From 047eafe9fa6ed3ffd27d684e756333a356900cc6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Jun 2022 16:18:00 -0700 Subject: [PATCH] pytest --- .../adapter/data/default_reference/analyticstories.conf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf index 5d1de1ec59..a5eee42b17 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf @@ -15,7 +15,8 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]} known_false_positives = None identified. -providing_technologies = [] +providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] + [savedsearch://ESCU - Detect new user AWS Console Login - Rule] type = detection @@ -25,7 +26,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. -providing_technologies = [] +providing_technologies = ["Amazon Web Services - Cloudtrail"] ### END DETECTIONS ###