admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-09-15 08:08:52 -07:00
committed by GitHub
parent d2663ce2a7 5db5524752
commit 1cc5266ca9
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2
+3 -1
View File
@@ -38,7 +38,7 @@ action.escu.providing_technologies = []
{% endif %}
{% if detection.tags.analytic_story is defined %}
action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
{% if detection.tags.risk_score is defined %}
{% if detection.tags.risk_score is defined and detection.type | lower != "correlation" %}
action.risk = 1
action.risk.param._risk_message = {{ detection.tags.message }}
action.risk.param._risk = {{ detection.risk | tojson }}
@@ -54,6 +54,8 @@ dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
action.correlationsearch.enabled = 1
{% if detection.deprecated %}
action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
{% elif detection.type | lower == "correlation" %}
action.correlationsearch.label = ESCU - RIR - {{ detection.name }} - Rule
{% else %}
action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
{% endif %}
detections/endpoint/living_off_the_land.yml
+7 -8
View File
@@ -1,19 +1,18 @@
name: Living Off The Land
id: 1be30d80-3a39-4df9-9102-64a467b24abc
version: 2
date: '2022-08-19'
date: '2022-09-09'
author: Michael Haag, Splunk
type: Correlation
datamodel:
- Risk
description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source
| `drop_dm_object_name(All_Risk)`
| stats values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type
| where source_count >= 5
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `living_off_the_land_filter`'
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
| `drop_dm_object_name(All_Risk)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where source_count >= 5
| `living_off_the_land_filter`'
how_to_implement: To implement this correlation search a user needs to enable all
detections in the Living Off The Land Analytic Story and confirm it is generating risk events.
A simple search `index=risk analyticstories="Living Off The Land"` should contain