admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating docs and package bits [ci skip]

Browse Source
This commit is contained in:
research bot
2021-08-18 19:10:04 +00:00
parent 8681ca59d2
commit 2ca7ca8bec
22 changed files with 18 additions and 1568 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/escu/default/analytic_stories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/analyticstories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/app.conf
Vendored
+1 -1
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 217
build = 222
[triggers]
reload.analytic_stories = simple
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/es_investigations.conf
Vendored
-816
View File
@@ -666,819 +666,3 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task]
label = AWS Investigate Security Hub alerts by dest
description = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id).
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task]
label = AWS Investigate User Activities By ARN
description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task]
label = AWS Investigate User Activities By AccessKeyId
description = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials.
disabled = 0
tokens = {\
"accessKeyId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR accessKeyId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_network_acl_details_from_id___response_task]
label = AWS Network ACL Details from ID
description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID
disabled = 0
tokens = {\
"networkAclId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR networkAclId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task]
label = AWS Network Interface details via resourceId
description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface.
disabled = 0
tokens = {\
"resourceId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR resourceId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task]
label = AWS S3 Bucket details via bucketName
description = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket.
disabled = 0
tokens = {\
"bucketName": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR bucketName=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_all_backup_logs_for_host___response_task]
label = All backup logs for host
description = Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task]
label = Amazon EKS Kubernetes activity by src ip
description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task]
label = GCP Kubernetes activity by src ip
description = This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_city___response_task]
label = Get All AWS Activity From City
description = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"City": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR City=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_country___response_task]
label = Get All AWS Activity From Country
description = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"Country": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR Country=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task]
label = Get All AWS Activity From IP Address
description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_region___response_task]
label = Get All AWS Activity From Region
description = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"Region": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR Region=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_backup_logs_for_endpoint___response_task]
label = Get Backup Logs For Endpoint
description = This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_certificate_logs_for_a_domain___response_task]
label = Get Certificate logs for a domain
description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers.
disabled = 0
tokens = {\
"domain": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR domain=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_dns_server_history_for_a_host___response_task]
label = Get DNS Server History for a host
description = While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_dns_traffic_ratio___response_task]
label = Get DNS traffic ratio
description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS.
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task]
label = Get EC2 Instance Details by instanceId
description = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field
disabled = 0
tokens = {\
"instanceId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR instanceId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_ec2_launch_details___response_task]
label = Get EC2 Launch Details
description = This search returns some of the launch details for a EC2 instance.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_email_info___response_task]
label = Get Email Info
description = This search returns all the information Splunk might have collected a specific email message over the last 2 hours.
disabled = 0
tokens = {\
"message_id": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR message_id=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_emails_from_specific_sender___response_task]
label = Get Emails From Specific Sender
description = This search returns all the emails from a specific sender over the last 24 and next hours.
disabled = 0
tokens = {\
"src_user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_user=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task]
label = Get First Occurrence and Last Occurrence of a MAC Address
description = This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network.
disabled = 0
tokens = {\
"src_mac": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_mac=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_history_of_email_sources___response_task]
label = Get History Of Email Sources
description = This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source.
disabled = 0
tokens = {\
"src": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_logon_rights_modifications_for_endpoint___response_task]
label = Get Logon Rights Modifications For Endpoint
description = This search allows you to retrieve any modifications to logon rights associated with a specific host.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_logon_rights_modifications_for_user___response_task]
label = Get Logon Rights Modifications For User
description = This search allows you to retrieve any modifications to logon rights for a specific user account.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_notable_history___response_task]
label = Get Notable History
description = This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task]
label = Get Outbound Emails to Hidden Cobra Threat Actors
description = This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`.
disabled = 0
tokens = {\
"src_user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_user=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"recipient": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR recipient=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_parent_process_info___response_task]
label = Get Parent Process Info
description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest
disabled = 0
tokens = {\
"parent_process_name": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR parent_process_name=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_process_file_activity___response_task]
label = Get Process File Activity
description = This search returns the file activity for a specific process on a specific endpoint
disabled = 0
tokens = {\
"process_name": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR process_name=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_process_info___response_task]
label = Get Process Info
description = This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address.
disabled = 0
tokens = {\
"process_name": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR process_name=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_process_information_for_port_activity___response_task]
label = Get Process Information For Port Activity
description = This search will return information about the process associated with observed network traffic to a specific destination port from a specific host.
disabled = 0
tokens = {\
"dest_port": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest_port=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task]
label = Get Process Responsible For The DNS Traffic
description = While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task]
label = Get Sysmon WMI Activity for Host
description = This search queries Sysmon WMI events for the host of interest.
disabled = 0
tokens = {\
"process": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR process=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_web_session_information_via_session_id___response_task]
label = Get Web Session Information via session id
description = This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code.
disabled = 0
tokens = {\
"session_id": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR session_id=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task]
label = Investigate AWS User Activities by user field
description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_aws_activities_via_region_name___response_task]
label = Investigate AWS activities via region name
description = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user
disabled = 0
tokens = {\
"vendor_region": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR vendor_region=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task]
label = Investigate Failed Logins for Multiple Destinations
description = This search returns failed logins to multiple destinations by user.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task]
label = Investigate Network Traffic From src ip
description = This search allows you to find all the network traffic from a specific IP address.
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task]
label = Investigate Okta Activity by IP Address
description = This search returns all okta events from a specific IP address.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_okta_activity_by_app___response_task]
label = Investigate Okta Activity by app
description = This search returns all okta events associated with a specific app
disabled = 0
tokens = {\
"app": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR app=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_pass_the_hash_attempts___response_task]
label = Investigate Pass the Hash Attempts
description = This search hunts for dumped NTLM hashes used for pass the hash.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task]
label = Investigate Pass the Ticket Attempts
description = This search hunts for dumped kerberos ticket from LSASS memory.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_previous_unseen_user___response_task]
label = Investigate Previous Unseen User
description = This search returns previous unseen user, which didn't log in for 30 days.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task]
label = Investigate Successful Remote Desktop Authentications
description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task]
label = Investigate Suspicious Strings in HTTP Header
description = This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest.
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
},\
"dest_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_user_activities_in_okta___response_task]
label = Investigate User Activities In Okta
description = This search returns all okta events by a specific user
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_web_posts_from_src___response_task]
label = Investigate Web POSTs From src
description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic.
disabled = 0
tokens = {\
"src": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/use_case_library.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:14 UTC
# On Date: 2021-08-18T18:43:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/workflow_actions.conf
Vendored
-359
View File
@@ -1,360 +1 @@
[workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task]
label = Workbench - AWS Investigate Security Hub alerts by dest
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_investigate_user_activities_by_arn___response_task]
label = Workbench - AWS Investigate User Activities By ARN
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task]
label = Workbench - AWS Investigate User Activities By AccessKeyId
type = link
fields = accessKeyId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_network_acl_details_from_id___response_task]
label = Workbench - AWS Network ACL Details from ID
type = link
fields = networkAclId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_network_interface_details_via_resourceid___response_task]
label = Workbench - AWS Network Interface details via resourceId
type = link
fields = resourceId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_s3_bucket_details_via_bucketname___response_task]
label = Workbench - AWS S3 Bucket details via bucketName
type = link
fields = bucketName
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_all_backup_logs_for_host___response_task]
label = Workbench - All backup logs for host
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_all_backup_logs_for_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task]
label = Workbench - Amazon EKS Kubernetes activity by src ip
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task]
label = Workbench - GCP Kubernetes activity by src ip
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_city___response_task]
label = Workbench - Get All AWS Activity From City
type = link
fields = City
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_country___response_task]
label = Workbench - Get All AWS Activity From Country
type = link
fields = Country
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_ip_address___response_task]
label = Workbench - Get All AWS Activity From IP Address
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_region___response_task]
label = Workbench - Get All AWS Activity From Region
type = link
fields = Region
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_backup_logs_for_endpoint___response_task]
label = Workbench - Get Backup Logs For Endpoint
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_backup_logs_for_endpoint___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_certificate_logs_for_a_domain___response_task]
label = Workbench - Get Certificate logs for a domain
type = link
fields = domain
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_certificate_logs_for_a_domain___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_dns_server_history_for_a_host___response_task]
label = Workbench - Get DNS Server History for a host
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_dns_server_history_for_a_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_ec2_instance_details_by_instanceid___response_task]
label = Workbench - Get EC2 Instance Details by instanceId
type = link
fields = instanceId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_ec2_launch_details___response_task]
label = Workbench - Get EC2 Launch Details
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_email_info___response_task]
label = Workbench - Get Email Info
type = link
fields = message_id
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_email_info___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_emails_from_specific_sender___response_task]
label = Workbench - Get Emails From Specific Sender
type = link
fields = src_user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_emails_from_specific_sender___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task]
label = Workbench - Get First Occurrence and Last Occurrence of a MAC Address
type = link
fields = src_mac
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_history_of_email_sources___response_task]
label = Workbench - Get History Of Email Sources
type = link
fields = src
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_history_of_email_sources___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_logon_rights_modifications_for_endpoint___response_task]
label = Workbench - Get Logon Rights Modifications For Endpoint
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_endpoint___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_logon_rights_modifications_for_user___response_task]
label = Workbench - Get Logon Rights Modifications For User
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_user___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_notable_history___response_task]
label = Workbench - Get Notable History
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_history___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_process_responsible_for_the_dns_traffic___response_task]
label = Workbench - Get Process Responsible For The DNS Traffic
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_process_responsible_for_the_dns_traffic___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_web_session_information_via_session_id___response_task]
label = Workbench - Get Web Session Information via session id
type = link
fields = session_id
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_web_session_information_via_session_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_aws_user_activities_by_user_field___response_task]
label = Workbench - Investigate AWS User Activities by user field
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_aws_activities_via_region_name___response_task]
label = Workbench - Investigate AWS activities via region name
type = link
fields = vendor_region
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task]
label = Workbench - Investigate Failed Logins for Multiple Destinations
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_network_traffic_from_src_ip___response_task]
label = Workbench - Investigate Network Traffic From src ip
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_network_traffic_from_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_okta_activity_by_ip_address___response_task]
label = Workbench - Investigate Okta Activity by IP Address
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_okta_activity_by_app___response_task]
label = Workbench - Investigate Okta Activity by app
type = link
fields = app
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_app___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_pass_the_hash_attempts___response_task]
label = Workbench - Investigate Pass the Hash Attempts
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_hash_attempts___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_pass_the_ticket_attempts___response_task]
label = Workbench - Investigate Pass the Ticket Attempts
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_ticket_attempts___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_previous_unseen_user___response_task]
label = Workbench - Investigate Previous Unseen User
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_previous_unseen_user___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_successful_remote_desktop_authentications___response_task]
label = Workbench - Investigate Successful Remote Desktop Authentications
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_successful_remote_desktop_authentications___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_user_activities_in_okta___response_task]
label = Workbench - Investigate User Activities In Okta
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_user_activities_in_okta___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_web_posts_from_src___response_task]
label = Workbench - Investigate Web POSTs From src
type = link
fields = src
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_posts_from_src___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
dist/saaws/default/analytic_stories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/analyticstories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/app.conf
Vendored
+1 -1
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 217
build = 222
[triggers]
reload.analytic_stories = simple
dist/saaws/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/es_investigations.conf
Vendored
-240
View File
@@ -92,243 +92,3 @@ panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___resp
[panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task]
label = AWS Investigate Security Hub alerts by dest
description = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id).
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task]
label = AWS Investigate User Activities By ARN
description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task]
label = AWS Investigate User Activities By AccessKeyId
description = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials.
disabled = 0
tokens = {\
"accessKeyId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR accessKeyId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_network_acl_details_from_id___response_task]
label = AWS Network ACL Details from ID
description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID
disabled = 0
tokens = {\
"networkAclId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR networkAclId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task]
label = AWS Network Interface details via resourceId
description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface.
disabled = 0
tokens = {\
"resourceId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR resourceId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task]
label = AWS S3 Bucket details via bucketName
description = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket.
disabled = 0
tokens = {\
"bucketName": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR bucketName=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task]
label = Amazon EKS Kubernetes activity by src ip
description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_city___response_task]
label = Get All AWS Activity From City
description = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"City": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR City=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_country___response_task]
label = Get All AWS Activity From Country
description = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"Country": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR Country=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task]
label = Get All AWS Activity From IP Address
description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"src_ip": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR src_ip=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_all_aws_activity_from_region___response_task]
label = Get All AWS Activity From Region
description = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful.
disabled = 0
tokens = {\
"Region": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR Region=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task]
label = Get EC2 Instance Details by instanceId
description = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field
disabled = 0
tokens = {\
"instanceId": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR instanceId=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
[panel://workbench_panel_get_ec2_launch_details___response_task]
label = Get EC2 Launch Details
description = This search returns some of the launch details for a EC2 instance.
disabled = 0
tokens = {\
"dest": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR dest=",\
"valueType": "primitive",\
"value": "asset",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task]
label = Investigate AWS User Activities by user field
description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
disabled = 0
tokens = {\
"user": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR user=",\
"valueType": "primitive",\
"value": "identity",\
"default": "null"\
}\
}\
[panel://workbench_panel_investigate_aws_activities_via_region_name___response_task]
label = Investigate AWS activities via region name
description = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user
disabled = 0
tokens = {\
"vendor_region": {\
"valuePrefix": "\"",\
"valueSuffix": "\"",\
"delimiter": " OR vendor_region=",\
"valueType": "primitive",\
"value": "file",\
"default": "null"\
}\
}\
dist/saaws/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/savedsearches.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/use_case_library.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-08-18T16:31:35 UTC
# On Date: 2021-08-18T18:44:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/workflow_actions.conf
Vendored
-135
View File
@@ -1,136 +1 @@
[workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task]
label = Workbench - AWS Investigate Security Hub alerts by dest
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_investigate_user_activities_by_arn___response_task]
label = Workbench - AWS Investigate User Activities By ARN
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task]
label = Workbench - AWS Investigate User Activities By AccessKeyId
type = link
fields = accessKeyId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_network_acl_details_from_id___response_task]
label = Workbench - AWS Network ACL Details from ID
type = link
fields = networkAclId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_network_interface_details_via_resourceid___response_task]
label = Workbench - AWS Network Interface details via resourceId
type = link
fields = resourceId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_aws_s3_bucket_details_via_bucketname___response_task]
label = Workbench - AWS S3 Bucket details via bucketName
type = link
fields = bucketName
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task]
label = Workbench - Amazon EKS Kubernetes activity by src ip
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_city___response_task]
label = Workbench - Get All AWS Activity From City
type = link
fields = City
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_country___response_task]
label = Workbench - Get All AWS Activity From Country
type = link
fields = Country
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_ip_address___response_task]
label = Workbench - Get All AWS Activity From IP Address
type = link
fields = src_ip
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_all_aws_activity_from_region___response_task]
label = Workbench - Get All AWS Activity From Region
type = link
fields = Region
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_ec2_instance_details_by_instanceid___response_task]
label = Workbench - Get EC2 Instance Details by instanceId
type = link
fields = instanceId
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_get_ec2_launch_details___response_task]
label = Workbench - Get EC2 Launch Details
type = link
fields = dest
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_aws_user_activities_by_user_field___response_task]
label = Workbench - Investigate AWS User Activities by user field
type = link
fields = user
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
[workbench_panel_investigate_aws_activities_via_region_name___response_task]
label = Workbench - Investigate AWS activities via region name
type = link
fields = vendor_region
display_location = field_menu
link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target = blank
link.method = get
docs/detections.wiki
+1 -1
View File
@@ -50319,7 +50319,7 @@ There might be false positives associted with this detection since items like ar
<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
# On Date: 2021-08-18 16:45:46.451568 UTC''
# On Date: 2021-08-18 18:55:07.503681 UTC''
# Author: Splunk Security Research''
# Contact: research@splunk.com''
#############
docs/stories.wiki
+1 -1
View File
@@ -8612,7 +8612,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content
# On Date: 2021-08-18 16:45:47.055510 UTC
# On Date: 2021-08-18 18:55:08.114939 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############