metadata']: + errors.append("ERROR: The Splunk search uses a data model but 'data_models' field is not set") + + if not investigation['data_metadata']['data_models']: + errors.append("ERROR: The Splunk search uses a data model but 'data_models' is empty") + + # do a regex match here instead of key values + if (investigation['detect']['splunk']['correlation_rule']['search'].find('sourcetype') != -1): + if 'data_sourcetypes' not in investigation['data_metadata']: + errors.append("ERROR: The Splunk search specifies a sourcetype but 'data_sourcetypes' \ + field is not set") + + if not investigation['data_metadata']['data_sourcetypes']: + errors.append("ERROR: The Splunk search specifies a sourcetype but \ + 'data_sourcetypes' is empty") + + return errors + + def validate_detection_contentv1(detection, DETECTION_UUIDS, errors): try: @@ -159,8 +220,91 @@ def validate_detection_contentv1(detection, DETECTION_UUIDS, errors): return errors +def validate_investigation_contentv1(investigation, investigation_uuids, errors): + + try: + investigation['search_description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii") + + if investigation['search_name'].endswith(" "): + errors.append( + "ERROR: Investigation name has trailing spaces: '%s'" % + investigation['search_name']) + + if investigation['search_id'] == '': + errors.append('ERROR: Blank ID') + + if investigation['search_id'] in investigation_uuids: + errors.append('ERROR: Duplicate UUID found: %s' % investigation['search_id']) + else: + investigation_uuids.append(investigation['search_id']) + + if '| tstats' in investigation['search'] or 'datamodel' in investigation['search']: + if 'data_models' not in investigation['data_metadata']: + errors.append( + "ERROR: The search uses a data model but 'data_models' \ + field is not set") + + if 'data_models' in investigation and not \ + investigation['data_metadata']['data_models']: + errors.append( + "ERROR: The search uses a data model but 'data_models' is empty") + + if 'sourcetype' in investigation['search']: + if 'data_sourcetypes' not in investigation['data_metadata']: + errors.append( + "ERROR: The search specifies a sourcetype but 'data_sourcetypes' \ + field is not set") + + if 'data_sourcetypes' in investigation and not \ + investigation['data_metadata']['data_sourcetypes']: + errors.append( + "ERROR: The search specifies a sourcetype but \ + 'data_sourcetypes' is empty") + + try: + investigation['search_description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: search_description not ascii") + + if 'how_to_implement' in investigation: + try: + investigation['how_to_implement'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: how_to_implement not ascii") + + if 'eli5' in investigation: + try: + investigation['eli5'].encode('ascii') + except UnicodeEncodeError: + errors.append("eli5 not ascii") + + if 'known_false_positives' in investigation: + try: + investigation['known_false_positives'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: known_false_positives not ascii") + + return errors + + +def validate_investigation_content(investigation, investigation_uuids): + '''Validate that the content of a investigation manifest is correct''' + errors = [] + + # run v1 content validation + if investigation["spec_version"] == 1: + errors = validate_investigation_contentv1(investigation, investigation_uuids, errors) + + if investigation["spec_version"] == 2: + errors = validate_investigation_contentv2(investigation, investigation_uuids, errors) + + return errors + + def validate_detection_content(detection, DETECTION_UUIDS): - ''' Validate that the content of a detection manifest is correct''' + '''Validate that the content of a detection manifest is correct''' errors = [] # run v1 content validation @@ -198,6 +342,85 @@ def validate_story_content(story, STORY_UUIDS): return errors +def validate_investigation(REPO_PATH, verbose): + ''' Validates Investigation''' + + INVESTIGATION_UUIDS = [] + # retrive + v1_schema_file_investigative = path.join(path.expanduser(REPO_PATH), 'spec/v1/investigative_search.json.spec') + try: + v1_schema_investigative = json.loads(open(v1_schema_file_investigative, 'rb').read()) + except IOError: + print "ERROR: reading version 1 investigations schema file {0}".format(v1_schema_file_investigative) + + v1_schema_file_contexual = path.join(path.expanduser(REPO_PATH), 'spec/v1/contextual_search.json.spec') + try: + v1_schema_contexual = json.loads(open(v1_schema_file_contexual, 'rb').read()) + except IOError: + print "ERROR: reading version 1 investigations schema file {0}".format(v1_schema_file_contexual) + + v2_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v2/investigations.spec.json') + try: + v2_schema = json.loads(open(v2_schema_file, 'rb').read()) + except IOError: + print "ERROR: reading version 2 investigations schema file {0}".format(v2_schema_file) + + error = False + manifest_files = path.join(path.expanduser(REPO_PATH), "investigations/*.json") + + for manifest_file in glob.glob(manifest_files): + if verbose: + print "processing investigation {0}".format(manifest_file) + + # read in each story + try: + investigation = json.loads( + open(manifest_file, 'r').read()) + except IOError: + print "Error reading {0}".format(manifest_file) + error = True + continue + + # validate v1 and v2 stories against spec for both investigations and old contexual searches + if investigation['spec_version'] == 1 and investigation['search_type'] == "contextual": + try: + jsonschema.validate(instance=investigation, schema=v1_schema_contexual) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + if investigation['spec_version'] == 1 and investigation['search_type'] == "investigative": + try: + jsonschema.validate(instance=investigation, schema=v1_schema_investigative) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + elif investigation['spec_version'] == 2: + try: + jsonschema.validate(instance=investigation, schema=v2_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + else: + print "ERROR: Story {0} does not contain a spec_version which is required".format(manifest_file) + error = True + continue + + # now lets validate the content + investigation_errors = validate_investigation_content(investigation, INVESTIGATION_UUIDS) + if investigation_errors: + error = True + for err in investigation_errors: + print "{0} at:\n\t {1}".format(err, manifest_file) + + return error + + def validate_detection(REPO_PATH, verbose): ''' Validates Detections''' @@ -344,9 +567,13 @@ def validate_story(REPO_PATH, verbose): detection_error = validate_detection(REPO_PATH, verbose) + investigation_error = validate_investigation(REPO_PATH, verbose) + if story_error: sys.exit("Errors found") elif detection_error: sys.exit("Errors found") + elif investigation_error: + sys.exit("Errors found") else: print "No Errors found" diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index 3423ed8349..6f055b80eb 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -193,6 +193,10 @@ "description": "A description of what the search is designed to detect", "type": "string" }, + "eli5": { + "description": "Explain it like I\u2019m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "type": "string" + }, "entities": { "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ", "items": { @@ -244,6 +248,10 @@ } ] }, + "known_false_positives": { + "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", + "type": "string" + }, "maintainers": { "description": "An array of the current maintainers of the Analytic Story.", "items": { From af192d416d577dc4539ec0acdf886261d01c89c2 Mon Sep 17 00:00:00 2001 From: divious1 Date: Sat, 30 Mar 2019 15:19:40 -0400 Subject: [PATCH 58/74] fixed errors with investigative validations --- bin/validate.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 59fe771268..4595945c2a 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -382,6 +382,7 @@ def validate_investigation(REPO_PATH, verbose): continue # validate v1 and v2 stories against spec for both investigations and old contexual searches + if investigation['spec_version'] == 1 and investigation['search_type'] == "contextual": try: jsonschema.validate(instance=investigation, schema=v1_schema_contexual) @@ -389,15 +390,13 @@ def validate_investigation(REPO_PATH, verbose): print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) error = True - - if investigation['spec_version'] == 1 and investigation['search_type'] == "investigative": + elif investigation['spec_version'] == 1 and investigation['search_type'] == "investigative": try: jsonschema.validate(instance=investigation, schema=v1_schema_investigative) except jsonschema.exceptions.ValidationError as json_ve: print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) error = True - elif investigation['spec_version'] == 2: try: jsonschema.validate(instance=investigation, schema=v2_schema) @@ -405,7 +404,6 @@ def validate_investigation(REPO_PATH, verbose): print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file) print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) error = True - else: print "ERROR: Story {0} does not contain a spec_version which is required".format(manifest_file) error = True From e562cc1e376906624632288e44062d1c384d98f9 Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 1 Apr 2019 16:36:17 -0400 Subject: [PATCH 59/74] updated with baseline searches --- bin/validate.py | 224 +++++++++++++++++- .../baseline_dns_record_changed.json.example | 5 +- 2 files changed, 222 insertions(+), 7 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 4595945c2a..02882c4870 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -113,11 +113,11 @@ def validate_investigation_contentv2(investigation, investigation_uuids, errors) except UnicodeEncodeError: errors.append("ERROR: known_false_positives not ascii") - if investigation['detect']['splunk']: + if investigation['investigate']['splunk']: # do a regex match here instead of key values - if (investigation['detect']['splunk']['correlation_rule']['search'].find('tstats') != -1) or \ - (investigation['detect']['splunk']['correlation_rule']['search'].find('datamodel') != -1): + if (investigation['investigate']['splunk']['search'].find('tstats') != -1) or \ + (investigation['investigate']['splunk']['search'].find('datamodel') != -1): if 'data_models' not in investigation['data_metadata']: errors.append("ERROR: The Splunk search uses a data model but 'data_models' field is not set") @@ -126,7 +126,7 @@ def validate_investigation_contentv2(investigation, investigation_uuids, errors) errors.append("ERROR: The Splunk search uses a data model but 'data_models' is empty") # do a regex match here instead of key values - if (investigation['detect']['splunk']['correlation_rule']['search'].find('sourcetype') != -1): + if (investigation['investigate']['splunk']['search'].find('sourcetype') != -1): if 'data_sourcetypes' not in investigation['data_metadata']: errors.append("ERROR: The Splunk search specifies a sourcetype but 'data_sourcetypes' \ field is not set") @@ -138,6 +138,69 @@ def validate_investigation_contentv2(investigation, investigation_uuids, errors) return errors +def validate_baselines_contentv2(baseline, baselines_uuids, errors): + + if baseline['id'] == '': + errors.append('ERROR: Blank ID') + + if baseline['id'] in baselines_uuids: + errors.append('ERROR: Duplicate UUID found: %s' % baseline['id']) + else: + baselines_uuids.append(baseline['id']) + + if baseline['name'].endswith(" "): + errors.append( + "ERROR: Investigation name has trailing spaces: '%s'" % + baseline['name']) + + try: + baseline['description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii") + + if 'how_to_implement' in baseline: + try: + baseline['how_to_implement'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: how_to_implement not ascii") + + if 'eli5' in baseline: + try: + baseline['eli5'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: eli5 not ascii") + + if 'known_false_positives' in baseline: + try: + baseline['known_false_positives'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: known_false_positives not ascii") + + if baseline['baseline']['splunk']: + + # do a regex match here instead of key values + if (baseline['baseline']['splunk']['search'].find('tstats') != -1) or \ + (baseline['baseline']['splunk']['search'].find('datamodel') != -1): + + if 'data_models' not in baseline['data_metadata']: + errors.append("ERROR: The Splunk search uses a data model but 'data_models' field is not set") + + if not baseline['data_metadata']['data_models']: + errors.append("ERROR: The Splunk search uses a data model but 'data_models' is empty") + + # do a regex match here instead of key values + if (baseline['baseline']['splunk']['search'].find('sourcetype') != -1): + if 'data_sourcetypes' not in baseline['data_metadata']: + errors.append("ERROR: The Splunk search specifies a sourcetype but 'data_sourcetypes' \ + field is not set") + + if not baseline['data_metadata']['data_sourcetypes']: + errors.append("ERROR: The Splunk search specifies a sourcetype but \ + 'data_sourcetypes' is empty") + + return errors + + def validate_detection_contentv1(detection, DETECTION_UUIDS, errors): try: @@ -289,6 +352,75 @@ def validate_investigation_contentv1(investigation, investigation_uuids, errors) return errors +def validate_baselines_contentv1(baseline, baselines_uuids, errors): + + try: + baseline['search_description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: description not ascii") + + if baseline['search_name'].endswith(" "): + errors.append( + "ERROR: Baseline name has trailing spaces: '%s'" % + baseline['search_name']) + + if baseline['search_id'] == '': + errors.append('ERROR: Blank ID') + + if baseline['search_id'] in baselines_uuids: + errors.append('ERROR: Duplicate UUID found: %s' % baseline['search_id']) + else: + baselines_uuids.append(baseline['search_id']) + + if '| tstats' in baseline['search'] or 'datamodel' in baseline['search']: + if 'data_models' not in baseline['data_metadata']: + errors.append( + "ERROR: The search uses a data model but 'data_models' \ + field is not set") + + if 'data_models' in baseline and not \ + baseline['data_metadata']['data_models']: + errors.append( + "ERROR: The search uses a data model but 'data_models' is empty") + + if 'sourcetype' in baseline['search']: + if 'data_sourcetypes' not in baseline['data_metadata']: + errors.append( + "ERROR: The search specifies a sourcetype but 'data_sourcetypes' \ + field is not set") + + if 'data_sourcetypes' in baseline and not \ + baseline['data_metadata']['data_sourcetypes']: + errors.append( + "ERROR: The search specifies a sourcetype but \ + 'data_sourcetypes' is empty") + + try: + baseline['search_description'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: search_description not ascii") + + if 'how_to_implement' in baseline: + try: + baseline['how_to_implement'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: how_to_implement not ascii") + + if 'eli5' in baseline: + try: + baseline['eli5'].encode('ascii') + except UnicodeEncodeError: + errors.append("eli5 not ascii") + + if 'known_false_positives' in baseline: + try: + baseline['known_false_positives'].encode('ascii') + except UnicodeEncodeError: + errors.append("ERROR: known_false_positives not ascii") + + return errors + + def validate_investigation_content(investigation, investigation_uuids): '''Validate that the content of a investigation manifest is correct''' errors = [] @@ -342,6 +474,20 @@ def validate_story_content(story, STORY_UUIDS): return errors +def validate_baselines_content(baseline, baselines_uuids): + '''Validate that the content of a baseline manifest is correct''' + errors = [] + + # run v1 content validation + if baseline["spec_version"] == 1: + errors = validate_baselines_contentv1(baseline, baselines_uuids, errors) + + if baseline["spec_version"] == 2: + errors = validate_baselines_contentv2(baseline, baselines_uuids, errors) + + return errors + + def validate_investigation(REPO_PATH, verbose): ''' Validates Investigation''' @@ -550,6 +696,72 @@ def validate_story(REPO_PATH, verbose): return error +def validate_baselines(REPO_PATH, verbose): + ''' Validates Baselines''' + + BASELINE_UUIDS = [] + + # retrive + v1_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v1/support_search.json.spec') + try: + v1_schema = json.loads(open(v1_schema_file, 'rb').read()) + except IOError: + print "ERROR: reading version 1 baseline schema file {0}".format(v1_schema_file) + + v2_schema_file = path.join(path.expanduser(REPO_PATH), 'spec/v2/baselines.spec.json') + try: + v2_schema = json.loads(open(v2_schema_file, 'rb').read()) + except IOError: + print "ERROR: reading version 2 baseline schema file {0}".format(v2_schema_file) + + error = False + baselines_manifest_files = path.join(path.expanduser(REPO_PATH), "baselines/*.json") + + for baselines_manifest_file in glob.glob(baselines_manifest_files): + if verbose: + print "processing story {0}".format(baselines_manifest_file) + + # read in each baseline + try: + baseline = json.loads( + open(baselines_manifest_file, 'r').read()) + except IOError: + print "Error reading {0}".format(baselines_manifest_file) + error = True + continue + + # validate v1 and v2 stories against spec + if baseline['spec_version'] == 1: + try: + jsonschema.validate(instance=baseline, schema=v1_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), baselines_manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + elif baseline['spec_version'] == 2: + try: + jsonschema.validate(instance=baseline, schema=v2_schema) + except jsonschema.exceptions.ValidationError as json_ve: + print "ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), baselines_manifest_file) + print "\tAffected Object: {}".format(json.dumps(json_ve.instance)) + error = True + + else: + print "ERROR: Baseline {0} does not contain a spec_version which is required".format(baselines_manifest_file) + error = True + continue + + # now lets validate the content + baselines_errors = validate_baselines_content(baseline, BASELINE_UUIDS) + if baselines_errors: + error = True + for err in baselines_errors: + print "{0} at:\n\t {1}".format(err, baselines_manifest_file) + + return error + + if __name__ == "__main__": # grab arguments parser = argparse.ArgumentParser(description="validates security content manifest files", epilog=""" @@ -567,11 +779,15 @@ def validate_story(REPO_PATH, verbose): investigation_error = validate_investigation(REPO_PATH, verbose) + baseline_error = validate_baselines(REPO_PATH, verbose) + if story_error: sys.exit("Errors found") elif detection_error: sys.exit("Errors found") elif investigation_error: sys.exit("Errors found") + elif baseline_error: + sys.exit("Errors found") else: print "No Errors found" diff --git a/spec/v2/example/baseline_dns_record_changed.json.example b/spec/v2/example/baseline_dns_record_changed.json.example index 716d26308e..adaae015bc 100644 --- a/spec/v2/example/baseline_dns_record_changed.json.example +++ b/spec/v2/example/baseline_dns_record_changed.json.example @@ -1,6 +1,6 @@ { "baseline": { - "splunk:": { + "splunk": { "scheduling": { "earliest_time": "-30d@d", "latest_time": "-10m@m" @@ -44,6 +44,5 @@ } ], "spec_version": 2, - "version": "1.0" -} +} \ No newline at end of file From 35f8c61e8c429e251a5bb4350b22eec0e76232ca Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 2 Apr 2019 10:55:59 -0700 Subject: [PATCH 60/74] oneOF example --- spec/v2/example/one_of.json.example | 29 ++++ spec/v2/one_of.spec.json | 218 ++++++++++++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 spec/v2/example/one_of.json.example create mode 100644 spec/v2/one_of.spec.json diff --git a/spec/v2/example/one_of.json.example b/spec/v2/example/one_of.json.example new file mode 100644 index 0000000000..c8e50db777 --- /dev/null +++ b/spec/v2/example/one_of.json.example @@ -0,0 +1,29 @@ +{ + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "src", + "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed", + "rule_title": "DNS record changed" + } + }, + "risk": { + "risk_object": "src", + "risk_object_type": [ + "system" + ], + "risk_score": 40 + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "suppress": { + "suppress_fields": "src", + "suppress_period": "28800s" + } + } +} +} diff --git a/spec/v2/one_of.spec.json b/spec/v2/one_of.spec.json new file mode 100644 index 0000000000..e39ea9e51e --- /dev/null +++ b/spec/v2/one_of.spec.json @@ -0,0 +1,218 @@ +{ + "$id": "https://api.splunkresearch.com/schemas/detections.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "correlation_rule": { + "properties": { + "description": "Various fields to enhance usability in Enterprise Security", + "properties": { + "notable": { + "description": "Various fields associated with creating a notable event", + "properties": { + "nes_fields": { + "description": "A list of suggested fields to be used for notable-event suppression", + "type": "string" + }, + "rule_description": { + "description": "Description of the notable event that will display in Incident Review", + "type": "string" + }, + "rule_title": { + "description": "Title of the notable event that will display in Incident Review", + "type": "string" + } + }, + "required": [ + "rule_description", + "rule_title", + "nes_fields" + ], + "type": "object" + }, + "risk": { + "description": "Fields associated with assigning risk to objects", + "properties": { + "risk_object": { + "description": "TThe field to which you are assigning risk", + "type": "string" + }, + "risk_object_type": { + "description": "The type of object to which you are assigning risk", + "items": { + "enum": [ + "system", + "user", + "other" + ], + "type": "string" + }, + "maxItems": 1, + "minItems": 0, + "type": "array", + "uniqueItems": true + }, + "risk_score": { + "description": "Score assigned to risk_object", + "type": "integer" + } + }, + "required": [ + "risk_score", + "risk_object", + "risk_object_type" + ], + "type": "object" + }, + "scheduling": { + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, + "search": { + "description": "The search that will trigger phantom playbook", + "type": "string" + }, + "suppress": { + "description": "Fields associated with suppressing the creation of multiple alerts", + "properties": { + "suppress_fields": { + "description": "The fields to base the suppression on", + "type": "string" + }, + "suppress_period": { + "description": "The length of time the suppression should be in effect", + "type": "string" + } + }, + "required": [ + "suppress_fields", + "suppress_period" + ], + "type": "object" + } + }, + "required": [ + "search", + "scheduling" + ], + "type": "object" + }, + "type": "object" + }, + "definitions": { + "phantom": { + "properties": { + "correlation_rule": { + "$ref": "#/correlation_rule" + }, + "phantom_server": { + "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "type": "string" + }, + "playbook_name": { + "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "type": "string" + }, + "playbook_url": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" + } + }, + "required": [ + "playbook_name", + "phantom_server", + "playbook_url" + ], + "type": "object" + }, + "splunk": { + "properties": { + "correlation_rule": { + "$ref": "#/correlation_rule" + } + }, + "required": [ + "correlation_rule" + ], + "type": "object" + }, + "uba": { + "properties": { + "correlation_rule": { + "$ref": "#/correlation_rule" + }, + "event_type": { + "description": "An anomaly or threat.", + "type": "string" + }, + "model": { + "description": "The name of the Splunk UBA model that detected the anomaly.", + "type": "string" + }, + "model_version": { + "description": "Url of the playbook on Phantom website.", + "type": "string" + }, + "threat_category": { + "description": "The category of a threat in Splunk UBA.", + "type": "string" + } + }, + "required": [ + "correlation_rule", + "event_type", + "model", + "model_version", + "threat_category" + ], + "type": "object" + } + }, + "description": "A object that defines the parameters for detecting things using various Splunk capabilities", + "properties": { + "detect": { + "anyOf": [ + { + "splunk": { + "$ref": "#/definitions/splunk" + } + }, + { + "phantom": { + "$ref": "#/definitions/phantom" + } + }, + { + "uba": { + "$ref": "#/definitions/uba" + } + } + ] + } + }, + "required": [ + "detect" + ], + "title": "Detection Manifest", + "type": "object" +} From 9cd8ba034360576e86912acb6fa3cd9c31ba940a Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 14:33:27 -0400 Subject: [PATCH 61/74] skeleton of generate tool, removed old validation tool --- bin/generate.py | 131 +++++++++ bin/validate.py | 3 +- bin/validate_manifests.py | 585 -------------------------------------- 3 files changed, 133 insertions(+), 586 deletions(-) create mode 100644 bin/generate.py delete mode 100644 bin/validate_manifests.py diff --git a/bin/generate.py b/bin/generate.py new file mode 100644 index 0000000000..9c1289b634 --- /dev/null +++ b/bin/generate.py @@ -0,0 +1,131 @@ +#!/usr/bin/python + +''' +Generates splunk configurations from manifest files under the security-content repo. +''' + +import glob +import json +import argparse +from os import path + +ALL_UUIDS = [] + + +def markdown(x): + markdown = str(x) + markdown = markdown.replace("", "`") + markdown = markdown.replace("", "`") + markdown = markdown.replace("", "**") + markdown = markdown.replace("", "**") + # list tag replacements + markdown = markdown.replace("
  1. ", "\\\n\\\n1. ") + markdown = markdown.replace("
  2. ", "\\\n\\\n1. ") + markdown = markdown.replace("
", "") + markdown = markdown.replace("", "") + markdown = markdown.replace("
  • ", "\\\n\\\n1. ") + # break tags replacements + markdown = markdown.replace("

    ", "\\\n\\\n") + markdown = markdown.replace("

    ", "\\\n\\\n") + markdown = markdown.replace("
    ", "\\\n\\\n") + return markdown + + +def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): + + # Create conf files from analytics stories files + story_output_path = OUTPUT_DIR + "/default/analytics_stories.conf" + output_file = open(story_output_path, 'w') + + story_files = [] + story_manifest_files = path.join(path.expanduser(REPO_PATH), "stories/*.json") + + for story_manifest_file in glob.glob(story_manifest_files): + # read in each story + try: + story = json.loads( + open(story_manifest_file, 'r').read()) + except IOError: + print "ERROR: reading {0}".format(story_manifest_file) + continue + story_files.append(story) + + # store an object with all stories and their data + complete_stories = dict() + for story in story_files: + if verbose: + print "processing story: {0}".format(story['name']) + # Start building the story for the use case + complete_stories[story['name']] = {} + complete_stories[story['name']]['story_name'] = story['name'] + complete_stories[story['name']]['id'] = story['id'] + + # grab modification date if it has one, otherwise write as creation date + if 'modification_date' in story: + complete_stories[story['name']]['modification_date'] = story['modification_date'] + complete_stories[story['name']]['creation_date'] = story['creation_date'] + else: + complete_stories[story['name']]['modification_date'] = story['creation_date'] + complete_stories[story['name']]['creation_date'] = story['creation_date'] + + complete_stories[story['name']]['description'] = story['description'] + if 'references' not in story: + story['references'] = [] + complete_stories[story['name']]['references'] = story['references'] + complete_stories[story['name']]['category'] = story['category'] + complete_stories[story['name']]['version'] = story['version'] + complete_stories[story['name']]['mappings'] = {} + complete_stories[story['name']]['data_models'] = set() + complete_stories[story['name']]['providing_technologies'] = set() + complete_stories[story['name']]['tags'] = set() + complete_stories[story['name']]['narrative'] = story['narrative'] + + complete_stories[story['name']]['detection_searches'] = [] + complete_stories[story['name']]['investigative_searches'] = [] + complete_stories[story['name']]['contextual_searches'] = [] + complete_stories[story['name']]['support_searches'] = [] + + # Finish the story + for story_name, story in sorted(complete_stories.iteritems()): + output_file.write("[%s]\n" % story_name) + output_file.write("category = %s\n" % story['category']) + output_file.write("creation_date = %s\n" % story['creation_date']) + output_file.write("modification_date = %s\n" % story['modification_date']) + output_file.write("id = %s\n" % story['id']) + output_file.write("version = %s\n" % story['version']) + output_file.write("reference = %s\n" % json.dumps(story['references'])) + + # REMOVE THIS FUNCTION MAKE SURE ALL DESCRIPTIONs ARE NATIVELY IN MARKDOWN + description = markdown(story['description']) + output_file.write("description = %s\n" % description) + + # REMOVE THIS FUNCTION MAKE SURE ALL NARRATIVE ARE NATIVELY IN MARKDOWN + if story['narrative']: + narrative = markdown(story['narrative']) + output_file.write("narrative = %s\n" % narrative) + output_file.write("\n") + + # close file, count stories we found and return + output_file.close() + story_count = len(story_files) + return story_count, story_output_path + + +if __name__ == "__main__": + + # grab arguments + parser = argparse.ArgumentParser(description="generates splunk conf files out of security-content manifests", epilog=""" + This tool converts manifests to the source files to be used by products like Splunk Enterprise. + It generates the savesearches.conf, analytics_stories.conf files for ES.""") + parser.add_argument("-p", "--path", required=True, help="path to security-security content repo") + parser.add_argument("-o", "--output", required=True, help="path to the output directory") + parser.add_argument("-v", "--verbose", required=False, action='store_true', help="prints verbose output") + + # parse them + args = parser.parse_args() + REPO_PATH = args.path + OUTPUT_DIR = args.output + verbose = args.verbose + + story_count, story_path = generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose) + print "{0} stories have been successfully to {1}".format(story_count, story_path) diff --git a/bin/validate.py b/bin/validate.py index 02882c4870..a19d91f206 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -765,7 +765,8 @@ def validate_baselines(REPO_PATH, verbose): if __name__ == "__main__": # grab arguments parser = argparse.ArgumentParser(description="validates security content manifest files", epilog=""" - Validates security manifest for correctness, adhering to spec and other common items.""") + Validates security manifest for correctness, adhering to spec and other common items. + VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""") parser.add_argument("-p", "--path", required=True, help="path to security-security content repo") parser.add_argument("-v", "--verbose", required=False, action='store_true', help="prints verbose output") # parse them diff --git a/bin/validate_manifests.py b/bin/validate_manifests.py deleted file mode 100644 index 41e6699dea..0000000000 --- a/bin/validate_manifests.py +++ /dev/null @@ -1,585 +0,0 @@ -#!/usr/bin/python -''' -Take the manifest files and build files for Enterprise Security -''' -import glob -import json -import jsonschema -import sys -import argparse -from os import path - -# HIGH Level Fields -STORY_CATEGORIES = [ - "Abuse", "Adversary Tactics", "Best Practices", - "Cloud Security", "Malware", "Vulnerability" -] - -VALID_SEARCH_TYPES = [ - "detection", "investigative", "contextual", "support" -] - -VALID_DATA_MODELS = [ - "Alerts", - "Application_State", - "Authentication", - "Certificates", - "Change_Analysis", - "Change", - "Malware", - "Email", - "Identity_Management", - "Network_Resolution", - "Network_Traffic", - "Vulnerabilities", - "Web", - "Network_Sessions", - "Updates", - "Risk", - "Endpoint"] - -RISK_OBJECCT_TYPE = [ - "system", "user", "other" -] - -PROVIDING_TECHNOLOGIES = [ - "Apache", "Bro", "Microsoft Windows", "Linux", "macOS", - "Netbackup", "Splunk Enterprise", "Splunk Enterprise Security", - "Splunk Stream", "Active Directory", "Bluecoat", - "Carbon Black Response", "Carbon Black Protect", "CrowdStrike Falcon", - "Microsoft Exchange", "Nessus", "Palo Alto Firewall", "Qualys", - "Sysmon", "Tanium", "Ziften", "AWS", "OSquery" -] - -KILL_CHAIN_PHASES = [ - "Reconnaissance", "Weaponization", "Delivery", "Exploitation", - "Installation", "Command and Control", "Actions on Objectives" -] - -CIS_CONTROLS = [ - "CIS 1", "CIS 2", "CIS 3", "CIS 4", "CIS 5", "CIS 6", "CIS 7", "CIS 8", - "CIS 9", "CIS 10", "CIS 11", "CIS 12", "CIS 13", "CIS 14", "CIS 15", - "CIS 16", "CIS 17", "CIS 18", "CIS 19", "CIS 20" -] - -NIST_FIELDS = [ - "ID.AM", "ID.RA", "PR.DS", "PR.IP", "PR.AC", "PR.PT", "PR.AT", "PR.MA", - "DE.CM", "DE.DP", "DE.AE", "RS.MI", "RS.AN", "RS.RP", "RS.IM", "RS.CO", - "RC.IM", "RC.CO" -] - -MITRE_ATTACK_FIELDS = [ - "Persistence", - "Privilege Escalation", - "Defense Evasion", - "Credential Access", - "Discovery", - "Lateral Movement", - "Authentication Package", - "Execution", - "Collection", - "Exfiltration", - "Command and Control", - "Accessibility Features", - "Account Discovery", - "AppInit DLLs", - "Application Deployment Software", - "Application Shimming", - "Application Window Discovery", - "Audio Capture", - "Automated Collection", - "Automated Exfiltration", - "Basic Input/Output System", - "Binary Padding", - "Bootkit", - "Brute Force", - "Bypass User Account Control", - "Change Default File Association", - "Clipboard Data", - "Code Signing", - "Command-Line Interface", - "Commonly Used Port", - "Communication Through Removable Media", - "Component Firmware", - "Component Object Model Hijacking", - "Connection Proxy", - "Credential Dumping", - "Credential Manipulation", - "Credentials in Files", - "Custom Command and Control Protocol", - "Custom Cryptographic Protocol", - "DLL Injection", - "DLL Search Order Hijacking", - "DLL Side-Loading", - "Data Compressed", - "Data Encrypted", - "Data Obfuscation", - "Data Staged", - "Data Transfer Size Limits", - "Data from Local System", - "Data from Network Shared Drive", - "Data from Removable Media", - "Disabling Security Tools", - "Email Collection", - "Execution through API", - "Exfiltration Over Alternative Protocol", - "Exfiltration Over Command and Control Channel", - "Exfiltration Over Other Network Medium", - "Exfiltration Over Physical Medium", - "Exploitation of Vulnerability", - "Fallback Channels", - "File Deletion", - "File System Logical Offsets", - "File System Permissions Weakness", - "File and Directory Discovery", - "Graphical User Interface", - "Hypervisor", - "Indicator Blocking", - "Indicator Removal from Tools", - "Indicator Removal on Host", - "Input Capture", - "InstallUtil", - "Legitimate Credentials", - "Local Network Configuration Discovery", - "Local Network Connections Discovery", - "Local Port Monitor", - "Logon Scripts", - "MSBuild", - "Masquerading", - "Modify Existing Service", - "Modify Registry", - "Multi-Stage Channels", - "Multiband Communication", - "Multilayer Encryption", - "NTFS Extended Attributes", - "Network Service Scanning", - "Network Share Connection Removal", - "Network Sniffing", - "New Service", - "Obfuscated Files or Information", - "Pass the Hash", - "Pass the Ticket", - "Path Interception", - "Peripheral Device Discovery", - "Permission Groups Discovery", - "PowerShell", - "Process Discovery", - "Process Hollowing", - "Query Registry", - "Redundant Access", - "Registry Run Keys / Start Folder", - "Regsvcs/Regasm", - "Regsvr32", - "Remote Desktop Protocol", - "Create Account", - "Remote File Copy", - "Remote Services", - "Remote System Discovery", - "Replication Through Removable Media", - "Rootkit", - "Rundll32", - "Scheduled Task", - "Scheduled Transfer", - "Screen Capture", - "Scripting", - "Security Software Discovery", - "Security Support Provider", - "Service Execution", - "Service Registry Permissions Weakness", - "Shared Webroot", - "Shortcut Modification", - "Software Packing", - "Standard Application Layer Protocol", - "Standard Cryptographic Protocol", - "Standard Non-Application Layer Protocol", - "System Information Discovery", - "System Owner/User Discovery", - "System Service Discovery", - "System Time Discovery", - "Taint Shared Content", - "Third-party Software", - "Timestomp", - "Two-Factor Authentication Interception", - "Uncommonly Used Port", - "Video Capture", - "Valid Accounts", - "Web Service", - "Web Shell", - "Windows Admin Shares", - "Windows Management Instrumentation Event Subscription", - "Windows Management Instrumentation", - "Windows Remote Management", - "Winlogon Helper DLL", - "Initial Access", - "Exploitation for Privilege Escalation"] - -ALL_UUIDS = [] - - -def validate_search_manifest(search): - '''Confirmsearch has the required fields for savedsearches.conf''' - errors = [] - if search['search_id'] == '': - errors.append('ERROR: Blank Search ID') - - if search['search_id'] in ALL_UUIDS: - errors.append('ERROR: Duplicate UUID found: %s' % search['search_id']) - else: - ALL_UUIDS.append(search['search_id']) - - if search['search_name'].endswith(" "): - errors.append( - "ERROR: Search name has trailing spaces: '%s'" % - search['search_name']) - - if search['search_type'] not in VALID_SEARCH_TYPES: - errors.append("ERROR: Invalid search type: %s" % search['search_type']) - - if 'mappings' in search: - if 'kill_chain_phases' in search['mappings']: - for kill_chain in search['mappings']['kill_chain_phases']: - if kill_chain not in KILL_CHAIN_PHASES: - errors.append( - 'ERROR: Invalid kill chain phase: %s' % - kill_chain) - - if 'cis20' in search['mappings']: - for cis in search['mappings']['cis20']: - if cis not in CIS_CONTROLS: - errors.append('ERROR: Invalid CIS field: %s' % cis) - - if 'mitre_attack' in search['mappings']: - for attack in search['mappings']['mitre_attack']: - if attack not in MITRE_ATTACK_FIELDS: - errors.append('ERROR: Invalid ATT&CK label %s' % attack) - - if 'nist' in search['mappings']: - for nist in search['mappings']['nist']: - if nist not in NIST_FIELDS: - errors.append('ERROR: Invalid nist label %s' % nist) - - if 'data_models' in search['data_metadata']: - for data_model in search['data_metadata']['data_models']: - if data_model not in VALID_DATA_MODELS: - errors.append('ERROR: Invalid data model: %s' % data_model) - - if data_model not in search['search']: - errors.append( - 'WARNING: Data model listed but is not in search: %s' % - data_model) - - if 'providing_technologies' in search['data_metadata']: - for providing_technology in \ - search['data_metadata']['providing_technologies']: - if providing_technology not in PROVIDING_TECHNOLOGIES: - errors.append( - 'ERRORS: Unknown product in providing technologies: %s' % - providing_technology) - - if search['search_type'] == 'detection': - try: - if search['correlation_rule']['risk']: - for risk_object_type in \ - search['correlation_rule']['risk']['risk_object_type']: - if risk_object_type not in RISK_OBJECCT_TYPE: - errors.append( - 'ERRORS: Unknown risk object type, must be system, \ - user, or other got: %s' % - risk_object_type) - except BaseException: - errors.append('WARNING: correlation_rule is missing risk object') - - if 'providing_technologies' in search['data_metadata']: - for providing_technology in \ - search['data_metadata']['providing_technologies']: - if providing_technology not in PROVIDING_TECHNOLOGIES: - errors.append( - 'ERRORS: Unknown product in providing technologies: %s' % - providing_technology) - # Check to see if datamodel or tstats is in the search. If so, make sure - # data_models is defined - if '| tstats' in search['search'] or 'datamodel' in search['search']: - if 'data_models' not in search['data_metadata']: - errors.append( - "The search uses a data model but 'data_models' \ - field is not set") - - if 'data_models' in search and not \ - search['data_metadata']['data_models']: - errors.append( - "The search uses a data model but 'data_models' is empty") - - if 'sourcetype' in search['search']: - if 'data_sourcetypes' not in search['data_metadata']: - errors.append( - "The search specifies a sourcetype but 'data_sourcetypes' \ - field is not set") - - if 'data_sourcetypes' in search and not \ - search['data_metadata']['data_sourcetypes']: - errors.append( - "The search specifies a sourcetype but \ - 'data_sourcetypes' is empty") - - try: - search['search_description'].encode('ascii') - except UnicodeEncodeError: - errors.append("search_description not ascii") - - if 'how_to_implement' in search: - try: - search['how_to_implement'].encode('ascii') - except UnicodeEncodeError: - errors.append("how_to_implement not ascii") - - if 'eli5' in search: - try: - search['eli5'].encode('ascii') - except UnicodeEncodeError: - errors.append("eli5 not ascii") - - if 'known_false_positives' in search: - try: - search['known_false_positives'].encode('ascii') - except UnicodeEncodeError: - errors.append("known_false_positives not ascii") - - if 'correlation_rule' in search and 'notable' in \ - search['correlation_rule']: - try: - search['correlation_rule']['notable']['rule_title'].encode('ascii') - except UnicodeEncodeError: - errors.append("rule_title not ascii") - - try: - search['correlation_rule']['notable']['rule_description'].encode( - 'ascii') - except UnicodeEncodeError: - errors.append("rule_description not ascii") - - return errors - - -def validate_story_manifest(story): - ''' Validate that the analytic story manifest is in the proper format ''' - errors = [] - - if story['id'] == '': - errors.append('ERROR: Blank Content ID') - - if story['id'] in ALL_UUIDS: - errors.append('ERROR: Duplicate UUID found: %s' % story['id']) - else: - ALL_UUIDS.append(story['id']) - - try: - story['description'].encode('ascii') - except UnicodeEncodeError: - errors.append("description not ascii") - - try: - story['narrative'].encode('ascii') - except UnicodeEncodeError: - errors.append("narrative not ascii") - - if story['category'] not in STORY_CATEGORIES: - errors.append('ERROR: Invalid category found: %s' % story['category']) - return errors - - -def main(): - ''' Open manifest file, validate required fields ''' - - errors = False - story_manifests = {} - story_schema_file = path.join( - path.expanduser(MANIFEST_DIRECTORY), - 'spec/analytic_story.json.spec') - story_schema = json.loads(open(story_schema_file, 'rb').read()) - story_manifest_files = path.join(path.expanduser(MANIFEST_DIRECTORY), - "*/stories/*.json") - for story_manifest_file in glob.glob(story_manifest_files): - try: - story_manifest_data = json.loads( - open(story_manifest_file, 'r').read()) - except Exception as e: - print "Error reading %s" % story_manifest_file - errors = True - continue - - try: - jsonschema.validate(story_manifest_data, story_schema) - except jsonschema.exceptions.ValidationError as json_ve: - print story_manifest_file - print json_ve.message - errors = True - continue - - story_errors = validate_story_manifest(story_manifest_data) - if story_errors: - errors = True - for err in story_errors: - print path.basename(story_manifest_file) - print "\t%s" % err - - story_manifests[story_manifest_data['name']] = story_manifest_data - - detection_search_schema_file = path.join( - path.expanduser(MANIFEST_DIRECTORY), 'spec/detection_search.json.spec') - detection_search_schema = json.loads( - open(detection_search_schema_file, 'rb').read()) - contextual_search_schema_file = path.join( - path.expanduser(MANIFEST_DIRECTORY), - 'spec/contextual_search.json.spec') - contextual_search_schema = json.loads( - open(contextual_search_schema_file, 'rb').read()) - investigative_search_schema_file = path.join( - path.expanduser(MANIFEST_DIRECTORY), - 'spec/investigative_search.json.spec') - investigative_search_schema = json.loads( - open(investigative_search_schema_file, 'rb').read()) - support_search_schema_file = path.join( - path.expanduser(MANIFEST_DIRECTORY), 'spec/support_search.json.spec') - support_search_schema = json.loads( - open(support_search_schema_file, 'rb').read()) - - search_manifests = {} - search_manifest_files = path.join( - path.expanduser(MANIFEST_DIRECTORY), "*/searches/*.json") - for search_manifest_file in glob.glob(search_manifest_files): - try: - search_manifest_data = json.loads( - open(search_manifest_file, 'r').read()) - except Exception as e: - errors = True - print "Error reading %s" % search_manifest_file - print e - continue - - if 'status' in search_manifest_data and \ - search_manifest_data['status'] == 'development': - continue - - if 'search_type' not in search_manifest_data: - print "Error in %s, no search_type found" % search_manifest_file - errors = True - continue - - if search_manifest_data['search_type'] not in [ - 'support', 'detection', 'contextual', 'investigative']: - print "Error in %s, invalid search_type, %s, found" % ( - search_manifest_file, search_manifest_data) - errors = True - continue - - try: - if search_manifest_data['search_type'] == 'detection': - search_schema = detection_search_schema - elif search_manifest_data['search_type'] == 'contextual': - search_schema = contextual_search_schema - elif search_manifest_data['search_type'] == 'investigative': - search_schema = investigative_search_schema - else: - search_schema = support_search_schema - - jsonschema.validate(search_manifest_data, search_schema) - except jsonschema.exceptions.ValidationError as json_ve: - errors = True - print search_manifest_file - print json_ve.message - except Exception as broad_exception: - errors = True - print search_manifest_file - print broad_exception - - sm_errors = validate_search_manifest(search_manifest_data) - if sm_errors: - errors = True - for err in sm_errors: - print path.basename(search_manifest_file) - print "\t%s" % err - - search_manifests[search_manifest_data['search_name'] - ] = search_manifest_data - - for story_name, story_data in story_manifests.iteritems(): - if 'detection_searches' in story_data['searches']: - for ds in story_data['searches']['detection_searches']: - if ds not in search_manifests: - print "INFO: %s has a detection search, \ - %s, not in local repo. Verify name of search provided \ - in Enterprise Security Content Updates" % ( - story_name, ds) - continue - - if search_manifests[ds]['search_type'] != 'detection': - errors = True - print "ERROR: \"%s\" mislabeled \"%s\" \ - as a detection search" % ( - story_name, ds) - - if 'investigative_searches' in story_data['searches']: - for invs in story_data['searches']['investigative_searches']: - if invs not in search_manifests: - print "INFO: %s has an investigative search, \ - %s, not in local repo. \ - Verify name of search provided in \ - Enterprise Security Content Updates" % ( - story_name, invs) - continue - - if search_manifests[invs]['search_type'] != 'investigative': - errors = True - print "ERROR: \"%s\" mislabeled \"%s\" \ - as a investigative search" % ( - story_name, invs) - - if 'contextual_searches' in story_data['searches']: - for cs in story_data['searches']['contextual_searches']: - if cs not in search_manifests: - print "INFO: %s has a contextual search, \ - %s, not in local repo. Verify name of search provided \ - in Enterprise Security Content Updates" \ - % (story_name, cs) - continue - - if search_manifests[cs]['search_type'] != 'contextual': - errors = True - print "ERROR: \"%s\" mislabeled \"%s\" \ - as a contextual search" % ( - story_name, cs) - - if 'support_searches' in story_data['searches']: - for ss in story_data['searches']['support_searches']: - if ss not in search_manifests: - print "INFO: %s has a support search, %s, \ - not in local repo. Verify name of search provided \ - in Enterprise Security Content Updates" % ( - story_name, ss) - continue - - if search_manifests[ss]['search_type'] != 'support': - errors = True - print "ERROR: \"%s\" mislabeled \"%s\" \ - as a support search" % ( - story_name, ss) - - print "%d story manifests checked" % len(story_manifests) - print "%d search manifests checked" % len(search_manifests) - - if errors: - sys.exit("Errors found") - else: - print "No errors found" - - -if __name__ == "__main__": - # grab arguments - parser = argparse.ArgumentParser(description="validates security content manifests", epilog=""" - Validates security manifest for correctness, adhering to spec and other common items.""") - parser.add_argument("-p", "--path", required=True, help="path to security-security content repo") - - # parse them - args = parser.parse_args() - MANIFEST_DIRECTORY = args.path - main() From a9bb9bad0d807ddcf4b721f04f71f4583fe80b50 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 14:34:35 -0400 Subject: [PATCH 62/74] updated spec and examples to correct some def errors --- spec/v2/baselines.spec.json | 26 +++++++++++-------- .../baseline_dns_record_changed.json.example | 2 +- spec/v2/investigations.spec.json | 20 +++++++------- 3 files changed, 26 insertions(+), 22 deletions(-) diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index 323946e191..50ff85d3ca 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -1,7 +1,6 @@ { "$id": "https://api.splunkresearch.com/schemas/baselines.json", "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, "definitions": { "phantom": { "properties": { @@ -30,26 +29,34 @@ }, "splunk": { "properties": { - "scheduling": { + "schedule": { "additionalProperties": false, - "description": "Various fields to assist in scheduling the search", + "description": "The fields associated on when this search should run relative to the detection event", "properties": { "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" + "description": "The number of seconds into the past from the event time the search should cover", + "type": "integer" }, "latest_time": { - "description": "The latest time tes search should run against in Splunk format", - "type": "string" + "description": "The number of seconds into the future from the event time the search should cover", + "type": "integer" } }, + "required": [ + "latest_time", + "earliest_time" + ], "type": "object" }, "search": { - "description": "The search (in SPL) executed within core Splunk for creating a baseline", + "description": "The search (in SPL) executed within core Splunk for investgation.", "type": "string" } }, + "required": [ + "search", + "schedule" + ], "type": "object" } }, @@ -70,7 +77,6 @@ "type": "string" }, "data_metadata": { - "additionalProperties": false, "description": "Information about the date being ingested", "properties": { "data_eventtypes": { @@ -222,7 +228,6 @@ "maintainers": { "description": "An array of the current maintainers of the Analytic Story.", "items": { - "additionalProperties": false, "properties": { "company": { "description": "Company associated with the person maintaining this search", @@ -257,7 +262,6 @@ "original_authors": { "description": "A list of the original authors of the search", "items": { - "additionalProperties": false, "properties": { "company": { "description": "Company associated with the person who originally authored the search", diff --git a/spec/v2/example/baseline_dns_record_changed.json.example b/spec/v2/example/baseline_dns_record_changed.json.example index adaae015bc..562e8dabf4 100644 --- a/spec/v2/example/baseline_dns_record_changed.json.example +++ b/spec/v2/example/baseline_dns_record_changed.json.example @@ -1,7 +1,7 @@ { "baseline": { "splunk": { - "scheduling": { + "schedule": { "earliest_time": "-30d@d", "latest_time": "-10m@m" }, diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index 6f055b80eb..13843b9a18 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -54,34 +54,34 @@ "type": "array", "uniqueItems": true }, - "search": { - "description": "The search (in SPL) executed within core Splunk for investgation.", - "type": "string" - }, - "window": { + "schedule": { "additionalProperties": false, "description": "The fields associated on when this search should run relative to the detection event", "properties": { - "earliest_time_offset": { + "earliest_time": { "description": "The number of seconds into the past from the event time the search should cover", "type": "integer" }, - "latest_time_offset": { + "latest_time": { "description": "The number of seconds into the future from the event time the search should cover", "type": "integer" } }, "required": [ - "latest_time_offset", - "earliest_time_offset" + "latest_time", + "earliest_time" ], "type": "object" + }, + "search": { + "description": "The search (in SPL) executed within core Splunk for investgation.", + "type": "string" } }, "required": [ "search", "fields_required", - "window" + "schedule" ], "type": "object" } From b923dc56c35c1151ccd4c72a05d7b2bfcd770115 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 14:47:10 -0400 Subject: [PATCH 63/74] updated investigations --- spec/v2/investigations.spec.json | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index 13843b9a18..aaeeddc95e 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -16,22 +16,14 @@ "description": "Url of the playbook on Phantom website.", "type": "string" }, - "sensitivity": { - "description": "TLP colors (White, Green, Amber or Red)", - "type": "string" - }, - "severity": { - "description": "Severity in phantom (High, Medium, Low)", - "type": "string" - }, - "window": { + "schedule": { "description": "The time associated on when this investigste object should run relative to the detection event", "properties": { - "earliest_time_offset": { + "earliest_time": { "description": "The number of seconds into the past from the event time the search should cover", "type": "integer" }, - "latest_time_offset": { + "latest_time": { "description": "The number of seconds into the future from the event time the search should cover", "type": "integer" } @@ -42,6 +34,14 @@ "playbook_url" ], "type": "object" + }, + "sensitivity": { + "description": "TLP colors (White, Green, Amber or Red)", + "type": "string" + }, + "severity": { + "description": "Severity in phantom (High, Medium, Low)", + "type": "string" } }, "type": "object" From 43093da142d4f0613ee0f9fab00e62dba5b6ea91 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 2 Apr 2019 14:28:20 -0700 Subject: [PATCH 64/74] story spec with example and docs --- docs/story.spec.md | 173 +++++++++++++++++++++++++++++++++++++--- spec/v2/story.spec.json | 67 +++++++++++++++- 2 files changed, 225 insertions(+), 15 deletions(-) diff --git a/docs/story.spec.md b/docs/story.spec.md index 3a14126951..518fed76d7 100644 --- a/docs/story.spec.md +++ b/docs/story.spec.md @@ -15,7 +15,7 @@ The fields that make up the manifest of a version 2 Analytic Story | Property | Type | Required | Nullable | Defined by | |----------|------|----------|----------|------------| -| [category](#category) | `enum` | **Required** | No | Analytic Story Manifest (this schema) | +| [category](#category) | `enum[]` | **Required** | No | Analytic Story Manifest (this schema) | | [channel](#channel) | `string` | Optional | No | Analytic Story Manifest (this schema) | | [creation_date](#creation_date) | `string` | Optional | No | Analytic Story Manifest (this schema) | | [description](#description) | `string` | **Required** | No | Analytic Story Manifest (this schema) | @@ -28,6 +28,7 @@ The fields that make up the manifest of a version 2 Analytic Story | [original_authors](#original_authors) | `object[]` | Optional | No | Analytic Story Manifest (this schema) | | [references](#references) | `string[]` | Optional | No | Analytic Story Manifest (this schema) | | [spec_version](#spec_version) | `integer` | Optional | No | Analytic Story Manifest (this schema) | +| [usecase](#usecase) | `enum` | **Required** | No | Analytic Story Manifest (this schema) | | [version](#version) | `string` | **Required** | No | Analytic Story Manifest (this schema) | | `*` | any | Additional | Yes | this schema *allows* additional properties | @@ -38,20 +39,23 @@ The category to which the Analytic Story belongs `category` * is **required** -* type: `enum` +* type: `enum[]` +* at least `0` items in the array * defined in this schema -The value of this property **must** be equal to one of the [known values below](#category-known-values). +### category Type + + +Array type: `enum[]` + +All items must be of the type: +`string` + + + + + -### category Known Values -| Value | Description | -|-------|-------------| -| `Abuse` | | -| `Adversary Tactics` | | -| `Best Practices` | | -| `Cloud Security` | | -| `Malware` | | -| `Vulnerability` | | @@ -76,6 +80,12 @@ A grouping function that designates where this search came from. For example, se +### channel Example + +```json +"ESCU" +``` + ## creation_date @@ -97,6 +107,12 @@ The date this story was created +### creation_date Example + +```json +"2017-11-21" +``` + ## description @@ -118,6 +134,12 @@ A high-level description or goal of the Analytic Story +### description Example + +```json +"Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records." +``` + ## detections @@ -165,6 +187,12 @@ unique identifier of the detection, in the form of UUID +##### detection_id Example + +```json +1169w17b-ef78-4b59-aae8-5369073014e1 +``` + @@ -187,6 +215,12 @@ Name of the Detection. It can be a name of a Splunk correlation search name, a U +##### name Example + +```json +DNS record changed +``` + @@ -210,6 +244,20 @@ The value of this property **must** be equal to one of the [known values below]( +##### type Examples + +```json +splunk +``` + +```json +uba +``` + +```json +phantom +``` + @@ -292,6 +340,12 @@ Company associated with the person maintaining this Analytic Story +##### company Example + +```json +Splunk +``` + @@ -314,6 +368,12 @@ Email address of the person maintaining this Analytic Story +##### email Example + +```json +daftpunk@splunk.com +``` + @@ -336,6 +396,11 @@ Name of the person maintaining this Analytic Story +##### name Example + +```json +Daft Punk +``` @@ -365,6 +430,12 @@ The date of the most recent modification to this Analytic Story +### modification_date Example + +```json +"2018-09-06" +``` + ## name @@ -386,6 +457,12 @@ The name of the Analytic Story +### name Example + +```json +"DNS Hijacking" +``` + ## narrative @@ -407,6 +484,12 @@ Long-form text that describes the Analytic Story and the rationale behind it, as +### narrative Example + +```json +"Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.

    The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous." +``` + ## original_authors @@ -454,6 +537,12 @@ Company associated with the person who originally authored the Analytic Story +##### company Example + +```json +Splunk +``` + @@ -476,6 +565,12 @@ Email address of the person who originally authored the Analytic Story +##### email Example + +```json +daftpunk@splunk.com +``` + @@ -498,6 +593,11 @@ Name of the person who originally authored the Analytic Story +##### name Example + +```json +Daft Punk +``` @@ -533,6 +633,11 @@ All items must be of the type: +### references Example + +```json +"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html" +``` ## spec_version @@ -555,10 +660,46 @@ The version of the Analytic Story specification this manifest follows +### spec_version Example + +```json +2 +``` + + +## usecase + +The usecase to which the Analytic Story belongs to. + +`usecase` + +* is **required** +* type: `enum` +* defined in this schema + +The value of this property **must** be equal to one of the [known values below](#usecase-known-values). + +### usecase Known Values +| Value | Description | +|-------|-------------| +| `Security Monitoring` | | +| `Advanced Threat Detection` | | +| `Insider Threat` | | +| `Compliance` | | +| `Fraud Detection` | | + + + +### usecase Example + +```json +"Advanced Threat Detection" +``` + ## version -The version of the Analytic Story +The version of the Analytic Story, bump the version number when the story gets an update `version` @@ -576,3 +717,9 @@ The version of the Analytic Story +### version Example + +```json +"1.0" +``` + diff --git a/spec/v2/story.spec.json b/spec/v2/story.spec.json index 01ac342a00..2b34152acc 100644 --- a/spec/v2/story.spec.json +++ b/spec/v2/story.spec.json @@ -41,7 +41,11 @@ "Unauthorized Software", "Vulnerability", "Web Attack" - ] + ], + "examples": [ + "Adversary Tactics" + ], + "type": "string" }, "minItems": 0, "type": "array", @@ -49,14 +53,23 @@ }, "channel": { "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Content Updates are in the ESCU channel", + "examples": [ + "ESCU" + ], "type": "string" }, "creation_date": { "description": "The date this story was created", + "examples": [ + "2017-11-21" + ], "type": "string" }, "description": { "description": "A high-level description or goal of the Analytic Story", + "examples": [ + "Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records." + ], "type": "string" }, "detections": { @@ -66,10 +79,16 @@ "properties": { "detection_id": { "description": "unique identifier of the detection, in the form of UUID", + "examples": [ + "1169w17b-ef78-4b59-aae8-5369073014e1" + ], "type": "string" }, "name": { "description": "Name of the Detection. It can be a name of a Splunk correlation search name, a UBA threat or a Phantom detection playbook.", + "examples": [ + "DNS record changed" + ], "type": "string" }, "type": { @@ -79,6 +98,11 @@ "uba", "phantom" ], + "examples": [ + "splunk", + "uba", + "phantom" + ], "type": "string" } }, @@ -106,14 +130,23 @@ "properties": { "company": { "description": "Company associated with the person maintaining this Analytic Story", + "examples": [ + "Splunk" + ], "type": "string" }, "email": { "description": "Email address of the person maintaining this Analytic Story", + "examples": [ + "daftpunk@splunk.com" + ], "type": "string" }, "name": { "description": "Name of the person maintaining this Analytic Story", + "examples": [ + "Daft Punk" + ], "type": "string" } }, @@ -128,14 +161,23 @@ }, "modification_date": { "description": "The date of the most recent modification to this Analytic Story", + "examples": [ + "2018-09-06" + ], "type": "string" }, "name": { "description": "The name of the Analytic Story", + "examples": [ + "DNS Hijacking" + ], "type": "string" }, "narrative": { "description": "Long-form text that describes the Analytic Story and the rationale behind it, as well as an overview of the included searches, and how they enable the story", + "examples": [ + "Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.

    The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous." + ], "type": "string" }, "original_authors": { @@ -145,14 +187,23 @@ "properties": { "company": { "description": "Company associated with the person who originally authored the Analytic Story", + "examples": [ + "Splunk" + ], "type": "string" }, "email": { "description": "Email address of the person who originally authored the Analytic Story", + "examples": [ + "daftpunk@splunk.com" + ], "type": "string" }, "name": { "description": "Name of the person who originally authored the Analytic Story", + "examples": [ + "Daft Punk" + ], "type": "string" } }, @@ -167,6 +218,9 @@ }, "references": { "description": "An array of URLs that give information about the problem the story is addressing", + "examples": [ + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html" + ], "items": { "type": "string" }, @@ -176,6 +230,9 @@ }, "spec_version": { "description": "The version of the Analytic Story specification this manifest follows", + "examples": [ + 2 + ], "type": "integer" }, "usecase": { @@ -186,10 +243,16 @@ "Insider Threat", "Compliance", "Fraud Detection" + ], + "examples": [ + "Advanced Threat Detection" ] }, "version": { - "description": "The version of the Analytic Story", + "description": "The version of the Analytic Story, bump the version number when the story gets an update", + "examples": [ + "1.0" + ], "type": "string" } }, From 6b852b50c3414c7bd33e25e473a1198fac1c3c4c Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 17:03:26 -0500 Subject: [PATCH 65/74] fixed error in validate --- bin/validate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/validate.py b/bin/validate.py index a19d91f206..4f3cf1d9a5 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -113,7 +113,7 @@ def validate_investigation_contentv2(investigation, investigation_uuids, errors) except UnicodeEncodeError: errors.append("ERROR: known_false_positives not ascii") - if investigation['investigate']['splunk']: + if 'splunk' in investigation['investigate']: # do a regex match here instead of key values if (investigation['investigate']['splunk']['search'].find('tstats') != -1) or \ From d76848cb392cce3a77f96939d67f49de0f42d1ec Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 17:03:55 -0500 Subject: [PATCH 66/74] correct mistakes with the sub schema validation --- spec/v2/investigations.spec.json | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index aaeeddc95e..78136dd0f1 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -28,11 +28,6 @@ "type": "integer" } }, - "required": [ - "playbook_name", - "phantom_server", - "playbook_url" - ], "type": "object" }, "sensitivity": { @@ -44,6 +39,11 @@ "type": "string" } }, + "required": [ + "playbook_name", + "phantom_server", + "playbook_url" + ], "type": "object" }, "splunk": { @@ -239,14 +239,27 @@ "type": "string" }, "investigate": { - "oneOf": [ + "anyOf": [ { - "$ref": "#/definitions/splunk" + "required": [ + "splunk" + ] }, { + "required": [ + "phantom" + ] + } + ], + "properties": { + "phantom": { "$ref": "#/definitions/phantom" + }, + "splunk": { + "$ref": "#/definitions/splunk" } - ] + }, + "type": "object" }, "known_false_positives": { "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", From 6112fcc9e6ee022b60403cfdab20e2db9b3db62e Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 17:31:02 -0500 Subject: [PATCH 67/74] updating schedule field in specs, also corrected validation logic --- spec/v2/baselines.spec.json | 61 +++++++++++++++++++++++++------- spec/v2/detections.spec.json | 38 ++++++++++++++------ spec/v2/investigations.spec.json | 33 +++++++++-------- spec/v2/responses.spec.json | 53 +++++++++++++++++---------- 4 files changed, 128 insertions(+), 57 deletions(-) diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index 50ff85d3ca..e22898f33a 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -16,6 +16,24 @@ "description": "Url of the playbook on Phantom website.", "type": "string" }, + "schedule": { + "description": "Various fields to assist in scheduling the search", + "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" + } + }, + "type": "object" + }, "sensitivity": { "description": "TLP colors (White, Green, Amber or Red)", "type": "string" @@ -25,27 +43,31 @@ "type": "string" } }, + "required": [ + "phantom_server", + "playbook_name", + "playbook_url" + ], "type": "object" }, "splunk": { "properties": { "schedule": { - "additionalProperties": false, - "description": "The fields associated on when this search should run relative to the detection event", + "description": "Various fields to assist in scheduling the search", "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, "earliest_time": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" + "description": "The earliest time the search should run in Splunk format", + "type": "string" }, "latest_time": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" + "description": "The latest time tes search should run against in Splunk format", + "type": "string" } }, - "required": [ - "latest_time", - "earliest_time" - ], "type": "object" }, "search": { @@ -63,14 +85,27 @@ "description": "The fields that make up the manifest of a version 2 baseline search", "properties": { "baseline": { - "oneOf": [ + "anyOf": [ { - "$ref": "#/definitions/splunk" + "required": [ + "splunk" + ] }, { + "required": [ + "phantom" + ] + } + ], + "properties": { + "phantom": { "$ref": "#/definitions/phantom" + }, + "splunk": { + "$ref": "#/definitions/splunk" } - ] + }, + "type": "object" }, "creation_date": { "description": "The date the baseline manifest was created", diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 1227fd5fb2..b8f2a93269 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -64,7 +64,7 @@ ], "type": "object" }, - "scheduling": { + "schedule": { "description": "Various fields to assist in scheduling the search", "properties": { "cron_schedule": { @@ -107,7 +107,7 @@ }, "required": [ "search", - "scheduling" + "schedule" ], "type": "object" }, @@ -201,7 +201,7 @@ ], "type": "object" }, - "scheduling": { + "schedule": { "description": "Various fields to assist in scheduling the search", "properties": { "cron_schedule": { @@ -244,7 +244,7 @@ }, "required": [ "search", - "scheduling" + "schedule" ], "type": "object" }, @@ -312,7 +312,7 @@ ], "type": "object" }, - "scheduling": { + "schedule": { "description": "Various fields to assist in scheduling the search", "properties": { "cron_schedule": { @@ -355,7 +355,7 @@ }, "required": [ "search", - "scheduling" + "schedule" ], "type": "object" }, @@ -537,17 +537,35 @@ "type": "string" }, "detect": { - "oneOf": [ + "anyOf": [ { - "$ref": "#/definitions/splunk" + "required": [ + "splunk" + ] }, { - "$ref": "#/definitions/phantom" + "required": [ + "phantom" + ] }, { + "required": [ + "uba" + ] + } + ], + "properties": { + "phantom": { + "$ref": "#/definitions/phantom" + }, + "splunk": { + "$ref": "#/definitions/splunk" + }, + "uba": { "$ref": "#/definitions/uba" } - ] + }, + "type": "object" }, "eli5": { "description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index 78136dd0f1..58654106dd 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -17,15 +17,19 @@ "type": "string" }, "schedule": { - "description": "The time associated on when this investigste object should run relative to the detection event", + "description": "Various fields to assist in scheduling the search", "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, "earliest_time": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" + "description": "The earliest time the search should run in Splunk format", + "type": "string" }, "latest_time": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" + "description": "The latest time tes search should run against in Splunk format", + "type": "string" } }, "type": "object" @@ -55,22 +59,21 @@ "uniqueItems": true }, "schedule": { - "additionalProperties": false, - "description": "The fields associated on when this search should run relative to the detection event", + "description": "Various fields to assist in scheduling the search", "properties": { + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" + }, "earliest_time": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" + "description": "The earliest time the search should run in Splunk format", + "type": "string" }, "latest_time": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" + "description": "The latest time tes search should run against in Splunk format", + "type": "string" } }, - "required": [ - "latest_time", - "earliest_time" - ], "type": "object" }, "search": { diff --git a/spec/v2/responses.spec.json b/spec/v2/responses.spec.json index 0e1c788241..3edaf76302 100644 --- a/spec/v2/responses.spec.json +++ b/spec/v2/responses.spec.json @@ -1,7 +1,6 @@ { - "$id": "https://api.splunkresearch.com/schemas/investigations.json", + "$id": "https://api.splunkresearch.com/schemas/responses.json", "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, "definitions": { "phantom": { "properties": { @@ -43,23 +42,22 @@ }, "splunk": { "properties": { - "investigate_window": { - "additionalProperties": false, - "description": "The fields associated on when this search should run relative to the detection event", + "schedule": { + "description": "Various fields to assist in scheduling the search", "properties": { - "earliest_time_offset": { - "description": "The number of seconds into the past from the event time the search should cover", - "type": "integer" + "cron_schedule": { + "description": "Schedule of the search in cron format", + "type": "string" }, - "latest_time_offset": { - "description": "The number of seconds into the future from the event time the search should cover", - "type": "integer" + "earliest_time": { + "description": "The earliest time the search should run in Splunk format", + "type": "string" + }, + "latest_time": { + "description": "The latest time tes search should run against in Splunk format", + "type": "string" } }, - "required": [ - "latest_time_offset", - "earliest_time_offset" - ], "type": "object" }, "search": { @@ -67,10 +65,14 @@ "type": "string" } }, + "required": [ + "search", + "schedule" + ], "type": "object" } }, - "description": "The fields that make up the manifest of a version 1 reponse spec", + "description": "The fields that make up the manifest of a version 1 response spec", "properties": { "creation_date": { "description": "The date the story manifest was created", @@ -279,14 +281,27 @@ ] }, "response": { - "oneOf": [ + "anyOf": [ { - "$ref": "#/definitions/splunk" + "required": [ + "splunk" + ] }, { + "required": [ + "phantom" + ] + } + ], + "properties": { + "phantom": { "$ref": "#/definitions/phantom" + }, + "splunk": { + "$ref": "#/definitions/splunk" } - ] + }, + "type": "object" }, "spec_version": { "description": "The version of the investigative search specification this manifest follows", From cfeccbd73e6ab666ecfe380b79f5a38f96b27ff4 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 2 Apr 2019 17:31:57 -0500 Subject: [PATCH 68/74] removed example spec --- spec/v2/one_of.spec.json | 218 --------------------------------------- 1 file changed, 218 deletions(-) delete mode 100644 spec/v2/one_of.spec.json diff --git a/spec/v2/one_of.spec.json b/spec/v2/one_of.spec.json deleted file mode 100644 index e39ea9e51e..0000000000 --- a/spec/v2/one_of.spec.json +++ /dev/null @@ -1,218 +0,0 @@ -{ - "$id": "https://api.splunkresearch.com/schemas/detections.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "correlation_rule": { - "properties": { - "description": "Various fields to enhance usability in Enterprise Security", - "properties": { - "notable": { - "description": "Various fields associated with creating a notable event", - "properties": { - "nes_fields": { - "description": "A list of suggested fields to be used for notable-event suppression", - "type": "string" - }, - "rule_description": { - "description": "Description of the notable event that will display in Incident Review", - "type": "string" - }, - "rule_title": { - "description": "Title of the notable event that will display in Incident Review", - "type": "string" - } - }, - "required": [ - "rule_description", - "rule_title", - "nes_fields" - ], - "type": "object" - }, - "risk": { - "description": "Fields associated with assigning risk to objects", - "properties": { - "risk_object": { - "description": "TThe field to which you are assigning risk", - "type": "string" - }, - "risk_object_type": { - "description": "The type of object to which you are assigning risk", - "items": { - "enum": [ - "system", - "user", - "other" - ], - "type": "string" - }, - "maxItems": 1, - "minItems": 0, - "type": "array", - "uniqueItems": true - }, - "risk_score": { - "description": "Score assigned to risk_object", - "type": "integer" - } - }, - "required": [ - "risk_score", - "risk_object", - "risk_object_type" - ], - "type": "object" - }, - "scheduling": { - "description": "Various fields to assist in scheduling the search", - "properties": { - "cron_schedule": { - "description": "Schedule of the search in cron format", - "type": "string" - }, - "earliest_time": { - "description": "The earliest time the search should run in Splunk format", - "type": "string" - }, - "latest_time": { - "description": "The latest time tes search should run against in Splunk format", - "type": "string" - } - }, - "type": "object" - }, - "search": { - "description": "The search that will trigger phantom playbook", - "type": "string" - }, - "suppress": { - "description": "Fields associated with suppressing the creation of multiple alerts", - "properties": { - "suppress_fields": { - "description": "The fields to base the suppression on", - "type": "string" - }, - "suppress_period": { - "description": "The length of time the suppression should be in effect", - "type": "string" - } - }, - "required": [ - "suppress_fields", - "suppress_period" - ], - "type": "object" - } - }, - "required": [ - "search", - "scheduling" - ], - "type": "object" - }, - "type": "object" - }, - "definitions": { - "phantom": { - "properties": { - "correlation_rule": { - "$ref": "#/correlation_rule" - }, - "phantom_server": { - "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", - "type": "string" - }, - "playbook_name": { - "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", - "type": "string" - }, - "playbook_url": { - "description": "Url of the playbook on Phantom website.", - "type": "string" - }, - "sensitivity": { - "description": "TLP colors (White, Green, Amber or Red)", - "type": "string" - }, - "severity": { - "description": "Severity in phantom (High, Medium, Low)", - "type": "string" - } - }, - "required": [ - "playbook_name", - "phantom_server", - "playbook_url" - ], - "type": "object" - }, - "splunk": { - "properties": { - "correlation_rule": { - "$ref": "#/correlation_rule" - } - }, - "required": [ - "correlation_rule" - ], - "type": "object" - }, - "uba": { - "properties": { - "correlation_rule": { - "$ref": "#/correlation_rule" - }, - "event_type": { - "description": "An anomaly or threat.", - "type": "string" - }, - "model": { - "description": "The name of the Splunk UBA model that detected the anomaly.", - "type": "string" - }, - "model_version": { - "description": "Url of the playbook on Phantom website.", - "type": "string" - }, - "threat_category": { - "description": "The category of a threat in Splunk UBA.", - "type": "string" - } - }, - "required": [ - "correlation_rule", - "event_type", - "model", - "model_version", - "threat_category" - ], - "type": "object" - } - }, - "description": "A object that defines the parameters for detecting things using various Splunk capabilities", - "properties": { - "detect": { - "anyOf": [ - { - "splunk": { - "$ref": "#/definitions/splunk" - } - }, - { - "phantom": { - "$ref": "#/definitions/phantom" - } - }, - { - "uba": { - "$ref": "#/definitions/uba" - } - } - ] - } - }, - "required": [ - "detect" - ], - "title": "Detection Manifest", - "type": "object" -} From 018cd8256cdae6368d2d7e7210604c39ba03e7e1 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 2 Apr 2019 17:00:32 -0700 Subject: [PATCH 69/74] examples in spec files and docs --- spec/v2/baselines.spec.json | 107 +++++++++ spec/v2/detections.spec.json | 203 +++++++++++++++++- .../baseline_dns_record_changed.json.example | 1 + .../v2/example/detection_phantom.json.example | 12 +- spec/v2/example/detection_splunk.json.example | 3 +- 5 files changed, 313 insertions(+), 13 deletions(-) diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index e22898f33a..81a3204250 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -6,14 +6,23 @@ "properties": { "phantom_server": { "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "examples": [ + "automation (hostname)" + ], "type": "string" }, "playbook_name": { "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "examples": [ + "community/dns_hijack_investigation" + ], "type": "string" }, "playbook_url": { "description": "Url of the playbook on Phantom website.", + "examples": [ + "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/" + ], "type": "string" }, "schedule": { @@ -21,14 +30,23 @@ "properties": { "cron_schedule": { "description": "Schedule of the search in cron format", + "examples": [ + "0 * * * *" + ], "type": "string" }, "earliest_time": { "description": "The earliest time the search should run in Splunk format", + "examples": [ + "-70m@m" + ], "type": "string" }, "latest_time": { "description": "The latest time tes search should run against in Splunk format", + "examples": [ + "-10m@m" + ], "type": "string" } }, @@ -36,10 +54,16 @@ }, "sensitivity": { "description": "TLP colors (White, Green, Amber or Red)", + "examples": [ + "green" + ], "type": "string" }, "severity": { "description": "Severity in phantom (High, Medium, Low)", + "examples": [ + "medium" + ], "type": "string" } }, @@ -57,14 +81,23 @@ "properties": { "cron_schedule": { "description": "Schedule of the search in cron format", + "examples": [ + "0 * * * *" + ], "type": "string" }, "earliest_time": { "description": "The earliest time the search should run in Splunk format", + "examples": [ + "-70m@m" + ], "type": "string" }, "latest_time": { "description": "The latest time tes search should run against in Splunk format", + "examples": [ + "-10m@m" + ], "type": "string" } }, @@ -72,6 +105,9 @@ }, "search": { "description": "The search (in SPL) executed within core Splunk for investgation.", + "examples": [ + "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" + ], "type": "string" } }, @@ -109,6 +145,9 @@ }, "creation_date": { "description": "The date the baseline manifest was created", + "examples": [ + "2019-02-14" + ], "type": "string" }, "data_metadata": { @@ -116,6 +155,9 @@ "properties": { "data_eventtypes": { "description": "A list of eventtypes, if any, used by this search", + "examples": [ + "wineventlog" + ], "items": { "type": "string" }, @@ -125,6 +167,9 @@ }, "data_models": { "description": "A list of data models, if any, used by this search", + "examples": [ + "Network_Resolution" + ], "items": { "enum": [ "Alerts", @@ -152,6 +197,9 @@ }, "data_source": { "description": "A high-level description of the type of data needed for this search to complete", + "examples": [ + "DNS" + ], "items": { "type": "string" }, @@ -161,6 +209,9 @@ }, "data_sourcetypes": { "description": "The list of sourcetypes, if any, used by this search", + "examples": [ + "stream:dns" + ], "items": { "type": "string" }, @@ -170,6 +221,9 @@ }, "providing_technologies": { "description": "A list of technologies that provide this data", + "examples": [ + "Bro" + ], "items": { "enum": [ "Apache", @@ -209,14 +263,24 @@ }, "description": { "description": "A description of what the search is is doing to create a baseline", + "examples": [ + "The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Traffic` datamodel, then stores the output under the `discovered_dns_records.csv` lookup" + ], "type": "string" }, "eli5": { "description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "examples": [ + "Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`" + ], "type": "string" }, "entities": { "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", + "examples": [ + "dest", + "user" + ], "items": { "enum": [ "accessKeyId", @@ -250,14 +314,23 @@ }, "how_to_implement": { "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "examples": [ + "To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation" + ], "type": "string" }, "id": { "description": "The unique identifier for the search", + "examples": [ + "c096f721-8842-42ce-bfc7-74bd8c72b7c3" + ], "type": "string" }, "known_false_positives": { "description": "Describe the known false postives while the analyst builds the baseline.", + "examples": [ + "Please vet the lookup created by this baseline search." + ], "type": "string" }, "maintainers": { @@ -266,14 +339,23 @@ "properties": { "company": { "description": "Company associated with the person maintaining this search", + "examples": [ + "Splunk" + ], "type": "string" }, "email": { "description": "Email address of the person maintaining this search", + "examples": [ + "daftpunk@splunk.com" + ], "type": "string" }, "name": { "description": "Name of the person maintaining this search", + "examples": [ + "Daft Punk" + ], "type": "string" } }, @@ -288,10 +370,16 @@ }, "modification_date": { "description": "The date of the most recent modification to the search", + "examples": [ + "2019-02-14" + ], "type": "string" }, "name": { "description": "The name of the search that creates the baseline", + "examples": [ + "Discover DNS records" + ], "type": "string" }, "original_authors": { @@ -300,14 +388,23 @@ "properties": { "company": { "description": "Company associated with the person who originally authored the search", + "examples": [ + "Splunk" + ], "type": "string" }, "email": { "description": "Email address of the person who originally authored the search", + "examples": [ + "daftpunk@splunk.com" + ], "type": "string" }, "name": { "description": "Name of the person who originally authored the search", + "examples": [ + "Daft Punk" + ], "type": "string" } }, @@ -326,14 +423,24 @@ "splunk", "phantom", "uba" + ], + "examples": [ + "splunk" ] }, "spec_version": { "description": "The version of the detection search specification this manifest follows", + "examples": [ + "2.0" + ], "type": "integer" }, "version": { "description": "The version of the search", + "examples": [ + "1", + "2" + ], "type": "string" } }, diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index b8f2a93269..0e502e0a03 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -12,14 +12,23 @@ "properties": { "nes_fields": { "description": "A list of suggested fields to be used for notable-event suppression", + "examples": [ + "src" + ], "type": "string" }, "rule_description": { "description": "Description of the notable event that will display in Incident Review", + "examples": [ + "The table represents a list of DNS records and their responses for corporate domains that have recently changed" + ], "type": "string" }, "rule_title": { - "description": "Title of the notable event that will display in Incident Review", + "description": "Title of the notable event that will display in Incident Review. Add tokenized fieldnames", + "examples": [ + "DNS record changed on $src$" + ], "type": "string" } }, @@ -35,10 +44,16 @@ "properties": { "risk_object": { "description": "TThe field to which you are assigning risk", + "examples": [ + "src" + ], "type": "string" }, "risk_object_type": { "description": "The type of object to which you are assigning risk", + "examples": [ + "system" + ], "items": { "enum": [ "system", @@ -54,6 +69,9 @@ }, "risk_score": { "description": "Score assigned to risk_object", + "examples": [ + "40" + ], "type": "integer" } }, @@ -69,14 +87,23 @@ "properties": { "cron_schedule": { "description": "Schedule of the search in cron format", + "examples": [ + "0 * * * *" + ], "type": "string" }, "earliest_time": { "description": "The earliest time the search should run in Splunk format", + "examples": [ + "-70m@m" + ], "type": "string" }, "latest_time": { "description": "The latest time tes search should run against in Splunk format", + "examples": [ + "-10m@m" + ], "type": "string" } }, @@ -84,6 +111,9 @@ }, "search": { "description": "The search that will trigger phantom playbook", + "examples": [ + "| sendalert runphantomplaybook" + ], "type": "string" }, "suppress": { @@ -91,10 +121,16 @@ "properties": { "suppress_fields": { "description": "The fields to base the suppression on", + "examples": [ + "src" + ], "type": "string" }, "suppress_period": { "description": "The length of time the suppression should be in effect", + "examples": [ + "28800s" + ], "type": "string" } }, @@ -113,22 +149,37 @@ }, "phantom_server": { "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)", + "examples": [ + "automation (hostname)" + ], "type": "string" }, "playbook_name": { "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment", + "examples": [ + "community/dns_hijack_detect_playbook" + ], "type": "string" }, "playbook_url": { "description": "Url of the playbook on Phantom website.", + "examples": [ + "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/" + ], "type": "string" }, "sensitivity": { - "description": "TLP colors (White, Green, Amber or Red)", + "description": "TLP colors (white, green, amber or red)", + "examples": [ + "green" + ], "type": "string" }, "severity": { "description": "Severity in phantom (High, Medium, Low)", + "examples": [ + "high" + ], "type": "string" } }, @@ -361,18 +412,30 @@ }, "event_type": { "description": "An anomaly or threat.", + "examples": [ + "anomaly" + ], "type": "string" }, "model": { "description": "The name of the Splunk UBA model that detected the anomaly.", + "examples": [ + "UBA Model" + ], "type": "string" }, "model_version": { "description": "Url of the playbook on Phantom website.", + "examples": [ + "2.0" + ], "type": "string" }, "threat_category": { "description": "The category of a threat in Splunk UBA.", + "examples": [ + "Malware" + ], "type": "string" } }, @@ -390,6 +453,9 @@ "properties": { "asset_type": { "description": "Designates the type of asset being investigated", + "examples": [ + "Endpoint" + ], "type": "string" }, "baselines": { @@ -398,10 +464,16 @@ "properties": { "id": { "description": "UUID of the baseline object", + "examples": [ + "c096f721-8842-42ce-bfc7-74bd8c72b7c3" + ], "type": "string" }, "name": { "description": "name of baseline object", + "examples": [ + "Discover DNS records" + ], "type": "string" }, "type": { @@ -411,6 +483,9 @@ "splunk", "uba" ], + "examples": [ + "splunk" + ], "product_type": "string" } }, @@ -429,10 +504,16 @@ "high", "medium", "low" + ], + "examples": [ + "high" ] }, "creation_date": { "description": "The date the story manifest was created", + "examples": [ + "2019-02-14" + ], "type": "string" }, "data_metadata": { @@ -440,6 +521,9 @@ "properties": { "data_eventtypes": { "description": "A list of eventtypes, if any, used by this search", + "examples": [ + "wineventlog" + ], "items": { "type": "string" }, @@ -449,6 +533,9 @@ }, "data_models": { "description": "A list of data models, if any, used by this search", + "examples": [ + "Network_Resolution" + ], "items": { "enum": [ "Alerts", @@ -476,6 +563,9 @@ }, "data_source": { "description": "A high-level description of the type of data needed for this search to complete", + "examples": [ + "DNS" + ], "items": { "type": "string" }, @@ -485,6 +575,9 @@ }, "data_sourcetypes": { "description": "The list of sourcetypes, if any, used by this search", + "examples": [ + "stream:dns" + ], "items": { "type": "string" }, @@ -494,6 +587,9 @@ }, "providing_technologies": { "description": "A list of technologies that provide this data", + "examples": [ + "Bro" + ], "items": { "enum": [ "Apache", @@ -534,6 +630,9 @@ }, "description": { "description": "A description of what the detection is designed to find", + "examples": [ + "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day." + ], "type": "string" }, "detect": { @@ -569,10 +668,17 @@ }, "eli5": { "description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert", + "examples": [ + "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed." + ], "type": "string" }, "entities": { "description": "A list of entities that is outputed by the search...", + "examples": [ + "dest", + "user" + ], "items": { "enum": [ "accessKeyId", @@ -606,10 +712,14 @@ }, "how_to_implement": { "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications", + "examples": [], "type": "string" }, "id": { "description": "The unique identifier for the detection", + "examples": [ + "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\"." + ], "type": "string" }, "investigations": { @@ -617,20 +727,29 @@ "items": { "properties": { "id": { - "description": "UUID of the baseline object", + "description": "UUID of the investigation object", + "examples": [ + "bc11a8cf-35e7-4bb2-8140-e756cc06fd72" + ], "type": "string" }, "name": { - "description": "Name of baseline", + "description": "Name of investigation object ", + "examples": [ + "Get DNS Server History for a host" + ], "type": "string" }, "product_type": { - "description": "Type of baseline to execute", + "description": "Type of investigation object", "enum": [ "phantom", "splunk", "uba" ], + "examples": [ + "splunk" + ], "type": "string" } }, @@ -645,6 +764,9 @@ }, "known_false_positives": { "description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior", + "examples": [ + "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate." + ], "type": "string" }, "maintainers": { @@ -653,14 +775,23 @@ "properties": { "company": { "description": "Company associated with the person maintaining this search", + "examples": [ + "Splunk" + ], "type": "string" }, "email": { "description": "Email address of the person maintaining this search", + "examples": [ + "daftpunk@splunk.com" + ], "type": "string" }, "name": { "description": "Name of the person maintaining this search", + "examples": [ + "Daft Punk" + ], "type": "string" } }, @@ -678,6 +809,9 @@ "properties": { "cis20": { "description": "A list of critical security controls this search helps you implement", + "examples": [ + "CIS 12" + ], "items": { "enum": [ "CIS 1", @@ -708,6 +842,9 @@ }, "emoji": { "description": "A list of security emojis that will help UBA understand this alert as an external alarm", + "examples": [ + "EndPoint" + ], "items": { "enum": [ "EndPoint", @@ -727,6 +864,9 @@ }, "kill_chain_phases": { "description": "A list of kill-chain phases to which the search applies", + "examples": [ + "Reconnaissance" + ], "items": { "enum": [ "Reconnaissance", @@ -744,6 +884,10 @@ }, "mitre_attack": { "description": "A list of the techniques and tactics identified by the search", + "examples": [ + "Defense Evasion", + "Initial Access" + ], "items": { "enum": [ "Initial Access", @@ -871,6 +1015,10 @@ }, "nist": { "description": "A list of the NIST controls the search helps you implement", + "examples": [ + "ID.AM", + "PR.PT" + ], "items": { "enum": [ "ID.AM", @@ -902,10 +1050,16 @@ }, "modification_date": { "description": "The date of the most recent modification to the search", + "examples": [ + "2019-02-14" + ], "type": "string" }, "name": { "description": "The name of the detection", + "examples": [ + "DNS record changed" + ], "type": "string" }, "original_authors": { @@ -914,14 +1068,23 @@ "properties": { "company": { "description": "Company associated with the person who originally authored the search", + "examples": [ + "Splunk" + ], "type": "string" }, "email": { "description": "Email address of the person who originally authored the search", + "examples": [ + "daftpunk@splunk.com" + ], "type": "string" }, "name": { "description": "Name of the person who originally authored the search", + "examples": [ + "Daft Punk" + ], "type": "string" } }, @@ -940,10 +1103,16 @@ "uba", "splunk", "phantom" + ], + "examples": [ + "phantom" ] }, "references": { "description": "A list of URLs that give more information about the search", + "examples": [ + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html" + ], "items": { "type": "string" }, @@ -952,15 +1121,21 @@ "uniqueItems": true }, "responses": { - "description": "An array of the response objects to exectute on the detection results ", + "description": "An array of the response objects to exectute on the detection results", "items": { "properties": { "id": { - "description": "UUID of the baseline object", + "description": "UUID of the Respose object", + "examples": [ + "1169w17b-ef78-4b59-aae8-5369073014e1" + ], "type": "string" }, "name": { - "description": "name of baseline", + "description": "Name of Response Object", + "examples": [ + "DNS Hijack Reponse" + ], "type": "string" }, "product_type": { @@ -970,6 +1145,9 @@ "splunk", "uba" ], + "examples": [ + "phantom" + ], "product_type": "string" } }, @@ -989,14 +1167,23 @@ "endpoint", "network", "threat" + ], + "examples": [ + "endpoint" ] }, "spec_version": { "description": "The version of the detection specification this manifest follows", + "examples": [ + "2.0" + ], "type": "integer" }, "version": { "description": "The version of the detection", + "examples": [ + "1" + ], "type": "string" } }, diff --git a/spec/v2/example/baseline_dns_record_changed.json.example b/spec/v2/example/baseline_dns_record_changed.json.example index 562e8dabf4..cac82fdae2 100644 --- a/spec/v2/example/baseline_dns_record_changed.json.example +++ b/spec/v2/example/baseline_dns_record_changed.json.example @@ -8,6 +8,7 @@ "search": "| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \"\\*\", \"\")) | join domain [|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records.csv" } }, + "entities": ["dest","user"], "product_type": "splunk", "creation_date": "2019-02-14", "data_metadata": { diff --git a/spec/v2/example/detection_phantom.json.example b/spec/v2/example/detection_phantom.json.example index 6ddf5c88b6..81a0feb550 100644 --- a/spec/v2/example/detection_phantom.json.example +++ b/spec/v2/example/detection_phantom.json.example @@ -67,14 +67,19 @@ "spec_version": 2, "version": "1.0", "baselines": [], + "entities":["dest"], "detect": { "phantom": { "phantom_server": "automation (hostname)", - "playbook_display_name": "DNS record change investigation", "playbook_name": "community/dns_hijack_investigation", "playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/", "sensitivity": "green", "severity": "medium", + "schedule": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, "correlation_rule": { "notable": { "nes_fields": "src", @@ -88,7 +93,7 @@ ], "risk_score": 40 }, - "scheduling": { + "schedule": { "cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m" @@ -96,8 +101,7 @@ "suppress": { "suppress_fields": "src", "suppress_period": "28800s" - }, - "search": "|makeresults | sendalert sendtophantom" + } } } }, diff --git a/spec/v2/example/detection_splunk.json.example b/spec/v2/example/detection_splunk.json.example index 9b4b36fcaf..ac6bdce560 100644 --- a/spec/v2/example/detection_splunk.json.example +++ b/spec/v2/example/detection_splunk.json.example @@ -4,7 +4,7 @@ "baselines": [ { "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3", - "name": "Discover DNS records,", + "name": "Discover DNS records", "product_type": "splunk" } ], @@ -50,6 +50,7 @@ } } }, + "entities":["dest"] "eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.", "how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\".

    Splunk>Phantom Playbook Integration

    If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.
    (Playbook Link:https://my.phantom.us/4.1/playbook/dns-hijack-investigation/).

    ", "id": "44d3a43e-dcd5-49f7-8356-5209bb369065", From 4e08aa61bc33e6b04b62191ec8684b87a1e00163 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 3 Apr 2019 08:54:00 -0700 Subject: [PATCH 70/74] docs --- docs/baselines.spec.md | 306 ++++++++++++++++++--- docs/detections.spec.md | 573 ++++++++++++++++++++++++++++++++-------- 2 files changed, 731 insertions(+), 148 deletions(-) diff --git a/docs/baselines.spec.md b/docs/baselines.spec.md index daa59817d9..8d76a5c212 100644 --- a/docs/baselines.spec.md +++ b/docs/baselines.spec.md @@ -9,13 +9,13 @@ The fields that make up the manifest of a version 2 baseline search | Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In | |----------|------------|--------|--------------|-------------------|-----------------------|------------| -| Can be instantiated | Yes | Experimental | No | Forbidden | Forbidden | | +| Can be instantiated | Yes | Experimental | No | Forbidden | Permitted | | # Baseline Manifest Properties | Property | Type | Required | Nullable | Defined by | |----------|------|----------|----------|------------| -| [baseline](#baseline) | complex | **Required** | No | Baseline Manifest (this schema) | +| [baseline](#baseline) | `object` | **Required** | No | Baseline Manifest (this schema) | | [creation_date](#creation_date) | `string` | **Required** | No | Baseline Manifest (this schema) | | [data_metadata](#data_metadata) | `object` | **Required** | No | Baseline Manifest (this schema) | | [description](#description) | `string` | **Required** | No | Baseline Manifest (this schema) | @@ -31,6 +31,7 @@ The fields that make up the manifest of a version 2 baseline search | [product_type](#product_type) | `enum` | **Required** | No | Baseline Manifest (this schema) | | [spec_version](#spec_version) | `integer` | **Required** | No | Baseline Manifest (this schema) | | [version](#version) | `string` | **Required** | No | Baseline Manifest (this schema) | +| `*` | any | Additional | Yes | this schema *allows* additional properties | ## baseline @@ -38,22 +39,31 @@ The fields that make up the manifest of a version 2 baseline search `baseline` * is **required** -* type: complex +* type: `object` * defined in this schema ### baseline Type -**One** of the following *conditions* need to be fulfilled. +`object` with following properties: + +| Property | Type | Required | +|----------|------|----------| +| `phantom`| | Optional | +| `splunk`| | Optional | -#### Condition 1 -* []() – `#/definitions/splunk` +#### phantom -#### Condition 2 +`phantom` + +* is optional +* type: reference + +##### phantom Type * []() – `#/definitions/phantom` @@ -63,6 +73,29 @@ The fields that make up the manifest of a version 2 baseline search + +#### splunk + + +`splunk` + +* is optional +* type: reference + +##### splunk Type + + +* []() – `#/definitions/splunk` + + + + + + + + + + ## creation_date The date the baseline manifest was created @@ -83,6 +116,12 @@ The date the baseline manifest was created +### creation_date Example + +```json +"2019-02-14" +``` + ## data_metadata @@ -135,6 +174,11 @@ All items must be of the type: +##### data_eventtypes Example + +```json +wineventlog +``` @@ -160,6 +204,10 @@ Unknown type ``. ```json { "description": "A list of data models, if any, used by this search", + "examples": [ + "Network_Resolution" + ], + "type": "array", "items": { "enum": [ "Alerts", @@ -202,7 +250,6 @@ Unknown type ``. } }, "minItems": 0, - "type": "array", "uniqueItems": true, "simpletype": "`enum[]`" } @@ -213,6 +260,11 @@ Unknown type ``. +##### data_models Example + +```json +Network_Resolution +``` @@ -242,6 +294,11 @@ All items must be of the type: +##### data_source Example + +```json +DNS +``` @@ -271,6 +328,11 @@ All items must be of the type: +##### data_sourcetypes Example + +```json +stream:dns +``` @@ -296,6 +358,9 @@ Unknown type ``. ```json { "description": "A list of technologies that provide this data", + "examples": [ + "Bro" + ], "items": { "enum": [ "Apache", @@ -359,6 +424,11 @@ Unknown type ``. +##### providing_technologies Example + +```json +Bro +``` @@ -386,10 +456,16 @@ A description of what the search is is doing to create a baseline +### description Example + +```json +"The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Traffic` datamodel, then stores the output under the `discovered_dns_records.csv` lookup" +``` + ## eli5 -Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert +Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert `eli5` @@ -407,6 +483,12 @@ Explain it like I’m 5 - A detail description of the SPL of the search, written +### eli5 Example + +```json +"Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`" +``` + ## entities @@ -430,6 +512,10 @@ Unknown type ``. ```json { "description": "A list of entities that will used in the story flow or are relevant to the security investigation.", + "examples": [ + "dest", + "user" + ], "items": { "enum": [ "accessKeyId", @@ -495,6 +581,16 @@ Unknown type ``. +### entities Examples + +```json +"dest" +``` + +```json +"user" +``` + ## how_to_implement @@ -517,6 +613,12 @@ A discussion on how to implement this search, from what needs to be ingested, co +### how_to_implement Example + +```json +"To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation" +``` + ## id @@ -538,6 +640,12 @@ The unique identifier for the search +### id Example + +```json +"c096f721-8842-42ce-bfc7-74bd8c72b7c3" +``` + ## known_false_positives @@ -559,6 +667,12 @@ Describe the known false postives while the analyst builds the baseline. +### known_false_positives Example + +```json +"Please vet the lookup created by this baseline search." +``` + ## maintainers @@ -606,6 +720,12 @@ Company associated with the person maintaining this search +##### company Example + +```json +Splunk +``` + @@ -628,6 +748,12 @@ Email address of the person maintaining this search +##### email Example + +```json +daftpunk@splunk.com +``` + @@ -650,6 +776,11 @@ Name of the person maintaining this search +##### name Example + +```json +Daft Punk +``` @@ -679,6 +810,12 @@ The date of the most recent modification to the search +### modification_date Example + +```json +"2019-02-14" +``` + ## name @@ -700,6 +837,12 @@ The name of the search that creates the baseline +### name Example + +```json +"Discover DNS records" +``` + ## original_authors @@ -747,6 +890,12 @@ Company associated with the person who originally authored the search +##### company Example + +```json +Splunk +``` + @@ -769,6 +918,12 @@ Email address of the person who originally authored the search +##### email Example + +```json +daftpunk@splunk.com +``` + @@ -791,6 +946,11 @@ Name of the person who originally authored the search +##### name Example + +```json +Daft Punk +``` @@ -821,6 +981,12 @@ The value of this property **must** be equal to one of the [known values below]( +### product_type Example + +```json +"splunk" +``` + ## spec_version @@ -842,6 +1008,12 @@ The version of the detection search specification this manifest follows +### spec_version Example + +```json +"2.0" +``` + ## version @@ -863,16 +1035,26 @@ The version of the search +### version Examples + +```json +"1" +``` + +```json +"2" +``` + + # Baseline Manifest Definitions | Property | Type | Group | |----------|------|-------| | [phantom_server](#phantom_server) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | -| [playbook_display_name](#playbook_display_name) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | | [playbook_name](#playbook_name) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | | [playbook_url](#playbook_url) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | -| [scheduling](#scheduling) | `object` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` | +| [schedule](#schedule) | `object` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` | | [search](#search) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` | | [sensitivity](#sensitivity) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | | [severity](#severity) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` | @@ -897,26 +1079,11 @@ IP address and username of the phantom server. Currently, we will ship this valu +### phantom_server Example -## playbook_display_name - -Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment - -`playbook_display_name` - -* is optional -* type: `string` -* defined in this schema - -### playbook_display_name Type - - -`string` - - - - - +```json +"automation (hostname)" +``` ## playbook_name @@ -939,6 +1106,12 @@ Name of the playbook. This name should be the same as the name on phantom commun +### playbook_name Example + +```json +"community/dns_hijack_investigation" +``` + ## playbook_url @@ -960,18 +1133,24 @@ Url of the playbook on Phantom website. +### playbook_url Example + +```json +"https://my.phantom.us/4.1/playbook/dns-hijack-investigation/" +``` + -## scheduling +## schedule Various fields to assist in scheduling the search -`scheduling` +`schedule` * is optional * type: `object` * defined in this schema -### scheduling Type +### schedule Type `object` with following properties: @@ -979,11 +1158,40 @@ Various fields to assist in scheduling the search | Property | Type | Required | |----------|------|----------| +| `cron_schedule`| string | Optional | | `earliest_time`| string | Optional | | `latest_time`| string | Optional | +#### cron_schedule + +Schedule of the search in cron format + +`cron_schedule` + +* is optional +* type: `string` + +##### cron_schedule Type + + +`string` + + + + + + +##### cron_schedule Example + +```json +0 * * * * +``` + + + + #### earliest_time The earliest time the search should run in Splunk format @@ -1003,6 +1211,12 @@ The earliest time the search should run in Splunk format +##### earliest_time Example + +```json +-70m@m +``` + @@ -1025,6 +1239,12 @@ The latest time tes search should run against in Splunk format +##### latest_time Example + +```json +-10m@m +``` + @@ -1033,7 +1253,7 @@ The latest time tes search should run against in Splunk format ## search -The search (in SPL) executed within core Splunk for creating a baseline +The search (in SPL) executed within core Splunk for investgation. `search` @@ -1051,6 +1271,12 @@ The search (in SPL) executed within core Splunk for creating a baseline +### search Example + +```json +"| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)" +``` + ## sensitivity @@ -1072,6 +1298,12 @@ TLP colors (White, Green, Amber or Red) +### sensitivity Example + +```json +"green" +``` + ## severity @@ -1093,3 +1325,9 @@ Severity in phantom (High, Medium, Low) +### severity Example + +```json +"medium" +``` + diff --git a/docs/detections.spec.md b/docs/detections.spec.md index 968ba2d57c..d3ac1ec0ff 100644 --- a/docs/detections.spec.md +++ b/docs/detections.spec.md @@ -21,7 +21,7 @@ A object that defines the parameters for detecting things using various Splunk c | [creation_date](#creation_date) | `string` | **Required** | No | Detection Manifest (this schema) | | [data_metadata](#data_metadata) | `object` | **Required** | No | Detection Manifest (this schema) | | [description](#description) | `string` | **Required** | No | Detection Manifest (this schema) | -| [detect](#detect) | complex | **Required** | No | Detection Manifest (this schema) | +| [detect](#detect) | `object` | **Required** | No | Detection Manifest (this schema) | | [eli5](#eli5) | `string` | **Required** | No | Detection Manifest (this schema) | | [entities](#entities) | `enum[]` | Optional | No | Detection Manifest (this schema) | | [how_to_implement](#how_to_implement) | `string` | **Required** | No | Detection Manifest (this schema) | @@ -61,6 +61,12 @@ Designates the type of asset being investigated +### asset_type Example + +```json +"Endpoint" +``` + ## baselines @@ -108,6 +114,12 @@ UUID of the baseline object +##### id Example + +```json +c096f721-8842-42ce-bfc7-74bd8c72b7c3 +``` + @@ -130,6 +142,12 @@ name of baseline object +##### name Example + +```json +Discover DNS records +``` + @@ -153,6 +171,11 @@ The value of this property **must** be equal to one of the [known values below]( +##### type Example + +```json +splunk +``` @@ -183,6 +206,12 @@ The value of this property **must** be equal to one of the [known values below]( +### confidence Example + +```json +"high" +``` + ## creation_date @@ -204,6 +233,12 @@ The date the story manifest was created +### creation_date Example + +```json +"2019-02-14" +``` + ## data_metadata @@ -256,6 +291,11 @@ All items must be of the type: +##### data_eventtypes Example + +```json +wineventlog +``` @@ -281,6 +321,9 @@ Unknown type ``. ```json { "description": "A list of data models, if any, used by this search", + "examples": [ + "Network_Resolution" + ], "items": { "enum": [ "Alerts", @@ -334,6 +377,11 @@ Unknown type ``. +##### data_models Example + +```json +Network_Resolution +``` @@ -363,6 +411,11 @@ All items must be of the type: +##### data_source Example + +```json +DNS +``` @@ -392,6 +445,11 @@ All items must be of the type: +##### data_sourcetypes Example + +```json +stream:dns +``` @@ -417,6 +475,9 @@ Unknown type ``. ```json { "description": "A list of technologies that provide this data", + "examples": [ + "Bro" + ], "items": { "enum": [ "Apache", @@ -482,6 +543,11 @@ Unknown type ``. +##### providing_technologies Example + +```json +Bro +``` @@ -509,6 +575,12 @@ A description of what the detection is designed to find +### description Example + +```json +"The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day." +``` + ## detect @@ -516,28 +588,70 @@ A description of what the detection is designed to find `detect` * is **required** -* type: complex +* type: `object` * defined in this schema ### detect Type -**One** of the following *conditions* need to be fulfilled. +`object` with following properties: + + +| Property | Type | Required | +|----------|------|----------| +| `phantom`| | Optional | +| `splunk`| | Optional | +| `uba`| | Optional | -#### Condition 1 +#### phantom -* []() – `#/definitions/splunk` +`phantom` -#### Condition 2 +* is optional +* type: reference + +##### phantom Type * []() – `#/definitions/phantom` -#### Condition 3 + + + + + +#### splunk + + +`splunk` + +* is optional +* type: reference + +##### splunk Type + + +* []() – `#/definitions/splunk` + + + + + + + +#### uba + + +`uba` + +* is optional +* type: reference + +##### uba Type * []() – `#/definitions/uba` @@ -547,6 +661,10 @@ A description of what the detection is designed to find + + + + ## eli5 Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert @@ -567,6 +685,12 @@ Explain it like I am 5 - A detail description of the SPL of the search, written +### eli5 Example + +```json +"Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed." +``` + ## entities @@ -590,6 +714,10 @@ Unknown type ``. ```json { "description": "A list of entities that is outputed by the search...", + "examples": [ + "dest", + "user" + ], "items": { "enum": [ "accessKeyId", @@ -655,6 +783,16 @@ Unknown type ``. +### entities Examples + +```json +"dest" +``` + +```json +"user" +``` + ## how_to_implement @@ -698,6 +836,12 @@ The unique identifier for the detection +### id Example + +```json +"To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\"." +``` + ## investigations @@ -728,7 +872,7 @@ All items must be of the type: #### id -UUID of the baseline object +UUID of the investigation object `id` @@ -745,12 +889,18 @@ UUID of the baseline object +##### id Example + +```json +bc11a8cf-35e7-4bb2-8140-e756cc06fd72 +``` + #### name -Name of baseline +Name of investigation object `name` @@ -767,12 +917,18 @@ Name of baseline +##### name Example + +```json +Get DNS Server History for a host +``` + #### product_type -Type of baseline to execute +Type of investigation object `product_type` @@ -790,6 +946,11 @@ The value of this property **must** be equal to one of the [known values below]( +##### product_type Example + +```json +splunk +``` @@ -819,6 +980,12 @@ Scenarios in which detected behavior is benig, coupled with suggestions on how t +### known_false_positives Example + +```json +"Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate." +``` + ## maintainers @@ -866,6 +1033,12 @@ Company associated with the person maintaining this search +##### company Example + +```json +Splunk +``` + @@ -888,6 +1061,12 @@ Email address of the person maintaining this search +##### email Example + +```json +daftpunk@splunk.com +``` + @@ -910,6 +1089,11 @@ Name of the person maintaining this search +##### name Example + +```json +Daft Punk +``` @@ -966,6 +1150,9 @@ Unknown type ``. ```json { "description": "A list of critical security controls this search helps you implement", + "examples": [ + "CIS 12" + ], "items": { "enum": [ "CIS 1", @@ -1025,6 +1212,11 @@ Unknown type ``. +##### cis20 Example + +```json +CIS 12 +``` @@ -1050,6 +1242,9 @@ Unknown type ``. ```json { "description": "A list of security emojis that will help UBA understand this alert as an external alarm", + "examples": [ + "EndPoint" + ], "items": { "enum": [ "EndPoint", @@ -1087,6 +1282,11 @@ Unknown type ``. +##### emoji Example + +```json +EndPoint +``` @@ -1112,6 +1312,9 @@ Unknown type ``. ```json { "description": "A list of kill-chain phases to which the search applies", + "examples": [ + "Reconnaissance" + ], "items": { "enum": [ "Reconnaissance", @@ -1145,6 +1348,11 @@ Unknown type ``. +##### kill_chain_phases Example + +```json +Reconnaissance +``` @@ -1170,6 +1378,10 @@ Unknown type ``. ```json { "description": "A list of the techniques and tactics identified by the search", + "examples": [ + "Defense Evasion", + "Initial Access" + ], "items": { "enum": [ "Initial Access", @@ -1423,6 +1635,16 @@ Unknown type ``. +##### mitre_attack Examples + +```json +Defense Evasion +``` + +```json +Initial Access +``` + @@ -1448,6 +1670,10 @@ Unknown type ``. ```json { "description": "A list of the NIST controls the search helps you implement", + "examples": [ + "ID.AM", + "PR.PT" + ], "items": { "enum": [ "ID.AM", @@ -1503,6 +1729,16 @@ Unknown type ``. +##### nist Examples + +```json +ID.AM +``` + +```json +PR.PT +``` + @@ -1530,6 +1766,12 @@ The date of the most recent modification to the search +### modification_date Example + +```json +"2019-02-14" +``` + ## name @@ -1551,6 +1793,12 @@ The name of the detection +### name Example + +```json +"DNS record changed" +``` + ## original_authors @@ -1598,6 +1846,12 @@ Company associated with the person who originally authored the search +##### company Example + +```json +Splunk +``` + @@ -1620,6 +1874,12 @@ Email address of the person who originally authored the search +##### email Example + +```json +daftpunk@splunk.com +``` + @@ -1642,6 +1902,11 @@ Name of the person who originally authored the search +##### name Example + +```json +Daft Punk +``` @@ -1672,6 +1937,12 @@ The value of this property **must** be equal to one of the [known values below]( +### product_type Example + +```json +"phantom" +``` + ## references @@ -1699,6 +1970,11 @@ All items must be of the type: +### references Example + +```json +"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html" +``` ## responses @@ -1730,7 +2006,7 @@ All items must be of the type: #### id -UUID of the baseline object +UUID of the Respose object `id` @@ -1747,12 +2023,18 @@ UUID of the baseline object +##### id Example + +```json +1169w17b-ef78-4b59-aae8-5369073014e1 +``` + #### name -name of baseline +Name of Response Object `name` @@ -1769,6 +2051,12 @@ name of baseline +##### name Example + +```json +DNS Hijack Reponse +``` + @@ -1792,6 +2080,11 @@ The value of this property **must** be equal to one of the [known values below]( +##### product_type Example + +```json +phantom +``` @@ -1823,6 +2116,12 @@ The value of this property **must** be equal to one of the [known values below]( +### security_domain Example + +```json +"endpoint" +``` + ## spec_version @@ -1844,6 +2143,12 @@ The version of the detection specification this manifest follows +### spec_version Example + +```json +"2.0" +``` + ## version @@ -1865,21 +2170,24 @@ The version of the detection +### version Example + +```json +"1" +``` + # Detection Manifest Definitions | Property | Type | Group | |----------|------|-------| -| [correlation_rule](#correlation_rule) | `object` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/splunk` | +| [correlation_rule](#correlation_rule) | `object` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | | [event_type](#event_type) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | | [model](#model) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | | [model_version](#model_version) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | | [phantom_server](#phantom_server) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | -| [playbook_display_name](#playbook_display_name) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | | [playbook_name](#playbook_name) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | | [playbook_url](#playbook_url) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | -| [scheduling](#scheduling) | `object` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/splunk` | -| [search](#search) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | | [sensitivity](#sensitivity) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | | [severity](#severity) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/phantom` | | [threat_category](#threat_category) | `string` | `https://api.splunkresearch.com/schemas/detections.json#/definitions/uba` | @@ -1904,6 +2212,8 @@ Various fields to enhance usability in Enterprise Security |----------|------|----------| | `notable`| object | Optional | | `risk`| object | Optional | +| `schedule`| object | **Required** | +| `search`| string | **Required** | | `suppress`| object | Optional | @@ -2103,16 +2413,16 @@ Score assigned to risk_object -#### suppress +#### schedule -Fields associated with suppressing the creation of multiple alerts +Various fields to assist in scheduling the search -`suppress` +`schedule` -* is optional +* is **required** * type: `object` -##### suppress Type +##### schedule Type `object` with following properties: @@ -2120,21 +2430,22 @@ Fields associated with suppressing the creation of multiple alerts | Property | Type | Required | |----------|------|----------| -| `suppress_fields`| string | **Required** | -| `suppress_period`| string | **Required** | +| `cron_schedule`| string | Optional | +| `earliest_time`| string | Optional | +| `latest_time`| string | Optional | -#### suppress_fields +#### cron_schedule -The fields to base the suppression on +Schedule of the search in cron format -`suppress_fields` +`cron_schedule` -* is **required** +* is optional * type: `string` -##### suppress_fields Type +##### cron_schedule Type `string` @@ -2147,16 +2458,16 @@ The fields to base the suppression on -#### suppress_period +#### earliest_time -The length of time the suppression should be in effect +The earliest time the search should run in Splunk format -`suppress_period` +`earliest_time` -* is **required** +* is optional * type: `string` -##### suppress_period Type +##### earliest_time Type `string` @@ -2169,28 +2480,26 @@ The length of time the suppression should be in effect +#### latest_time +The latest time tes search should run against in Splunk format +`latest_time` +* is optional +* type: `string` +##### latest_time Type +`string` -## event_type - -An anomaly or threat. -`event_type` -* is optional -* type: `string` -* defined in this schema -### event_type Type -`string` @@ -2198,17 +2507,16 @@ An anomaly or threat. -## model +#### search -The name of the Splunk UBA model that detected the anomaly. +The search (in SPL) executed within core Splunk -`model` +`search` -* is optional +* is **required** * type: `string` -* defined in this schema -### model Type +##### search Type `string` @@ -2219,38 +2527,40 @@ The name of the Splunk UBA model that detected the anomaly. -## model_version -Url of the playbook on Phantom website. -`model_version` +#### suppress -* is optional -* type: `string` -* defined in this schema +Fields associated with suppressing the creation of multiple alerts -### model_version Type +`suppress` +* is optional +* type: `object` -`string` +##### suppress Type +`object` with following properties: +| Property | Type | Required | +|----------|------|----------| +| `suppress_fields`| string | **Required** | +| `suppress_period`| string | **Required** | -## phantom_server +#### suppress_fields -IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname) +The fields to base the suppression on -`phantom_server` +`suppress_fields` -* is optional +* is **required** * type: `string` -* defined in this schema -### phantom_server Type +##### suppress_fields Type `string` @@ -2261,17 +2571,18 @@ IP address and username of the phantom server. Currently, we will ship this valu -## playbook_display_name -Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment -`playbook_display_name` +#### suppress_period -* is optional +The length of time the suppression should be in effect + +`suppress_period` + +* is **required** * type: `string` -* defined in this schema -### playbook_display_name Type +##### suppress_period Type `string` @@ -2282,38 +2593,27 @@ Display Name of the playbook. Capitalize each letter and remove underscores from -## playbook_name -Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment -`playbook_name` -* is optional -* type: `string` -* defined in this schema -### playbook_name Type - - -`string` +## event_type -## playbook_url - -Url of the playbook on Phantom website. +An anomaly or threat. -`playbook_url` +`event_type` * is optional * type: `string` * defined in this schema -### playbook_url Type +### event_type Type `string` @@ -2323,41 +2623,51 @@ Url of the playbook on Phantom website. +### event_type Example -## scheduling +```json +"anomaly" +``` -Various fields to assist in scheduling the search -`scheduling` +## model + +The name of the Splunk UBA model that detected the anomaly. + +`model` * is optional -* type: `object` +* type: `string` * defined in this schema -### scheduling Type +### model Type -`object` with following properties: +`string` -| Property | Type | Required | -|----------|------|----------| -| `cron_schedule`| string | Optional | -| `earliest_time`| string | Optional | -| `latest_time`| string | Optional | -#### cron_schedule -Schedule of the search in cron format +### model Example -`cron_schedule` +```json +"UBA Model" +``` + + +## model_version + +Url of the playbook on Phantom website. + +`model_version` * is optional * type: `string` +* defined in this schema -##### cron_schedule Type +### model_version Type `string` @@ -2367,19 +2677,24 @@ Schedule of the search in cron format +### model_version Example +```json +"2.0" +``` -#### earliest_time +## phantom_server -The earliest time the search should run in Splunk format +IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname) -`earliest_time` +`phantom_server` * is optional * type: `string` +* defined in this schema -##### earliest_time Type +### phantom_server Type `string` @@ -2389,19 +2704,24 @@ The earliest time the search should run in Splunk format +### phantom_server Example +```json +"automation (hostname)" +``` -#### latest_time +## playbook_name -The latest time tes search should run against in Splunk format +Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment -`latest_time` +`playbook_name` * is optional * type: `string` +* defined in this schema -##### latest_time Type +### playbook_name Type `string` @@ -2411,23 +2731,24 @@ The latest time tes search should run against in Splunk format +### playbook_name Example +```json +"community/dns_hijack_detect_playbook" +``` +## playbook_url +Url of the playbook on Phantom website. - -## search - -The search you will run against the UEBA index to idenfiy the threat. - -`search` +`playbook_url` * is optional * type: `string` * defined in this schema -### search Type +### playbook_url Type `string` @@ -2437,10 +2758,16 @@ The search you will run against the UEBA index to idenfiy the threat. +### playbook_url Example + +```json +"https://my.phantom.us/4.1/playbook/dns-hijack-investigation/" +``` + ## sensitivity -TLP colors (White, Green, Amber or Red) +TLP colors (white, green, amber or red) `sensitivity` @@ -2458,6 +2785,12 @@ TLP colors (White, Green, Amber or Red) +### sensitivity Example + +```json +"green" +``` + ## severity @@ -2479,6 +2812,12 @@ Severity in phantom (High, Medium, Low) +### severity Example + +```json +"high" +``` + ## threat_category @@ -2500,3 +2839,9 @@ The category of a threat in Splunk UBA. +### threat_category Example + +```json +"Malware" +``` + From 00a13b450affd6a0472caa208349b47c39d7e66c Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 9 Apr 2019 13:43:53 -0400 Subject: [PATCH 71/74] update to the generator --- bin/generate.py | 101 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 87 insertions(+), 14 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 9c1289b634..9807e8a981 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -31,12 +31,33 @@ def markdown(x): return markdown -def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): +def generate_savedsearches(REPO_PATH, stories): + # first we process detections - # Create conf files from analytics stories files - story_output_path = OUTPUT_DIR + "/default/analytics_stories.conf" - output_file = open(story_output_path, 'w') + # detections_files = [] + # detections_manifest_files = path.join(path.expanduser(REPO_PATH), "detections/*.json") + + for story_name, story in stories.iteritems(): + if 'detections' in story: + + search_manifests = {} + for search_manifest_file in glob.glob(path.join(REPO_PATH, '*/detections/*.json')): + try: + search_manifest = json.loads(open(search_manifest_file, 'r').read()) + except Exception as e: + print "Error reading %s" % search_manifest_file + print e + continue + + search_manifests[search_manifest['search_name']] = search_manifest + + # story['mappings'] = + # complete_stories[story['name']]['mappings'] = {} + # complete_stories[story['name']]['data_models'] = set() + # complete_stories[story['name']]['providing_technologies'] = set() + +def generate_analytics_story(REPO_PATH, verbose): story_files = [] story_manifest_files = path.join(path.expanduser(REPO_PATH), "stories/*.json") @@ -51,6 +72,7 @@ def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): story_files.append(story) # store an object with all stories and their data + complete_stories = dict() for story in story_files: if verbose: @@ -74,16 +96,58 @@ def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): complete_stories[story['name']]['references'] = story['references'] complete_stories[story['name']]['category'] = story['category'] complete_stories[story['name']]['version'] = story['version'] - complete_stories[story['name']]['mappings'] = {} - complete_stories[story['name']]['data_models'] = set() - complete_stories[story['name']]['providing_technologies'] = set() - complete_stories[story['name']]['tags'] = set() complete_stories[story['name']]['narrative'] = story['narrative'] - complete_stories[story['name']]['detection_searches'] = [] - complete_stories[story['name']]['investigative_searches'] = [] - complete_stories[story['name']]['contextual_searches'] = [] - complete_stories[story['name']]['support_searches'] = [] + # grab searches + if story['spec_version'] == 1: + if 'detection_searches' in story['searches']: + detections = [] + for d in story['searches']['detection_searches']: + detections.append({"type": "splunk", "name": "ESCU - " + d + " - Rule"}) + complete_stories[story['name']]['detections'] = detections + + if 'support_searches' in story['searches']: + baselines = [] + for b in story['searches']['support_searches']: + detections.append({"type": "splunk", "name": "ESCU - " + b}) + complete_stories[story['name']]['baselines'] = baselines + + investigations = [] + if 'contexual_searches' in story['searches']: + for i in story['searches']['contexual_searches']: + investigations.append({"type": "splunk", "name": "ESCU - " + i}) + if 'investigative_searches' in story['searches']: + for i in story['searches']['investigative_searches']: + investigations.append({"type": "splunk", "name": "ESCU - " + i}) + complete_stories[story['name']]['investigations'] = investigations + + if story['spec_version'] == 2: + if 'detections' in story: + detections = [] + for d in story['detections']: + detections.append({"type": d['type'], "name": "ESCU - " + d['name'] + " - Rule"}) + complete_stories[story['name']]['detections'] = detections + + if 'baselines' in story: + baselines = [] + for b in story['baselines']: + detections.append({"type": d['type'], "name": "ESCU - " + b['name']}) + complete_stories[story['name']]['baselines'] = baselines + + if 'investigations' in story: + investigations = [] + for i in story['investigations']: + investigations.append({"type": i['type'], "name": "ESCU - " + i['name']}) + complete_stories[story['name']]['investigations'] = investigations + + return complete_stories + + +def write_story_output(complete_stories, OUTPUT_DIR): + + # Create conf files from analytics stories files + story_output_path = OUTPUT_DIR + "/default/analytics_stories.conf" + output_file = open(story_output_path, 'w') # Finish the story for story_name, story in sorted(complete_stories.iteritems()): @@ -95,6 +159,13 @@ def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): output_file.write("version = %s\n" % story['version']) output_file.write("reference = %s\n" % json.dumps(story['references'])) + if 'detections' in story: + output_file.write("detections = %s\n" % json.dumps(story['detections'])) + if 'investigations' in story: + output_file.write("investigations = %s\n" % json.dumps(story['investigations'])) + if 'baselines' in story: + output_file.write("baselines = %s\n" % json.dumps(story['baselines'])) + # REMOVE THIS FUNCTION MAKE SURE ALL DESCRIPTIONs ARE NATIVELY IN MARKDOWN description = markdown(story['description']) output_file.write("description = %s\n" % description) @@ -107,7 +178,7 @@ def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): # close file, count stories we found and return output_file.close() - story_count = len(story_files) + story_count = len(complete_stories.keys()) return story_count, story_output_path @@ -127,5 +198,7 @@ def generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose): OUTPUT_DIR = args.output verbose = args.verbose - story_count, story_path = generate_analytics_story(REPO_PATH, OUTPUT_DIR, verbose) + complete_stories = generate_analytics_story(REPO_PATH, verbose) + # generate_detections(REPO_PATH, complete_stories) + story_count, story_path = write_story_output(complete_stories, OUTPUT_DIR) print "{0} stories have been successfully to {1}".format(story_count, story_path) From 8ee0606d6c2d828fda8bfd85d92651e9c4322751 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 9 Apr 2019 14:17:13 -0400 Subject: [PATCH 72/74] first commit --- detections/dns_evilginx_subdomains.json | 101 ++++++++++++++++++++++++ src/default/macros.conf | 3 +- stories/common_phishing_frameworks.json | 38 +++++++++ stories/dns_hijacking.json | 66 +++++++--------- 4 files changed, 171 insertions(+), 37 deletions(-) create mode 100644 detections/dns_evilginx_subdomains.json create mode 100644 stories/common_phishing_frameworks.json diff --git a/detections/dns_evilginx_subdomains.json b/detections/dns_evilginx_subdomains.json new file mode 100644 index 0000000000..89d64aa5a4 --- /dev/null +++ b/detections/dns_evilginx_subdomains.json @@ -0,0 +1,101 @@ +{ + "asset_type": "Endpoint", + "confidence": "high", + "creation_date": "2019-04-04", + "data_metadata": { + "data_models": [ + "Network_Resolution" + ], + "data_source": [ + "DNS" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.", + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "src, query", + "rule_description": "The host $src$ issued a DNS request for a domain that could be a phishing site leverating EvilGinx toolkit.", + "rule_title": "DNS request for EvilGinx subdomain detected on $src$" + }, + "risk": { + "risk_object": "src", + "risk_object_type": [ + "system" + ], + "risk_score": 40 + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "|tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution.DNS by DNS.dest DNS.src DNS.query host | `drop_dm_object_name(DNS)`| search `evilginx_phishlets_subdomains` | rex field=query \".*?(?[^./:]+\\.(\\S{2,3}|\\S{2,3}.\\S{2,3}))$\" | `ctime(firstTime)`| `ctime(lastTime)`| search NOT [ inputlookup domains.csv | fields domain]", + "suppress": { + "suppress_fields": "src, query", + "suppress_period": "14400s" + } + } + } + }, + "eli5": "This search gathers all the answers to each system's DNS query, then filters for queries that have sub domains extracted from the EvilGinx toolkit. It will then run a regex to extract `domain` from the query and remove that from the detection if it is listed in the `domains.csv`", + "entities": [ + "src" + ], + "how_to_implement": "You need to ingest data from your DNS logs. Specifically you must ingest the domain that is being queried and the IP of the host originating the request. Ideally, you should also be ingesting the answer to the query and the query type. This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You will have to add legitimate domain names to the `domains.csv` file shipped with the app", + "id": "24dd17b1-e2fb-4c31-878c-d4f226595bfa", + "investigations": [], + "known_false_positives": "If a known good domain is not listed in the known_domains.csv file, then the search could give you false postives. Please update that lookup file to filter out legitimate DNS requests", + "maintainers": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "mappings": { + "cis20": [ + "CIS 1", + "CIS 3", + "CIS 8", + "CIS 12" + ], + "kill_chain_phases": [ + "Delivery", + "Actions on Objectives", + "Command and Control" + ], + "mitre_attack": [ + "Exfiltration", + "Command and Control", + "Defense Evasion", + "Commonly Used Port" + ], + "nist": [ + "ID.AM", + "PR.DS", + "PR.IP", + "DE.AE", + "DE.CM" + ] + }, + "modification_date": "2019-04-04", + "name": "Detect DNS requests to Phishing Sites leveraging EvilGinx", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "product_type": "splunk", + "responses": [], + "security_domain": "network", + "spec_version": 2, + "version": "1.0" +} diff --git a/src/default/macros.conf b/src/default/macros.conf index cc00f9c327..5d78100c3f 100644 --- a/src/default/macros.conf +++ b/src/default/macros.conf @@ -65,4 +65,5 @@ definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] N [system_network_configuration_discovery_tools] definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe") - +[evilginx_phishlets_subdomains] +definition = (query=fls-na* OR query = www* OR query=images*) diff --git a/stories/common_phishing_frameworks.json b/stories/common_phishing_frameworks.json new file mode 100644 index 0000000000..317606d815 --- /dev/null +++ b/stories/common_phishing_frameworks.json @@ -0,0 +1,38 @@ +{ + "category": [ + "Adversary Tactics", + "Other" + ], + "channel": "ESCU", + "creation_date": "2019-03-12", + "description": "XXXX - Placeholder for Phishing description", + "detections": [ + { + "detection_id": "24dd17b1-e2fb-4c31-878c-d4f226595bfa", + "name": "Detect DNS requests to Phishing Sites leveraging EvilGinx", + "type": "splunk" + } + ], + "id": "9a64ab44-9214-4639-8163-7eaa2621bd61", + "maintainers": [ + { + "company": "Splunk", + "email": "research@splunk.com", + "name": "Splunk Research Team" + } + ], + "modification_date": "2019-04-04", + "name": "Common Phishing Frameworks", + "narrative": "XXXX - Placeholder for Phishing narrative", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "references": [], + "spec_version": 2, + "usecase": "Advanced Threat Detection", + "version": "1.0" +} diff --git a/stories/dns_hijacking.json b/stories/dns_hijacking.json index 727f1d47db..65c5e58d6e 100644 --- a/stories/dns_hijacking.json +++ b/stories/dns_hijacking.json @@ -1,9 +1,29 @@ { - "category": "Adversary Tactics", + "category": [ + "Adversary Tactics", + "Other" + ], "channel": "ESCU", - "creation_date": "2019-02-09", + "creation_date": "2017-11-21", "description": "Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.", - "id": "ad7eb6e0-f06c-4781-b145-a422d59c26e9", + "detections": [ + { + "detection_id": "1169w17b-ef78-4b59-aae8-5369073014e1", + "name": "DNS record changed", + "type": "splunk" + }, + { + "detection_id": "8129w27b-ef78-4w59-aae8-5369073014e1", + "name": "Lateral Movement detected", + "type": "uba" + }, + { + "detection_id": "1229w27b-ef78-4w59-aae8-5369073014e1", + "name": "Playbook that detects DNS Hijacks", + "type": "phantom" + } + ], + "id": "8169f17b-ef68-4b59-aae8-5869073014e1", "maintainers": [ { "company": "Splunk", @@ -11,7 +31,7 @@ "name": "Bhavin Patel" } ], - "modification_date": "2019-02-14", + "modification_date": "2018-09-06", "name": "DNS Hijacking", "narrative": "Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.

    The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well.

    On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity and Infrastructure Security Agency (CISA) raised awareness of some high-profile DNS hijacking attacks against infrastructure, both in the United States and abroad. It issued Emergency Directive 19-01 (see https://cyber.dhs.gov/ed/19-01/), which summarized the activity and required government agencies to take the following four actions, all within 10 days:
    1. For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers, verify that they resolve to the intended location or report them to CISA.
    2. Update the passwords for all accounts on systems that can make changes to each agency 2019's DNS records.
    3. Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency's 2019 DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.
    4. CISA will begin regular delivery of newly added certificates to Certificate Transparency (CT) logs for agency domains via the Cyber Hygiene service. Upon receipt, agencies must immediately begin monitoring CT log data for certificates issued that they did not request. If an agency confirms that a certificate was unauthorized, it must report the certificate to the issuing certificate authority and to CISA.
    Of course, it makes sense to put equivalent actions in place within your environment, as well.

    In DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.

    The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment.", "original_authors": [ @@ -22,38 +42,12 @@ } ], "references": [ - "https://blog.malwarebytes.com/cybercrime/2015/09/dns-hijacks-what-to-look-for/", - "https://www.darkreading.com/attacks-breaches/dns-hijacking-the-silent-threat-thats-putting-your-network-at-risk/a/d-id/1330922", - "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html", - "https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html", - "https://www.splunk.com/blog/2019/01/25/cisa-emergency-directive-19-01-doing-things-the-easy-way-in-splunk.html" + "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", + "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", + "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", + "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html" ], - "searches": { - "contextual_searches": [ - "Get Vulnerability Logs For Endpoint", - "Get Authentication Logs For Endpoint", - "Get Notable History", - "Get User Information from Identity Table", - "Get Risk Modifiers For User", - "Get Risk Modifiers For Endpoint" - ], - "detection_searches": [ - "Clients Connecting to Multiple DNS Servers", - "Detect hosts connecting to dynamic domain providers", - "DNS Query Requests Resolved by Unauthorized DNS Servers", - "DNS record changed" - ], - "investigative_searches": [ - "Get DNS Server History for a host", - "Get DNS traffic ratio", - "Get Process responsible for the DNS traffic", - "Investigate Web Activity From src_ip", - "Get History Of Email Sources" - ], - "support_searches": [ - "Discover DNS records" - ] - }, - "spec_version": 1, + "spec_version": 2, + "usecase": "Advanced Threat Detection", "version": "1.0" } From aa205852f92f56652d243df7a0f745112b370f7c Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 9 Apr 2019 11:34:37 -0700 Subject: [PATCH 73/74] spec 2 manifests --- detections/dns_evilginx_subdomains.json | 13 ++- detections/outlook_writing_zip.json | 96 +++++++++++++++++++ .../get_certificate_for_domain.json | 50 ++++++++++ 3 files changed, 158 insertions(+), 1 deletion(-) create mode 100644 detections/outlook_writing_zip.json create mode 100644 investigations/get_certificate_for_domain.json diff --git a/detections/dns_evilginx_subdomains.json b/detections/dns_evilginx_subdomains.json index 89d64aa5a4..07455cb8df 100644 --- a/detections/dns_evilginx_subdomains.json +++ b/detections/dns_evilginx_subdomains.json @@ -49,7 +49,18 @@ ], "how_to_implement": "You need to ingest data from your DNS logs. Specifically you must ingest the domain that is being queried and the IP of the host originating the request. Ideally, you should also be ingesting the answer to the query and the query type. This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You will have to add legitimate domain names to the `domains.csv` file shipped with the app", "id": "24dd17b1-e2fb-4c31-878c-d4f226595bfa", - "investigations": [], + "investigations": [ + { + "id": "bc91a8cf-35e7-4bb2-2240-e756cc06fd73", + "name": "Get Certificate logs for a domain", + "product_type": "splunk" + }, + { + "id": "c096f721-8842-42ce-bfc7-74bd8c72b711", + "name": "DNS record change investigation", + "product_type": "phantom" + } + ], "known_false_positives": "If a known good domain is not listed in the known_domains.csv file, then the search could give you false postives. Please update that lookup file to filter out legitimate DNS requests", "maintainers": [ { diff --git a/detections/outlook_writing_zip.json b/detections/outlook_writing_zip.json new file mode 100644 index 0000000000..e76cec26a4 --- /dev/null +++ b/detections/outlook_writing_zip.json @@ -0,0 +1,96 @@ +{ + "asset_type": "Endpoint", + "baselines": [], + "confidence": "high", + "creation_date": "2019-04-08", + "data_metadata": { + "data_models": [ + "Endpoint" + ], + "data_source": [ + "Endpoint Intel" + ], + "providing_technologies": [ + "Carbon Black Response", + "CrowdStrike Falcon", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "description": "This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk.", + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "dest, process_name, file_name", + "rule_description": "Oulook.exe is writing a zip file $file_name$ on $dest$", + "rule_title": "Oulook.exe is writing a zip file $file_name$ on $dest$" + }, + "risk": { + "risk_object": "dest", + "risk_object_type": [ + "system" + ], + "risk_score": 20 + }, + "scheduling": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user| `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | join [| tstats `summariesonly` values(Filesystem.file_path) as file_path count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*.zip by Filesystem.process_id Filesystem.file_hash Filesystem.dest Filesystem.file_name| `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | fields process_id dest file_path file_name file_hash]", + "suppress": { + "suppress_fields": "dest,file_name", + "suppress_period": "86400s" + } + } + } + }, + "eli5": "In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field \"process_id\", that we use the main search to check if that process_id belongs to a process_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk", + "entities": [ + "dest" + ], + "how_to_implement": "You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon.", + "id": "a51bfe1a-94f0-4822-b1e4-16ae10145893", + "investigations": [], + "known_false_positives": "It is not uncommon for outlook to write legitimate zip files to the disk.", + "maintainers": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "mappings": { + "cis20": [ + "CIS 7", + "CIS 8" + ], + "kill_chain_phases": [ + "Installation", + "Actions on Objectives" + ], + "mitre_attack": [ + "Spearphishing Attachment" + ], + "nist": [ + "ID.AM", + "PR.DS" + ] + }, + "modification_date": "2019-04-08", + "name": "Detect Oulook.exe writing a .zip file", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "product_type": "splunk", + "responses": [], + "security_domain": "network", + "spec_version": 2, + "version": "1.0" +} diff --git a/investigations/get_certificate_for_domain.json b/investigations/get_certificate_for_domain.json new file mode 100644 index 0000000000..d655085eb7 --- /dev/null +++ b/investigations/get_certificate_for_domain.json @@ -0,0 +1,50 @@ +{ + "channel": "ESCU", + "creation_date": "2019-04-08", + "data_metadata": { + "data_models": [ + "Certificates" + ], + "data_source": [ + "Certificate Logs" + ], + "providing_technologies": [ + "Splunk Stream", + "Bro" + ] + }, + "description": "This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that if the certificate information ", + "how_to_implement": "You must be ingesting your certificates or SSL logs from your network traffic into your Certificates datamodel. Please note the wildcard(*) before domain in the search syntax, we use to match for all domain and subdomain combinations", + "id": "bc91a8cf-35e7-4bb2-2240-e756cc06fd73", + "investigate": { + "splunk": { + "fields_required": [ + "domain" + ], + "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*{domain} by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `ctime(firstTime)` | `ctime(lastTime)`", + "window": { + "earliest_time_offset": 0, + "latest_time_offset": 86400 + } + } + }, + "maintainers": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "modification_date": "2019-04-08", + "name": "Get Certificate logs for a domain", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "product_type": "splunk", + "spec_version": 2, + "version": "1.0" +} From ad6a52f49cd9fd2760a7e9f8f0d8061220537909 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 9 Apr 2019 16:02:27 -0400 Subject: [PATCH 74/74] adding phishing payloads story --- stories/phishing_payloads.json | 38 ++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 stories/phishing_payloads.json diff --git a/stories/phishing_payloads.json b/stories/phishing_payloads.json new file mode 100644 index 0000000000..8164b97c8d --- /dev/null +++ b/stories/phishing_payloads.json @@ -0,0 +1,38 @@ +{ + "category": [ + "Adversary Tactics", + "Other" + ], + "channel": "ESCU", + "creation_date": "2019-04-10", + "description": "XXXX - Placeholder for Phishing description", + "detections": [ + { + "detection_id": "a51bfe1a-94f0-4822-b1e4-16ae10145893", + "name": "Detect Oulook.exe writing a .zip file", + "type": "splunk" + } + ], + "id": "57226b40-94f3-4ce5-b101-a75f67759c27", + "maintainers": [ + { + "company": "Splunk", + "email": "research@splunk.com", + "name": "Splunk Research Team" + } + ], + "modification_date": "2019-04-10", + "name": "Phishing Payloads", + "narrative": "XXXX - Placeholder for Phishing narrative", + "original_authors": [ + { + "company": "Splunk", + "email": "bpatel@splunk.com", + "name": "Bhavin Patel" + } + ], + "references": [], + "spec_version": 2, + "usecase": "Advanced Threat Detection", + "version": "1.0" +}