admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-01-24 15:06:20 -08:00
committed by GitHub
parent af8cd582e4 b3ebd4b2a9
commit 13d71a84cb
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/network/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
+2 -2
View File
@@ -25,7 +25,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| rename answer as text
| fields firstTime, lastTime, message_type,record_type,src,dest, text
| apply detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl
| rename pred_is_unknown_proba as is_suspicious_score
| rename predicted_is_unknown as is_suspicious_score
| where is_suspicious_score > 0.5
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -41,7 +41,7 @@ how_to_implement: 'Steps to deploy detect suspicious DNS TXT records model into
deep learning model that needs to be deployed in DSDL app. Follow the steps
for deployment here - `https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU`.\
* Download the `artifacts .tar.gz` file from the link - TODO update link here=
* Download the `artifacts .tar.gz` file from the link - https://seal.splunkresearch.com/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz
Download the `detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.ipynb`
Jupyter notebook from https://github.com/splunk/security_content/notebooks\
notebooks/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.ipynb
+2 -2
View File
@@ -58,7 +58,7 @@
"import pickle\n",
"\n",
"# global constants\n",
"MODEL_DIRECTORY = \"/srv/app/model/data/\"\n",
"MODEL_DIRECTORY = \"/srv/app/model/data/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl/\"\n",
"vocab_size = 10002\n",
"embedding_dim = 64\n",
"hidden_size = 64\n",
@@ -550,7 +550,7 @@
" is_unknown_probability_score.append(pred_proba)\n",
" is_unknown.append(pred)\n",
" output = pd.DataFrame()\n",
" output['pred_is_unknown_proba'] = is_unknown_probability_score\n",
" output['predicted_is_unknown'] = is_unknown_probability_score\n",
" output['pred_is_unknown'] = is_unknown\n",
" return output"
]