#############
# Automatically generated by generator.py in splunk/security_content
# On Date: {{ time }} UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

### STORIES ###

{% for story in stories %}
[analytic_story://{{ story.name }}]
category = {{ story.tags.category[0] }}
last_updated = {{ story.date }}
version = {{ story.version }}
references = {{ story.references | tojson }}
maintainers = [{"company": "{{ story.author_company }}", "email": "-", "name": "{{ story.author_name }}"}]
spec_version = 3
searches = {{ story.searches | tojson }}
description = {{ story.description }}
{% if story.narrative is defined %}
narrative = {{ story.narrative }}
{% endif %}

{% endfor %}
### END STORIES ###

### DETECTIONS ###

{% for detection in detections %}
[savedsearch://ESCU - {{ detection.name }} - Rule]
type = detection
asset_type = {{ detection.tags.asset_type }}
confidence = medium
explanation = {{ detection.description }}
{% if detection.how_to_implement is defined %}
how_to_implement = {{ detection.how_to_implement }}
{% else %}
how_to_implement = none
{% endif %}
annotations = {{ detection.mappings | tojson }}
known_false_positives = {{ detection.known_false_positives }}
providing_technologies = []

{% endfor %}
### END DETECTIONS ###

### RESPONSE TASKS ###

{% for response_task in response_tasks %}
[savedsearch://ESCU - {{ response_task.name }} - Response Task]
type = investigation
explanation = none
{% if response_task.how_to_implement is defined %}
how_to_implement = {{ response_task.how_to_implement }}
{% else %}
how_to_implement = none
{% endif %}
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0

{% endfor %}
### END RESPONSE TASKS ###

### BASELINES ###
{% for baseline in baselines %}
[savedsearch://ESCU - {{ baseline.name }}]
type = support
explanation = {{ baseline.description }}
{% if baseline.how_to_implement is defined %}
how_to_implement = {{ baseline.how_to_implement }}
{% else %}
how_to_implement = none
{% endif %}
{% if baseline.known_false_positives is defined %}
known_false_positives = {{ baseline.known_false_positives }}
{% else %}
known_false_positives = not defined
{% endif %}
providing_technologies = none

{% endfor %}
### END ESCU BASELINES ###
