updated names of the support searches and updates stories accordingly

baselines/train_dns_query_length.json

@@ -37,7 +37,7 @@
   "search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type |  `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel",
   "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.",
   "search_id": "c914844c-0ff5-4efc-8d44-c063443129ba",
-  "search_name": "Model Builder For DNS Query Length Outliers - MLTK",
+  "search_name": "Baseline of DNS Query Length - MLTK",
   "search_type": "support",
   "spec_version": 1,
   "version": "1.0"

baselines/train_smb_traffic_spike.json

@@ -37,7 +37,7 @@
   "search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel",
   "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.",
   "search_id": "df98763b-0b08-4281-8ef9-08db7ac572a9",
-  "search_name": "Model Builder For SMB Traffic Spike - MLTK",
+  "search_name": "Baseline of SMB Traffic - MLTK",
   "search_type": "support",
   "spec_version": 1,
   "version": "1.0"

baselines/train_unusually_long_commandlines.json

@@ -40,7 +40,7 @@
   "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel",
   "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.",
   "search_id": "d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459",
-  "search_name": "Model Builder For Unusually Long Command Line - MLTK",
+  "search_name": "Baseline of Command Line Length- MLTK",
   "search_type": "support",
   "spec_version": 1,
   "version": "1.0"

stories/command_and_control.json

@@ -60,7 +60,7 @@
     ],
     "support_searches": [
       "Baseline of blocked outbound traffic from AWS",
-      "Model Builder For DNS Query Length Outliers - MLTK"
+      "Baseline of DNS Query Length - MLTK"
     ]
   },
   "spec_version": 1,

stories/dhs_report_TA18-074A.json

@@ -56,7 +56,7 @@
     ],
     "support_searches": [
       "Previously seen command line arguments",
-      "Model Builder For SMB Traffic Spike - MLTK"
+      "Baseline of SMB Traffic - MLTK"
     ]
   },
   "spec_version": 1,

stories/emotet.json

@@ -53,7 +53,7 @@
       "Investigate Web Activity From Host"
     ],
     "support_searches": [
-      "Model Builder For SMB Traffic Spike - MLTK"
+      "Baseline of SMB Traffic - MLTK"
     ]
   },
   "spec_version": 1,

stories/hidden_cobra_malware.json

@@ -54,8 +54,8 @@
     ],
     "support_searches": [
       "Previously seen command line arguments",
-      "Model Builder For DNS Query Length Outliers - MLTK",
-      "Model Builder For SMB Traffic Spike - MLTK"
+      "Baseline of DNS Query Length - MLTK",
+      "Baseline of SMB Traffic - MLTK"
     ]
   },
   "spec_version": 1,

stories/mudcarp.json

@@ -48,7 +48,7 @@
     ],
     "support_searches": [
       "Previously seen command line arguments",
-      "Model Builder For Unusually Long Command Line - MLTK"
+      "Baseline of Command Line Length - MLTK"
     ]
   },
   "spec_version": 1,

stories/ransomware.json

@@ -68,8 +68,8 @@
       "Monitor Unsuccessful Backups",
       "Windows Updates Install Failures",
       "Windows Updates Install Successes",
-      "Model Builder For Unusually Long Command Line - MLTK",
-      "Model Builder For SMB Traffic Spike - MLTK"
+      "Baseline of Command Line Length - MLTK",
+      "Baseline of SMB Traffic - MLTK"
     ]
   },
   "spec_version": 1,

stories/suspicious_cmd_line_executions.json

@@ -48,7 +48,7 @@
     ],
     "support_searches": [
       "Previously seen command line arguments",
-      "Model Builder For Unusually Long Command Line - MLTK"
+      "Baseline of Command Line Length - MLTK"
     ]
   },
   "spec_version": 1,

stories/suspicious_dns_traffic.json

@@ -51,7 +51,7 @@
       "Get Process Responsible For The DNS Traffic"
     ],
     "support_searches": [
-      "Model Builder For DNS Query Length Outliers - MLTK"
+      "Baseline of DNS Query Length - MLTK"
     ]
   },
   "spec_version": 1,

stories/unusual_processes.json

@@ -48,7 +48,7 @@
       "Investigate Web Activity From Host"
     ],
     "support_searches": [
-      "Model Builder For Unusually Long Command Line - MLTK"
+      "Baseline of Command Line Length - MLTK"
     ]
   },
   "spec_version": 1,