admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

examples in spec files and docs

Browse Source
This commit is contained in:
bpatel
2019-04-02 17:00:32 -07:00
parent cfeccbd73e
commit 018cd8256c
5 changed files with 313 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/v2/baselines.spec.json
+107
View File
@@ -6,14 +6,23 @@
"properties": {
"phantom_server": {
"description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)",
"examples": [
"automation (hostname)"
],
"type": "string"
},
"playbook_name": {
"description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment",
"examples": [
"community/dns_hijack_investigation"
],
"type": "string"
},
"playbook_url": {
"description": "Url of the playbook on Phantom website.",
"examples": [
"https://my.phantom.us/4.1/playbook/dns-hijack-investigation/"
],
"type": "string"
},
"schedule": {
@@ -21,14 +30,23 @@
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"examples": [
"0 * * * *"
],
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"examples": [
"-70m@m"
],
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"examples": [
"-10m@m"
],
"type": "string"
}
},
@@ -36,10 +54,16 @@
},
"sensitivity": {
"description": "TLP colors (White, Green, Amber or Red)",
"examples": [
"green"
],
"type": "string"
},
"severity": {
"description": "Severity in phantom (High, Medium, Low)",
"examples": [
"medium"
],
"type": "string"
}
},
@@ -57,14 +81,23 @@
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"examples": [
"0 * * * *"
],
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"examples": [
"-70m@m"
],
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"examples": [
"-10m@m"
],
"type": "string"
}
},
@@ -72,6 +105,9 @@
},
"search": {
"description": "The search (in SPL) executed within core Splunk for investgation.",
"examples": [
"| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)"
],
"type": "string"
}
},
@@ -109,6 +145,9 @@
},
"creation_date": {
"description": "The date the baseline manifest was created",
"examples": [
"2019-02-14"
],
"type": "string"
},
"data_metadata": {
@@ -116,6 +155,9 @@
"properties": {
"data_eventtypes": {
"description": "A list of eventtypes, if any, used by this search",
"examples": [
"wineventlog"
],
"items": {
"type": "string"
},
@@ -125,6 +167,9 @@
},
"data_models": {
"description": "A list of data models, if any, used by this search",
"examples": [
"Network_Resolution"
],
"items": {
"enum": [
"Alerts",
@@ -152,6 +197,9 @@
},
"data_source": {
"description": "A high-level description of the type of data needed for this search to complete",
"examples": [
"DNS"
],
"items": {
"type": "string"
},
@@ -161,6 +209,9 @@
},
"data_sourcetypes": {
"description": "The list of sourcetypes, if any, used by this search",
"examples": [
"stream:dns"
],
"items": {
"type": "string"
},
@@ -170,6 +221,9 @@
},
"providing_technologies": {
"description": "A list of technologies that provide this data",
"examples": [
"Bro"
],
"items": {
"enum": [
"Apache",
@@ -209,14 +263,24 @@
},
"description": {
"description": "A description of what the search is is doing to create a baseline",
"examples": [
"The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Traffic` datamodel, then stores the output under the `discovered_dns_records.csv` lookup"
],
"type": "string"
},
"eli5": {
"description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
"examples": [
"Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`"
],
"type": "string"
},
"entities": {
"description": "A list of entities that will used in the story flow or are relevant to the security investigation.",
"examples": [
"dest",
"user"
],
"items": {
"enum": [
"accessKeyId",
@@ -250,14 +314,23 @@
},
"how_to_implement": {
"description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications",
"examples": [
"To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation"
],
"type": "string"
},
"id": {
"description": "The unique identifier for the search",
"examples": [
"c096f721-8842-42ce-bfc7-74bd8c72b7c3"
],
"type": "string"
},
"known_false_positives": {
"description": "Describe the known false postives while the analyst builds the baseline.",
"examples": [
"Please vet the lookup created by this baseline search."
],
"type": "string"
},
"maintainers": {
@@ -266,14 +339,23 @@
"properties": {
"company": {
"description": "Company associated with the person maintaining this search",
"examples": [
"Splunk"
],
"type": "string"
},
"email": {
"description": "Email address of the person maintaining this search",
"examples": [
"daftpunk@splunk.com"
],
"type": "string"
},
"name": {
"description": "Name of the person maintaining this search",
"examples": [
"Daft Punk"
],
"type": "string"
}
},
@@ -288,10 +370,16 @@
},
"modification_date": {
"description": "The date of the most recent modification to the search",
"examples": [
"2019-02-14"
],
"type": "string"
},
"name": {
"description": "The name of the search that creates the baseline",
"examples": [
"Discover DNS records"
],
"type": "string"
},
"original_authors": {
@@ -300,14 +388,23 @@
"properties": {
"company": {
"description": "Company associated with the person who originally authored the search",
"examples": [
"Splunk"
],
"type": "string"
},
"email": {
"description": "Email address of the person who originally authored the search",
"examples": [
"daftpunk@splunk.com"
],
"type": "string"
},
"name": {
"description": "Name of the person who originally authored the search",
"examples": [
"Daft Punk"
],
"type": "string"
}
},
@@ -326,14 +423,24 @@
"splunk",
"phantom",
"uba"
],
"examples": [
"splunk"
]
},
"spec_version": {
"description": "The version of the detection search specification this manifest follows",
"examples": [
"2.0"
],
"type": "integer"
},
"version": {
"description": "The version of the search",
"examples": [
"1",
"2"
],
"type": "string"
}
},
spec/v2/detections.spec.json
+195 -8
View File
@@ -12,14 +12,23 @@
"properties": {
"nes_fields": {
"description": "A list of suggested fields to be used for notable-event suppression",
"examples": [
"src"
],
"type": "string"
},
"rule_description": {
"description": "Description of the notable event that will display in Incident Review",
"examples": [
"The table represents a list of DNS records and their responses for corporate domains that have recently changed"
],
"type": "string"
},
"rule_title": {
"description": "Title of the notable event that will display in Incident Review",
"description": "Title of the notable event that will display in Incident Review. Add tokenized fieldnames",
"examples": [
"DNS record changed on $src$"
],
"type": "string"
}
},
@@ -35,10 +44,16 @@
"properties": {
"risk_object": {
"description": "TThe field to which you are assigning risk",
"examples": [
"src"
],
"type": "string"
},
"risk_object_type": {
"description": "The type of object to which you are assigning risk",
"examples": [
"system"
],
"items": {
"enum": [
"system",
@@ -54,6 +69,9 @@
},
"risk_score": {
"description": "Score assigned to risk_object",
"examples": [
"40"
],
"type": "integer"
}
},
@@ -69,14 +87,23 @@
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"examples": [
"0 * * * *"
],
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"examples": [
"-70m@m"
],
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"examples": [
"-10m@m"
],
"type": "string"
}
},
@@ -84,6 +111,9 @@
},
"search": {
"description": "The search that will trigger phantom playbook",
"examples": [
"| sendalert runphantomplaybook"
],
"type": "string"
},
"suppress": {
@@ -91,10 +121,16 @@
"properties": {
"suppress_fields": {
"description": "The fields to base the suppression on",
"examples": [
"src"
],
"type": "string"
},
"suppress_period": {
"description": "The length of time the suppression should be in effect",
"examples": [
"28800s"
],
"type": "string"
}
},
@@ -113,22 +149,37 @@
},
"phantom_server": {
"description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)",
"examples": [
"automation (hostname)"
],
"type": "string"
},
"playbook_name": {
"description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment",
"examples": [
"community/dns_hijack_detect_playbook"
],
"type": "string"
},
"playbook_url": {
"description": "Url of the playbook on Phantom website.",
"examples": [
"https://my.phantom.us/4.1/playbook/dns-hijack-investigation/"
],
"type": "string"
},
"sensitivity": {
"description": "TLP colors (White, Green, Amber or Red)",
"description": "TLP colors (white, green, amber or red)",
"examples": [
"green"
],
"type": "string"
},
"severity": {
"description": "Severity in phantom (High, Medium, Low)",
"examples": [
"high"
],
"type": "string"
}
},
@@ -361,18 +412,30 @@
},
"event_type": {
"description": "An anomaly or threat.",
"examples": [
"anomaly"
],
"type": "string"
},
"model": {
"description": "The name of the Splunk UBA model that detected the anomaly.",
"examples": [
"UBA Model"
],
"type": "string"
},
"model_version": {
"description": "Url of the playbook on Phantom website.",
"examples": [
"2.0"
],
"type": "string"
},
"threat_category": {
"description": "The category of a threat in Splunk UBA.",
"examples": [
"Malware"
],
"type": "string"
}
},
@@ -390,6 +453,9 @@
"properties": {
"asset_type": {
"description": "Designates the type of asset being investigated",
"examples": [
"Endpoint"
],
"type": "string"
},
"baselines": {
@@ -398,10 +464,16 @@
"properties": {
"id": {
"description": "UUID of the baseline object",
"examples": [
"c096f721-8842-42ce-bfc7-74bd8c72b7c3"
],
"type": "string"
},
"name": {
"description": "name of baseline object",
"examples": [
"Discover DNS records"
],
"type": "string"
},
"type": {
@@ -411,6 +483,9 @@
"splunk",
"uba"
],
"examples": [
"splunk"
],
"product_type": "string"
}
},
@@ -429,10 +504,16 @@
"high",
"medium",
"low"
],
"examples": [
"high"
]
},
"creation_date": {
"description": "The date the story manifest was created",
"examples": [
"2019-02-14"
],
"type": "string"
},
"data_metadata": {
@@ -440,6 +521,9 @@
"properties": {
"data_eventtypes": {
"description": "A list of eventtypes, if any, used by this search",
"examples": [
"wineventlog"
],
"items": {
"type": "string"
},
@@ -449,6 +533,9 @@
},
"data_models": {
"description": "A list of data models, if any, used by this search",
"examples": [
"Network_Resolution"
],
"items": {
"enum": [
"Alerts",
@@ -476,6 +563,9 @@
},
"data_source": {
"description": "A high-level description of the type of data needed for this search to complete",
"examples": [
"DNS"
],
"items": {
"type": "string"
},
@@ -485,6 +575,9 @@
},
"data_sourcetypes": {
"description": "The list of sourcetypes, if any, used by this search",
"examples": [
"stream:dns"
],
"items": {
"type": "string"
},
@@ -494,6 +587,9 @@
},
"providing_technologies": {
"description": "A list of technologies that provide this data",
"examples": [
"Bro"
],
"items": {
"enum": [
"Apache",
@@ -534,6 +630,9 @@
},
"description": {
"description": "A description of what the detection is designed to find",
"examples": [
"The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day."
],
"type": "string"
},
"detect": {
@@ -569,10 +668,17 @@
},
"eli5": {
"description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
"examples": [
"Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed."
],
"type": "string"
},
"entities": {
"description": "A list of entities that is outputed by the search...",
"examples": [
"dest",
"user"
],
"items": {
"enum": [
"accessKeyId",
@@ -606,10 +712,14 @@
},
"how_to_implement": {
"description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications",
"examples": [],
"type": "string"
},
"id": {
"description": "The unique identifier for the detection",
"examples": [
"To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\"."
],
"type": "string"
},
"investigations": {
@@ -617,20 +727,29 @@
"items": {
"properties": {
"id": {
"description": "UUID of the baseline object",
"description": "UUID of the investigation object",
"examples": [
"bc11a8cf-35e7-4bb2-8140-e756cc06fd72"
],
"type": "string"
},
"name": {
"description": "Name of baseline",
"description": "Name of investigation object ",
"examples": [
"Get DNS Server History for a host"
],
"type": "string"
},
"product_type": {
"description": "Type of baseline to execute",
"description": "Type of investigation object",
"enum": [
"phantom",
"splunk",
"uba"
],
"examples": [
"splunk"
],
"type": "string"
}
},
@@ -645,6 +764,9 @@
},
"known_false_positives": {
"description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior",
"examples": [
"Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate."
],
"type": "string"
},
"maintainers": {
@@ -653,14 +775,23 @@
"properties": {
"company": {
"description": "Company associated with the person maintaining this search",
"examples": [
"Splunk"
],
"type": "string"
},
"email": {
"description": "Email address of the person maintaining this search",
"examples": [
"daftpunk@splunk.com"
],
"type": "string"
},
"name": {
"description": "Name of the person maintaining this search",
"examples": [
"Daft Punk"
],
"type": "string"
}
},
@@ -678,6 +809,9 @@
"properties": {
"cis20": {
"description": "A list of critical security controls this search helps you implement",
"examples": [
"CIS 12"
],
"items": {
"enum": [
"CIS 1",
@@ -708,6 +842,9 @@
},
"emoji": {
"description": "A list of security emojis that will help UBA understand this alert as an external alarm",
"examples": [
"EndPoint"
],
"items": {
"enum": [
"EndPoint",
@@ -727,6 +864,9 @@
},
"kill_chain_phases": {
"description": "A list of kill-chain phases to which the search applies",
"examples": [
"Reconnaissance"
],
"items": {
"enum": [
"Reconnaissance",
@@ -744,6 +884,10 @@
},
"mitre_attack": {
"description": "A list of the techniques and tactics identified by the search",
"examples": [
"Defense Evasion",
"Initial Access"
],
"items": {
"enum": [
"Initial Access",
@@ -871,6 +1015,10 @@
},
"nist": {
"description": "A list of the NIST controls the search helps you implement",
"examples": [
"ID.AM",
"PR.PT"
],
"items": {
"enum": [
"ID.AM",
@@ -902,10 +1050,16 @@
},
"modification_date": {
"description": "The date of the most recent modification to the search",
"examples": [
"2019-02-14"
],
"type": "string"
},
"name": {
"description": "The name of the detection",
"examples": [
"DNS record changed"
],
"type": "string"
},
"original_authors": {
@@ -914,14 +1068,23 @@
"properties": {
"company": {
"description": "Company associated with the person who originally authored the search",
"examples": [
"Splunk"
],
"type": "string"
},
"email": {
"description": "Email address of the person who originally authored the search",
"examples": [
"daftpunk@splunk.com"
],
"type": "string"
},
"name": {
"description": "Name of the person who originally authored the search",
"examples": [
"Daft Punk"
],
"type": "string"
}
},
@@ -940,10 +1103,16 @@
"uba",
"splunk",
"phantom"
],
"examples": [
"phantom"
]
},
"references": {
"description": "A list of URLs that give more information about the search",
"examples": [
"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
],
"items": {
"type": "string"
},
@@ -952,15 +1121,21 @@
"uniqueItems": true
},
"responses": {
"description": "An array of the response objects to exectute on the detection results ",
"description": "An array of the response objects to exectute on the detection results",
"items": {
"properties": {
"id": {
"description": "UUID of the baseline object",
"description": "UUID of the Respose object",
"examples": [
"1169w17b-ef78-4b59-aae8-5369073014e1"
],
"type": "string"
},
"name": {
"description": "name of baseline",
"description": "Name of Response Object",
"examples": [
"DNS Hijack Reponse"
],
"type": "string"
},
"product_type": {
@@ -970,6 +1145,9 @@
"splunk",
"uba"
],
"examples": [
"phantom"
],
"product_type": "string"
}
},
@@ -989,14 +1167,23 @@
"endpoint",
"network",
"threat"
],
"examples": [
"endpoint"
]
},
"spec_version": {
"description": "The version of the detection specification this manifest follows",
"examples": [
"2.0"
],
"type": "integer"
},
"version": {
"description": "The version of the detection",
"examples": [
"1"
],
"type": "string"
}
},
spec/v2/example/baseline_dns_record_changed.json.example
+1
View File
@@ -8,6 +8,7 @@
"search": "| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \"\\*\", \"\")) | join domain [|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records.csv"
}
},
"entities": ["dest","user"],
"product_type": "splunk",
"creation_date": "2019-02-14",
"data_metadata": {
spec/v2/example/detection_phantom.json.example
+8 -4
View File
@@ -67,14 +67,19 @@
"spec_version": 2,
"version": "1.0",
"baselines": [],
"entities":["dest"],
"detect": {
"phantom": {
"phantom_server": "automation (hostname)",
"playbook_display_name": "DNS record change investigation",
"playbook_name": "community/dns_hijack_investigation",
"playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/",
"sensitivity": "green",
"severity": "medium",
"schedule": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"correlation_rule": {
"notable": {
"nes_fields": "src",
@@ -88,7 +93,7 @@
],
"risk_score": 40
},
"scheduling": {
"schedule": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
@@ -96,8 +101,7 @@
"suppress": {
"suppress_fields": "src",
"suppress_period": "28800s"
},
"search": "|makeresults | sendalert sendtophantom"
}
}
}
},
spec/v2/example/detection_splunk.json.example
+2 -1
View File
@@ -4,7 +4,7 @@
"baselines": [
{
"id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3",
"name": "Discover DNS records,",
"name": "Discover DNS records",
"product_type": "splunk"
}
],
@@ -50,6 +50,7 @@
}
}
},
"entities":["dest"]
"eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.",
"how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\". <br></br> <b>Splunk>Phantom Playbook Integration</b><br></br>If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk <code>https://splunkbase.splunk.com/app/3411/</code>, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. <br/>(Playbook Link:<code>https://my.phantom.us/4.1/playbook/dns-hijack-investigation/</code>).<br></br>",
"id": "44d3a43e-dcd5-49f7-8356-5209bb369065",