admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update uba_email_anomaly.json

Browse Source 
Various changes for grammar, punctuation, and flow.
This commit is contained in:
briannablacet
2019-07-24 16:28:53 -07:00
committed by GitHub
parent ddb3d4f6c2
commit 5243bb2f98
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/uba_email_anomaly.json
+4 -4
View File
@@ -14,7 +14,7 @@
"Microsoft Exchange"
]
},
"description": "Emails that are suspicious due to sender, domain rareness or behavior differences. This is an anomaly generated by Splunk> User Behavior Analytics(UBA) product.",
"description": "This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).",
"detect": {
"uba": {
"correlation_rule": {
@@ -47,14 +47,14 @@
"threat_category": "Email"
}
},
"eli5": "This search detects emails that are suspicious due to sender, domain rareness or behavior differences calculated by the Splunk UBA product. In this search, we query the `UEBA` datamodel to look for anomalies that are raised by the `SuspiciousEmailDetectionModel` and will output the count, description of the anomaly, signature, the type of event in UBA, severity and the user who received a potentially suspicious email from a newly seen domain. It will also output all the associated categories with that anomaly.",
"eli5": "This detection monitors for emails that are suspicious because of their sender, domain rareness, or behavior differences, as determined by Splunk UBA. In this search, we query the \"UEBA\" data model to look for anomalies that are raised by the \"SuspiciousEmailDetectionModel\" and will output the count, description of the anomaly, signature, the type of event in UBA, the severity, and the user who received a potentially suspicious email from a newly seen domain. It will also output all the categories associated with that anomaly.",
"entities": [
"user",
"url"
],
"how_to_implement": "You need to ingest data from email logs and have Splunk integrated with UBA. This anomaly is raised by a UBA detection model `SuspiciousEmailDetectionModel`, ensure that this model is enabled on your UBA instance.",
"how_to_implement": "You must be ingesting data from email logs and have Splunk integrated with UBA. This anomaly is raised by a UBA detection model called \"SuspiciousEmailDetectionModel.\" Ensure that this model is enabled on your UBA instance.",
"id": "56e877a6-1455-4479-ad16-0550dc1e33f8",
"known_false_positives": "This detection model will alert on any sender, domain that is seen for the first time, this could be a potential false postive. Please investigate and whitelist the url if it is a legitimate sender.",
"known_false_positives": "This detection model will alert on any sender domain that is seen for the first time. This could be a potential false positive. The next step is to investigate and whitelist the URL if you determine that it is a legitimate sender.",
"maintainers": [
{
"company": "Splunk",