admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

going back to hyphens

Browse Source
This commit is contained in:
Rico Valdez
2019-05-10 14:39:34 -06:00
parent ead7741cee
commit 2286622900
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/train_smb_traffic_spike.json
+1 -1
View File
@@ -37,7 +37,7 @@
"search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel",
"search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.",
"search_id": "df98763b-0b08-4281-8ef9-08db7ac572a9",
"search_name": "Model Builder For SMB Traffic Spike MLTK",
"search_name": "Model Builder For SMB Traffic Spike - MLTK",
"search_type": "support",
"spec_version": 1,
"version": "1.0"
stories/dhs_report_TA18-074A.json
+1 -1
View File
@@ -56,7 +56,7 @@
],
"support_searches": [
"Previously seen command line arguments",
"Model Builder For SMB Traffic Spike MLTK"
"Model Builder For SMB Traffic Spike - MLTK"
]
},
"spec_version": 1,
stories/emotet.json
+1 -1
View File
@@ -53,7 +53,7 @@
"Investigate Web Activity From Host"
],
"support_searches": [
"Model Builder For SMB Traffic Spike MLTK"
"Model Builder For SMB Traffic Spike - MLTK"
]
},
"spec_version": 1,
stories/hidden_cobra_malware.json
+1 -1
View File
@@ -55,7 +55,7 @@
"support_searches": [
"Previously seen command line arguments",
"Model Builder For DNS Query Length Outliers - MLTK",
"Model Builder For SMB Traffic Spike MLTK"
"Model Builder For SMB Traffic Spike - MLTK"
]
},
"spec_version": 1,
stories/ransomware.json
+1 -1
View File
@@ -69,7 +69,7 @@
"Windows Updates Install Failures",
"Windows Updates Install Successes",
"Model Builder For Unusually Long Command Line - MLTK",
"Model Builder For SMB Traffic Spike MLTK"
"Model Builder For SMB Traffic Spike - MLTK"
]
},
"spec_version": 1,