renamed on all detections

2026-06-08 17:32:49 +00:00 · 2021-02-08 10:18:16 -05:00
parent b4c31d718a
commit 1ec15cf044
284 changed files with 284 additions and 284 deletions
@@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count values(Filesystem.file_
  | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `email_files_written_outside_of_the_outlook_directory_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Collection and Staging
  asset_type: Endpoint
  cis20:
@@ -17,7 +17,7 @@ search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalC
  city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -12,7 +12,7 @@ search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.g
  as country, client.geographicalContext.state as state, client.geographicalContext.city
  as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -12,7 +12,7 @@ search: '`okta` displayMessage="User attempted unauthorized access to app" | sta
  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `okta_failed_sso_attempts_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -18,7 +18,7 @@ search: '`okta` displayMessage="User login to Okta" client.geographicalContext.c
  as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `okta_user_logins_from_multiple_cities_filter` | search locations > 1'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Apache Struts Vulnerability
  asset_type: Web Server
  cis20:
@@ -26,7 +26,7 @@ search: '| tstats count as instances_destroyed values(All_Changes.object_id) as
  table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold,
  object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Instance Activities
  asset_type: Cloud Instance
  cis20:
@@ -26,7 +26,7 @@ search: '| tstats count as instances_launched values(All_Changes.object_id) as o
  _time, user, instances_launched, expected_upper_threshold, distance_from_threshold,
  object_id | `abnormally_high_number_of_cloud_instances_launched_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  - Suspicious Cloud Instance Activities
  asset_type: Cloud Instance
@@ -21,7 +21,7 @@ search: '| tstats count as api_calls values(All_Changes.command) as command from
  = api_calls - expected_upper_threshold | table _time, user, command, api_calls,
  expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -22,7 +22,7 @@ search: '| tstats count as security_group_api_calls values(All_Changes.command)
  - expected_upper_threshold | table _time, user, command, security_group_api_calls,
  expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -27,7 +27,7 @@ search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=
  Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `aws_cross_account_activity_from_previously_unseen_account_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
  eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Ransomware Cloud
  asset_type: AWS Account
  automated_detection_testing: passed
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e
  values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Ransomware Cloud
  asset_type: S3 Bucket
  automated_detection_testing: passed
@@ -22,7 +22,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
  requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=f
  userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -23,7 +23,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
  object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `cloud_api_calls_from_previously_unseen_user_roles_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
  | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)`
  | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  asset_type: Cloud Compute Instance
  automated_detection_testing: passed
@@ -24,7 +24,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(
  "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)`
  | `cloud_compute_instance_created_in_previously_unused_region_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  asset_type: Cloud Compute Instance
  automated_detection_testing: passed
@@ -24,7 +24,7 @@ search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime
  OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user,
  image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  asset_type: Cloud Compute Instance
  automated_detection_testing: passed
@@ -24,7 +24,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values
  "-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)`
  | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  asset_type: Cloud Compute Instance
  automated_detection_testing: passed
@@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
  OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command
  object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Instance Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -37,7 +37,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
  table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
  | `security_content_ctime(firstTime)`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Provisioning Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -37,7 +37,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
  Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
  | `security_content_ctime(firstTime)`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Provisioning Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -36,7 +36,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, value
  | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
  | `security_content_ctime(firstTime)`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Provisioning Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -37,7 +37,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
  | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
  | `security_content_ctime(firstTime)`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Provisioning Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -25,7 +25,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
  Time Logging into AWS Console" |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `detect_aws_console_login_by_new_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -30,7 +30,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
  userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | table firstTime lastTime user City  userStatus userCity  | `detect_aws_console_login_by_user_from_new_city_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS Login Activities
  - Suspicious Cloud Authentication Activities
  asset_type: AWS Instance
@@ -30,7 +30,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
  AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | table firstTime lastTime user Country  userStatus userCountry  | `detect_aws_console_login_by_user_from_new_country_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS Login Activities
  - Suspicious Cloud Authentication Activities
  asset_type: AWS Instance
@@ -30,7 +30,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
  Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | table firstTime lastTime user Region  userStatus userRegion  | `detect_aws_console_login_by_user_from_new_region_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS Login Activities
  - Suspicious Cloud Authentication Activities
  asset_type: AWS Instance
@@ -33,7 +33,7 @@ search: '`google_gcp_pubsub_message` | multikv | rename sc_status_ as status | r
  %H:%M:%S") | eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") | table  first_time
  last_time bucket_name remote_ip operation request_uri | `detect_gcp_storage_access_from_a_new_ip_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious GCP Storage Activities
  asset_type: GCP Storage Bucket
  cis20:
@@ -22,7 +22,7 @@ search: '`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPay
  | search (member=allUsers AND action=ADD) | table  _time, bucketName, src, user,
  location, action, role, member | search `detect_new_open_gcp_storage_buckets_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious GCP Storage Activities
  asset_type: GCP Storage Bucket
  cis20:
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
  bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `detect_new_open_s3_buckets_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS S3 Activities
  asset_type: S3 Bucket
  automated_detection_testing: passed
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR r
  requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS S3 Activities
  asset_type: S3 Bucket
  automated_detection_testing: passed
@@ -22,7 +22,7 @@ search: '`aws_s3_accesslogs` http_status=200  [search `aws_s3_accesslogs` http_s
  | table bucket_name remote_ip]| iplocation remote_ip |rename remote_ip as src_ip
  | table _time bucket_name src_ip City Country operation request_uri | `detect_s3_access_from_a_new_ip_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS S3 Activities
  asset_type: S3 Bucket
  cis20:
@@ -22,7 +22,7 @@ search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket sp
  * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
  vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Security Hub Alerts
  asset_type: AWS Instance
  cis20:
@@ -21,7 +21,7 @@ search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | r
 | search isOutlier=1
 | table _time user alerts |`detect_spike_in_aws_security_hub_alerts_for_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Security Hub Alerts
  asset_type: AWS Instance
  cis20:
@@ -38,7 +38,7 @@ search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17
  count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections by src_ip
  | `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  - Suspicious AWS Traffic
  - Command and Control
@@ -32,7 +32,7 @@ search: '`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=Dele
  path=requestParameters.bucketName | stats values(bucketName) as bucketName, count
  as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_s3_bucket_deletion_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS S3 Activities
  asset_type: S3 Bucket
  cis20:
@@ -12,7 +12,7 @@ search: '`o365_management_activity` Operation=UserLoginFailed  record_type=Azure
  values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type
  Operation app | search accounts_locked >= 5| `high_number_of_login_failures_from_a_single_source_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  cis20:
@@ -18,7 +18,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime FROM data
  Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")`
  | `new_container_uploaded_to_aws_ecr_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Container Implantation Monitoring and Investigation
  asset_type: AWS ECR container
  mitre_attack_id:
@@ -22,7 +22,7 @@ search: '`o365_management_activity` signature="Set Company Information." Modifie
  status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
  `o365_bypass_mfa_via_trusted_ip_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -15,7 +15,7 @@ search: '`o365_management_activity` Operation="Disable Strong Authentication." |
  user status signature dest ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
  | `o365_disable_mfa_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -16,7 +16,7 @@ search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthentica
  values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -16,7 +16,7 @@ search: '`o365_management_activity` Category=ThreatManagement Name="eDiscovery s
  lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -11,7 +11,7 @@ search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Paramete
  AS src_user values(user) AS user by ForwardingAddress | where count_src_user > 1
  |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -11,7 +11,7 @@ search: '`o365_management_activity` Operation=Add-MailboxPermission | spath inpu
  as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights
  |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_rights_delegation_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -11,7 +11,7 @@ search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Paramete
  AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user
  > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
@@ -22,7 +22,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m
  / total_launched_stdev, 2) | table _time, userName, instances_launched, num_standard_deviations_away,
  total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  asset_type: AWS Instance
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_
  apply ec2_excessive_runinstances_v1  | rename "IsOutlier(instances_launched)" as
  isOutlier  | where isOutlier=1'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  asset_type: AWS Instance
@@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp
  num_standard_deviations_away, total_terminations_avg, total_terminations_stdev |
  `abnormally_high_aws_instances_terminated_by_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS EC2 Activities
  asset_type: AWS Instance
  cis20:
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally
  apply ec2_excessive_terminateinstances_v1  | rename "IsOutlier(instances_terminated)"
  as isOutlier  | where isOutlier=1'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS EC2 Activities
  asset_type: AWS Instance
  cis20:
@@ -34,7 +34,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
  output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
  src_ip, City, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_city_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Suspicious Provisioning Activities
  asset_type: AWS Instance
  cis20:
@@ -35,7 +35,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
  spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time,
  user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Suspicious Provisioning Activities
  asset_type: AWS Instance
  cis20:
@@ -34,7 +34,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail`
  | spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table
  _time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Suspicious Provisioning Activities
  asset_type: AWS Instance
  cis20:
@@ -34,7 +34,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
  output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
  src_ip, Region, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_region_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Suspicious Provisioning Activities
  asset_type: AWS Instance
  cis20:
@@ -24,7 +24,7 @@ search: '| tstats `security_content_summariesonly` count, values(DNS.dest) AS de
  by DNS.src | `drop_dm_object_name("Network_Resolution")` |where dest_count > 5 |
  `clients_connecting_to_multiple_dns_servers_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - DNS Hijacking
  - Command and Control
  - Suspicious DNS Traffic
@@ -19,7 +19,7 @@ search: '`cloudtrail` eventName=DeleteNetworkAcl|rename userIdentity.arn as arn
  values(errorCode) values(userAgent) values(userIdentity.*) by src userName arn eventName
  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `cloud_network_access_control_list_deleted_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Network ACL Activity
  asset_type: Instance
  cis20:
@@ -43,7 +43,7 @@ search: '`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa
  as eventName by userIdentity.arn userIdentity.type user | `security_content_ctime(firstTime)`  |
  `security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
@@ -44,7 +44,7 @@ search: '`cloudtrail` errorCode=success | rename userName as identity | search N
  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_aws_api_activities_from_unapproved_accounts_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
@@ -32,7 +32,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  by Web.dest Web.site | rename "Web.*" as * | rex field=site ".*?(?<domain>[^./:]+\.(\S{2,3}|\S{2,3}.\S{2,3}))$"
  | table dest domain url] | table count src dest query answer domain url | `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Common Phishing Frameworks
  asset_type: Endpoint
  cis20:
@@ -26,7 +26,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  IP" "Destination IP" "DNS Answer" "DNS Record Type"  "Answer Length" Count "First
  Time" "Last Time" | `detect_long_dns_txt_record_response_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious DNS Traffic
  - Command and Control
  asset_type: Endpoint
@@ -21,7 +21,7 @@ search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(
  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `detect_mimikatz_using_loaded_images_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Credential Dumping
  - Detect Zerologon Attack
  asset_type: Windows
@@ -24,7 +24,7 @@ search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=A
  as earliest latest(_time) as latest by user | `security_content_ctime(earliest)`
  | `security_content_ctime(latest)` | `detect_new_api_calls_from_user_roles_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
@@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user |
  "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
  where userStatus ="First Time Logging into AWS Console"  | `detect_new_user_aws_console_login_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS Login Activities
  asset_type: AWS Instance
  cis20:
@@ -49,7 +49,7 @@ search: '`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi
  as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user
  | `detect_spike_in_aws_api_activity_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
@@ -33,7 +33,7 @@ search: '`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_eve
  | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
  as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  cis20:
@@ -34,7 +34,7 @@ search: '`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_
  | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
  as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) AS earl
  (All_Changes.src_priority=high) by All_Changes.dest | `drop_dm_object_name("All_Changes")`|
  `security_content_ctime(earliest)`| `security_content_ctime(latest)`  | `detect_usb_device_insertion_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Data Protection
  asset_type: Endpoint
  cis20:
@@ -29,7 +29,7 @@ search: '| tstats `security_content_summariesonly` count values(Web.url) as url
  | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `dynamic_dns_web_traffic`
  | `detect_web_traffic_to_dynamic_domain_providers_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Dynamic DNS
  asset_type: Endpoint
  cis20:
@@ -36,7 +36,7 @@ search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  fro
  message) | eval length=len(message) | stats sum(length) as length by src ] | stats
  sum(length) as length by src | where length > 10000 | `detection_of_dns_tunnels_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Data Protection
  - Suspicious DNS Traffic
  - Command and Control
@@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Network_
  where DNS.dest_category != dns_server AND DNS.src_category != dns_server by DNS.src
  DNS.dest | `drop_dm_object_name("DNS")` | `dns_query_requests_resolved_by_unauthorized_dns_servers_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - DNS Hijacking
  - Command and Control
  - Suspicious DNS Traffic
@@ -23,7 +23,7 @@ search: '`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod
  | rename arn as userIdentity.arn | table userIdentity.arn] | spath output=dest responseElements.instancesSet.items{}.instanceId
  | spath output=user userIdentity.arn | table _time, user, dest | `ec2_instance_modified_with_previously_unseen_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Unusual AWS EC2 Modifications
  asset_type: AWS Instance
  cis20:
@@ -21,7 +21,7 @@ search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as ear
  | `security_content_ctime(latest)` | where regionStatus="Instance Started in a New
  Region" | `ec2_instance_started_in_previously_unseen_region_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  asset_type: AWS Instance
@@ -25,7 +25,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
  as arn, requestParameters.instancesSet.items{}.imageId as amiID | table firstTime,
  lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  asset_type: AWS Instance
  cis20:
@@ -25,7 +25,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
  as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table
  _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  asset_type: AWS Instance
  cis20:
@@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
  as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
  as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  asset_type: AWS Instance
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
  Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `drop_dm_object_name(Processes)` | `execution_of_file_with_spaces_before_extension_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Windows File Extension and Association Abuse
  asset_type: Endpoint
  cis20:
@@ -17,7 +17,7 @@ search: '`netbackup` MESSAGE="Disk/Partition backup completed successfully." | s
  | rename COMPUTERNAME as dest | eval isOutlier=if(latestTime <= relative_time(now(),
  "-7d@d"), 1, 0) | search isOutlier=1 | table latestTime, dest | `extended_period_without_successful_netbackup_backups_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Monitor Backup Solution
  asset_type: Endpoint
  cis20:
@@ -31,7 +31,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
  "-70m@m"), 1, 0) | where newCmdLineArgument=1 | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | table process] | `first_time_seen_command_line_argument_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - DHS Report TA18-074A
  - Suspicious Command-Line Executions
  - Orangeworm Attack Group
@@ -19,7 +19,7 @@ search: '|tstats count min(_time) as firstTime max(_time) as lastTime  FROM data
  Storage.action Storage.bucket_name Storage.event_name Storage.http_user_agent Storage.msg
  Storage.object_path | `drop_dm_object_name("Storage")`  | `gcp_gcr_container_uploaded_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Container Implantation Monitoring and Investigation
  asset_type: GCP GCR Container
  mitre_attack_id:
@@ -17,7 +17,7 @@ search: '| from datamodel Identity_Management.All_Identities  | eval empStatus=c
  `security_content_ctime(endDate)` | `security_content_ctime(startDate)`| table identity
  empStatus endDate startDate | `identify_new_user_accounts_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Account Monitoring and Controls
  asset_type: Domain Server
  cis20:
@@ -24,7 +24,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
  search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Malicious PowerShell
  asset_type: Endpoint
  cis20:
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min
  as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name("DNS")`
  | `security_content_ctime(firstTime)`| `brand_abuse_dns` | `monitor_dns_for_brand_abuse_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Brand Monitoring
  asset_type: Endpoint
  kill_chain_phases:
@@ -9,7 +9,7 @@ name: Open Redirect in Splunk Web
 references: []
 search: index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter`
 tags:
-  analytics_story:
+  analytic_story:
  - Splunk Enterprise Vulnerability
  asset_type: Splunk Server
  cis20:
@@ -14,7 +14,7 @@ search: '| from datamodel Alerts.Alerts | search app=osquery:results (name=pack_
  OR name=pack_osx-attacks_OSX_ColdRoot_RAT_Files) | rename columns.path as path |
  bucket _time span=30s | stats count(path) by _time, host, user, path | `osquery_pack___coldroot_detection_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - ColdRoot MacOS RAT
  asset_type: Endpoint
  cis20:
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
  Processes.parent_process_name Processes.process_name | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `processes_created_by_netsh_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Netsh Abuse
  asset_type: Endpoint
  cis20:
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
  | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Monitor for Unauthorized Software
  - 'Emotet Malware  DHS Report TA18-201A '
  - SamSam Ransomware
@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
  Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)`| regex process = "(/d\s+2)" | `reg_exe_used_to_hide_files_directories_via_registry_keys_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Windows Defense Evasion Tactics
  - Suspicious Windows Registry Activities
  - Windows Persistence Techniques
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
  Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
  | `drop_dm_object_name(Registry)` | `remote_registry_key_modifications_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Windows Defense Evasion Tactics
  - Suspicious Windows Registry Activities
  - Windows Persistence Techniques
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
  Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious WMI Use
  asset_type: Endpoint
  cis20:
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
  | search (process=*rhaegal* OR process=*drogon* OR *viserion_*) | `scheduled_tasks_used_in_badrabbit_ransomware_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Ransomware
  asset_type: Endpoint
  cis20:
@@ -16,7 +16,7 @@ search: index=_internal sourcetype=splunkd_ui_access server-info | search client
  as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter`
 tags:
-  analytics_story:
+  analytic_story:
  - Splunk Enterprise Vulnerability CVE-2018-11409
  asset_type: Splunk Server
  cis20:
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table
  process_id dest registry_path]| `suspicious_changes_to_file_associations_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Windows Registry Activities
  - Windows File Extension and Association Abuse
  asset_type: Endpoint
@@ -25,7 +25,7 @@ search: '| tstats `security_content_summariesonly` count values(Filesystem.actio
  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)`
  | `suspicious_writes` | `suspicious_file_write_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Hidden Cobra Malware
  asset_type: Endpoint
  cis20:
@@ -16,7 +16,7 @@ search: (`sysmon` OR tag=process) EventCode=11 process_id!=4 file_path=*System\
  Image, file_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `suspicious_writes_to_system_volume_information_filter`
 tags:
-  analytics_story:
+  analytic_story:
  - Collection and Staging
  asset_type: Windows
  cis20:
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `drop_dm_object_name(Processes)` | `uncommon_processes` |`uncommon_processes_on_endpoint_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Windows Privilege Escalation
  - Unusual Processes
  asset_type: Endpoint
@@ -19,7 +19,7 @@ search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_tim
  | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `unsigned_image_loaded_by_lsass_filter` '
 tags:
-  analytics_story:
+  analytic_story:
  - Credential Dumping
  asset_type: Windows
  cis20:
@@ -15,7 +15,7 @@ search: '`netbackup` | stats latest(_time) as latestTime by COMPUTERNAME, MESSAG
  | rename COMPUTERNAME as dest, MESSAGE as signature | table latestTime, dest, signature
  | `unsuccessful_netbackup_backups_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Monitor Backup Solution
  asset_type: Endpoint
  cis20:
@@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `windows_connhost_exe_started_forcefully_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Ryuk Ransomware
  asset_type: Endpoint
  cis20:
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)`
  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Ryuk Ransomware
  asset_type: Endpoint
  cis20:
--- a/Show More
+++ b/Show More