From 0282aff10be08ecbe7de100a51b3caa27ab62ec6 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 7 Jan 2025 16:51:06 +1000 Subject: [PATCH] fixing syntax & updating macro --- detections/cloud/azure_ad_service_principal_enumeration.yml | 5 +++-- macros/ms_defender.yml | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_service_principal_enumeration.yml b/detections/cloud/azure_ad_service_principal_enumeration.yml index 98b4101d28..12c36d8654 100644 --- a/detections/cloud/azure_ad_service_principal_enumeration.yml +++ b/detections/cloud/azure_ad_service_principal_enumeration.yml @@ -17,8 +17,9 @@ search: >- | eval spn=coalesce(servicePrincipalb,servicePrincipalv1) | stats min(_time) as _time dc(spn) as spn_count values(user) as user values(user_category) as user_category values(src_category) as src_category count by src tenantId properties.userAgent | rename properties.userAgent as user_agent | where spn_count>9 | `azure_ad_service_principal_enumeration_filter` -how_to_implement: Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements. -The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source. +how_to_implement: >- + Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements. + The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source. known_false_positives: Unknown references: - https://github.com/SpecterOps/AzureHound diff --git a/macros/ms_defender.yml b/macros/ms_defender.yml index ad8e782902..bed2e5be4f 100644 --- a/macros/ms_defender.yml +++ b/macros/ms_defender.yml @@ -1,4 +1,4 @@ -definition: source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" +definition: ( source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. name: ms_defender