#############
# Automatically generated by generator.py in splunk/security_content
# On Date: {{ time }} UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

### ESCU DETECTIONS ###

{% for detection in detections %}
[ESCU - {{ detection.name }} - Rule]
action.escu = 0
action.escu.enabled = 1
description = {{ detection.description }}
action.escu.mappings = {{ detection.mappings | tojson }}
{% if detection.data_model is defined %}
action.escu.data_models = [{{ detection.data_model | tojson }}]
{% else %}
action.escu.data_models = []
{% endif %}
action.escu.eli5 = {{ detection.description }}
{% if detection.how_to_implement is defined %}
action.escu.how_to_implement = {{ detection.how_to_implement }}
{% else %}
action.escu.how_to_implement = none
{% endif %}
{% if detection.known_false_positives is defined %}
action.escu.known_false_positives = {{ detection.known_false_positives }}
{% else %}
action.escu.known_false_positives = None
{% endif %}
action.escu.creation_date = {{ detection.date }}
action.escu.modification_date = {{ detection.date }}
action.escu.confidence = high
action.escu.full_search_name = ESCU - {{ detection.name }} - Rule
action.escu.search_type = detection
{% if detection.product is defined %}
action.escu.product = {{ detection.product | tojson }}
{% endif %}
{% if detection.providing_technologies is defined %}
action.escu.providing_technologies = {{ detection.providing_technologies | tojson }}
{% else %}
action.escu.providing_technologies = []
{% endif %}
{% if detection.tags.analytic_story is defined %}
action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
{% if detection.tags.risk_object is defined %}
action.risk = 1
action.risk.param._risk_object = {{ detection.tags.risk_object }}
action.risk.param._risk_object_type = {{ detection.tags.risk_object_type }}
action.risk.param._risk_score = {{ detection.tags.risk_score }}
action.risk.param.verbose = 0
{% endif %}
{% else %}
action.escu.analytic_story = []
{% endif %}
cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
{% if detection.deployment.scheduling.schedule_window is defined %}
schedule_window = {{ detection.deployment.scheduling.schedule_window }}
{% endif %}
{% if detection.deployment.alert_action is defined %}
{% if detection.deployment.alert_action.notable is defined %}
action.notable = 1
{% if detection.nes_fields is defined %}
action.notable.param.nes_fields = {{ detection.nes_fields }}
{% endif %}
action.notable.param.rule_description = {{ detection.deployment.alert_action.notable.rule_description | custom_jinja2_enrichment_filter(detection) }}
action.notable.param.rule_title = {{ detection.deployment.alert_action.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}
action.notable.param.security_domain = {{ detection.tags.security_domain }}
action.notable.param.severity = high
{% endif %}
{% if detection.deployment.alert_action.email is defined %}
action.email.subject.alert = {{ detection.deployment.alert_action.email.subject | custom_jinja2_enrichment_filter(detection) }}
action.email.to = {{ detection.deployment.alert_action.email.to }}
action.email.message.alert = {{ detection.deployment.alert_action.email.message | custom_jinja2_enrichment_filter(detection) }}
action.email.useNSSubject = 1
{% endif %}
{% endif %}
alert.digest_mode = 1
disabled = true
enableSched = 1
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = {{ detection.search }}

{% endfor %}
### END ESCU DETECTIONS ###


### ESCU BASELINES ###

{% for baseline in baselines %}
[ESCU - {{ baseline.name }}]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = support
action.escu.full_search_name = ESCU - {{ baseline.name }}
description = {{ baseline.description }}
action.escu.creation_date = {{ baseline.date }}
action.escu.modification_date = {{ baseline.date }}
{% if baseline.tags.analytic_story is defined %}
action.escu.analytic_story = {{ baseline.tags.analytic_story | tojson }}
{% else %}
action.escu.analytic_story = []
{% endif %}
{% if baseline.data_model is defined %}
action.escu.data_models = [{{ baseline.data_model | tojson }}]
{% else %}
action.escu.data_models = []
{% endif %}
cron_schedule = {{ baseline.deployment.scheduling.cron_schedule }}
enableSched = 1
dispatch.earliest_time = {{ baseline.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ baseline.deployment.scheduling.latest_time }}
{% if baseline.deployment.scheduling.schedule_window is defined %}
schedule_window = {{ baseline.deployment.scheduling.schedule_window }}
{% endif %}
{% if baseline.providing_technologies is defined %}
action.escu.providing_technologies = {{ baseline.providing_technologies | tojson }}
{% else %}
action.escu.providing_technologies = []
{% endif %}
action.escu.eli5 = {{ baseline.description }}
{% if baseline.how_to_implement is defined %}
action.escu.how_to_implement = {{ baseline.how_to_implement }}
{% else %}
action.escu.how_to_implement = none
{% endif %}
disabled = true
is_visible = false
search = {{ baseline.search }}

{% endfor %}


### ESCU RESPONSE TASKS ###

{% for response_task in response_tasks %}
{% if response_task.search is defined %}
[ESCU - {{ response_task.name }} - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - {{ response_task.name }} - Response Task
description = {{ response_task.description }}
action.escu.creation_date = {{ response_task.date }}
action.escu.modification_date = {{ response_task.date }}
{% if response_task.tags is defined %}
action.escu.analytic_story = {{ response_task.tags.analytic_story | tojson }}
{% else %}
action.escu.analytic_story = []
{% endif %}
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
{% if response_task.data_model is defined %}
action.escu.data_models = [{{ response_task.data_model | tojson}}]
{% else %}
action.escu.data_models = []
{% endif %}
action.escu.eli5 = {{ response_task.description }}
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = {{ response_task.search }}

{% endif %}
{% endfor %}


### END ESCU RESPONSE TASKS ###

### USAGE DASHBOARD CONFIGURATIONS ###

[escu-metrics-usage]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

[escu-metrics-search]
action.email.useNSSubject = 1
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)

[escu-metrics-search-events]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")

[escu-metrics-search-longest-runtime]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
disabled = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id

[escu-metrics-usage-search]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
enableSched = 1
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*

### END OF USAGE DASHBOARD CONFIGURATIONS ###
