conflits

.github/workflows/appinspect.yml

@@ -18,7 +18,7 @@ jobs:
           
       - name: Install Python Dependencies and ContentCTL and Atomic Red Team
         run: |
-          pip install contentctl==v5.0.0-alpha.2
+          pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
           git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
           git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
       

.github/workflows/build.yml

@@ -19,7 +19,8 @@ jobs:
           
       - name: Install Python Dependencies and ContentCTL and Atomic Red Team
         run: |
-          pip install contentctl==v5.0.0-alpha.2
+          echo "CONTENTCTL_VERSION is ${{ vars.CONTENTCTL_VERSION }}"
+          pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
           git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
           git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
       

.github/workflows/unit-testing.yml

@@ -23,7 +23,7 @@ jobs:
         - name: Install Python Dependencies and ContentCTL
           run: |
             python -m pip install --upgrade pip
-            pip install contentctl==v5.0.0-alpha.2
+            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
            
         # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop
         # Make sure we check out the PR, even if it actually lives in a fork

baselines/baseline_of_blocked_outbound_traffic_from_aws.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-05-07'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of outbound connections blocked in your VPC flow logs by
   each source IP address (IP address of your EC2 instances). Also recorded is the

baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many API calls are performed by each user. By default, the search uses the
   last 90 days of data to build the model and the model is rebuilt weekly. The model

baselines/baseline_of_cloud_instances_destroyed.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-25'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many instances are destroyed in the environment. By default, the search
   uses the last 90 days of data to build the model and the model is rebuilt weekly.

baselines/baseline_of_cloud_instances_launched.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-14'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many instances are created in the environment. By default, the search uses
   the last 90 days of data to build the model and the model is rebuilt weekly. The

baselines/baseline_of_cloud_security_group_api_calls_per_user.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many API calls for security groups are performed by each user. By default,
   the search uses the last 90 days of data to build the model and the model is rebuilt

baselines/baseline_of_command_line_length___mltk.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2019-05-08'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the length of the command lines observed for each user in the environment.
   By default, the search uses the last 30 days of data to build the model. The model

baselines/baseline_of_dns_query_length___mltk.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2019-05-08'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the length of the DNS queries for each DNS record type observed
   in the environment. By default, the search uses the last 30 days of data to build

baselines/baseline_of_kubernetes_container_network_io.yml

@@ -4,6 +4,7 @@ version: 4
 date: '2024-09-24'
 author: Matthew Moore, Splunk
 type: Baseline
+status: production
 description: This baseline rule calculates the average and standard deviation of inbound
   and outbound network IO for each Kubernetes container. It uses metrics from the
   Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates

baselines/baseline_of_kubernetes_container_network_io_ratio.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2024-09-24'
 author: Matthew Moore, Splunk
 type: Baseline
+status: production
 description: This baseline rule calculates the average ratio of inbound to outbound
   network IO for each Kubernetes container. It uses metrics from the Kubernetes API
   and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup table

baselines/baseline_of_kubernetes_process_resource.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2023-12-18'
 author: Matthew Moore, Splunk
 type: Baseline
+status: production
 description: This baseline rule calculates the average and standard deviation of various
   process resources in a Kubernetes environment. It uses metrics from the Kubernetes
   API and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup

baselines/baseline_of_kubernetes_process_resource_ratio.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2024-09-24'
 author: Matthew Moore, Splunk
 type: Baseline
+status: production
 description: This baseline rule calculates the average and standard deviation of the
   ratio of various process resources in a Kubernetes environment. It uses metrics
   from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule

baselines/baseline_of_network_acl_activity_by_arn.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-05-21'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls that were related to network ACLs made by each
   user. Also recorded is the number of data points for each user. This table is then

baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-07-17'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search establishes, on a per-hour basis, the average and standard
   deviation for the number of API calls related to deleting an S3 bucket by each user.
   Also recorded is the number of data points for each user. This table is then outputted

baselines/baseline_of_security_group_activity_by_arn.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-04-17'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation for the number of API calls related to security groups made by each user.
   Also recorded is the number of data points for each user. This table is then outputted

baselines/baseline_of_smb_traffic___mltk.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2019-05-08'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the number of SMB connections observed each hour for every day of
   week. By default, the search uses the last 30 days of data to build the model. The

baselines/count_of_assets_by_category.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-13'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search shows you every asset category you have and the assets that
   belong to those categories.
 search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)

baselines/count_of_unique_ips_connecting_to_ports.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-13'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: The search counts the number of times a connection was observed to each
   destination port, and the number of unique source IPs connecting to them.
 search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts

baselines/create_a_list_of_approved_aws_service_accounts.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2018-12-03'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search looks for successful API activity in CloudTrail within the
   last 30 days, filters out known users from the identity table, and outputs values
   of users into `aws_service_accounts.csv` lookup file.

baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-15'
 author: David Dorsey, Splunk
 type: Baseline
+status: deprecated
 description: This search takes the existing interesting process table from ES, filters
   out any existing additions added by ESCU and then updates the table with processes
   identified by ESCU that should be prohibited on your endpoints.

baselines/deprecated/baseline_of_api_calls_per_user_arn.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-04-09'
 author: David Dorsey, Splunk
 type: Baseline
+status: deprecated
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls made by each user. Also recorded is the number
   of data points for each user. This table is then outputted to a lookup file to allow

baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2019-11-14'
 author: Jason Brewer, Splunk
 type: Baseline
+status: deprecated
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many RunInstances users do in the environment. By default, the search uses
   the last 90 days of data to build the model. The model created by this search is

baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2019-11-14'
 author: Jason Brewer, Splunk
 type: Baseline
+status: deprecated
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many TerminateInstances users do in the environment. By default, the search
   uses the last 90 days of data to build the model. The model created by this search

baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-04-16'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: deprecated
 description: This search looks for successful API calls made by different user roles,
   then creates a baseline of the earliest and latest times we have encountered this
   user role. It also returns the name of the API call in our dataset--grouped by user

baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-03-16'
 author: David Dorsey, Splunk
 type: Baseline
+status: deprecated
 description: This search builds a table of the first and last times seen for every
   IP address (along with its physical location) previously associated with cloud-provisioning
   activity. This is broadly defined as any event that runs or creates something.

baselines/deprecated/previously_seen_ec2_amis.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2025-01-16'
 author: David Dorsey, Splunk
 type: Baseline
+status: deprecated
 description: This search builds a table of previously seen AMIs used to launch EC2
   instances
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId

baselines/deprecated/previously_seen_ec2_instance_types.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2025-01-16'
 author: David Dorsey, Splunk
 type: Baseline
+status: deprecated
 description: This search builds a table of previously seen EC2 instance types
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType
   as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time)

baselines/deprecated/previously_seen_ec2_launches_by_user.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2025-01-16'
 author: David Dorsey, Splunk
 type: Baseline
+status: deprecated
 description: This search builds a table of previously seen ARNs that have launched
   a EC2 instance.
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn

baselines/deprecated/previously_seen_users_in_cloudtrail.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-04-30'
 author: Jason Brewer, Splunk
 type: Baseline
+status: deprecated
 description: This search looks for CloudTrail events where a user logs into the console,
   then creates a baseline of the latest and earliest times, City, Region, and Country
   we have encountered this user in our dataset, grouped by ARN, within the last 30

baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2025-01-16'
 author: Jason Brewer, Splunk
 type: Baseline
+status: deprecated
 description: This search looks for CloudTrail events where a user logs into the console,
   then updates the baseline of the latest and earliest times, City, Region, and Country
   we have encountered this user in our dataset, grouped by ARN, within the last hour.

baselines/discover_dns_records.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2025-01-16'
 author: Jose Hernandez, Splunk
 type: Baseline
+status: production
 description: The search takes corporate and common cloud provider domains configured
   under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv`
   finds their responses across the last 30 days from data in the `Network_Resolution

baselines/dnstwist_domain_names.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2018-10-08'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search creates permutations of your existing domains, removes the
   valid domain names and stores them in a specified lookup file so they can be checked
   for in the associated detection searches.

baselines/identify_systems_creating_remote_desktop_traffic.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-15'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search counts the numbers of times the system has generated remote
   desktop traffic.
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic

baselines/identify_systems_receiving_remote_desktop_traffic.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-15'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search counts the numbers of times the system has created remote
   desktop traffic
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic

baselines/identify_systems_using_remote_desktop.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2019-04-01'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search counts the numbers of times the remote desktop process, mstsc.exe,
   has run on each system.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes

baselines/monitor_successful_backups.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-12'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is intended to give you a feel for how often successful backups
   are conducted in your environment. Fluctuations in these numbers will allow you
   to determine when you should investigate.

baselines/monitor_unsuccessful_backups.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-12'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is intended to give you a feel for how often backup failures
   happen in your environments.  Fluctuations in these numbers will allow you to determine
   when you should investigate.

baselines/previously_seen_aws_cross_account_activity.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-06-04'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search looks for **AssumeRole** events where the requesting account
   differs from the requested account, then writes these relationships to a lookup
   file.

baselines/previously_seen_aws_cross_account_activity___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search looks for **AssumeRole** events where the requesting account
   differs from the requested account, then writes these relationships to a lookup
   file.

baselines/previously_seen_aws_cross_account_activity___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search looks for **AssumeRole** events where the requesting account
   differs from the requested account, then writes these relationships to a lookup
   file.

baselines/previously_seen_aws_regions.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-01-08'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search looks for CloudTrail events where an AWS instance is started
   and creates a baseline of most recent time (latest) and the first time (earliest)
   we've seen this region in our dataset grouped by the value awsRegion for the last

baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-03'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search builds a table of the first and last times seen for every
   user role and command combination. This is broadly defined as any event that runs
   or creates something. This table is then cached.

baselines/previously_seen_cloud_api_calls_per_user_role___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-03'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search updates the table of the first and last times seen for every
   user role and command combination.
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_compute_creations_by_user___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen users that have launched
   a cloud compute instance.
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_compute_creations_by_user___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen users that have launched
   a cloud compute instance.
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_compute_images___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-10-08'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen images used to launch cloud
   compute instances
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_compute_images___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-12'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen images used to launch cloud
   compute instances
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_compute_instance_types___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-03'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen cloud compute instance
   types
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_compute_instance_types___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-03'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen cloud compute instance
   types
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-07-29'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen users that have modified
   a cloud instance.
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_instance_modifications_by_user___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-07-29'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search updates a table of previously seen Cloud Instance modifications
   that have been made by a user
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen

baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-19'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search builds a table of the first and last times seen for every
   IP address (along with its physical location) previously associated with cloud-provisioning
   activity. This is broadly defined as any event that runs or creates something. This

baselines/previously_seen_cloud_provisioning_activity_sources___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-08-20'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This returns the first and last times seen for every IP address (along
   with its physical location) previously associated with cloud-provisioning activity
   within the last day. Cloud provisioning is broadly defined as any event that runs

baselines/previously_seen_cloud_regions___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-02'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search looks for cloud compute events where a compute instance is
   started and creates a baseline of most recent time, `lastTime` and the first time
   `firstTime` we've seen this region in our dataset grouped by the region for the

baselines/previously_seen_cloud_regions___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-09-02'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search looks for cloud compute events where a compute instance is
   started and creates a baseline of most recent time, `lastTime` and the first time
   `firstTime` we've seen this region in our dataset grouped by the region for the

baselines/previously_seen_command_line_arguments.yml

@@ -4,6 +4,7 @@ version: 2
 date: '2019-03-01'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search looks for command-line arguments where `cmd.exe /c` is used
   to execute a program, then creates a baseline of the earliest and latest times we
   have encountered this command-line argument in our dataset within the last 30 days.

baselines/previously_seen_ec2_modifications_by_user.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-04-05'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search builds a table of previously seen ARNs that have launched
   a EC2 instance.
 search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn

baselines/previously_seen_running_windows_services___initial.yml

@@ -4,6 +4,7 @@ version: 3
 date: '2020-06-23'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This collects the services that have been started across your entire
   enterprise.
 search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service>[-\(\)\s\w]+)

baselines/previously_seen_running_windows_services___update.yml

@@ -4,6 +4,7 @@ version: 3
 date: '2020-06-23'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search returns the first and last time a Windows service was seen
   across your enterprise within the last hour. It then updates this information with
   historical data and filters out Windows services pairs that have not been seen within

baselines/previously_seen_s3_bucket_access_by_remote_ip.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-06-28'
 author: Bhavin Patel, Splunk
 type: Baseline
+status: production
 description: This search looks for successful access to S3 buckets from remote IP
   addresses, then creates a baseline of the earliest and latest times we have encountered
   this remote IP within the last 30 days. In this support search, we are only looking

baselines/previously_seen_users_in_cloudtrail___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-05-28'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search looks for CloudTrail events where a user logs into the console,
   then creates a baseline of the latest and earliest times, City, Region, and Country
   we have encountered this user in our dataset, grouped by username, within the last

baselines/previously_seen_users_in_cloudtrail___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-05-28'
 author: Rico Valdez, Splunk
 type: Baseline
+status: production
 description: This search looks for CloudTrail events where a user logs into the console,
   then updates the baseline of the latest and earliest times, City, Region, and Country
   we have encountered this user in our dataset, grouped by user, within the last hour.

baselines/previously_seen_zoom_child_processes___initial.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-05-20'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search returns the first and last time a process was seen per endpoint
   with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then
   cached.

baselines/previously_seen_zoom_child_processes___update.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2020-05-20'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search returns the first and last time a process was seen per endpoint
   with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour.
   It then updates this information with historical data and filters out proces_name

baselines/systems_ready_for_spectre_meltdown_windows_patch.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2018-01-08'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: Some AV applications can cause the Spectre/Meltdown patch for Windows
   not to install successfully. This registry key is supposed to be created by the
   AV engine when it has been patched to be able to handle the Windows patch. If this

baselines/windows_updates_install_failures.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-14'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is intended to give you a feel for how often Windows updates
   fail to install in your environment. Fluctuations in these numbers will allow you
   to determine when you should be concerned.

baselines/windows_updates_install_successes.yml

@@ -4,6 +4,7 @@ version: 1
 date: '2017-09-14'
 author: David Dorsey, Splunk
 type: Baseline
+status: production
 description: This search is intended to give you a feel for how often successful Windows
   updates are applied in your environments. Fluctuations in these numbers will allow
   you to determine when you should be concerned.

contentctl.yml

@@ -3,7 +3,7 @@ app:
   uid: 3449
   title: ES Content Updates
   appid: DA-ESS-ContentUpdate
-  version: 4.44.0
+  version: 5.0.0
   description: Explore the Analytic Stories included with ES Content Updates.
   prefix: ESCU
   label: ESCU
@@ -155,9 +155,9 @@ apps:
 - uid: 3110
   title: Splunk Add-on for Microsoft Cloud Services
   appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
-  version: 5.4.1
+  version: 5.4.2
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz
 - uid: 4055
   title: Splunk Add-on for Microsoft Office 365
   appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365

data_sources/azure_active_directory.yml

@@ -10,4 +10,4 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2

data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_member_to_role.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_owner_to_application.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_service_principal.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_unverified_domain.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_consent_to_application.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_disable_strong_authentication.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_enable_account.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_invite_external_user.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_reset_password_(by_admin).yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_set_domain_authentication.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_sign_in_activity.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_update_application.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_update_authorization_policy.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_update_user.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_user_registered_security_info.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - Level

data_sources/azure_audit_create_or_update_an_azure_automation_account.yml

@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - authorization.action

data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml

@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - authorization.action

data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml

@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - _time
 - authorization.action

data_sources/azure_monitor_activity.yml

@@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2
 version: 1
 date: '2025-01-13'
 author: Bhavin Patel, Splunk
-description: Data source object for Azure Monitor Activity.  The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.  To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. 
+description: Data source object for Azure Monitor Activity.  The Splunk Add-on for
+  Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure
+  EventHub.  To configure this logging, visit Intune > Tenant administration > Diagnostic
+  settings > Add diagnostic settings & send events to the activity audit event hub.
 source: Azure AD
 sourcetype: azure:monitor:activity
 separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.1
+  version: 5.4.2
 fields:
 - column
 - action
@@ -93,4 +96,16 @@ fields:
 - vendor_product
 - vendor_region
 - _time
-example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}'
+example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388",
+  "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript",
+  "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1,
+  "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4",
+  "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false,
+  "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId":
+  "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"},
+  "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37",
+  "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds":
+  ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name":
+  "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]},
+  "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00",
+  "identity": "brian.cove@frothlydev.onmicrosoft.com"}'

data_sources/linux_secure.yml

@@ -6,7 +6,10 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Linux Secure
 source: /var/log/secure
 sourcetype: linux_secure
-supported_TA: []
+supported_TA:
+- name: Splunk Add-on for Unix and Linux
+  url: https://splunkbase.splunk.com/app/833
+  version: 9.2.0
 fields:
 - _time
 - action

detections/application/email_attachments_with_lots_of_spaces.yml

@@ -29,7 +29,7 @@ how_to_implement: "You need to ingest data from emails. Specifically, the sender
   this detection search. To use this integration, install the Phantom App for Splunk
   `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the \"\
   Phantom Instance\" field in the Adaptive Response Actions when configuring this
-  detection search. The notable event will be sent to Phantom and the playbook will
+  detection search. The finding based event will be sent to Phantom and the playbook will
   gather further information about the file attachment and its network behaviors.
   If Phantom finds malicious behavior and an analyst approves of the results, the
   email will be deleted from the user's inbox."

detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml

@@ -60,9 +60,9 @@ references:
 - https://splunkbase.splunk.com/app/6553
 rba:
   message: A mismatch between source and response for verifying a push request has
-    occurred for $actor.alternateId$
+    occurred for $user$
   risk_objects:
-  - field: actor.alternateId
+  - field: user
     type: user
     score: 64
   threat_objects: []

detections/application/okta_risk_threshold_exceeded.yml

@@ -28,9 +28,9 @@ search: '| tstats `security_content_summariesonly` values(All_Risk.analyticstori
   |  search mitre_technique_id_count > 5 | `okta_risk_threshold_exceeded_filter`'
 how_to_implement: This search leverages the Risk Framework from Enterprise Security.
   Ensure that "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion"
-  analytic stories are enabled. TTPs may be set to Notables for point detections;
-  anomalies should not be notables but rather risk generators. The correlation relies
-  on risk before generating a notable. Modify the value as needed.
+  analytic stories are enabled. TTPs may be set to finding for point detections;
+  anomalies should not be findings but rather intermediate findings. The correlation relies
+  on intermediate findings before generating a findings. Modify the value as needed.
 known_false_positives: False positives will be limited to the number of events generated
   by the analytics tied to the stories. Analytics will need to be tested and tuned,
   and the risk score reduced as needed based on the organization.

detections/application/pingid_mismatch_auth_source_and_verification_response.yml

@@ -1,6 +1,6 @@
 name: PingID Mismatch Auth Source and Verification Response
 id: 15b0694e-caa2-4009-8d83-a1f98b86d086
-version: 4
+version: 5
 date: '2025-01-21'
 author: Steven Dick
 status: production

detections/application/suspicious_email_attachment_extensions.yml

@@ -26,7 +26,7 @@ how_to_implement: "You need to ingest data from emails. Specifically, the sender
   Delete\" can be configured to run when any results are found by this detection search.
   To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`,
   and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response
-  Actions when configuring this detection search. The notable event will be sent to
+  Actions when configuring this detection search. The finding event will be sent to
   Phantom and the playbook will gather further information about the file attachment
   and its network behaviors. If Phantom finds malicious behavior and an analyst approves
   of the results, the email will be deleted from the user's inbox.'"

detections/application/windows_ad_suspicious_attribute_modification.yml

@@ -1,6 +1,6 @@
 name: Windows AD Suspicious Attribute Modification
 id: 5682052e-ce55-4f9f-8d28-59191420b7e0
-version: 3
+version: 4
 date: '2025-01-21'
 author: Dean Luxton
 status: production

detections/application/windows_ad_suspicious_gpo_modification.yml

@@ -1,6 +1,6 @@
 name: Windows AD Suspicious GPO Modification
 id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf
-version: 3
+version: 4
 date: '2025-01-21'
 author: Dean Luxton
 status: experimental

detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml

@@ -8,7 +8,8 @@ type: TTP
 description: The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within a compromised AWS environment. This detection is achieved by monitoring for specific CloudTrail log entries that indicate the cessation of logging activities. Identifying such behavior is crucial for a Security Operations Center (SOC), as it signals an attempt to undermine the integrity of logging mechanisms, potentially allowing malicious activities to proceed without observation. The impact of this evasion tactic is significant, as it can severely hamper incident response and forensic investigations by obscuring the attacker's actions.
 data_source: 
 - ASL AWS CloudTrail
-search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`'
+search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid
+ as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`'
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
 references: