From dcab2f186772321a0d887476a4252810c8b6ab3a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 13 Jun 2023 11:06:53 -0700 Subject: [PATCH] update ocsf --- .../cloud/asl_aws_concurrent_sessions_from_different_ips.yml | 3 +-- detections/cloud/asl_aws_createaccesskey.yml | 3 +-- detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml | 3 +-- .../asl_aws_defense_evasion_delete_cloudwatch_log_group.yml | 3 +-- .../cloud/asl_aws_defense_evasion_impair_security_services.yml | 3 +-- detections/cloud/asl_aws_excessive_security_scanning.yml | 3 +-- detections/cloud/asl_aws_iam_delete_policy.yml | 3 +-- .../cloud/asl_aws_multi_factor_authentication_disabled.yml | 3 +-- .../cloud/asl_aws_new_mfa_method_registered_for_user.yml | 3 +-- detections/cloud/asl_aws_password_policy_changes.yml | 3 +-- 10 files changed, 10 insertions(+), 20 deletions(-) diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml index c4df947417..fa5239667d 100644 --- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml @@ -23,8 +23,7 @@ search: ' `amazon_security_lake` api.operation=DescribeEventAggregates src_endpo by _time identity.user.credential_uid identity.user.name | where distinct_ip_count > 1 | `aws_concurrent_sessions_from_different_ips_filter`' -how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This - search works with Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. diff --git a/detections/cloud/asl_aws_createaccesskey.yml b/detections/cloud/asl_aws_createaccesskey.yml index ed548351d3..b735fa3f8b 100644 --- a/detections/cloud/asl_aws_createaccesskey.yml +++ b/detections/cloud/asl_aws_createaccesskey.yml @@ -27,8 +27,7 @@ search: '`amazon_security_lake` api.operation=CreateAccessKey http_request.user_ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`asl_aws_createaccesskey_filter`' -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. references: diff --git a/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml index 0809a64745..8e364e9515 100644 --- a/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml @@ -15,8 +15,7 @@ search: '`amazon_security_lake` api.operation=DeleteTrail | stats count min(_time) as firstTime max(_time) as lastTime by identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudtrail_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Amazon Security Lake logs in - your AWS Environment. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudTrail logging. Please investigate this activity. references: diff --git a/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml index 8458cb44ab..fe392e5ee7 100644 --- a/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml +++ b/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml @@ -15,8 +15,7 @@ search: '`amazon_security_lake` api.operation=DeleteLogGroup | stats count min(_time) as firstTime max(_time) as lastTime by identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Amazon Security Lake logs in - your AWS Environment. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity. references: diff --git a/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml b/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml index 9f73402543..109d85b448 100644 --- a/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml +++ b/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml @@ -17,8 +17,7 @@ search: '`amazon_security_lake` api.operation IN ("DeleteLogStream","DeleteDetec identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `asl_aws_defense_evasion_impair_security_services_filter`' -how_to_implement: You must install Splunk AWS Add on and enable Amazon Security Lake logs in - your AWS Environment. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names. diff --git a/detections/cloud/asl_aws_excessive_security_scanning.yml b/detections/cloud/asl_aws_excessive_security_scanning.yml index dba5b6ca40..61be603583 100644 --- a/detections/cloud/asl_aws_excessive_security_scanning.yml +++ b/detections/cloud/asl_aws_excessive_security_scanning.yml @@ -14,8 +14,7 @@ search: '`amazon_security_lake` api.operation=Describe* OR api.operation=List* O values(src_endpoint.ip) as src_endpoint.ip values(cloud.region) as cloud.region values(identity.user.account_uid) as identity.user.account_uid by identity.user.name | where dc_api_operations > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`asl_aws_excessive_security_scanning_filter`' -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: While this search has no known false positives. references: - https://github.com/aquasecurity/cloudsploit diff --git a/detections/cloud/asl_aws_iam_delete_policy.yml b/detections/cloud/asl_aws_iam_delete_policy.yml index 711e28bced..582d9b2ee7 100644 --- a/detections/cloud/asl_aws_iam_delete_policy.yml +++ b/detections/cloud/asl_aws_iam_delete_policy.yml @@ -15,8 +15,7 @@ search: '`amazon_security_lake` api.operation=DeletePolicy | stats count min(_ti api.service.name identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_delete_policy_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize - this data. The search requires Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to diff --git a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml index f2fb673098..8063a2f1a9 100644 --- a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml +++ b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml @@ -19,8 +19,7 @@ search: '`amazon_security_lake` (api.operation=DeleteVirtualMFADevice OR api.ope | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_multi_factor_authentication_disabled_filter`' -how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search - requires Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company references: diff --git a/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml b/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml index fc0294fb23..bcc75c8b08 100644 --- a/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml @@ -15,8 +15,7 @@ search: ' `amazon_security_lake` api.operation=CreateVirtualMFADevice | stats co | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_new_mfa_method_registered_for_user_filter`' -how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This - search works with Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. references: diff --git a/detections/cloud/asl_aws_password_policy_changes.yml b/detections/cloud/asl_aws_password_policy_changes.yml index 1a5909553e..e6a585133e 100644 --- a/detections/cloud/asl_aws_password_policy_changes.yml +++ b/detections/cloud/asl_aws_password_policy_changes.yml @@ -18,8 +18,7 @@ search: '`amazon_security_lake` "api.service.name"="iam.amazonaws.com" "api.oper | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_password_policy_changes_filter`' -how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This - search works with Amazon Security Lake logs. +how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event.