From 2f1cdca631902e51bbabd11984ba41bd97ccf7cd Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Wed, 15 May 2019 11:51:39 -0600 Subject: [PATCH] updated names of the support searches and updates stories accordingly --- baselines/train_dns_query_length.json | 2 +- baselines/train_smb_traffic_spike.json | 2 +- baselines/train_unusually_long_commandlines.json | 2 +- stories/command_and_control.json | 2 +- stories/dhs_report_TA18-074A.json | 2 +- stories/emotet.json | 2 +- stories/hidden_cobra_malware.json | 4 ++-- stories/mudcarp.json | 2 +- stories/ransomware.json | 4 ++-- stories/suspicious_cmd_line_executions.json | 2 +- stories/suspicious_dns_traffic.json | 2 +- stories/unusual_processes.json | 2 +- 12 files changed, 14 insertions(+), 14 deletions(-) diff --git a/baselines/train_dns_query_length.json b/baselines/train_dns_query_length.json index 14b096abe3..f51aba74f8 100644 --- a/baselines/train_dns_query_length.json +++ b/baselines/train_dns_query_length.json @@ -37,7 +37,7 @@ "search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel", "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.", "search_id": "c914844c-0ff5-4efc-8d44-c063443129ba", - "search_name": "Model Builder For DNS Query Length Outliers - MLTK", + "search_name": "Baseline of DNS Query Length - MLTK", "search_type": "support", "spec_version": 1, "version": "1.0" diff --git a/baselines/train_smb_traffic_spike.json b/baselines/train_smb_traffic_spike.json index c4469d0c6f..396c10c656 100644 --- a/baselines/train_smb_traffic_spike.json +++ b/baselines/train_smb_traffic_spike.json @@ -37,7 +37,7 @@ "search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel", "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.", "search_id": "df98763b-0b08-4281-8ef9-08db7ac572a9", - "search_name": "Model Builder For SMB Traffic Spike - MLTK", + "search_name": "Baseline of SMB Traffic - MLTK", "search_type": "support", "spec_version": 1, "version": "1.0" diff --git a/baselines/train_unusually_long_commandlines.json b/baselines/train_unusually_long_commandlines.json index 2aa4537a2f..f9fa996559 100644 --- a/baselines/train_unusually_long_commandlines.json +++ b/baselines/train_unusually_long_commandlines.json @@ -40,7 +40,7 @@ "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel", "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.", "search_id": "d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459", - "search_name": "Model Builder For Unusually Long Command Line - MLTK", + "search_name": "Baseline of Command Line Length- MLTK", "search_type": "support", "spec_version": 1, "version": "1.0" diff --git a/stories/command_and_control.json b/stories/command_and_control.json index 9dcb378a48..fd999f827f 100644 --- a/stories/command_and_control.json +++ b/stories/command_and_control.json @@ -60,7 +60,7 @@ ], "support_searches": [ "Baseline of blocked outbound traffic from AWS", - "Model Builder For DNS Query Length Outliers - MLTK" + "Baseline of DNS Query Length - MLTK" ] }, "spec_version": 1, diff --git a/stories/dhs_report_TA18-074A.json b/stories/dhs_report_TA18-074A.json index d6baa3b0da..17865d366a 100644 --- a/stories/dhs_report_TA18-074A.json +++ b/stories/dhs_report_TA18-074A.json @@ -56,7 +56,7 @@ ], "support_searches": [ "Previously seen command line arguments", - "Model Builder For SMB Traffic Spike - MLTK" + "Baseline of SMB Traffic - MLTK" ] }, "spec_version": 1, diff --git a/stories/emotet.json b/stories/emotet.json index b021db0cce..42683609e3 100644 --- a/stories/emotet.json +++ b/stories/emotet.json @@ -53,7 +53,7 @@ "Investigate Web Activity From Host" ], "support_searches": [ - "Model Builder For SMB Traffic Spike - MLTK" + "Baseline of SMB Traffic - MLTK" ] }, "spec_version": 1, diff --git a/stories/hidden_cobra_malware.json b/stories/hidden_cobra_malware.json index 1d0e12ea13..7b232fe052 100644 --- a/stories/hidden_cobra_malware.json +++ b/stories/hidden_cobra_malware.json @@ -54,8 +54,8 @@ ], "support_searches": [ "Previously seen command line arguments", - "Model Builder For DNS Query Length Outliers - MLTK", - "Model Builder For SMB Traffic Spike - MLTK" + "Baseline of DNS Query Length - MLTK", + "Baseline of SMB Traffic - MLTK" ] }, "spec_version": 1, diff --git a/stories/mudcarp.json b/stories/mudcarp.json index faffe1fc99..c4a1ecc1ac 100644 --- a/stories/mudcarp.json +++ b/stories/mudcarp.json @@ -48,7 +48,7 @@ ], "support_searches": [ "Previously seen command line arguments", - "Model Builder For Unusually Long Command Line - MLTK" + "Baseline of Command Line Length - MLTK" ] }, "spec_version": 1, diff --git a/stories/ransomware.json b/stories/ransomware.json index 9ca083397d..bc9b08859e 100644 --- a/stories/ransomware.json +++ b/stories/ransomware.json @@ -68,8 +68,8 @@ "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", - "Model Builder For Unusually Long Command Line - MLTK", - "Model Builder For SMB Traffic Spike - MLTK" + "Baseline of Command Line Length - MLTK", + "Baseline of SMB Traffic - MLTK" ] }, "spec_version": 1, diff --git a/stories/suspicious_cmd_line_executions.json b/stories/suspicious_cmd_line_executions.json index 2eb33085cc..cf2b71740f 100644 --- a/stories/suspicious_cmd_line_executions.json +++ b/stories/suspicious_cmd_line_executions.json @@ -48,7 +48,7 @@ ], "support_searches": [ "Previously seen command line arguments", - "Model Builder For Unusually Long Command Line - MLTK" + "Baseline of Command Line Length - MLTK" ] }, "spec_version": 1, diff --git a/stories/suspicious_dns_traffic.json b/stories/suspicious_dns_traffic.json index a826cbe5cf..7964e0565b 100644 --- a/stories/suspicious_dns_traffic.json +++ b/stories/suspicious_dns_traffic.json @@ -51,7 +51,7 @@ "Get Process Responsible For The DNS Traffic" ], "support_searches": [ - "Model Builder For DNS Query Length Outliers - MLTK" + "Baseline of DNS Query Length - MLTK" ] }, "spec_version": 1, diff --git a/stories/unusual_processes.json b/stories/unusual_processes.json index f52a49aba9..d16955dc94 100644 --- a/stories/unusual_processes.json +++ b/stories/unusual_processes.json @@ -48,7 +48,7 @@ "Investigate Web Activity From Host" ], "support_searches": [ - "Model Builder For Unusually Long Command Line - MLTK" + "Baseline of Command Line Length - MLTK" ] }, "spec_version": 1,