diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index 980a4b23a8..2f76ac5958 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -8,7 +8,6 @@ build = 25386 [triggers] reload.analytic_stories = simple -reload.usage_searches = simple reload.use_case_library = simple reload.correlationsearches = simple reload.analyticstories = simple diff --git a/dist/saaws/default/commands.conf b/dist/saaws/default/commands.conf deleted file mode 100644 index 14ea427b91..0000000000 --- a/dist/saaws/default/commands.conf +++ /dev/null @@ -1,10 +0,0 @@ -[dnstwist] -filename = dnstwist.py -chunked = true - -# run story functionality has been moved to: https://github.com/splunk/analytic_story_execution' -# [runstory] -# filename = runstory.py -# chunked = true -# is_risky = true - diff --git a/dist/saaws/default/searchbnf.conf b/dist/saaws/default/searchbnf.conf deleted file mode 100644 index 2b074fb3fe..0000000000 --- a/dist/saaws/default/searchbnf.conf +++ /dev/null @@ -1,26 +0,0 @@ -[dnstwist-command] -syntax = dnstwist ()* -shortdesc = Perform word permutations on a domain, or list of domains -description = Perform domain permutations on a domain, provided list of domains or domains part of Splunk_SA_CIM lookups -usage = public -maintainer = Splunk Security Research -example1 = |dnstwist domainlist=domains.csv -comment1 = Performs word premutation on a list of domains provided under DA-ESS-ContentUpdate/lookup/domains.csv -example2 = |dnstwist domain=www.splunk.com -comment2 = Performs word premutation on a single domain -example3 = |dnstwist populate_from_cim=true -comment3 = Performs word premutation on cim_corporate_email_domains.csv and cim_corporate_web_domains.csv from Splunk_SA_CIM - -[dnstwist-options] -syntax = domainlist= | domain= | populate_from_cim= -description = Prove the name of a lookup file with the list of domains, or individual domain you want to create permutations of. - -# runstory functionality was migrated to: https://github.com/splunk/analytic_story_execution -# [runstory-command] -# syntax = runstory -# shortdesc = Run an analytic story -# description = Run all the detection searches in an analytic story -# maintainer = Splunk Security Research -# example1 = | runstory "Malicious PowerShell" -# example2 = | runstory "AWS Cryptomining" -# usage = public diff --git a/dist/saaws/default/usage_searches.conf b/dist/saaws/default/usage_searches.conf deleted file mode 100644 index 0c8aa32c0a..0000000000 --- a/dist/saaws/default/usage_searches.conf +++ /dev/null @@ -1,73 +0,0 @@ -[escu-metrics-usage] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -dispatchAs = user -search = index=_audit sourcetype="audittrail" \ -"ESCU - "\ -`comment("Find all the search names in the audittrail.")`\ -| stats count(search) by search savedsearch_name user\ -| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \ -`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\ -| rex field=search "\"(?.*)\""\ -`comment("Extract the name of the search from the search string")`\ -| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* - -[escu-metrics-search] -action.email.useNSSubject = 1 -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -enableSched = 1 -cron_schedule = 0 0 * * * -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count) - -[escu-metrics-search-events] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -cron_schedule = 0 0 * * * -enableSched = 1 -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?.*)\"" | rex field=_raw "user=(?[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y") - -[escu-metrics-search-longest-runtime] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -enableSched = 1 -cron_schedule = 0 0 * * * -disabled = 1 -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id - -[escu-metrics-usage-search] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -cron_schedule = 0 0 * * * -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -enableSched = 1 -dispatchAs = user -search = index=_audit sourcetype="audittrail" \ -"ESCU - "\ -`comment("Find all the search names in the audittrail. Ignore the last few minutes so we can exclude this search's text from the result.")`\ -| stats count(search) by search savedsearch_name user\ -| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \ -`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\ -| rex field=search "\"(?.*)\""\ -`comment("Extract the name of the search from the search string")`\ -| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*