mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'sphear_attach' of github.com:splunk/security_content into sphear_attach
This commit is contained in:
tcontreras
Vendored
-1
@@ -8,7 +8,6 @@ build = 25386
|
||||
|
||||
[triggers]
|
||||
reload.analytic_stories = simple
|
||||
reload.usage_searches = simple
|
||||
reload.use_case_library = simple
|
||||
reload.correlationsearches = simple
|
||||
reload.analyticstories = simple
|
||||
|
||||
Vendored
-10
@@ -1,10 +0,0 @@
|
||||
[dnstwist]
|
||||
filename = dnstwist.py
|
||||
chunked = true
|
||||
|
||||
# run story functionality has been moved to: https://github.com/splunk/analytic_story_execution'
|
||||
# [runstory]
|
||||
# filename = runstory.py
|
||||
# chunked = true
|
||||
# is_risky = true
|
||||
|
||||
Vendored
-26
@@ -1,26 +0,0 @@
|
||||
[dnstwist-command]
|
||||
syntax = dnstwist (<dnstwist-options>)*
|
||||
shortdesc = Perform word permutations on a domain, or list of domains
|
||||
description = Perform domain permutations on a domain, provided list of domains or domains part of Splunk_SA_CIM lookups
|
||||
usage = public
|
||||
maintainer = Splunk Security Research <research@splunk.com>
|
||||
example1 = |dnstwist domainlist=domains.csv
|
||||
comment1 = Performs word premutation on a list of domains provided under DA-ESS-ContentUpdate/lookup/domains.csv
|
||||
example2 = |dnstwist domain=www.splunk.com
|
||||
comment2 = Performs word premutation on a single domain
|
||||
example3 = |dnstwist populate_from_cim=true
|
||||
comment3 = Performs word premutation on cim_corporate_email_domains.csv and cim_corporate_web_domains.csv from Splunk_SA_CIM
|
||||
|
||||
[dnstwist-options]
|
||||
syntax = domainlist=<string> | domain=<string> | populate_from_cim=<bool>
|
||||
description = Prove the name of a lookup file with the list of domains, or individual domain you want to create permutations of.
|
||||
|
||||
# runstory functionality was migrated to: https://github.com/splunk/analytic_story_execution
|
||||
# [runstory-command]
|
||||
# syntax = runstory <analytic_story_name>
|
||||
# shortdesc = Run an analytic story
|
||||
# description = Run all the detection searches in an analytic story
|
||||
# maintainer = Splunk Security Research
|
||||
# example1 = | runstory "Malicious PowerShell"
|
||||
# example2 = | runstory "AWS Cryptomining"
|
||||
# usage = public
|
||||
-73
@@ -1,73 +0,0 @@
|
||||
[escu-metrics-usage]
|
||||
action.email.useNSSubject = 1
|
||||
alert.digest_mode = True
|
||||
alert.suppress = 0
|
||||
alert.track = 0
|
||||
auto_summarize.dispatch.earliest_time = -1d@h
|
||||
dispatchAs = user
|
||||
search = index=_audit sourcetype="audittrail" \
|
||||
"ESCU - "\
|
||||
`comment("Find all the search names in the audittrail.")`\
|
||||
| stats count(search) by search savedsearch_name user\
|
||||
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
|
||||
`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\
|
||||
| rex field=search "\"(?<savedsearch_name>.*)\""\
|
||||
`comment("Extract the name of the search from the search string")`\
|
||||
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
|
||||
|
||||
[escu-metrics-search]
|
||||
action.email.useNSSubject = 1
|
||||
alert.suppress = 0
|
||||
alert.track = 0
|
||||
auto_summarize.dispatch.earliest_time = -1d@h
|
||||
enableSched = 1
|
||||
cron_schedule = 0 0 * * *
|
||||
dispatch.earliest_time = -4h@h
|
||||
dispatch.latest_time = -1h@h
|
||||
search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)
|
||||
|
||||
[escu-metrics-search-events]
|
||||
action.email.useNSSubject = 1
|
||||
alert.digest_mode = True
|
||||
alert.suppress = 0
|
||||
alert.track = 0
|
||||
auto_summarize.dispatch.earliest_time = -1d@h
|
||||
cron_schedule = 0 0 * * *
|
||||
enableSched = 1
|
||||
dispatch.earliest_time = -4h@h
|
||||
dispatch.latest_time = -1h@h
|
||||
search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")
|
||||
|
||||
[escu-metrics-search-longest-runtime]
|
||||
action.email.useNSSubject = 1
|
||||
alert.digest_mode = True
|
||||
alert.suppress = 0
|
||||
alert.track = 0
|
||||
auto_summarize.dispatch.earliest_time = -1d@h
|
||||
enableSched = 1
|
||||
cron_schedule = 0 0 * * *
|
||||
disabled = 1
|
||||
dispatch.earliest_time = -4h@h
|
||||
dispatch.latest_time = -1h@h
|
||||
search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id
|
||||
|
||||
[escu-metrics-usage-search]
|
||||
action.email.useNSSubject = 1
|
||||
alert.digest_mode = True
|
||||
alert.suppress = 0
|
||||
alert.track = 0
|
||||
auto_summarize.dispatch.earliest_time = -1d@h
|
||||
cron_schedule = 0 0 * * *
|
||||
dispatch.earliest_time = -4h@h
|
||||
dispatch.latest_time = -1h@h
|
||||
enableSched = 1
|
||||
dispatchAs = user
|
||||
search = index=_audit sourcetype="audittrail" \
|
||||
"ESCU - "\
|
||||
`comment("Find all the search names in the audittrail. Ignore the last few minutes so we can exclude this search's text from the result.")`\
|
||||
| stats count(search) by search savedsearch_name user\
|
||||
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
|
||||
`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\
|
||||
| rex field=search "\"(?<savedsearch_name>.*)\""\
|
||||
`comment("Extract the name of the search from the search string")`\
|
||||
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
|
||||
Reference in New Issue
Block a user