From 2beb040928ef83e65b4bf3e8a988be2cf13ebb89 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 21 Dec 2022 14:12:18 -0800 Subject: [PATCH] add risk index macro --- detections/cloud/correlation_by_repository_and_risk.yml | 2 +- detections/cloud/correlation_by_user_and_risk.yml | 2 +- macros/{signals.yml => risk_index.yml} | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) rename macros/{signals.yml => risk_index.yml} (80%) diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 149f9b6c60..0e9545b63d 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk type: Correlation datamodel: [] description: This search correlations detections by repository and risk_score -search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source) +search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository | sort - risk_score | where risk_score > 80 | `correlation_by_repository_and_risk_filter`' how_to_implement: For Dev Sec Ops POC diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 625b3fbf65..909ca482a1 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk type: Correlation datamodel: [] description: This search correlations detections by user and risk_score -search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source) +search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user | sort - risk_score | where risk_score > 80 | `correlation_by_user_and_risk_filter`' how_to_implement: For Dev Sec Ops POC diff --git a/macros/signals.yml b/macros/risk_index.yml similarity index 80% rename from macros/signals.yml rename to macros/risk_index.yml index 4f7ce112ee..e8194460d6 100644 --- a/macros/signals.yml +++ b/macros/risk_index.yml @@ -1,4 +1,4 @@ -definition: index=signals +definition: index=risk description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: signals +name: risk_index