diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 41d71af24c..7c308b6de3 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index f132628ceb..40ea441144 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 3cacc6429a..888f613ffc 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 217 +build = 222 [triggers] reload.analytic_stories = simple diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 7d9f9da983..4b93e837e9 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 7fc6ab7ec6..baef64485c 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -666,819 +666,3 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"] -[panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task] -label = AWS Investigate Security Hub alerts by dest -description = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task] -label = AWS Investigate User Activities By ARN -description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task] -label = AWS Investigate User Activities By AccessKeyId -description = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. -disabled = 0 -tokens = {\ - "accessKeyId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR accessKeyId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_network_acl_details_from_id___response_task] -label = AWS Network ACL Details from ID -description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID -disabled = 0 -tokens = {\ - "networkAclId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR networkAclId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task] -label = AWS Network Interface details via resourceId -description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface. -disabled = 0 -tokens = {\ - "resourceId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR resourceId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task] -label = AWS S3 Bucket details via bucketName -description = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket. -disabled = 0 -tokens = {\ - "bucketName": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR bucketName=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_all_backup_logs_for_host___response_task] -label = All backup logs for host -description = Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task] -label = Amazon EKS Kubernetes activity by src ip -description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task] -label = GCP Kubernetes activity by src ip -description = This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_city___response_task] -label = Get All AWS Activity From City -description = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "City": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR City=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_country___response_task] -label = Get All AWS Activity From Country -description = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "Country": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR Country=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task] -label = Get All AWS Activity From IP Address -description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_region___response_task] -label = Get All AWS Activity From Region -description = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "Region": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR Region=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_backup_logs_for_endpoint___response_task] -label = Get Backup Logs For Endpoint -description = This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_certificate_logs_for_a_domain___response_task] -label = Get Certificate logs for a domain -description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. -disabled = 0 -tokens = {\ - "domain": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR domain=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_dns_server_history_for_a_host___response_task] -label = Get DNS Server History for a host -description = While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours. -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_dns_traffic_ratio___response_task] -label = Get DNS traffic ratio -description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task] -label = Get EC2 Instance Details by instanceId -description = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field -disabled = 0 -tokens = {\ - "instanceId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR instanceId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_ec2_launch_details___response_task] -label = Get EC2 Launch Details -description = This search returns some of the launch details for a EC2 instance. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_email_info___response_task] -label = Get Email Info -description = This search returns all the information Splunk might have collected a specific email message over the last 2 hours. -disabled = 0 -tokens = {\ - "message_id": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR message_id=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_emails_from_specific_sender___response_task] -label = Get Emails From Specific Sender -description = This search returns all the emails from a specific sender over the last 24 and next hours. -disabled = 0 -tokens = {\ - "src_user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_user=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task] -label = Get First Occurrence and Last Occurrence of a MAC Address -description = This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network. -disabled = 0 -tokens = {\ - "src_mac": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_mac=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_history_of_email_sources___response_task] -label = Get History Of Email Sources -description = This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. -disabled = 0 -tokens = {\ - "src": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_logon_rights_modifications_for_endpoint___response_task] -label = Get Logon Rights Modifications For Endpoint -description = This search allows you to retrieve any modifications to logon rights associated with a specific host. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_logon_rights_modifications_for_user___response_task] -label = Get Logon Rights Modifications For User -description = This search allows you to retrieve any modifications to logon rights for a specific user account. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_notable_history___response_task] -label = Get Notable History -description = This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task] -label = Get Outbound Emails to Hidden Cobra Threat Actors -description = This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`. -disabled = 0 -tokens = {\ - "src_user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_user=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "recipient": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR recipient=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_parent_process_info___response_task] -label = Get Parent Process Info -description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest -disabled = 0 -tokens = {\ - "parent_process_name": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR parent_process_name=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_process_file_activity___response_task] -label = Get Process File Activity -description = This search returns the file activity for a specific process on a specific endpoint -disabled = 0 -tokens = {\ - "process_name": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR process_name=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_process_info___response_task] -label = Get Process Info -description = This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. -disabled = 0 -tokens = {\ - "process_name": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR process_name=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_process_information_for_port_activity___response_task] -label = Get Process Information For Port Activity -description = This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. -disabled = 0 -tokens = {\ - "dest_port": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest_port=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task] -label = Get Process Responsible For The DNS Traffic -description = While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task] -label = Get Sysmon WMI Activity for Host -description = This search queries Sysmon WMI events for the host of interest. -disabled = 0 -tokens = {\ - "process": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR process=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_web_session_information_via_session_id___response_task] -label = Get Web Session Information via session id -description = This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code. -disabled = 0 -tokens = {\ - "session_id": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR session_id=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task] -label = Investigate AWS User Activities by user field -description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_aws_activities_via_region_name___response_task] -label = Investigate AWS activities via region name -description = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user -disabled = 0 -tokens = {\ - "vendor_region": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR vendor_region=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task] -label = Investigate Failed Logins for Multiple Destinations -description = This search returns failed logins to multiple destinations by user. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task] -label = Investigate Network Traffic From src ip -description = This search allows you to find all the network traffic from a specific IP address. -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task] -label = Investigate Okta Activity by IP Address -description = This search returns all okta events from a specific IP address. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_okta_activity_by_app___response_task] -label = Investigate Okta Activity by app -description = This search returns all okta events associated with a specific app -disabled = 0 -tokens = {\ - "app": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR app=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_pass_the_hash_attempts___response_task] -label = Investigate Pass the Hash Attempts -description = This search hunts for dumped NTLM hashes used for pass the hash. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task] -label = Investigate Pass the Ticket Attempts -description = This search hunts for dumped kerberos ticket from LSASS memory. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_previous_unseen_user___response_task] -label = Investigate Previous Unseen User -description = This search returns previous unseen user, which didn't log in for 30 days. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task] -label = Investigate Successful Remote Desktop Authentications -description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task] -label = Investigate Suspicious Strings in HTTP Header -description = This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest. -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - },\ - "dest_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_user_activities_in_okta___response_task] -label = Investigate User Activities In Okta -description = This search returns all okta events by a specific user -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_web_posts_from_src___response_task] -label = Investigate Web POSTs From src -description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. -disabled = 0 -tokens = {\ - "src": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index b3c85e1976..879d9fbf1f 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 1c4a2e511b..0a9467169d 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 897a283ac0..f79ece477b 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index f132628ceb..40ea441144 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:14 UTC +# On Date: 2021-08-18T18:43:48 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index eb7dad24fa..8b13789179 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,360 +1 @@ -[workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task] -label = Workbench - AWS Investigate Security Hub alerts by dest -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_investigate_user_activities_by_arn___response_task] -label = Workbench - AWS Investigate User Activities By ARN -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task] -label = Workbench - AWS Investigate User Activities By AccessKeyId -type = link -fields = accessKeyId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_network_acl_details_from_id___response_task] -label = Workbench - AWS Network ACL Details from ID -type = link -fields = networkAclId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_network_interface_details_via_resourceid___response_task] -label = Workbench - AWS Network Interface details via resourceId -type = link -fields = resourceId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_s3_bucket_details_via_bucketname___response_task] -label = Workbench - AWS S3 Bucket details via bucketName -type = link -fields = bucketName -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_all_backup_logs_for_host___response_task] -label = Workbench - All backup logs for host -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_all_backup_logs_for_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task] -label = Workbench - Amazon EKS Kubernetes activity by src ip -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task] -label = Workbench - GCP Kubernetes activity by src ip -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_city___response_task] -label = Workbench - Get All AWS Activity From City -type = link -fields = City -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_country___response_task] -label = Workbench - Get All AWS Activity From Country -type = link -fields = Country -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_ip_address___response_task] -label = Workbench - Get All AWS Activity From IP Address -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_region___response_task] -label = Workbench - Get All AWS Activity From Region -type = link -fields = Region -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_backup_logs_for_endpoint___response_task] -label = Workbench - Get Backup Logs For Endpoint -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_backup_logs_for_endpoint___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_certificate_logs_for_a_domain___response_task] -label = Workbench - Get Certificate logs for a domain -type = link -fields = domain -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_certificate_logs_for_a_domain___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_dns_server_history_for_a_host___response_task] -label = Workbench - Get DNS Server History for a host -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_dns_server_history_for_a_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - - -[workbench_panel_get_ec2_instance_details_by_instanceid___response_task] -label = Workbench - Get EC2 Instance Details by instanceId -type = link -fields = instanceId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_ec2_launch_details___response_task] -label = Workbench - Get EC2 Launch Details -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_email_info___response_task] -label = Workbench - Get Email Info -type = link -fields = message_id -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_email_info___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_emails_from_specific_sender___response_task] -label = Workbench - Get Emails From Specific Sender -type = link -fields = src_user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_emails_from_specific_sender___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task] -label = Workbench - Get First Occurrence and Last Occurrence of a MAC Address -type = link -fields = src_mac -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_history_of_email_sources___response_task] -label = Workbench - Get History Of Email Sources -type = link -fields = src -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_history_of_email_sources___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_logon_rights_modifications_for_endpoint___response_task] -label = Workbench - Get Logon Rights Modifications For Endpoint -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_endpoint___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_logon_rights_modifications_for_user___response_task] -label = Workbench - Get Logon Rights Modifications For User -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_user___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_notable_history___response_task] -label = Workbench - Get Notable History -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_history___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - - - - - - -[workbench_panel_get_process_responsible_for_the_dns_traffic___response_task] -label = Workbench - Get Process Responsible For The DNS Traffic -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_process_responsible_for_the_dns_traffic___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - - -[workbench_panel_get_web_session_information_via_session_id___response_task] -label = Workbench - Get Web Session Information via session id -type = link -fields = session_id -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_web_session_information_via_session_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_aws_user_activities_by_user_field___response_task] -label = Workbench - Investigate AWS User Activities by user field -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_aws_activities_via_region_name___response_task] -label = Workbench - Investigate AWS activities via region name -type = link -fields = vendor_region -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task] -label = Workbench - Investigate Failed Logins for Multiple Destinations -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_network_traffic_from_src_ip___response_task] -label = Workbench - Investigate Network Traffic From src ip -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_network_traffic_from_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_okta_activity_by_ip_address___response_task] -label = Workbench - Investigate Okta Activity by IP Address -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_okta_activity_by_app___response_task] -label = Workbench - Investigate Okta Activity by app -type = link -fields = app -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_app___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_pass_the_hash_attempts___response_task] -label = Workbench - Investigate Pass the Hash Attempts -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_hash_attempts___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_pass_the_ticket_attempts___response_task] -label = Workbench - Investigate Pass the Ticket Attempts -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_ticket_attempts___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_previous_unseen_user___response_task] -label = Workbench - Investigate Previous Unseen User -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_previous_unseen_user___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_successful_remote_desktop_authentications___response_task] -label = Workbench - Investigate Successful Remote Desktop Authentications -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_successful_remote_desktop_authentications___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - - -[workbench_panel_investigate_user_activities_in_okta___response_task] -label = Workbench - Investigate User Activities In Okta -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_user_activities_in_okta___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_web_posts_from_src___response_task] -label = Workbench - Investigate Web POSTs From src -type = link -fields = src -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_posts_from_src___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index 1f49356167..aa9a0f14b5 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index ea84b1b72d..fd0ab862d6 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index 4be74c6838..101a2b09d1 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 217 +build = 222 [triggers] reload.analytic_stories = simple diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index b09a5a2a91..1137dd5975 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/es_investigations.conf b/dist/saaws/default/es_investigations.conf index c766fa1f6f..8f91b0c57f 100644 --- a/dist/saaws/default/es_investigations.conf +++ b/dist/saaws/default/es_investigations.conf @@ -92,243 +92,3 @@ panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___resp -[panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task] -label = AWS Investigate Security Hub alerts by dest -description = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task] -label = AWS Investigate User Activities By ARN -description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task] -label = AWS Investigate User Activities By AccessKeyId -description = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. -disabled = 0 -tokens = {\ - "accessKeyId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR accessKeyId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_network_acl_details_from_id___response_task] -label = AWS Network ACL Details from ID -description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID -disabled = 0 -tokens = {\ - "networkAclId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR networkAclId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task] -label = AWS Network Interface details via resourceId -description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface. -disabled = 0 -tokens = {\ - "resourceId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR resourceId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task] -label = AWS S3 Bucket details via bucketName -description = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket. -disabled = 0 -tokens = {\ - "bucketName": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR bucketName=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task] -label = Amazon EKS Kubernetes activity by src ip -description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_city___response_task] -label = Get All AWS Activity From City -description = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "City": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR City=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_country___response_task] -label = Get All AWS Activity From Country -description = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "Country": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR Country=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task] -label = Get All AWS Activity From IP Address -description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "src_ip": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR src_ip=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_all_aws_activity_from_region___response_task] -label = Get All AWS Activity From Region -description = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -disabled = 0 -tokens = {\ - "Region": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR Region=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task] -label = Get EC2 Instance Details by instanceId -description = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field -disabled = 0 -tokens = {\ - "instanceId": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR instanceId=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_get_ec2_launch_details___response_task] -label = Get EC2 Launch Details -description = This search returns some of the launch details for a EC2 instance. -disabled = 0 -tokens = {\ - "dest": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR dest=",\ - "valueType": "primitive",\ - "value": "asset",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task] -label = Investigate AWS User Activities by user field -description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. -disabled = 0 -tokens = {\ - "user": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR user=",\ - "valueType": "primitive",\ - "value": "identity",\ - "default": "null"\ - }\ -}\ - - -[panel://workbench_panel_investigate_aws_activities_via_region_name___response_task] -label = Investigate AWS activities via region name -description = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user -disabled = 0 -tokens = {\ - "vendor_region": {\ - "valuePrefix": "\"",\ - "valueSuffix": "\"",\ - "delimiter": " OR vendor_region=",\ - "valueType": "primitive",\ - "value": "file",\ - "default": "null"\ - }\ -}\ - - diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index 599a649855..7d6020e132 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 7df484ccb3..e7d349037d 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index a722dcbc2b..4b7dc1dcdf 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index ea84b1b72d..fd0ab862d6 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-18T16:31:35 UTC +# On Date: 2021-08-18T18:44:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/workflow_actions.conf b/dist/saaws/default/workflow_actions.conf index c53000b96a..8b13789179 100644 --- a/dist/saaws/default/workflow_actions.conf +++ b/dist/saaws/default/workflow_actions.conf @@ -1,136 +1 @@ -[workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task] -label = Workbench - AWS Investigate Security Hub alerts by dest -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_investigate_user_activities_by_arn___response_task] -label = Workbench - AWS Investigate User Activities By ARN -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task] -label = Workbench - AWS Investigate User Activities By AccessKeyId -type = link -fields = accessKeyId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_network_acl_details_from_id___response_task] -label = Workbench - AWS Network ACL Details from ID -type = link -fields = networkAclId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_network_interface_details_via_resourceid___response_task] -label = Workbench - AWS Network Interface details via resourceId -type = link -fields = resourceId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_aws_s3_bucket_details_via_bucketname___response_task] -label = Workbench - AWS S3 Bucket details via bucketName -type = link -fields = bucketName -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task] -label = Workbench - Amazon EKS Kubernetes activity by src ip -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_city___response_task] -label = Workbench - Get All AWS Activity From City -type = link -fields = City -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_country___response_task] -label = Workbench - Get All AWS Activity From Country -type = link -fields = Country -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_ip_address___response_task] -label = Workbench - Get All AWS Activity From IP Address -type = link -fields = src_ip -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_all_aws_activity_from_region___response_task] -label = Workbench - Get All AWS Activity From Region -type = link -fields = Region -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_ec2_instance_details_by_instanceid___response_task] -label = Workbench - Get EC2 Instance Details by instanceId -type = link -fields = instanceId -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_get_ec2_launch_details___response_task] -label = Workbench - Get EC2 Launch Details -type = link -fields = dest -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_aws_user_activities_by_user_field___response_task] -label = Workbench - Investigate AWS User Activities by user field -type = link -fields = user -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - -[workbench_panel_investigate_aws_activities_via_region_name___response_task] -label = Workbench - Investigate AWS activities via region name -type = link -fields = vendor_region -display_location = field_menu -link.uri = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name___response_task&drilldown_field=$@field_name$&use_drilldown_time=true -link.target = blank -link.method = get - diff --git a/docs/detections.wiki b/docs/detections.wiki index 35fcb29f70..436b37bf22 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -50319,7 +50319,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-08-18 16:45:46.451568 UTC''
+# On Date: 2021-08-18 18:55:07.503681 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/stories.wiki b/docs/stories.wiki
index 3ed99a918c..1e8059f3fd 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -8612,7 +8612,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-08-18 16:45:47.055510 UTC
+# On Date: 2021-08-18 18:55:08.114939 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############