diff --git a/contentctl.yml b/contentctl.yml index 8d4d68079f..0a0e902160 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.0.0 + version: 5.1.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU @@ -30,11 +30,11 @@ splunk_api_username: null post_test_behavior: pause_on_failure apps: - uid: 1621 - title: Splunk Common Information Model (CIM) + title: Splunk_SA_CIM appid: Splunk_SA_CIM - version: 6.0.1 + version: 6.0.2 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-cim_601.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-cim_602.tgz - uid: 6553 title: Splunk Add-on for Okta Identity Cloud appid: Splunk_TA_okta_identity_cloud @@ -143,9 +143,9 @@ apps: - uid: 1876 title: Splunk Add-on for AWS appid: Splunk_TA_aws - version: 7.9.0 + version: 7.9.1 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services-aws_790.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services-aws_791.tgz - uid: 3088 title: Splunk Add-on for Google Cloud Platform appid: SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM @@ -161,9 +161,9 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 5.4.2 + version: 5.4.3 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_543.tgz - uid: 4055 title: Splunk Add-on for Microsoft Office 365 appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365 diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 743e34d3eb..05913a6ff4 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -10,4 +10,4 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index c4f146026d..a20439b21c 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -9,7 +9,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index af1afc59c0..e2734eacfe 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -10,4 +10,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index ef4041930f..6f81a304c6 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index a40d3472a9..c1ecfc85fd 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 44fabed1bb..e3c593b810 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 4834e03b5d..d7a1719024 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 8c2aa289b1..4bb43d44ad 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 7f09482a94..9969173ed5 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index b9eb2d9e66..a2f6ad9a2a 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 49b4ea9e54..755fe9f0b1 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index d8140341e4..600b0023f9 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 64c885e902..669e657594 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 4a1bdc3f68..2161893152 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index bfef68070f..5f035b6840 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index 3998089a44..71542b720c 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index d7b436d019..1277dc4fd3 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index df3b6cea4e..ca2052001a 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index f383f21440..fef70de601 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 9e70698a5f..5b4fa662e4 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 936f52788a..8acfb651df 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 591ea64693..de55c5ea81 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 7c0003f08b..94dea0f434 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 44cd10188c..7c8c181855 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 545fbcec9a..e4061c8a3f 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 6b586a2a3e..83a15e8c9d 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 1555fafdac..da13b0269c 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index e03ef28b7d..21859dada9 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 2368ae2314..464634f0ad 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 94da197c95..c4849b1233 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 79696cbffc..8b3f6fd0aa 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 376fecc828..3315cc9143 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 27d29dea5d..6ec2284157 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index fc6857d804..20f51f7003 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index b33710f139..18c2c3b2c9 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 813b021c40..3c1769680a 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 26ab870860..836fee56bc 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 373a15ede9..5c006d97a8 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 10765a8703..d5009bf3d2 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index c9d8491a16..060a4d5b9a 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 50c9bb4051..9c72d4c291 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 4d928ee0d2..ebdfefcc92 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 707c03fcf6..2f1625ef3e 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 9b2786fadb..fb9b0a64d3 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 4ce1405960..c3dfb3942e 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 9797971379..26c0214146 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index f285ce143e..0f29b4bc23 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index de90a002fe..e378ea1ed5 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 6978637a08..f7731254c3 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 2f2cd5b188..faa465f737 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index f22ec6b7ba..265e352353 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index b20242046f..6cdaddfb41 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -9,7 +9,7 @@ sourcetype: aws:cloudwatchlogs:vpcflow separator: eventName supported_TA: - name: Splunk Add-on for AWS - version: 7.9.0 + version: 7.9.1 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 5d4d52b2e7..93d572e96f 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -9,7 +9,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.9.0 + version: 7.9.1 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 2fa460b33f..b9f6759d8f 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + version: 5.4.3 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index f527bda794..918b0f4e1e 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + version: 5.4.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 3a0db1013e..7b64ddee44 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -1,68 +1,69 @@ name: Azure Active Directory Add member to role id: 1660d196-127f-4678-81b2-472d51711b07 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Add member to role source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add member to role", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "52.177.250.168", "correlationId": "b425f2d7-2245-4952-b599-61dff8054f2b", diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index a58de4a47b..c98c77b9a8 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -1,73 +1,74 @@ name: Azure Active Directory Add owner to application id: e895ed56-7be4-4b3a-b782-ecd0f594ec4c version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Add owner to application source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- eventtype -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tag -- tag::eventtype -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - eventtype + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add owner to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "20.190.135.43", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index e3970586a3..0bb3fdcae5 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -1,68 +1,69 @@ name: Azure Active Directory Add service principal id: fd89d337-e4c0-4162-ad13-bca36f096fe6 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Add service principal source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", + - _time + - Level + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index d4103cfef6..a5596f0496 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -1,68 +1,69 @@ name: Azure Active Directory Add unverified domain id: d4c01fb1-3b88-46d3-bd12-9b9e256450f7 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Add unverified domain source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add unverified domain", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index d7a04aa5ad..b3d7d4261f 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -1,73 +1,74 @@ name: Azure Active Directory Consent to application id: 4c5d6c49-53e3-4980-a4de-c63e26291ed0 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Consent to application source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- eventtype -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.userAgent -- punct -- resourceId -- resultDescription -- resultSignature -- source -- sourcetype -- splunk_server -- tag -- tag::eventtype -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - eventtype + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.userAgent + - punct + - resourceId + - resultDescription + - resultSignature + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Consent to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "resultDescription": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 2ef98d1f69..2994b27ebc 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -1,67 +1,68 @@ name: Azure Active Directory Disable Strong Authentication id: 8f31966d-c496-496d-8837-f7fd11f31255 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Disable Strong Authentication source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Disable Strong Authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index b09a4f4204..c7a7fcebfa 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -1,68 +1,69 @@ name: Azure Active Directory Enable account id: cb49f3cd-04ad-415c-a5ed-9b27b2829fa7 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Enable account source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Enable account", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index e66920d152..fa664fc4e7 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -1,67 +1,68 @@ name: Azure Active Directory Invite external user id: d3818bd5-f283-4518-8b67-df19240c3e40 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Invite external user source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Invite external user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "40.126.4.40", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index b3fb17cd5e..b8858e31c3 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -1,68 +1,69 @@ name: Azure Active Directory Reset password (by admin) id: dcd0e4dc-68f8-4b77-a66f-89c57b3afa6b version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Reset password (by admin) source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultDescription -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultDescription + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Reset password (by admin)", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "resultDescription": "None", "durationMs": 0, "callerIpAddress": "40.81.4.144", diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index dda3730b7f..e71bc888af 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -1,68 +1,69 @@ name: Azure Active Directory Set domain authentication id: e7bcdab9-908c-40ab-ba38-5db54fa87750 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Set domain authentication source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 7b53354989..6f20719a53 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -1,118 +1,119 @@ name: Azure Active Directory Sign-in activity id: f9ed0a3a-9e20-4198-a035-d0a29593fbe0 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Sign-in activity source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- identity -- index -- linecount -- location -- operationName -- operationVersion -- properties.alternateSignInName -- properties.appDisplayName -- properties.appId -- properties.appServicePrincipalId -- properties.authenticationDetails{}.RequestSequence -- properties.authenticationDetails{}.StatusSequence -- properties.authenticationDetails{}.authenticationMethod -- properties.authenticationDetails{}.authenticationMethodDetail -- properties.authenticationDetails{}.authenticationStepDateTime -- properties.authenticationDetails{}.authenticationStepRequirement -- properties.authenticationDetails{}.authenticationStepResultDetail -- properties.authenticationDetails{}.succeeded -- properties.authenticationProcessingDetails{}.key -- properties.authenticationProcessingDetails{}.value -- properties.authenticationProtocol -- properties.authenticationRequirement -- properties.authenticationRequirementPolicies{}.detail -- properties.authenticationRequirementPolicies{}.requirementProvider -- properties.autonomousSystemNumber -- properties.clientAppUsed -- properties.clientCredentialType -- properties.conditionalAccessStatus -- properties.correlationId -- properties.createdDateTime -- properties.crossTenantAccessType -- properties.deviceDetail.deviceId -- properties.deviceDetail.operatingSystem -- properties.flaggedForReview -- properties.homeTenantId -- properties.id -- properties.incomingTokenType -- properties.ipAddress -- properties.isInteractive -- properties.isTenantRestricted -- properties.location.city -- properties.location.countryOrRegion -- properties.location.geoCoordinates.latitude -- properties.location.geoCoordinates.longitude -- properties.location.state -- properties.originalRequestId -- properties.originalTransferMethod -- properties.processingTimeInMilliseconds -- properties.resourceDisplayName -- properties.resourceId -- properties.resourceServicePrincipalId -- properties.resourceTenantId -- properties.riskDetail -- properties.riskLevelAggregated -- properties.riskLevelDuringSignIn -- properties.riskState -- properties.rngcStatus -- properties.servicePrincipalId -- properties.signInIdentifier -- properties.signInTokenProtectionStatus -- properties.ssoExtensionVersion -- properties.status.additionalDetails -- properties.status.errorCode -- properties.status.failureReason -- properties.tenantId -- properties.tokenIssuerName -- properties.tokenIssuerType -- properties.uniqueTokenIdentifier -- properties.userAgent -- properties.userDisplayName -- properties.userId -- properties.userPrincipalName -- properties.userType -- punct -- resourceId -- resultDescription -- resultSignature -- resultType -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-10-24T20:13:31.4449614Z", "resourceId": "/tenants/887c9144-28b8-431b-885b-764fdeefcf62/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - identity + - index + - linecount + - location + - operationName + - operationVersion + - properties.alternateSignInName + - properties.appDisplayName + - properties.appId + - properties.appServicePrincipalId + - properties.authenticationDetails{}.RequestSequence + - properties.authenticationDetails{}.StatusSequence + - properties.authenticationDetails{}.authenticationMethod + - properties.authenticationDetails{}.authenticationMethodDetail + - properties.authenticationDetails{}.authenticationStepDateTime + - properties.authenticationDetails{}.authenticationStepRequirement + - properties.authenticationDetails{}.authenticationStepResultDetail + - properties.authenticationDetails{}.succeeded + - properties.authenticationProcessingDetails{}.key + - properties.authenticationProcessingDetails{}.value + - properties.authenticationProtocol + - properties.authenticationRequirement + - properties.authenticationRequirementPolicies{}.detail + - properties.authenticationRequirementPolicies{}.requirementProvider + - properties.autonomousSystemNumber + - properties.clientAppUsed + - properties.clientCredentialType + - properties.conditionalAccessStatus + - properties.correlationId + - properties.createdDateTime + - properties.crossTenantAccessType + - properties.deviceDetail.deviceId + - properties.deviceDetail.operatingSystem + - properties.flaggedForReview + - properties.homeTenantId + - properties.id + - properties.incomingTokenType + - properties.ipAddress + - properties.isInteractive + - properties.isTenantRestricted + - properties.location.city + - properties.location.countryOrRegion + - properties.location.geoCoordinates.latitude + - properties.location.geoCoordinates.longitude + - properties.location.state + - properties.originalRequestId + - properties.originalTransferMethod + - properties.processingTimeInMilliseconds + - properties.resourceDisplayName + - properties.resourceId + - properties.resourceServicePrincipalId + - properties.resourceTenantId + - properties.riskDetail + - properties.riskLevelAggregated + - properties.riskLevelDuringSignIn + - properties.riskState + - properties.rngcStatus + - properties.servicePrincipalId + - properties.signInIdentifier + - properties.signInTokenProtectionStatus + - properties.ssoExtensionVersion + - properties.status.additionalDetails + - properties.status.errorCode + - properties.status.failureReason + - properties.tenantId + - properties.tokenIssuerName + - properties.tokenIssuerType + - properties.uniqueTokenIdentifier + - properties.userAgent + - properties.userDisplayName + - properties.userId + - properties.userPrincipalName + - properties.userType + - punct + - resourceId + - resultDescription + - resultSignature + - resultType + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-10-24T20:13:31.4449614Z", "resourceId": "/tenants/887c9144-28b8-431b-885b-764fdeefcf62/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "resultType": "50076", "resultSignature": "None", "resultDescription": "Due to a configuration change made by your administrator, diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index b77b1dfa80..885c6ebc6e 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -1,68 +1,69 @@ name: Azure Active Directory Update application id: 2c08188a-ba25-496e-87c7-803cf28b6c90 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Update application source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2024-01-29T21:31:03.0102031Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", + - _time + - Level + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2024-01-29T21:31:03.0102031Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Update application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "a5396d2b-fcf6-41e7-9219-c6239f1298e3", "Level": 4, "properties": diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index d04c125346..f5710a0bd3 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -1,69 +1,70 @@ name: Azure Active Directory Update authorization policy id: c5b7ffcd-73d8-4fe5-afd8-b1218d715c0c version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Update authorization policy source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5f210575-a69b-41a7-b623-3f6d79ccd432/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5f210575-a69b-41a7-b623-3f6d79ccd432/providers/Microsoft.aadiam", "operationName": "Update authorization policy", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "5f210575-a69b-41a7-b623-3f6d79ccd432", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index c589966ec2..0e5273fb9f 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -1,70 +1,71 @@ name: Azure Active Directory Update user id: 5495c90a-047c-4b8e-b2fe-1db6282d3872 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk description: Data source object for Azure Active Directory Update user source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.additionalDetails{}.key -- properties.additionalDetails{}.value -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.modifiedProperties{}.displayName -- properties.targetResources{}.modifiedProperties{}.newValue -- properties.targetResources{}.modifiedProperties{}.oldValue -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 5880ca36cd..dbd321a382 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -1,67 +1,69 @@ name: Azure Active Directory User registered security info id: b63240de-8a01-4ba8-8987-89d18d4b375d version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk -description: Data source object for Azure Active Directory User registered security +description: + Data source object for Azure Active Directory User registered security info source: Azure AD sourcetype: azure:monitor:aad separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- Level -- callerIpAddress -- category -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- durationMs -- host -- index -- linecount -- operationName -- operationVersion -- properties.activityDateTime -- properties.activityDisplayName -- properties.category -- properties.correlationId -- properties.id -- properties.initiatedBy.user.displayName -- properties.initiatedBy.user.id -- properties.initiatedBy.user.ipAddress -- properties.initiatedBy.user.userPrincipalName -- properties.loggedByService -- properties.operationType -- properties.result -- properties.resultReason -- properties.targetResources{}.displayName -- properties.targetResources{}.id -- properties.targetResources{}.type -- properties.targetResources{}.userPrincipalName -- properties.userAgent -- punct -- resourceId -- resultDescription -- resultSignature -- source -- sourcetype -- splunk_server -- tenantId -- time -- timeendpos -- timestartpos -example_log: '{"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/91da745f-8abb-4a7d-ba94-5667c6f9e01a/providers/Microsoft.aadiam", + - _time + - Level + - callerIpAddress + - category + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - durationMs + - host + - index + - linecount + - operationName + - operationVersion + - properties.activityDateTime + - properties.activityDisplayName + - properties.category + - properties.correlationId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.loggedByService + - properties.operationType + - properties.result + - properties.resultReason + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.type + - properties.targetResources{}.userPrincipalName + - properties.userAgent + - punct + - resourceId + - resultDescription + - resultSignature + - source + - sourcetype + - splunk_server + - tenantId + - time + - timeendpos + - timestartpos +example_log: + '{"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/91da745f-8abb-4a7d-ba94-5667c6f9e01a/providers/Microsoft.aadiam", "operationName": "User registered security info", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "91da745f-8abb-4a7d-ba94-5667c6f9e01a", "resultSignature": "None", "resultDescription": "User registered App Password", "durationMs": 0, "callerIpAddress": diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index b341d24461..05dd72aa2c 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -1,107 +1,109 @@ name: Azure Audit Create or Update an Azure Automation account id: 2ab182e7-feda-4249-9418-32710b55a885 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk -description: Data source object for Azure Audit Create or Update an Azure Automation +description: + Data source object for Azure Audit Create or Update an Azure Automation account source: mscs:azure:audit sourcetype: mscs:azure:audit separator: operationName.localizedValue supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- authorization.action -- authorization.scope -- caller -- channels -- claims.aio -- claims.altsecid -- claims.appid -- claims.appidacr -- claims.aud -- claims.exp -- claims.groups -- claims.http://schemas.microsoft.com/claims/authnclassreference -- claims.http://schemas.microsoft.com/claims/authnmethodsreferences -- claims.http://schemas.microsoft.com/identity/claims/identityprovider -- claims.http://schemas.microsoft.com/identity/claims/objectidentifier -- claims.http://schemas.microsoft.com/identity/claims/scope -- claims.http://schemas.microsoft.com/identity/claims/tenantid -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname -- claims.iat -- claims.ipaddr -- claims.iss -- claims.name -- claims.nbf -- claims.puid -- claims.rh -- claims.uti -- claims.ver -- claims.wids -- claims.xms_tcdt -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventDataId -- eventName.localizedValue -- eventName.value -- eventSource.localizedValue -- eventSource.value -- eventTimestamp -- host -- id -- index -- level -- linecount -- object -- object_id -- object_path -- operationId -- operationName.localizedValue -- operationName.value -- product -- properties.entity -- properties.eventCategory -- properties.hierarchy -- properties.message -- punct -- resourceGroupName -- resourceProviderName.localizedValue -- resourceProviderName.value -- resourceUri -- source -- sourcetype -- splunk_server -- status -- status.localizedValue -- status.value -- subStatus.value -- submissionTimestamp -- subscriptionId -- timeendpos -- timestartpos -- user -- user_name -- vendor -- vendor_product -- vendor_res_code -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/write", + - _time + - authorization.action + - authorization.scope + - caller + - channels + - claims.aio + - claims.altsecid + - claims.appid + - claims.appidacr + - claims.aud + - claims.exp + - claims.groups + - claims.http://schemas.microsoft.com/claims/authnclassreference + - claims.http://schemas.microsoft.com/claims/authnmethodsreferences + - claims.http://schemas.microsoft.com/identity/claims/identityprovider + - claims.http://schemas.microsoft.com/identity/claims/objectidentifier + - claims.http://schemas.microsoft.com/identity/claims/scope + - claims.http://schemas.microsoft.com/identity/claims/tenantid + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname + - claims.iat + - claims.ipaddr + - claims.iss + - claims.name + - claims.nbf + - claims.puid + - claims.rh + - claims.uti + - claims.ver + - claims.wids + - claims.xms_tcdt + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventDataId + - eventName.localizedValue + - eventName.value + - eventSource.localizedValue + - eventSource.value + - eventTimestamp + - host + - id + - index + - level + - linecount + - object + - object_id + - object_path + - operationId + - operationName.localizedValue + - operationName.value + - product + - properties.entity + - properties.eventCategory + - properties.hierarchy + - properties.message + - punct + - resourceGroupName + - resourceProviderName.localizedValue + - resourceProviderName.value + - resourceUri + - source + - sourcetype + - splunk_server + - status + - status.localizedValue + - status.value + - subStatus.value + - submissionTimestamp + - subscriptionId + - timeendpos + - timestartpos + - user + - user_name + - vendor + - vendor_product + - vendor_res_code +example_log: + '{"authorization": {"action": "Microsoft.Automation/automationAccounts/write", "scope": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661179930", diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6511f9fe3e..ce1fd177fb 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -1,107 +1,109 @@ name: Azure Audit Create or Update an Azure Automation Runbook id: 2bd83221-7a8b-436f-9b2b-efa1d44d009e version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk -description: Data source object for Azure Audit Create or Update an Azure Automation +description: + Data source object for Azure Audit Create or Update an Azure Automation Runbook source: mscs:azure:audit sourcetype: mscs:azure:audit separator: operationName.localizedValue supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- authorization.action -- authorization.scope -- caller -- channels -- claims.aio -- claims.altsecid -- claims.appid -- claims.appidacr -- claims.aud -- claims.exp -- claims.groups -- claims.http://schemas.microsoft.com/claims/authnclassreference -- claims.http://schemas.microsoft.com/claims/authnmethodsreferences -- claims.http://schemas.microsoft.com/identity/claims/identityprovider -- claims.http://schemas.microsoft.com/identity/claims/objectidentifier -- claims.http://schemas.microsoft.com/identity/claims/scope -- claims.http://schemas.microsoft.com/identity/claims/tenantid -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname -- claims.iat -- claims.ipaddr -- claims.iss -- claims.name -- claims.nbf -- claims.puid -- claims.rh -- claims.uti -- claims.ver -- claims.wids -- claims.xms_tcdt -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventDataId -- eventName.localizedValue -- eventName.value -- eventSource.localizedValue -- eventSource.value -- eventTimestamp -- host -- id -- index -- level -- linecount -- object -- object_id -- object_path -- operationId -- operationName.localizedValue -- operationName.value -- product -- properties.entity -- properties.eventCategory -- properties.hierarchy -- properties.message -- punct -- resourceGroupName -- resourceProviderName.localizedValue -- resourceProviderName.value -- resourceUri -- source -- sourcetype -- splunk_server -- status -- status.localizedValue -- status.value -- subStatus.value -- submissionTimestamp -- subscriptionId -- timeendpos -- timestartpos -- user -- user_name -- vendor -- vendor_product -- vendor_res_code -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/runbooks/write", + - _time + - authorization.action + - authorization.scope + - caller + - channels + - claims.aio + - claims.altsecid + - claims.appid + - claims.appidacr + - claims.aud + - claims.exp + - claims.groups + - claims.http://schemas.microsoft.com/claims/authnclassreference + - claims.http://schemas.microsoft.com/claims/authnmethodsreferences + - claims.http://schemas.microsoft.com/identity/claims/identityprovider + - claims.http://schemas.microsoft.com/identity/claims/objectidentifier + - claims.http://schemas.microsoft.com/identity/claims/scope + - claims.http://schemas.microsoft.com/identity/claims/tenantid + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname + - claims.iat + - claims.ipaddr + - claims.iss + - claims.name + - claims.nbf + - claims.puid + - claims.rh + - claims.uti + - claims.ver + - claims.wids + - claims.xms_tcdt + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventDataId + - eventName.localizedValue + - eventName.value + - eventSource.localizedValue + - eventSource.value + - eventTimestamp + - host + - id + - index + - level + - linecount + - object + - object_id + - object_path + - operationId + - operationName.localizedValue + - operationName.value + - product + - properties.entity + - properties.eventCategory + - properties.hierarchy + - properties.message + - punct + - resourceGroupName + - resourceProviderName.localizedValue + - resourceProviderName.value + - resourceUri + - source + - sourcetype + - splunk_server + - status + - status.localizedValue + - status.value + - subStatus.value + - submissionTimestamp + - subscriptionId + - timeendpos + - timestartpos + - user + - user_name + - vendor + - vendor_product + - vendor_res_code +example_log: + '{"authorization": {"action": "Microsoft.Automation/automationAccounts/runbooks/write", "scope": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourceGroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661194261", diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index da046c0e0b..49a151034e 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -1,116 +1,118 @@ name: Azure Audit Create or Update an Azure Automation webhook id: 575faeb2-09d0-4849-b1f6-eae241f26ff2 version: 1 -date: '2024-07-18' +date: "2024-07-18" author: Patrick Bareiss, Splunk -description: Data source object for Azure Audit Create or Update an Azure Automation +description: + Data source object for Azure Audit Create or Update an Azure Automation webhook source: mscs:azure:audit sourcetype: mscs:azure:audit separator: operationName.localizedValue supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- _time -- authorization.action -- authorization.scope -- caller -- channels -- claims.aio -- claims.altsecid -- claims.appid -- claims.appidacr -- claims.aud -- claims.exp -- claims.groups -- claims.http://schemas.microsoft.com/claims/authnclassreference -- claims.http://schemas.microsoft.com/claims/authnmethodsreferences -- claims.http://schemas.microsoft.com/identity/claims/identityprovider -- claims.http://schemas.microsoft.com/identity/claims/objectidentifier -- claims.http://schemas.microsoft.com/identity/claims/scope -- claims.http://schemas.microsoft.com/identity/claims/tenantid -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier -- claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname -- claims.iat -- claims.ipaddr -- claims.iss -- claims.name -- claims.nbf -- claims.puid -- claims.rh -- claims.uti -- claims.ver -- claims.wids -- claims.xms_tcdt -- correlationId -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventDataId -- eventName.localizedValue -- eventName.value -- eventSource.localizedValue -- eventSource.value -- eventTimestamp -- host -- httpRequest.clientIpAddress -- httpRequest.clientRequestId -- httpRequest.method -- id -- index -- level -- linecount -- object -- object_id -- object_path -- operationId -- operationName.localizedValue -- operationName.value -- product -- properties.entity -- properties.eventCategory -- properties.hierarchy -- properties.message -- properties.serviceRequestId -- properties.statusCode -- punct -- resourceGroupName -- resourceProviderName.localizedValue -- resourceProviderName.value -- resourceUri -- result -- result_id -- source -- sourcetype -- splunk_server -- src -- status -- status.localizedValue -- status.value -- subStatus.localizedValue -- subStatus.value -- submissionTimestamp -- subscriptionId -- timeendpos -- timestartpos -- user -- user_name -- vendor -- vendor_product -- vendor_res_code -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/webhooks/write", + - _time + - authorization.action + - authorization.scope + - caller + - channels + - claims.aio + - claims.altsecid + - claims.appid + - claims.appidacr + - claims.aud + - claims.exp + - claims.groups + - claims.http://schemas.microsoft.com/claims/authnclassreference + - claims.http://schemas.microsoft.com/claims/authnmethodsreferences + - claims.http://schemas.microsoft.com/identity/claims/identityprovider + - claims.http://schemas.microsoft.com/identity/claims/objectidentifier + - claims.http://schemas.microsoft.com/identity/claims/scope + - claims.http://schemas.microsoft.com/identity/claims/tenantid + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier + - claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname + - claims.iat + - claims.ipaddr + - claims.iss + - claims.name + - claims.nbf + - claims.puid + - claims.rh + - claims.uti + - claims.ver + - claims.wids + - claims.xms_tcdt + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventDataId + - eventName.localizedValue + - eventName.value + - eventSource.localizedValue + - eventSource.value + - eventTimestamp + - host + - httpRequest.clientIpAddress + - httpRequest.clientRequestId + - httpRequest.method + - id + - index + - level + - linecount + - object + - object_id + - object_path + - operationId + - operationName.localizedValue + - operationName.value + - product + - properties.entity + - properties.eventCategory + - properties.hierarchy + - properties.message + - properties.serviceRequestId + - properties.statusCode + - punct + - resourceGroupName + - resourceProviderName.localizedValue + - resourceProviderName.value + - resourceUri + - result + - result_id + - source + - sourcetype + - splunk_server + - src + - status + - status.localizedValue + - status.value + - subStatus.localizedValue + - subStatus.value + - submissionTimestamp + - subscriptionId + - timeendpos + - timestartpos + - user + - user_name + - vendor + - vendor_product + - vendor_res_code +example_log: + '{"authorization": {"action": "Microsoft.Automation/automationAccounts/webhooks/write", "scope": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661287859", diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index d3526f723c..af8a268a01 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -1,9 +1,10 @@ name: Azure Monitor Activity id: 1997a515-a61a-4f78-ada9-54af34c764f2 version: 1 -date: '2025-01-13' +date: "2025-01-13" author: Bhavin Patel, Splunk -description: Data source object for Azure Monitor Activity. The Splunk Add-on for +description: + Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. @@ -11,92 +12,93 @@ source: Azure AD sourcetype: azure:monitor:activity separator: operationName supported_TA: -- name: Splunk Add-on for Microsoft Cloud Services - url: https://splunkbase.splunk.com/app/3110 - version: 5.4.2 + - name: Splunk Add-on for Microsoft Cloud Services + url: https://splunkbase.splunk.com/app/3110 + version: 5.4.3 fields: -- column -- action -- category -- change_type -- command -- correlationId -- dataset_name -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventtype -- host -- identity -- image_id -- index -- instance_type -- linecount -- object -- object_attrs -- object_category -- object_id -- object_path -- operationName -- properties.ActivityDate -- properties.ActivityResultStatus -- properties.ActivityType -- properties.Actor.ActorType -- properties.Actor.Application -- properties.Actor.ApplicationName -- properties.Actor.IsDelegatedAdmin -- properties.Actor.Name -- properties.Actor.ObjectId -- properties.Actor.PartnerTenantId -- properties.Actor.UPN -- properties.Actor.UserPermissions{} -- properties.AdditionalDetails -- properties.AuditEventId -- properties.Category -- properties.RelationId -- properties.TargetDisplayNames{} -- properties.TargetObjectIds{} -- properties.Targets{}.ModifiedProperties{}.Name -- properties.Targets{}.ModifiedProperties{}.New -- properties.Targets{}.ModifiedProperties{}.Old -- properties.Targets{}.Name -- punct -- resourceId -- resource_provider -- response_body -- result -- resultDescription -- resultType -- result_id -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- status -- tag -- tag::action -- tag::eventtype -- tag::object_category -- tenantId -- time -- timeendpos -- timestartpos -- user -- user_name -- user_type -- vendor_account -- vendor_product -- vendor_region -- _time -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", + - column + - action + - category + - change_type + - command + - correlationId + - dataset_name + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventtype + - host + - identity + - image_id + - index + - instance_type + - linecount + - object + - object_attrs + - object_category + - object_id + - object_path + - operationName + - properties.ActivityDate + - properties.ActivityResultStatus + - properties.ActivityType + - properties.Actor.ActorType + - properties.Actor.Application + - properties.Actor.ApplicationName + - properties.Actor.IsDelegatedAdmin + - properties.Actor.Name + - properties.Actor.ObjectId + - properties.Actor.PartnerTenantId + - properties.Actor.UPN + - properties.Actor.UserPermissions{} + - properties.AdditionalDetails + - properties.AuditEventId + - properties.Category + - properties.RelationId + - properties.TargetDisplayNames{} + - properties.TargetObjectIds{} + - properties.Targets{}.ModifiedProperties{}.Name + - properties.Targets{}.ModifiedProperties{}.New + - properties.Targets{}.ModifiedProperties{}.Old + - properties.Targets{}.Name + - punct + - resourceId + - resource_provider + - response_body + - result + - resultDescription + - resultType + - result_id + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - status + - tag + - tag::action + - tag::eventtype + - tag::object_category + - tenantId + - time + - timeendpos + - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product + - vendor_region + - _time +example_log: + '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", diff --git a/data_sources/splunk_cim.yml b/data_sources/splunk_cim.yml new file mode 100644 index 0000000000..4f629bac79 --- /dev/null +++ b/data_sources/splunk_cim.yml @@ -0,0 +1,12 @@ +name: Splunk CIM +id: d3dd8270-7e1c-4bcd-8f3a-e5ec4a0e740a +version: 1 +date: '2025-01-14' +author: Bhavin Patel, Splunk +description: Data source object for Splunk CIM +source: not_applicable +sourcetype: not_applicable +supported_TA: +- name: Splunk_SA_CIM + url: https://splunkbase.splunk.com/app/1621 + version: 6.0.2 diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index 2501295d79..75268921b8 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -1,8 +1,8 @@ name: Linux Proxy Socks Curl id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 6 -date: '2024-11-13' -author: Michael Haag, Splunk +version: 7 +date: '2025-02-19' +author: Michael Haag, Splunk, 0xC0FFEEEE, Github Community status: production type: TTP description: The following analytic detects the use of the `curl` command with proxy-related @@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*--preproxy *", "--proxy*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_proxy_socks_curl_filter`' + | where match(process, "-x\s") OR match(process, "(?i)socks\d\w?:\/\/|--(pre)?proxy") | `linux_proxy_socks_curl_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 3c11ba94f9..5ec074c256 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-02-22' author: Michael Haag, Splunk status: production type: TTP @@ -16,15 +16,25 @@ description: The following analytic detects the Windows InstallUtil.exe binary m of this activity. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_installutil` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != - 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` - | rename dest as C2 ] | table _time user dest parent_process_name process_name process_path - process process_id dest_port C2 | `windows_installutil_remote_network_connection_filter`' +search: |- + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` by _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name + Processes.original_file_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | join process_id dest + [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != + 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.src + | `drop_dm_object_name(All_Traffic)` + | rename dest as command_and_control + | rename src as dest] + | table _time user src dest parent_process_name process_name process_path process process_id dest_port command_and_control + | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(command_and_control) as command_and_control by user dest process_name process_id dest_port parent_process_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_installutil_remote_network_connection_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -68,6 +78,8 @@ rba: type: parent_process_name - field: process_name type: process_name + - field: command_and_control + type: ip_address tags: analytic_story: - Living Off The Land