Merge branch 'develop' of github.com:splunk/security-content into tf23

.circleci/config.yml

@@ -253,6 +253,12 @@ jobs:
             cd security-content
             source venv/bin/activate
             python bin/doc-gen.py --path . --output docs -v
+      - run:
+          name: make yamls pretty
+          command: |
+            cd security-content
+            source venv/bin/activate
+            python bin/pretty_yaml.py --path . -v
       - run:
           name: get cti repo for mitre-maps
           command: |
@@ -283,6 +289,7 @@ jobs:
             git config --global push.default simple
             git add package/*
             git add docs/*
+            git add detections/*
             git commit --allow-empty -m "updating docs and package bits [ci skip]"
             # Push quietly to prevent showing the token in log
             git push https://${GITHUB_TOKEN}@github.com/splunk/security-content.git ${CIRCLE_BRANCH}
@@ -339,6 +346,7 @@ jobs:
           name: update api sources
           command: |
             cd security-content
+            aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml"
             aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml"
             aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml"
             aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml"

.gitlab-ci.yml

@@ -13,4 +13,4 @@ validate:
   script:
     - python3 bin/ssa_validate.py --skip-error detections/*/*
     - python3 bin/ssa_test.py --skip-error tests/*/*
-    - python3 bin/testing_coverage.py --type SSA --min-coverage 1.0
+    - python3 bin/testing_coverage.py --type streaming --min-coverage 1.0

README.md

@@ -4,8 +4,6 @@
         <img src="https://img.shields.io/github/v/release/splunk/security_content" /></a>
     <a href="https://circleci.com/gh/splunk/security_content/tree/develop">
         <img src="https://img.shields.io/circleci/build/github/splunk/security_content?token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269" /></a>
-    <a href="https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+extension%3Ayml+path%3Adetections&type=Code&ref=advsearch&l=&l=">
-        <img src="https://img.shields.io/github/directory-file-count/splunk/security_content/detections?extension=.yml&label=detections" /></a>
     <a href="https://github.com/splunk/security_content">
         <img src="https://security-content.s3-us-west-2.amazonaws.com/reporting/detection_coverage.svg" /></a>
     <a href="https://github.com/splunk/security_content">

automated_detection_testing/requirements.txt

@@ -1,4 +1,4 @@
-ansible==2.10.6
+ansible==2.10.7
 ansible-runner==1.4.6
 apipkg==1.5
 aspy.yaml==1.3.0
@@ -8,7 +8,7 @@ attrs==20.3.0
 azure-common==1.1.26
 azure-core==1.10.0
 azure-identity==1.5.0
-azure-mgmt-compute==18.1.0
+azure-mgmt-compute==18.2.0
 azure-mgmt-core==1.2.2
 azure-mgmt-network==17.1.0
 azure-mgmt-resource==15.0.0
@@ -16,18 +16,18 @@ bcrypt==3.2.0
 boto3==1.16.61
 botocore==1.19.63
 certifi==2020.12.5
-cffi==1.14.4
+cffi==1.14.5
 cfgv==2.0.1
 chardet==4.0.0
 configparser==4.0.2
 contextlib2==0.6.0.post1
-cryptography==3.3.1
+cryptography==3.3.2
 Deprecated==1.2.11
 dnspython==2.1.0
 docutils==0.16
 execnet==1.8.0
 gitdb==4.0.5
-GitPython==3.1.12
+GitPython==3.1.13
 identify==1.5.13
 idna==2.8
 importlib-metadata==3.4.0

baselines/baseline_of_api_calls_per_user_arn.yml

@@ -2,21 +2,28 @@ name: Baseline of API Calls per User ARN
 id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
 version: 1
 date: '2018-04-09'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls made by each user. Also recorded is the number
   of data points for each user. This table is then outputted to a lookup file to allow
   the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-author: David Dorsey, Splunk
 search: '`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn
   | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
   as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
   stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
   avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS User Monitoring
   detections:
   - Detect Spike in AWS API Activity
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_blocked_outbound_traffic_from_aws.yml

@@ -2,15 +2,14 @@ name: Baseline of blocked outbound traffic from AWS
 id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
 version: 1
 date: '2018-05-07'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of outbound connections blocked in your VPC flow logs by
   each source IP address (IP address of your EC2 instances). Also recorded is the
   number of data points for each source IP. This table outputs to a lookup file to
   allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
-  logs.`.
-author: Bhavin Patel, Splunk
 search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12
   OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)
   | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip
@@ -19,10 +18,18 @@ search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17
   as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints,
   avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections
   | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
+  logs.`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Network ACL Activity
   - Command and Control
   - Suspicious AWS Traffic
   detections:
   - Detect Spike in blocked Outbound Traffic from your AWS
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml

@@ -2,36 +2,42 @@ name: Baseline Of Cloud Infrastructure API Calls Per User
 id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
 version: 1
 date: '2020-09-07'
-description: This search is used to build a Machine Learning Toolkit (MLTK) model
-  for how many API calls are performed by each user. By default, the search uses
-  the last 90 days of data to build the model and the model is rebuilt weekly. The
-  model created by this search is then used in the corresponding detection search,
-  which identifies subsequent outliers in the number of instances created in a 
-  small time window.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
-  to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
-  along with any required dependencies. Depending on the number of users in your environment,
-  you may also need to adjust the value for max_inputs in the MLTK settings for the
-  DensityFunction algorithm, then ensure that the search completes in a reasonable
-  timeframe. By default, the search builds the model using the past 90 days of data.
-  You can modify the search window to build the model over a longer period of time,
-  which may give you better results. You may also want to periodically re-run this
-  search to rebuild the model with the latest data.'
 author: David Dorsey, Splunk
-search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h 
-| `drop_dm_object_name("All_Changes")` 
-| eval HourOfDay=strftime(_time, "%H") 
-| eval HourOfDay=floor(HourOfDay/4)*4 
-| eval DayOfWeek=strftime(_time, "%w") 
-| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
-| table _time api_calls, user, HourOfDay, isWeekend 
-| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend 
-| where api_calls >= 1 
-| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true'
+type: batch
+datamodel:
+- Change
+description: This search is used to build a Machine Learning Toolkit (MLTK) model
+  for how many API calls are performed by each user. By default, the search uses the
+  last 90 days of data to build the model and the model is rebuilt weekly. The model
+  created by this search is then used in the corresponding detection search, which
+  identifies subsequent outliers in the number of instances created in a small time
+  window.
+search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown
+  All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls)
+  as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction
+  api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm
+  show_density=true'
+how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
+  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+  installed, along with any required dependencies. Depending on the number of users
+  in your environment, you may also need to adjust the value for max_inputs in the
+  MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+  in a reasonable timeframe. By default, the search builds the model using the past
+  90 days of data. You can modify the search window to build the model over a longer
+  period of time, which may give you better results. You may also want to periodically
+  re-run this search to rebuild the model with the latest data.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud User Activities
+  deployments:
+  - Weekly Model Rebuild 90 Day Lookback
   detections:
   - Abnormally High Number Of Cloud Infrastructure API Calls
-  deployments:
-  - Weekly Model Rebuild 90 Day Lookback
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_cloud_instances_destroyed.yml

@@ -2,37 +2,45 @@ name: Baseline Of Cloud Instances Destroyed
 id: a2f701f8-5296-4d74-829c-0b7eb346d549
 version: 1
 date: '2020-08-25'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
-  for how many instances are destroyed in the environment. By default, the search uses
-  the last 90 days of data to build the model and the model is rebuilt weekly. The
-  model created by this search is then used in the corresponding detection search,
-  which identifies subsequent outliers in the number of instances destroyed in a 
-  small time window.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
-  to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
-  along with any required dependencies. Depending on the number of users in your environment,
-  you may also need to adjust the value for max_inputs in the MLTK settings for the
-  DensityFunction algorithm, then ensure that the search completes in a reasonable
-  timeframe. By default, the search builds the model using the past 30 days of data.
-  You can modify the search window to build the model over a longer period of time,
-  which may give you better results. You may also want to periodically re-run this
-  search to rebuild the model with the latest data.\
+  for how many instances are destroyed in the environment. By default, the search
+  uses the last 90 days of data to build the model and the model is rebuilt weekly.
+  The model created by this search is then used in the corresponding detection search,
+  which identifies subsequent outliers in the number of instances destroyed in a small
+  time window.
+search: '| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted
+  AND All_Changes.status=success AND All_Changes.object_category=instance by _time
+  span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed,
+  (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
+  | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction
+  instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1
+  dist=expon show_density=true'
+how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
+  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+  installed, along with any required dependencies. Depending on the number of users
+  in your environment, you may also need to adjust the value for max_inputs in the
+  MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+  in a reasonable timeframe. By default, the search builds the model using the past
+  30 days of data. You can modify the search window to build the model over a longer
+  period of time, which may give you better results. You may also want to periodically
+  re-run this search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: David Dorsey, Splunk
-search: '| tstats count as instances_destroyed from datamodel=Change where
-   All_Changes.action=deleted
-   AND All_Changes.status=success AND All_Changes.object_category=instance
-   by _time span=1h
-   | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001)
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-   | table _time instances_destroyed, HourOfDay, isWeekend
-   | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Instance Activities
   - Cloud Cryptomining
+  deployments:
+  - Weekly Model Rebuild 90 Day Lookback
   detections:
   - Abnormally High Number Of Cloud Instances Destroyed
-  deployments:
-  - Weekly Model Rebuild 90 Day Lookback
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_cloud_instances_launched.yml

@@ -2,37 +2,45 @@ name: Baseline Of Cloud Instances Launched
 id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
 version: 1
 date: '2020-08-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many instances are created in the environment. By default, the search uses
   the last 90 days of data to build the model and the model is rebuilt weekly. The
   model created by this search is then used in the corresponding detection search,
-  which identifies subsequent outliers in the number of instances created in a 
-  small time window.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
-  to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
-  along with any required dependencies. Depending on the number of users in your environment,
-  you may also need to adjust the value for max_inputs in the MLTK settings for the
-  DensityFunction algorithm, then ensure that the search completes in a reasonable
-  timeframe. By default, the search builds the model using the past 90 days of data.
-  You can modify the search window to build the model over a longer period of time,
-  which may give you better results. You may also want to periodically re-run this
-  search to rebuild the model with the latest data.\
+  which identifies subsequent outliers in the number of instances created in a small
+  time window.
+search: '| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created)
+  AND All_Changes.status=success AND All_Changes.object_category=instance by _time
+  span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
+  (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
+  | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
+  instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
+  dist=expon show_density=true'
+how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
+  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+  installed, along with any required dependencies. Depending on the number of users
+  in your environment, you may also need to adjust the value for max_inputs in the
+  MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+  in a reasonable timeframe. By default, the search builds the model using the past
+  90 days of data. You can modify the search window to build the model over a longer
+  period of time, which may give you better results. You may also want to periodically
+  re-run this search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: David Dorsey, Splunk
-search: '| tstats count as instances_launched from datamodel=Change where
-   (All_Changes.action=created)
-   AND All_Changes.status=success AND All_Changes.object_category=instance
-   by _time span=1h
-   | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001)
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-   | table _time instances_launched, HourOfDay, isWeekend
-   | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
   - Suspicious Cloud Instance Activities
-  detections:
-  - Abnormally High Number Of Cloud Instances Launched
   deployments:
   - Weekly Model Rebuild 90 Day Lookback
+  detections:
+  - Abnormally High Number Of Cloud Instances Launched
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_cloud_security_group_api_calls_per_user.yml

@@ -2,33 +2,41 @@ name: Baseline Of Cloud Security Group API Calls Per User
 id: 67b84d51-8329-4909-849f-8d38ce54260a
 version: 1
 date: '2020-09-07'
-description: This search is used to build a Machine Learning Toolkit (MLTK) model
-  for how many API calls for security groups are performed by each user. By default, the search uses
-  the last 90 days of data to build the model and the model is rebuilt weekly.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
-  to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
-  along with any required dependencies. Depending on the number of users in your environment,
-  you may also need to adjust the value for max_inputs in the MLTK settings for the
-  DensityFunction algorithm, then ensure that the search completes in a reasonable
-  timeframe. By default, the search builds the model using the past 90 days of data.
-  You can modify the search window to build the model over a longer period of time,
-  which may give you better results. You may also want to periodically re-run this
-  search to rebuild the model with the latest data.'
 author: David Dorsey, Splunk
-search: '| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h 
-| `drop_dm_object_name("All_Changes")` 
-| eval HourOfDay=strftime(_time, "%H") 
-| eval HourOfDay=floor(HourOfDay/4)*4 
-| eval DayOfWeek=strftime(_time, "%w") 
-| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
-| table _time security_group_api_calls, user, HourOfDay, isWeekend 
-| eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend 
-| where security_group_api_calls >= 1 
-| fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true'
+type: batch
+datamodel:
+- Change
+description: This search is used to build a Machine Learning Toolkit (MLTK) model
+  for how many API calls for security groups are performed by each user. By default,
+  the search uses the last 90 days of data to build the model and the model is rebuilt
+  weekly.
+search: '| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall
+  All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend |
+  eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay,
+  isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls
+  by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm
+  show_density=true'
+how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
+  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+  installed, along with any required dependencies. Depending on the number of users
+  in your environment, you may also need to adjust the value for max_inputs in the
+  MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+  in a reasonable timeframe. By default, the search builds the model using the past
+  90 days of data. You can modify the search window to build the model over a longer
+  period of time, which may give you better results. You may also want to periodically
+  re-run this search to rebuild the model with the latest data.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud User Activities
+  deployments:
+  - Weekly Model Rebuild 90 Day Lookback
   detections:
   - Abnormally High Number Of Cloud Security Group API Calls
-  deployments:
-  - Weekly Model Rebuild 90 Day Lookback
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_command_line_length___mltk.yml

@@ -2,11 +2,19 @@ name: Baseline of Command Line Length - MLTK
 id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
 version: 1
 date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the length of the command lines observed for each user in the environment.
   By default, the search uses the last 30 days of data to build the model. The model
   created by this search is then used in the corresponding detection search, which
   identifies outliers in the length of the command line.
+search: '| tstats `security_content_summariesonly` count min(_time) as start_time
+  max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
+  Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
+  user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
+  eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
 how_to_implement: You must be ingesting endpoint data and populating the Endpoint
   data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
   >= 4.2 installed, along with any required dependencies. Depending on the number
@@ -17,14 +25,9 @@ how_to_implement: You must be ingesting endpoint data and populating the Endpoin
   a longer period of time, which may give you better results. You may also want to
   periodically re-run this search to rebuild the model with the latest data. More
   information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as start_time
-  max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
-  Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
-  user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
-  eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
   - Ransomware
   - Suspicious Command-Line Executions
@@ -33,3 +36,7 @@ tags:
   detections:
   - Detect Prohibited Applications Spawning cmd.exe
   - Unusually Long Command Line - MLTK
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_dns_query_length___mltk.yml

@@ -2,11 +2,19 @@ name: Baseline of DNS Query Length - MLTK
 id: c914844c-0ff5-4efc-8d44-c063443129ba
 version: 1
 date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Network_Resolution
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the length of the DNS queries for each DNS record type observed
   in the environment. By default, the search uses the last 30 days of data to build
   the model. The model created by this search is then used in the corresponding detection
   search, which uses it to identify outliers in the length of the DNS query.
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
+  by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")`
+  | eval query_length = len(query) | fit DensityFunction query_length by record_type
+  into dns_query_pdfmodel'
 how_to_implement: To successfully implement this search, you will need to ensure that
   DNS data is populating the Network_Resolution data model. In addition, you must
   have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any
@@ -15,15 +23,15 @@ how_to_implement: To successfully implement this search, you will need to ensure
   period of time, which may give you better results. You may also want to periodically
   re-run this search to rebuild the model with the latest data. More information on
   the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
-  by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")`
-  | eval query_length = len(query) | fit DensityFunction query_length by record_type
-  into dns_query_pdfmodel'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Command and Control
   - Hidden Cobra Malware
   - Suspicious DNS Traffic
   detections:
   - DNS Query Length Outliers - MLTK
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml

@@ -2,11 +2,17 @@ name: Baseline of Excessive AWS Instances Launched by User - MLTK
 id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
 version: 1
 date: '2019-11-14'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many RunInstances users do in the environment. By default, the search uses
   the last 90 days of data to build the model. The model created by this search is
   then used in the corresponding detection search, which identifies subsequent outliers
   in the number of RunInstances performed by a user in a small time window.
+search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
+  | bucket span=10m _time | stats count as instances_launched by _time src_user |
+  fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs.\
@@ -21,13 +27,14 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
   search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: Jason Brewer, Splunk
-search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
-  | bucket span=10m _time | stats count as instances_launched by _time src_user |
-  fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Cryptomining
   - Suspicious AWS EC2 Activities
   detections:
   - Abnormally High AWS Instances Launched by User - MLTK
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml

@@ -2,12 +2,18 @@ name: Baseline of Excessive AWS Instances Terminated by User - MLTK
 id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
 version: 1
 date: '2019-11-14'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many TerminateInstances users do in the environment. By default, the search
   uses the last 90 days of data to build the model. The model created by this search
   is then used in the corresponding detection search, which identifies subsequent
   outliers in the number of TerminateInstances performed by a user in a small time
   window.
+search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
+  | bucket span=10m _time | stats count as instances_terminated by _time src_user
+  | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs.\
@@ -22,12 +28,13 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
   search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: Jason Brewer, Splunk
-search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
-  | bucket span=10m _time | stats count as instances_terminated by _time src_user
-  | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious AWS EC2 Activities
   detections:
   - Abnormally High AWS Instances Terminated by User - MLTK
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_network_acl_activity_by_arn.yml

@@ -2,22 +2,29 @@ name: Baseline of Network ACL Activity by ARN
 id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
 version: 1
 date: '2018-05-21'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls that were related to network ACLs made by each
   user. Also recorded is the number of data points for each user. This table is then
   outputted to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
-author: Bhavin Patel, Splunk
 search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn
   | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
   as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
   stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
   avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
   count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Network ACL Activity
   detections:
   - Detect Spike in Network ACL Activity
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml

@@ -2,21 +2,28 @@ name: Baseline of S3 Bucket deletion activity by ARN
 id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
 version: 1
 date: '2018-07-17'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and standard
   deviation for the number of API calls related to deleting an S3 bucket by each user.
   Also recorded is the number of data points for each user. This table is then outputted
   to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-author: Bhavin Patel, Splunk
 search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn
   | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
   as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
   stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
   avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious AWS S3 Activities
   detections:
   - Detect Spike in S3 Bucket deletion
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_security_group_activity_by_arn.yml

@@ -2,22 +2,29 @@ name: Baseline of Security Group Activity by ARN
 id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
 version: 1
 date: '2018-04-17'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation for the number of API calls related to security groups made by each user.
   Also recorded is the number of data points for each user. This table is then outputted
   to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
-author: Bhavin Patel, Splunk
 search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn
   | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
   as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
   stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
   avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats
   count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS User Monitoring
   detections:
   - Detect Spike in Security Group Activity
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/baseline_of_smb_traffic___mltk.yml

@@ -2,12 +2,21 @@ name: Baseline of SMB Traffic - MLTK
 id: df98763b-0b08-4281-8ef9-08db7ac572a9
 version: 1
 date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   to characterize the number of SMB connections observed each hour for every day of
   week. By default, the search uses the last 30 days of data to build the model. The
   model created by this search is then used in the corresponding detection search
   to identify outliers in the number of SMB connections for that hour and day of the
   week.
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
+  where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb
+  by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval
+  DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction
+  count by "HourOfDay,DayOfWeek" into smb_pdfmodel'
 how_to_implement: You must be ingesting network traffic and populating the Network_Traffic
   data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
   >= 4.2 installed, along with any required dependencies. To improve your results,
@@ -21,14 +30,9 @@ how_to_implement: You must be ingesting network traffic and populating the Netwo
   which may give you better results. You may also want to periodically re-run this
   search to rebuild the model with the latest data. More information on the algorithm
   used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
-  where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb
-  by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval
-  DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction
-  count by "HourOfDay,DayOfWeek" into smb_pdfmodel'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - DHS Report TA18-074A
   - Disabling Security Tools
   - 'Emotet Malware  DHS Report TA18-201A '
@@ -38,3 +42,7 @@ tags:
   detections:
   - Processes launching netsh
   - SMB Traffic Spike - MLTK
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/count_of_assets_by_category.yml

@@ -2,18 +2,25 @@ name: Count of assets by category
 id: dcfd6b40-42f9-469d-a433-2e53f7489ff9
 version: 1
 date: '2017-09-13'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search shows you every asset category you have and the assets that
   belong to those categories.
+search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
+  by category | sort -count'
 how_to_implement: To successfully implement this search you must first leverage the
   Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv
   file which should then be mapped to the Identity_Management data model. The Identity_Management
   data model will contain a list of known authorized company assets. Ensure that all
   inventoried systems are constantly vetted and updated.
-author: Bhavin Patel, Splunk
-search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
-  by category | sort -count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Asset Tracking
   detections:
   - Detect Unauthorized Assets by MAC address
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/count_of_unique_ips_connecting_to_ports.yml

@@ -2,12 +2,20 @@ name: Count of Unique IPs Connecting to Ports
 id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f
 version: 1
 date: '2017-09-13'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: The search counts the number of times a connection was observed to each
   destination port, and the number of unique source IPs connecting to them.
-how_to_implement: To successfully implement this search, you must be ingesting network
-  traffic, and populating the Network_Traffic data model.
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts
   from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
   | sort - count'
-tags: {}
+how_to_implement: To successfully implement this search, you must be ingesting network
+  traffic, and populating the Network_Traffic data model.
+references: []
+tags:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/create_a_list_of_approved_aws_service_accounts.yml

@@ -2,20 +2,27 @@ name: Create a list of approved AWS service accounts
 id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
 version: 2
 date: '2018-12-03'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for successful API activity in CloudTrail within the
   last 30 days, filters out known users from the identity table, and outputs values
   of users into `aws_service_accounts.csv` lookup file.
+search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
+  [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
+  | table identity | outputlookup aws_service_accounts | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs. Please validate the service account entires in `aws_service_accounts.csv`,
   which is a lookup file created as a result of running this support search. Please
   remove the entries of service accounts that are not legitimate.
-author: Bhavin Patel, Splunk
-search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
-  [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
-  | table identity | outputlookup aws_service_accounts | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS User Monitoring
   detections:
   - Detect AWS API Activities From Unapproved Accounts
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml

@@ -2,19 +2,26 @@ name: Add Prohibited Processes to Enterprise Security
 id: 251930a5-1451-4428-bb13-eed5775be0ce
 version: 1
 date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search takes the existing interesting process table from ES, filters
   out any existing additions added by ESCU and then updates the table with processes
   identified by ESCU that should be prohibited on your endpoints.
+search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T
+  prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false
+  is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes
+  | stats count'
 how_to_implement: This search should be run on each new install of ESCU.
-author: David Dorsey, Splunk
-search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup
-  append=T prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull
-  value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup
-  prohibited_processes | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - 'Emotet Malware  DHS Report TA18-201A '
   - Monitor for Unauthorized Software
   - SamSam Ransomware
   detections:
   - Prohibited Software On Endpoint
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/discover_dns_records.yml

@@ -2,15 +2,14 @@ name: Discover DNS records
 id: c096f721-8842-42ce-bfc7-74bd8c72b7c3
 version: 1
 date: '2019-02-14'
+author: Jose Hernandez, Splunk
+type: batch
+datamodel:
+- Network_Resolution
 description: The search takes corporate and common cloud provider domains configured
   under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv`
   finds their responses across the last 30 days from data in the `Network_Resolution
   ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup
-how_to_implement: To successfully implement this search, you must be ingesting DNS
-  logs, and populating the Network_Resolution data model. Also make sure that the
-  cim_corporate_web_domains and cim_corporate_email_domains lookups are populated
-  with the domains owned by your corporation
-author: Jose Hernandez, Splunk
 search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv
   | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain,
   "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type)
@@ -19,8 +18,17 @@ search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T ci
   where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"] | makemv
   delim=" " answer |  makemv delim=" " type | sort -count | table count,domain,type,query,answer
   | outputlookup createinapp=true discovered_dns_records'
+how_to_implement: To successfully implement this search, you must be ingesting DNS
+  logs, and populating the Network_Resolution data model. Also make sure that the
+  cim_corporate_web_domains and cim_corporate_email_domains lookups are populated
+  with the domains owned by your corporation
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - DNS Hijacking
   detections:
   - DNS record changed
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/dnstwist_domain_names.yml

@@ -2,20 +2,27 @@ name: DNSTwist Domain Names
 id: 19f7d2ec-6028-4d01-bcdb-bda9a034c17f
 version: 2
 date: '2018-10-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search creates permutations of your existing domains, removes the
   valid domain names and stores them in a specified lookup file so they can be checked
   for in the associated detection searches.
+search: '| dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true"
+  | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count'
 how_to_implement: To successfully implement this search you need to update the file
   called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv`
   and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**.
-author: David Dorsey, Splunk
-search: '| dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true"
-  | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Brand Monitoring
   - Suspicious Emails
   detections:
   - Monitor Email For Brand Abuse
   - Monitor DNS For Brand Abuse
   - Monitor Web Traffic For Brand Abuse
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/identify_systems_creating_remote_desktop_traffic.yml

@@ -2,12 +2,20 @@ name: Identify Systems Creating Remote Desktop Traffic
 id: 5cdda34f-4caf-4128-a713-0837fc48b67a
 version: 1
 date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: This search counts the numbers of times the system has generated remote
   desktop traffic.
-how_to_implement: To successfully implement this search, you must ingest network traffic
-  and populate the Network_Traffic data model.
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
   where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")`
   | sort - count'
-tags: {}
+how_to_implement: To successfully implement this search, you must ingest network traffic
+  and populate the Network_Traffic data model.
+references: []
+tags:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/identify_systems_receiving_remote_desktop_traffic.yml

@@ -2,13 +2,21 @@ name: Identify Systems Receiving Remote Desktop Traffic
 id: baaeea15-fe8a-4090-92c2-5b60943bb608
 version: 1
 date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: This search counts the numbers of times the system has created remote
   desktop traffic
-how_to_implement: To successfully implement this search you must ingest network traffic
-  and populate the Network_Traffic data model. If a system receives a lot of remote
-  desktop traffic, you can apply the category common_rdp_destination to it.
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
   where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")`
   | sort - count'
-tags: {}
+how_to_implement: To successfully implement this search you must ingest network traffic
+  and populate the Network_Traffic data model. If a system receives a lot of remote
+  desktop traffic, you can apply the category common_rdp_destination to it.
+references: []
+tags:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/identify_systems_using_remote_desktop.yml

@@ -2,12 +2,20 @@ name: Identify Systems Using Remote Desktop
 id: 063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8
 version: 1
 date: '2019-04-01'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search counts the numbers of times the remote desktop process, mstsc.exe,
   has run on each system.
-how_to_implement: To successfully implement this search you must be ingesting endpoint
-  data that records process activity.
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
   where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name
   | `drop_dm_object_name(Processes)` | sort - count'
-tags: {}
+how_to_implement: To successfully implement this search you must be ingesting endpoint
+  data that records process activity.
+references: []
+tags:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/monitor_successful_backups.yml

@@ -2,17 +2,24 @@ name: Monitor Successful Backups
 id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e
 version: 1
 date: '2017-09-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often successful backups
   are conducted in your environment. Fluctuations in these numbers will allow you
   to determine when you should investigate.
-how_to_implement: To successfully implement this search you must be ingesting your
-  backup logs.
-author: David Dorsey, Splunk
 search: '`netbackup` "Disk/Partition backup completed successfully." | bucket _time
   span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time,
   MESSAGE'
+how_to_implement: To successfully implement this search you must be ingesting your
+  backup logs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Monitor Backup Solution
   detections:
   - Unsuccessful Netbackup backups
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/monitor_unsuccessful_backups.yml

@@ -2,16 +2,23 @@ name: Monitor Unsuccessful Backups
 id: b2178fed-592f-492b-b851-74161678aa56
 version: 1
 date: '2017-09-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often backup failures
   happen in your environments.  Fluctuations in these numbers will allow you to determine
   when you should investigate.
-how_to_implement: To successfully implement this search you must be ingesting your
-  backup logs.
-author: David Dorsey, Splunk
 search: '`netbackup` "An error occurred, failed to backup." | bucket _time span=1d
   | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE'
+how_to_implement: To successfully implement this search you must be ingesting your
+  backup logs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Monitor Backup Solution
   detections:
   - Unsuccessful Netbackup backups
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml

@@ -2,21 +2,28 @@ name: Previously seen API call per user roles in CloudTrail
 id: fc0edc95-fq2c-48b0-9f6f-63da3289fd03
 version: 1
 date: '2018-04-16'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for successful API calls made by different user roles,
   then creates a baseline of the earliest and latest times we have encountered this
   user role. It also returns the name of the API call in our dataset--grouped by user
   role and name of the API call--that occurred within the last 30 days. In this support
   search, we are only looking for events where the user identity is Assumed Role.
+search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole
+  | stats earliest(_time) as earliest latest(_time) as latest by userName eventName
+  | outputlookup previously_seen_api_calls_from_user_roles | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`,
   which is a lookup file created as a result of running this support search.
-author: Bhavin Patel, Splunk
-search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole
-  | stats earliest(_time) as earliest latest(_time) as latest by userName eventName
-  | outputlookup previously_seen_api_calls_from_user_roles | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS User Monitoring
   detections:
   - Detect new API calls from user roles
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_aws_cross_account_activity.yml

@@ -2,21 +2,28 @@ name: Previously Seen AWS Cross Account Activity
 id: 1cc22b09-c867-416e-a511-cb36ac44aee2
 version: 1
 date: '2018-06-04'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search looks for **AssumeRole** events where the requesting account
   differs from the requested account, then writes these relationships to a lookup
   file.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
-  a lookup file created by this support search.
-author: David Dorsey, Splunk
 search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
   | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
   | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime
   latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup
   previously_seen_aws_cross_account_activity | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
+  a lookup file created by this support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Cross Account Activity
   detections:
   - AWS Cross Account Activity From Previously Unseen Account
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_aws_cross_account_activity_initial.yml

@@ -2,18 +2,34 @@ name: Previously Seen AWS Cross Account Activity - Initial
 id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
 version: 1
 date: '2020-08-15'
-description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
 author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role 
-|  `drop_dm_object_name(Authentication)`
-| rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):"
-|  where  vendor_account != dest_account
-| rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity'
+type: batch
+datamodel:
+- Authentication
+description: This search looks for **AssumeRole** events where the requesting account
+  differs from the requested account, then writes these relationships to a lookup
+  file.
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
+  Authentication.src Authentication.user_role |  `drop_dm_object_name(Authentication)`
+  | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" |  where  vendor_account
+  != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId
+  | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup
+  previously_seen_aws_cross_account_activity'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later)and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
-  - Suspicious Cloud Authentication Activities 
-  detections:
-  - AWS Cross Account Activity From Previously Unseen Account 
+  analytic_story:
+  - Suspicious Cloud Authentication Activities
   deployments:
   - 90 Day Baseline
+  detections:
+  - AWS Cross Account Activity From Previously Unseen Account
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_aws_cross_account_activity_update.yml

@@ -2,26 +2,35 @@ name: Previously Seen AWS Cross Account Activity - Update
 id: dd6fb3a9-4906-48cb-8626-c88a25a056c3
 version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for **AssumeRole** events where the requesting account
   differs from the requested account, then writes these relationships to a lookup
   file.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
-  and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
-  a lookup file created by this support search.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role 
-| `drop_dm_object_name(Authentication)` 
-| rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" 
-| where vendor_account != dest_account 
-| rename vendor_account as requestingAccountId dest_account as requestedAccountId 
-| inputlookup append=t previously_seen_aws_cross_account_activity 
-| stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId 
-| outputlookup previously_seen_aws_cross_account_activity'
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
+  Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
+  | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account
+  != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId
+  | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime)
+  as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId
+  | outputlookup previously_seen_aws_cross_account_activity'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
-  - Suspicious Cloud Authentication Activities 
-  detections:
-  - AWS Cross Account Activity From Previously Unseen Account
+  analytic_story:
+  - Suspicious Cloud Authentication Activities
   deployments:
   - Daily Cache Updates
-
+  detections:
+  - AWS Cross Account Activity From Previously Unseen Account
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_aws_provisioning_activity_sources.yml

@@ -2,22 +2,29 @@ name: Previously Seen AWS Provisioning Activity Sources
 id: ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee
 version: 1
 date: '2018-03-16'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of the first and last times seen for every
   IP address (along with its physical location) previously associated with cloud-provisioning
   activity. This is broadly defined as any event that runs or creates something.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.
-author: David Dorsey, Splunk
 search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress
   | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress,
   City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv
   | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Suspicious Provisioning Activities
   detections:
   - AWS Cloud Provisioning From Previously Unseen IP Address
   - AWS Cloud Provisioning From Previously Unseen City
   - AWS Cloud Provisioning From Previously Unseen Country
   - AWS Cloud Provisioning From Previously Unseen Region
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_aws_regions.yml

@@ -2,19 +2,26 @@ name: Previously Seen AWS Regions
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63
 version: 1
 date: '2018-01-08'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for CloudTrail events where an AWS instance is started
   and creates a baseline of most recent time (latest) and the first time (earliest)
   we've seen this region in our dataset grouped by the value awsRegion for the last
   30 days
+search: '`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time)
+  as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs.
-author: Bhavin Patel, Splunk
-search: '`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time)
-  as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Cryptomining
   - Suspicious AWS EC2 Activities
   detections:
   - EC2 Instance Started In Previously Unseen Region
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml

@@ -2,22 +2,30 @@ name: Previously Seen Cloud API Calls Per User Role - Initial
 id: 69d75f4b-b794-4a66-a777-730357b886b4
 version: 1
 date: '2020-09-03'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of the first and last times seen for every
   user role and command combination. This is broadly defined as any event that runs
   or creates something. This table is then cached.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider.
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change 
-  where All_Changes.user_type=AssumedRole AND All_Changes.status=success
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success
   by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
-  | eventstats min(firstTimeSeen) as globalFirstTime
-  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-  | table user, command, firstTimeSeen, lastTimeSeen, enough_data
-  | outputlookup previously_seen_cloud_api_calls_per_user_role'
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
+  enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud User Activities
-  detections:
-  - Cloud API Calls From Previously Unseen User Roles
   deployments:
   - 90 Day Baseline
+  detections:
+  - Cloud API Calls From Previously Unseen User Roles
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_api_calls_per_user_role_update.yml

@@ -2,25 +2,32 @@ name: Previously Seen Cloud API Calls Per User Role - Update
 id: c4b760a0-6a97-47e9-b089-8ae9e57f210e
 version: 1
 date: '2020-09-03'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search updates the table of the first and last times seen for every
   user role and command combination.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider.
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change 
-  where All_Changes.user_type=AssumedRole AND All_Changes.status=success
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success
   by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
-  | table user, command, firstTimeSeen, lastTimeSeen
-  | inputlookup previously_seen_cloud_api_calls_per_user_role append=t
-  | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command
-  | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`)
-  | eventstats min(firstTimeSeen) as globalFirstTime
-  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-  | table user, command, firstTimeSeen, lastTimeSeen, enough_data
-  | outputlookup previously_seen_cloud_api_calls_per_user_role'
+  | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role
+  append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
+  by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`)
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
+  enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud User Activities
-  detections:
-  - Cloud API Calls From Previously Unseen User Roles
   deployments:
   - Daily Cache Updates
+  detections:
+  - Cloud API Calls From Previously Unseen User Roles
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_compute_creations_by_user_initial.yml

@@ -2,21 +2,27 @@ name: Previously Seen Cloud Compute Creations By User - Initial
 id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
 version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen users that have launched
   a cloud compute instance.
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance
+  by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user
+  | stats count'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the proper TAs installed.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=created AND All_Changes.object_category=instance 
-    by All_Changes.user 
-| `drop_dm_object_name("All_Changes")` 
-| outputlookup previously_seen_cloud_compute_creations_by_user 
-| stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created By Previously Unseen User
   deployments:
   - Hourly Cache Updates
+  detections:
+  - Cloud Compute Instance Created By Previously Unseen User
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_compute_creations_by_user_update.yml

@@ -2,24 +2,30 @@ name: Previously Seen Cloud Compute Creations By User - Update
 id: 6bf75d69-7766-47bc-8097-e41696807a6f
 version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen users that have launched
   a cloud compute instance.
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance
+  by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t
+  previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen
+  max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(),
+  "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data
+  = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the proper TAs installed.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=created AND All_Changes.object_category=instance 
-    by All_Changes.user| `drop_dm_object_name("All_Changes")` 
-| inputlookup append=t previously_seen_cloud_compute_creations_by_user 
-| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user 
-| where lastTimeSeen > relative_time(now(), "-90d@d") 
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-| outputlookup previously_seen_cloud_compute_creations_by_user'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
+  deployments:
+  - Daily Cache Updates
   detections:
   - Cloud Compute Instance Created By Previously Unseen User
-  deployments:
-  - Daily Cache Updates
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_compute_images_initial.yml

@@ -2,22 +2,29 @@ name: Previously Seen Cloud Compute Images - Initial
 id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
 version: 1
 date: '2020-10-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen images used to launch cloud
   compute instances
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created  by All_Changes.Instance_Changes.image_id
+  | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
+  | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime
+  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
+  | outputlookup previously_seen_cloud_compute_images'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the latest Change Datamodel accelerated
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created  by All_Changes.Instance_Changes.image_id 
-| `drop_dm_object_name("All_Changes")` 
-| `drop_dm_object_name("Instance_Changes")` 
-| where image_id != "unknown"
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
-| outputlookup previously_seen_cloud_compute_images'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created With Previously Unseen Image
   deployments:
   - 90 Day Baseline
+  detections:
+  - Cloud Compute Instance Created With Previously Unseen Image
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_compute_images_update.yml

@@ -2,25 +2,30 @@ name: Previously Seen Cloud Compute Images - Update
 id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184
 version: 1
 date: '2020-08-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen images used to launch cloud
   compute instances
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id
+  | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
+  | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images
+  | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by
+  image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`)
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=created by All_Changes.Instance_Changes.image_id 
-| `drop_dm_object_name("All_Changes")` 
-| `drop_dm_object_name("Instance_Changes")` 
-| where image_id != "unknown" 
-| inputlookup append=t previously_seen_cloud_compute_images 
-| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id 
-| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) 
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-| outputlookup previously_seen_cloud_compute_images'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created With Previously Unseen Image
   deployments:
   - Daily Cache Updates
+  detections:
+  - Cloud Compute Instance Created With Previously Unseen Image
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_compute_instance_types_initial.yml

@@ -1,25 +1,29 @@
 name: Previously Seen Cloud Compute Instance Types - Initial
 id: 3c78025c-1ffe-4976-a640-75ef604842be
 version: 1
-date: '2020-9-03'
+date: 2020-9-03
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen cloud compute instance
   types
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type
+  | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type !=
+  "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data
+  = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the Security Research cloud data model installed.
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=created 
-    by All_Changes.Instance_Changes.instance_type 
-| `drop_dm_object_name("All_Changes.Instance_Changes")` 
-| where instance_type != "unknown"
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) 
-| outputlookup previously_seen_cloud_compute_instance_types'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created With Previously Unseen Instance Type
   deployments:
   - 90 Day Baseline
-
+  detections:
+  - Cloud Compute Instance Created With Previously Unseen Instance Type
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_compute_instance_types_update.yml

@@ -1,26 +1,31 @@
 name: Previously Seen Cloud Compute Instance Types - Update
 id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c
 version: 1
-date: '2020-9-03'
+date: 2020-9-03
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen cloud compute instance
   types
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type
+  | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type !=
+  "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types |
+  stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type
+  | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`)
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=created 
-    by All_Changes.Instance_Changes.instance_type 
-| `drop_dm_object_name("All_Changes.Instance_Changes")` 
-| where instance_type != "unknown"
-| inputlookup append=t previously_seen_cloud_compute_instance_types 
-| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type 
-| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) 
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) 
-| outputlookup previously_seen_cloud_compute_instance_types'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created With Previously Unseen Instance Type
   deployments:
   - Daily Cache Updates
+  detections:
+  - Cloud Compute Instance Created With Previously Unseen Instance Type
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml

@@ -2,21 +2,28 @@ name: Previously Seen Cloud Instance Modifications By User - Initial
 id: f36dc403-739d-42f3-83a3-49237d8654c5
 version: 1
 date: '2020-07-29'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen users that have modified
   a cloud instance.
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user 
-| `drop_dm_object_name("All_Changes")` 
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-| outputlookup previously_seen_cloud_instance_modifications_by_user'
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
+  All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the latest Change Datamodel accelerated.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Instance Activities
-  detections:
-  - Cloud Instance Modified By Previously Unseen User
   deployments:
   - 90 Day Baseline
-
+  detections:
+  - Cloud Instance Modified By Previously Unseen User
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_instance_modifications_by_user_update.yml

@@ -2,25 +2,32 @@ name: Previously Seen Cloud Instance Modifications By User - Update
 id: 534b7d30-7b0c-4510-8f55-65439850d58d
 version: 1
 date: '2020-07-29'
-description: This search updates a table of previously seen Cloud Instance modifications that have been made by a user
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
+description: This search updates a table of previously seen Cloud Instance modifications
+  that have been made by a user
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
+  All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
+  | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats
+  min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user |
+  where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`)
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-    where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success
-    by All_Changes.user 
-| `drop_dm_object_name("All_Changes")` 
-| inputlookup append=t previously_seen_cloud_instance_modifications_by_user 
-| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user
-| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) 
-| eventstats min(firstTimeSeen) as globalFirstTime 
-| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-| outputlookup previously_seen_cloud_instance_modifications_by_user'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Instance Activities
-  detections:
-  - Cloud Instance Modified By Previously Unseen User
   deployments:
   - Daily Cache Updates
+  detections:
+  - Cloud Instance Modified By Previously Unseen User
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml

@@ -2,27 +2,35 @@ name: Previously Seen Cloud Provisioning Activity Sources - Initial
 id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7
 version: 1
 date: '2020-08-19'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of the first and last times seen for every
   IP address (along with its physical location) previously associated with cloud-provisioning
-  activity. This is broadly defined as any event that runs or creates something. This table is
-  then cached.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change 
-  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success 
-  by All_Changes.src | `drop_dm_object_name("All_Changes")`
-  | iplocation src | where isnotnull(Country)
-  | eventstats min(firstTimeSeen) as globalFirstTime
-  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
-  | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data
-  | outputlookup previously_seen_cloud_provisioning_activity_sources'
+  activity. This is broadly defined as any event that runs or creates something. This
+  table is then cached.
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created)
+  All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")`
+  | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime
+  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
+  | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup
+  previously_seen_cloud_provisioning_activity_sources'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Provisioning Activities
+  deployments:
+  - 90 Day Baseline
   detections:
   - Cloud Provisioning Activity From Previously Unseen IP Address
   - Cloud Provisioning Activity From Previously Unseen City
   - Cloud Provisioning Activity From Previously Unseen Country
   - Cloud Provisioning Activity From Previously Unseen Region
-  deployments:
-  - 90 Day Baseline
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_provisioning_activity_sources_update.yml

@@ -2,32 +2,40 @@ name: Previously Seen Cloud Provisioning Activity Sources - Update
 id: 9830abb9-be80-4563-b232-09bf1f628cf3
 version: 1
 date: '2020-08-20'
-description: This returns the first and last times seen for every
-  IP address (along with its physical location) previously associated with cloud-provisioning
-  activity within the last day. Cloud provisioning is broadly defined as any event that runs or
-  creates something.  It then updates this information with historical data and filters out locations
-  that have not been seen within the specified time window. This updated table is then cached.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider.
 author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change 
-  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success 
-  by All_Changes.src | `drop_dm_object_name("All_Changes")`
-  | iplocation src | where isnotnull(Country)
-  | table src, firstTimeSeen, lastTimeSeen, City, Country, Region 
-  | inputlookup previously_seen_cloud_provisioning_activity_sources append=t
-  | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region
-  | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`)
-  | eventstats min(firstTimeSeen) as globalFirstTime
-  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
-  | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data
-  | outputlookup previously_seen_cloud_provisioning_activity_sources'
+type: batch
+datamodel:
+- Change
+description: This returns the first and last times seen for every IP address (along
+  with its physical location) previously associated with cloud-provisioning activity
+  within the last day. Cloud provisioning is broadly defined as any event that runs
+  or creates something.  It then updates this information with historical data and
+  filters out locations that have not been seen within the specified time window.
+  This updated table is then cached.
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created)
+  All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")`
+  | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen,
+  City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources
+  append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
+  by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`)
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen,
+  lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Provisioning Activities
+  deployments:
+  - Daily Cache Updates
   detections:
   - Cloud Provisioning Activity From Previously Unseen IP Address
   - Cloud Provisioning Activity From Previously Unseen City
   - Cloud Provisioning Activity From Previously Unseen Country
   - Cloud Provisioning Activity From Previously Unseen Region
-  deployments:
-  - Daily Cache Updates
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_regions_initial.yml

@@ -2,24 +2,30 @@ name: Previously Seen Cloud Regions - Initial
 id: b5e232db-dec6-4db8-aaa1-dd5474521e40
 version: 1
 date: '2020-09-02'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search looks for cloud compute events where a compute instance is
   started and creates a baseline of most recent time, `lastTime` and the first time
   `firstTime` we've seen this region in our dataset grouped by the region for the
   last 30 days
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the Security Research cloud data model installed.
-author: David Dorsey, Splunk
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-  where All_Changes.action=created by All_Changes.vendor_region
-  | `drop_dm_object_name("All_Changes")` 
-  | eventstats min(firstTimeSeen) as globalFirstTime
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region
+  | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime
   | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0)
   | outputlookup previously_seen_cloud_regions'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the Security Research cloud data model installed.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created In Previously Unused Region
   deployments:
   - 90 Day Baseline
-
+  detections:
+  - Cloud Compute Instance Created In Previously Unused Region
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_cloud_regions_update.yml

@@ -2,29 +2,33 @@ name: Previously Seen Cloud Regions - Update
 id: 512f928a-a461-41b4-8984-db4dd2c472e4
 version: 1
 date: '2020-09-02'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search looks for cloud compute events where a compute instance is
   started and creates a baseline of most recent time, `lastTime` and the first time
   `firstTime` we've seen this region in our dataset grouped by the region for the
   last 30 days
+search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
+  from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region
+  | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions
+  | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by
+  vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`)
+  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
+  <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions
+  | stats count'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the Security Research cloud data model installed.
-author: David Dorsey, Splunk
-
-search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change
-  where All_Changes.action=created by All_Changes.vendor_region
-  | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions 
-  | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region
-  | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`)
-  | eventstats min(firstTimeSeen) as globalFirstTime
-  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0)
-  | outputlookup previously_seen_cloud_regions | stats count'
-
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
-  detections:
-  - Cloud Compute Instance Created In Previously Unused Region
   deployments:
   - Daily Cache Updates
-
-
+  detections:
+  - Cloud Compute Instance Created In Previously Unused Region
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_command_line_arguments.yml

@@ -2,20 +2,24 @@ name: Previously seen command line arguments
 id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3
 version: 2
 date: '2019-03-01'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search looks for command-line arguments where `cmd.exe /c` is used
   to execute a program, then creates a baseline of the earliest and latest times we
   have encountered this command-line argument in our dataset within the last 30 days.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must be ingesting
   logs with both the process name and command line from your endpoints. The complete
   process name with command-line arguments are mapped to the "process" field in the
   Endpoint data model.
-author: Bhavin Patel, Splunk
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
-  AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - DHS Report TA18-074A
   - Disabling Security Tools
   - Hidden Cobra Malware
@@ -28,3 +32,7 @@ tags:
   - Detect Prohibited Applications Spawning cmd.exe
   - Processes launching netsh
   - First time seen command line argument
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_ec2_amis.yml

@@ -2,17 +2,24 @@ name: Previously Seen EC2 AMIs
 id: bb1bd99d-1e93-45f1-9571-cfed42d372b9
 version: 1
 date: '2018-03-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of previously seen AMIs used to launch EC2
   instances
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-author: David Dorsey, Splunk
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId
   as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID
   | outputlookup previously_seen_ec2_amis.csv | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Cryptomining
   detections:
   - EC2 Instance Started With Previously Unseen AMI
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_ec2_instance_types.yml

@@ -2,17 +2,24 @@ name: Previously Seen EC2 Instance Types
 id: b8f029f2-65a6-4d76-be98-dad1c9d59c45
 version: 1
 date: '2018-03-08'
-description: This search builds a table of previously seen EC2 instance types
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
 author: David Dorsey, Splunk
+type: batch
+datamodel: []
+description: This search builds a table of previously seen EC2 instance types
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType
   as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time)
   as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv
   | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Cryptomining
   detections:
   - EC2 Instance Started With Previously Unseen Instance Type
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_ec2_launches_by_user.yml

@@ -2,18 +2,25 @@ name: Previously Seen EC2 Launches By User
 id: 6c767ac0-0906-4355-9a83-927f5ee7bdad
 version: 1
 date: '2018-03-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of previously seen ARNs that have launched
   a EC2 instance.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-author: David Dorsey, Splunk
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn
   as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup
   previously_seen_ec2_launches_by_user.csv | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Cryptomining
   - Suspicious AWS EC2 Activities
   detections:
   - EC2 Instance Started With Previously Unseen User
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_ec2_modifications_by_user.yml

@@ -2,17 +2,24 @@ name: Previously Seen EC2 Modifications By User
 id: 4d69091b-d975-4267-85df-888bd41034eb
 version: 1
 date: '2018-04-05'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of previously seen ARNs that have launched
   a EC2 instance.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
-author: David Dorsey, Splunk
 search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn
   userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime
   by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Unusual AWS EC2 Modifications
   detections:
   - EC2 Instance Modified With Previously Unseen User
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_running_windows_services.yml

@@ -2,23 +2,28 @@ name: Previously Seen Running Windows Services - Initial
 id: 64ce0ade-cb01-4678-bddd-d31c0b175394
 version: 3
 date: '2020-06-23'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This collects the services that have been started across your entire
   enterprise.
+search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service>[-\(\)\s\w]+)
+  service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
+  as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services'
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
   you must be ingesting your Windows security-event logs for it to execute successfully.
   Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
-author: David Dorsey, Splunk
-search: '`wineventlog_system` EventCode=7036 |
-    rex field=Message "The (?<service>[-\(\)\s\w]+) service entered the (?<state>\w+) state" |
-    where state="running" |
-    stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service |
-    outputlookup previously_seen_running_windows_services'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Orangeworm Attack Group
   - Windows Service Abuse
   - Sunburst Malware
-  detections:
-  - First Time Seen Running Windows Service
   deployments:
   - 90 Day Baseline
+  detections:
+  - First Time Seen Running Windows Service
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_running_windows_services_update.yml

@@ -2,28 +2,33 @@ name: Previously Seen Running Windows Services - Update
 id: 2e3bdd68-1863-46ee-81f8-87273eee7f1c
 version: 3
 date: '2020-06-23'
-description: This search returns the first and last time a Windows service was seen across your enterprise
-    within the last hour. It then updates this information with historical data and filters out
-    Windows services pairs that have not been seen within the specified time window.
-    This updated table is then cached.
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
+description: This search returns the first and last time a Windows service was seen
+  across your enterprise within the last hour. It then updates this information with
+  historical data and filters out Windows services pairs that have not been seen within
+  the specified time window. This updated table is then cached.
+search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service>[-\(\)\s\w]+)
+  service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
+  as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services
+  append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
+  by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`")
+  | outputlookup previously_seen_running_windows_services'
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
   you must be ingesting your Windows security-event logs for it to execute successfully.
   Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
-author: David Dorsey, Splunk
-search: '`wineventlog_system` EventCode=7036 |
-    rex field=Message "The (?<service>[-\(\)\s\w]+) service entered the (?<state>\w+) state" |
-    where state="running" |
-    stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service |
-    inputlookup previously_seen_running_windows_services append=t |
-    stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service |
-    where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") |
-    outputlookup previously_seen_running_windows_services'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Orangeworm Attack Group
   - Windows Service Abuse
   - Sunburst Malware
-  detections:
-  - First Time Seen Running Windows Service
   deployments:
   - Hourly Cache Updates
+  detections:
+  - First Time Seen Running Windows Service
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_s3_bucket_access_by_remote_ip.yml

@@ -2,20 +2,27 @@ name: Previously seen S3 bucket access by remote IP
 id: fc0edc15-fq2c-48b0-9f6f-63qa1281fd03
 version: 1
 date: '2018-06-28'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for successful access to S3 buckets from remote IP
   addresses, then creates a baseline of the earliest and latest times we have encountered
   this remote IP within the last 30 days. In this support search, we are only looking
   for S3 access events where the HTTP response code from AWS is "200"
+search: '`aws_s3_accesslogs` http_status=200  | stats  earliest(_time) as earliest
+  latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip
+  | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs
   inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`,
   which is a lookup file created as a result of running this support search.
-author: Bhavin Patel, Splunk
-search: '`aws_s3_accesslogs` http_status=200  | stats  earliest(_time) as earliest
-  latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip
-  | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious AWS S3 Activities
   detections:
   - Detect S3 access from a new IP
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_users_in_cloudtrail.yml

@@ -2,24 +2,32 @@ name: Previously seen users in CloudTrail
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd03
 version: 1
 date: '2018-04-30'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search looks for CloudTrail events where a user logs into the console,
   then creates a baseline of the latest and earliest times, City, Region, and Country
   we have encountered this user in our dataset, grouped by ARN, within the last 30
-  days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
-  which is a lookup file created as a result of running this support search.
-author: Jason Brewer, Splunk
+  days. NOTE - This baseline search is deprecated and has been updated to use the
+  Authentication Datamodel
 search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
   src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
   stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region
   Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
+  which is a lookup file created as a result of running this support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious AWS Login Activities
   detections:
   - Detect AWS Console Login by User from New Country
   - Detect AWS Console Login by User from New Region
   - Detect AWS Console Login by User from New City
   - Detect new user AWS Console Login
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_users_in_cloudtrail_initial.yml

@@ -2,27 +2,36 @@ name: Previously Seen Users in CloudTrail - Initial
 id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
 version: 1
 date: '2020-05-28'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events where a user logs into the console,
   then creates a baseline of the latest and earliest times, City, Region, and Country
-  we have encountered this user in our dataset, grouped by username, within the last 30
-  days.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
-  and Enterprise Security 6.2, which contains the required updates to the Authentication data model  
-  for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`,
-  which is a lookup file created by this support search.
-author: Rico Valdez, Splunk
+  we have encountered this user in our dataset, grouped by username, within the last
+  30 days.
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
-  | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src
-  | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count'
+  | iplocation Authentication.src | rename Authentication.user as user Authentication.src
+  as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins
+  | stats count'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_users_console_logins`, which is a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Authentication Activities
+  deployments:
+  - 90 Day Baseline
   detections:
   - Detect AWS Console Login by User from New Country
   - Detect AWS Console Login by User from New Region
   - Detect AWS Console Login by User from New City
   - Detect AWS Console Login by New User
-  deployments:
-  - 90 Day Baseline
-
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_users_in_cloudtrail_update.yml

@@ -2,28 +2,36 @@ name: Previously Seen Users In CloudTrail - Update
 id: 66ff71c2-7e01-47dd-a041-906688c9d322
 version: 1
 date: '2020-05-28'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events where a user logs into the console,
   then updates the baseline of the latest and earliest times, City, Region, and Country
   we have encountered this user in our dataset, grouped by user, within the last hour.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
-  and Enterprise Security 6.2, which contains the required updates to the Authentication data model
-  for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`,
-  which is a lookup file created by this support search.
-author: Rico Valdez, Splunk
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from
-      datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user
-      Authentication.src | iplocation Authentication.src | rename Authentication.user as user
-      Authentication.src as src | table user src City Region Country firstTime lastTime
-      | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as
-      firstTime max(lastTime) as lastTime by user src City Region Country
-      | outputlookup previously_seen_users_console_logins'
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
+  | iplocation Authentication.src | rename Authentication.user as user Authentication.src
+  as src | table user src City Region Country firstTime lastTime | inputlookup append=t
+  previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime)
+  as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_users_console_logins`, which is a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Authentication Activities
+  deployments:
+  - Daily Cache Updates
   detections:
   - Detect AWS Console Login by User from New Country
   - Detect AWS Console Login by User from New Region
   - Detect AWS Console Login by User from New City
   - Detect AWS Console Login by New User
-  deployments:
-  - Daily Cache Updates
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_zoom_child_processes_initial.yml

@@ -2,21 +2,30 @@ name: Previously Seen Zoom Child Processes - Initial
 id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b
 version: 1
 date: '2020-05-20'
-description: This search returns the first and last time a process was seen per endpoint with
-    a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached.
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search returns the first and last time a process was seen per endpoint
+  with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then
+  cached.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time)
+  as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe
+  OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest|
+  `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen
+  | outputlookup zoom_first_time_child_process'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node.
-author: David Dorsey, Splunk
-search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen
-        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
-        by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)`
-        | table dest, process_name, firstTimeSeen, lastTimeSeen
-        | outputlookup zoom_first_time_child_process'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Zoom Child Processes
-  detections:
-  - First Time Seen Child Process of Zoom
   deployments:
   - 90 Day Baseline
+  detections:
+  - First Time Seen Child Process of Zoom
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/previously_seen_zoom_child_processes_update.yml

@@ -2,26 +2,35 @@ name: Previously Seen Zoom Child Processes - Update
 id: 80aea7fd-5da2-4533-b3c2-560533bfbaee
 version: 1
 date: '2020-05-20'
-description: This search returns the first and last time a process was seen per endpoint with
-    a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates
-    this information with historical data and filters out proces_name and endpoint pairs that have not
-    been seen within the specified time window. This updated table is outputed to disk.
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search returns the first and last time a process was seen per endpoint
+  with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour.
+  It then updates this information with historical data and filters out proces_name
+  and endpoint pairs that have not been seen within the specified time window. This
+  updated table is outputed to disk.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time)
+  as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe
+  OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest|
+  `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name,
+  dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen)
+  as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where
+  lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`")
+  | outputlookup zoom_first_time_child_process'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node.
-author: David Dorsey, Splunk
-search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen
-        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
-        by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)`
-        | table firstTimeSeen, lastTimeSeen, process_name, dest
-        | inputlookup zoom_first_time_child_process append=t
-        | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest
-        | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`")
-        | outputlookup zoom_first_time_child_process'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Zoom Child Processes
-  detections:
-  - First Time Seen Child Process of Zoom
   deployments:
   - Hourly Cache Updates
+  detections:
+  - First Time Seen Child Process of Zoom
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/systems_ready_for_spectre_meltdown_windows_patch.yml

@@ -2,22 +2,29 @@ name: Systems Ready for Spectre-Meltdown Windows Patch
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd61
 version: 1
 date: '2018-01-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: Some AV applications can cause the Spectre/Meltdown patch for Windows
   not to install successfully. This registry key is supposed to be created by the
   AV engine when it has been patched to be able to handle the Windows patch. If this
   key has been written, the system can then be patched for Spectre and Meltdown.
-how_to_implement: You need to be ingesting logs with both the process name and command-line
-  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry
   AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*")
   by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object,
   All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `drop_dm_object_name("All_Changes")`'
+how_to_implement: You need to be ingesting logs with both the process name and command-line
+  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Spectre And Meltdown Vulnerabilities
   detections:
   - Spectre and Meltdown Vulnerable Systems
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/update_previously_seen_users_in_cloudtrail.yml

@@ -2,25 +2,34 @@ name: Update previously seen users in CloudTrail
 id: 06c036e6-d6d7-4daa-bd76-411c3d356031
 version: 1
 date: '2018-04-30'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search looks for CloudTrail events where a user logs into the console,
   then updates the baseline of the latest and earliest times, City, Region, and Country
-  we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel
+  we have encountered this user in our dataset, grouped by ARN, within the last hour.
+  NOTE - This baseline search is deprecated and has been updated to use the Authentication
+  Datamodel
+search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
+  src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
+  stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region
+  Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail |
+  stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region
+  Country | outputlookup previously_seen_users_console_logins_cloudtrail'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
   which is a lookup file created as a result of running this support search.
-author: Jason Brewer, Splunk
-search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
-  src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
-  stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region
-  Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats
-  min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country
-  | outputlookup previously_seen_users_console_logins_cloudtrail'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious AWS Login Activities
   detections:
   - Detect AWS Console Login by User from New Country
   - Detect AWS Console Login by User from New Region
   - Detect AWS Console Login by User from New City
   - Detect new user AWS Console Login
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/windows_updates_install_failures.yml

@@ -2,12 +2,19 @@ name: Windows Updates Install Failures
 id: 6a4dbd1b-4502-4a11-943a-82b5ae7a42d7
 version: 1
 date: '2017-09-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often Windows updates
   fail to install in your environment. Fluctuations in these numbers will allow you
   to determine when you should be concerned.
-how_to_implement: You must be ingesting your Windows Update Logs
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM
   datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure
   by _time span=1d'
-tags: {}
+how_to_implement: You must be ingesting your Windows Update Logs
+references: []
+tags:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

baselines/windows_updates_install_successes.yml

@@ -2,12 +2,19 @@ name: Windows Updates Install Successes
 id: 6a80535c-86a6-4b54-894c-4b446d0c701d
 version: 1
 date: '2017-09-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often successful Windows
   updates are applied in your environments. Fluctuations in these numbers will allow
   you to determine when you should be concerned.
-how_to_implement: You must be ingesting your Windows Update Logs
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM
   datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed
   by _time span=1d'
-tags: {}
+how_to_implement: You must be ingesting your Windows Update Logs
+references: []
+tags:
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

bin/doc-gen.py

@@ -37,8 +37,8 @@ def prepare_content(stories, detections):
     sto_to_nists = {}
     sto_to_det = {}
     for detection in detections:
-        if 'analytics_story' in detection['tags']:
-            for story in detection['tags']['analytics_story']:
+        if 'analytic_story' in detection['tags']:
+            for story in detection['tags']['analytic_story']:
                 if story in sto_to_det.keys():
                     sto_to_det[story].add(detection['name'])
                 else:

bin/generate.py

@@ -105,7 +105,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
         # we are duplicating the code block above for now and just changing variable names to make future
         # changes to this data structure separate from the mappings generation
         # @todo expose the JSON data structure for newer risk type
-        annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytics_story']
+        annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story']
         savedsearch_annotations = {}
         for key in annotation_keys:
             if key == 'mitre_attack':
@@ -154,7 +154,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
     return output_path
 
 
-def generate_analytics_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
+def generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
 
     sto_det = map_detection_to_stories(detections)
 
@@ -280,7 +280,7 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT
                 j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
                                      trim_blocks=True)
                 template = j2_env.get_template('panel.j2')
-                file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml 
+                file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml
                 output_path = path.join(OUTPUT_PATH, file_path)
                 response_task['search']= response_task['search'].replace(">",">")
                 response_task['search']= response_task['search'].replace("<","&lt;")
@@ -334,27 +334,30 @@ def get_deployments(object, deployments):
     matched_deployments = []
 
     for deployment in deployments:
-        if 'analytics_story' in deployment['tags']:
-            if type(deployment['tags']['analytics_story']) is str:
-                if 'analytics_story' in object['tags']:
-                    if deployment['tags']['analytics_story'] == object['tags']['analytics_story'] or deployment['tags']['analytics_story']=='all':
+        if 'analytic_story' in deployment['tags']:
+            if type(deployment['tags']['analytic_story']) is str:
+                if 'analytic_story' in object['tags']:
+                    if deployment['tags']['analytic_story'] == object['tags']['analytic_story'] or deployment['tags']['analytic_story']=='all':
                         matched_deployments.append(deployment)
+
             else:
-                for story in deployment['tags']['analytics_story']:
-                    if story == object['tags']['analytics_story']:
+                for story in deployment['tags']['analytic_story']:
+                    if story == object['tags']['analytic_story']:
                         matched_deployments.append(deployment)
                         continue
 
-        if 'product' in deployment['tags']:
-            if type(deployment['tags']['product']) is str:
-                if 'product' in object['tags']:
-                    if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Splunk Security Analytics for AWS':
-                        matched_deployments.append(deployment)
-            else:
-                for story in deployment['tags']['product']:
-                    if story == object['tags']['product']:
-                        matched_deployments.append(deployment)
-                        continue
+        # Remove this check since deployment files are numbered and detections for Splunk Security Analytics for AWS will only get risk configs.
+
+        # if 'product' in deployment['tags']:
+        #     if type(deployment['tags']['product']) is str:
+        #         if 'product' in object['tags']:
+        #             if deployment['tags']['product'] == object['tags']['product'] or deployment['tags']['product']=='Splunk Security Analytics for AWS':
+        #                 matched_deployments.append(deployment)
+        #     else:
+        #         for story in deployment['tags']['product']:
+        #             if story == object['tags']['product']:
+        #                 matched_deployments.append(deployment)
+        #                 continue
 
 
         if 'detection_name' in deployment['tags']:
@@ -428,10 +431,11 @@ def get_nes_fields(search, deployment):
 def map_detection_to_stories(detections):
     sto_det = {}
     for detection in detections:
-        if 'analytics_story' in detection['tags']:
-            for story in detection['tags']['analytics_story']:
+        if 'analytic_story' in detection['tags']:
+            for story in detection['tags']['analytic_story']:
                 if 'type' in detection.keys():
-                    rule_name = str(detection['type'] + ' - ' + detection['name'] + ' - Rule')
+                    if detection['type'] == 'batch':
+                        rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
                 else:
                     rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
                 if not (story in sto_det):
@@ -445,10 +449,11 @@ def map_response_tasks_to_stories(response_tasks):
     sto_res = {}
     for response_task in response_tasks:
         if 'tags' in response_task:
-            if 'analytics_story' in response_task['tags']:
-                for story in response_task['tags']['analytics_story']:
+            if 'analytic_story' in response_task['tags']:
+                for story in response_task['tags']['analytic_story']:
                     if 'type' in response_task.keys():
-                        task_name = str(response_task['type'] + ' - ' + response_task['name'] + ' - Response Task' )
+                        if response_task['type'] == 'response':
+                            task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
                     else:
                         task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
                     if not (story in sto_res):
@@ -462,10 +467,11 @@ def map_baselines_to_stories(baselines):
     sto_bas = {}
     for baseline in baselines:
         if 'tags' in baseline:
-            if 'analytics_story' in baseline['tags']:
-                for story in baseline['tags']['analytics_story']:
+            if 'analytic_story' in baseline['tags']:
+                for story in baseline['tags']['analytic_story']:
                     if 'type' in baseline.keys():
-                        baseline_name = str(baseline['type'] + ' - ' + baseline['name'])
+                        if baseline['type'] == 'batch':
+                            baseline_name = str('ESCU - ' + baseline['name'])
                     else:
                         baseline_name = str('ESCU - ' + baseline['name'])
                     if not (story in sto_bas):
@@ -496,10 +502,11 @@ def prepare_stories(stories, detections):
     sto_to_nists = {}
     sto_to_det = {}
     for detection in detections:
-        if 'analytics_story' in detection['tags']:
-            for story in detection['tags']['analytics_story']:
+        if 'analytic_story' in detection['tags']:
+            for story in detection['tags']['analytic_story']:
                 if 'type' in detection.keys():
-                    rule_name = str(detection['type'] + ' - ' + detection['name'] + ' - Rule')
+                    if detection['type'] == 'batch':
+                        rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
                 else:
                     rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
 
@@ -637,14 +644,14 @@ def main(args):
     detections = sorted(detections, key=lambda d: d['name'])
 
     # only use ESCU detections to the configurations
-    detections = [object for object in detections if object["type"].lower() == "escu"]
+    detections = [object for object in detections if object["type"].lower() == "batch"]
 
     response_tasks = sorted(response_tasks, key=lambda i: i['name'])
     baselines = sorted(baselines, key=lambda b: b['name'])
     detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH)
 
     stories = sorted(stories, key=lambda s: s['name'])
-    story_path = generate_analytics_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
+    story_path = generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
 
     use_case_lib_path = generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
 

bin/jinja2_templates/savedsearches.j2

@@ -8,7 +8,7 @@
 ### ESCU DETECTIONS ###
 
 {% for detection in detections %}
-[{{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule]
+[ESCU - {{ detection.name }} - Rule]
 action.escu = 0
 action.escu.enabled = 1
 description = {{ detection.description }}
@@ -32,7 +32,7 @@ action.escu.known_false_positives = None
 action.escu.creation_date = {{ detection.date }}
 action.escu.modification_date = {{ detection.date }}
 action.escu.confidence = high
-action.escu.full_search_name = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule
+action.escu.full_search_name = ESCU - {{ detection.name }} - Rule
 action.escu.search_type = detection
 {% if detection.product is defined %}
 action.escu.product = {{ detection.product | tojson }}
@@ -42,8 +42,8 @@ action.escu.providing_technologies = {{ detection.providing_technologies | tojso
 {% else %}
 action.escu.providing_technologies = []
 {% endif %}
-{% if detection.tags.analytics_story is defined %}
-action.escu.analytic_story = {{ detection.tags.analytics_story | tojson }}
+{% if detection.tags.analytic_story is defined %}
+action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
 {% if detection.tags.risk_object is defined %}
 action.risk = 1
 action.risk.param._risk_object = {{ detection.tags.risk_object }}
@@ -58,7 +58,7 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
 dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
 dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule
+action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
 action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
 {% if detection.deployment.scheduling.schedule_window is defined %}
 schedule_window = {{ detection.deployment.scheduling.schedule_window }}
@@ -106,8 +106,8 @@ action.escu.full_search_name = {{ baseline.type | default('ESCU') }} - {{ baseli
 description = {{ baseline.description }}
 action.escu.creation_date = {{ baseline.date }}
 action.escu.modification_date = {{ baseline.date }}
-{% if baseline.tags.analytics_story is defined %}
-action.escu.analytic_story = {{ baseline.tags.analytics_story | tojson }}
+{% if baseline.tags.analytic_story is defined %}
+action.escu.analytic_story = {{ baseline.tags.analytic_story | tojson }}
 {% else %}
 action.escu.analytic_story = []
 {% endif %}
@@ -154,7 +154,7 @@ description = {{ response_task.description }}
 action.escu.creation_date = {{ response_task.date }}
 action.escu.modification_date = {{ response_task.date }}
 {% if response_task.tags is defined %}
-action.escu.analytic_story = {{ response_task.tags.analytics_story | tojson }}
+action.escu.analytic_story = {{ response_task.tags.analytic_story | tojson }}
 {% else %}
 action.escu.analytic_story = []
 {% endif %}

bin/pretty_yaml.py

@@ -0,0 +1,268 @@
+#!/bin/python
+from os import path, walk
+import sys
+import argparse
+import yaml
+import re
+
+def parse_data_models_from_search(search):
+    match = re.search(r'from\sdatamodel\s?=\s?([^\s.]*)', search)
+    if match is not None:
+        return match.group(1)
+    return False
+
+def pretty_yaml_detections(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    types = ["endpoint", "application", "cloud", "deprecated", "experimental", "network", "web"]
+    for t in types:
+        for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/' + t):
+            for file in files:
+                if file.endswith(".yml"):
+                    manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['datamodel'] = object['datamodel']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['search'] = object['search']
+        if 'how_to_implement' in object:
+            pretty_yaml['how_to_implement'] = object['how_to_implement']
+        else:
+            pretty_yaml['how_to_implement'] = ''
+        pretty_yaml['known_false_positives'] = object['known_false_positives']
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_baselines(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['datamodel'] = object['datamodel']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['search'] = object['search']
+        if 'how_to_implement' in object:
+            pretty_yaml['how_to_implement'] = object['how_to_implement']
+        else:
+            pretty_yaml['how_to_implement'] = ''
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_baselines(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['datamodel'] = object['datamodel']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['search'] = object['search']
+        if 'how_to_implement' in object:
+            pretty_yaml['how_to_implement'] = object['how_to_implement']
+        else:
+            pretty_yaml['how_to_implement'] = ''
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_deployments(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['scheduling'] = object['scheduling']
+        if 'alert_action' in object:
+            pretty_yaml['alert_action'] = object['alert_action']
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_stories(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['narrative'] = object['narrative']
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml(REPO_PATH, VERBOSE, content_part):
+    #for root, dirs, files in walk(REPO_PATH + "/"):
+    manifest_files = []
+    if content_part == 'detections':
+        manifest_files = pretty_yaml_detections(REPO_PATH, VERBOSE, content_part)
+    elif content_part == 'baselines':
+        manifest_files = pretty_yaml_baselines(REPO_PATH, VERBOSE, content_part)
+    elif content_part == 'deployments':
+        manifest_files = pretty_yaml_deployments(REPO_PATH, VERBOSE, content_part)
+    elif content_part == 'stories':
+        manifest_files = pretty_yaml_stories(REPO_PATH, VERBOSE, content_part)
+    return len(manifest_files)
+
+def main(args):
+
+    parser = argparse.ArgumentParser(description="keeps yamls in security_content sorted and pretty printed with custom sort keys, \
+            meant to run quitely for CI, use -v flag to make it bark")
+
+    parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
+    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
+
+    # parse them
+    args = parser.parse_args()
+    REPO_PATH = args.path
+    VERBOSE = args.verbose
+    output = []
+    pretty_yaml_objects = ['macros','lookups','stories','detections','baselines','response_tasks','responses','deployments']
+    for pretty_yaml_object in pretty_yaml_objects:
+        touch_count = pretty_yaml(REPO_PATH, VERBOSE, pretty_yaml_object)
+        if VERBOSE:
+            output.append("made {0} {1} pretty".format(touch_count, pretty_yaml_object))
+
+    for o in output:
+        print(o)
+
+    print("finished successfully!")
+
+
+if __name__ == "__main__":
+    main(sys.argv[1:])

bin/reporting/detection_coverage.svg

@@ -14,6 +14,6 @@
 <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="30" y="15" fill="#010101" fill-opacity=".3">coverage</text>
     <text x="30" y="14">coverage</text>
-    <text x="80" y="14">80%%</text>
+    <text x="80" y="14">82%</text>
 </g>
 </svg>

bin/testing_coverage.py

@@ -24,7 +24,7 @@ def main(args):
                         type=float,
                         default=0.0,
                         help="Minimum coverage, script return error if target is not met")
-    parser.add_argument('--types', type=str, nargs="*", help="SSA, ESCU", default=["ESCU", "SSA"])
+    parser.add_argument('--types', type=str, nargs="*", help="batch, streaming", default=["batch", "streaming"])
     parsed = parser.parse_args(args)
     populate_coverage(parsed.types)
     print_results(parsed.types)

bin/validate.py

@@ -76,10 +76,8 @@ def validate_objects(REPO_PATH, objects, verbose):
         validation_errors, uuids = validate_standard_fields(object, uuids)
         errors = errors + validation_errors
 
-    if verbose:
-        print("validating object {0}".format(object['name']))
     for object in objects['detections']:
-        if object['type'] == 'ESCU':
+        if object['type'] == 'batch':
             errors = errors + validate_detection_search(object, objects['macros'])
 
     for object in objects['baselines']:
@@ -132,8 +130,12 @@ def validate_standard_fields(object, uuids):
     # the first two fields risk_object, and risk_object_type are an enum of fixed values
     # defined by ESCU risk scoring
 
-
     if 'tags' in object:
+        # check product tag is present in all objects
+        if 'product' not in object['tags']:
+            errors.append("ERROR: a `product` tag is required for object: %s" % object['name'])
+
+        # check risk score values
         for k,v in object['tags'].items():
 
             if k == 'risk_score':

deployments/10_enterprise_security_deployment_configuration.yml

@@ -1,10 +1,11 @@
 name: Enterprise Security deployment configuration
 id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
 date: '2020-04-27'
-description: This configuration file applies to all correlation searches that are used for detection
 author: Bhavin Patel
+description: This configuration file applies to all correlation searches that are
+  used for detection
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
   earliest_time: -70m@m
   latest_time: -10m@m
   schedule_window: auto
@@ -13,8 +14,8 @@ alert_action:
     rule_description: '%description%'
     rule_title: '%name%'
     nes_fields:
-      - user
-      - dest
-      - src
+    - user
+    - dest
+    - src
 tags:
   analytics_story: all

deployments/11_detect_arp_poisoning.yml

@@ -1,22 +1,22 @@
 name: Detect ARP Poisoning deployment configuration
 id: e1d5b4dc-4cf3-404f-905c-b478bbb20474
 date: '2020-08-14'
-description: This configuration file applies to the Detect ARP Poisoning detection
 author: Mikael Bjerkeland
+description: This configuration file applies to the Detect ARP Poisoning detection
 scheduling:
-  cron_schedule: '59 * * * *'
+  cron_schedule: 59 * * * *
   earliest_time: -70m@m
   latest_time: -10m@m
   schedule_window: auto
 alert_action:
   notable:
-    rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$.
-      This may be an indication of a MITM attack.'
-    rule_title: 'ARP Poisoning Detected on $orig_host$'
+    rule_description: ARP Poisoning has been detected on interface $src_interface$
+      on host $orig_host$. This may be an indication of a MITM attack.
+    rule_title: ARP Poisoning Detected on $orig_host$
     nes_fields:
-      - src_interface
-      - firstTime
-      - lastTime
-      - count
+    - src_interface
+    - firstTime
+    - lastTime
+    - count
 tags:
   detection_name: Detect ARP Poisoning

deployments/12_detect_dhcp_poisoning.yml

@@ -1,23 +1,23 @@
 name: Detect Rogue DHCP Server deployment configuration
 id: 6e4e20ac-e719-4ebe-a52d-d672cd451dbb
 date: '2020-08-14'
-description: This configuration file applies to the Detect Rogue DHCP Server detection
 author: Mikael Bjerkeland
+description: This configuration file applies to the Detect Rogue DHCP Server detection
 scheduling:
-  cron_schedule: '59 * * * *'
+  cron_schedule: 59 * * * *
   earliest_time: -70m@m
   latest_time: -10m@m
   schedule_window: auto
 alert_action:
   notable:
-    rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$.
-      This may be an indication of a MITM attack.'
-    rule_title: 'Rogue DHCP Server Detected on $orig_host$'
+    rule_description: DHCP Snooping has detected a Rogue DHCP Server on $orig_host$
+      from $src_mac$. This may be an indication of a MITM attack.
+    rule_title: Rogue DHCP Server Detected on $orig_host$
     nes_fields:
-      - src_mac
-      - firstTime
-      - lastTime
-      - count
-      - message_type
+    - src_mac
+    - firstTime
+    - lastTime
+    - count
+    - message_type
 tags:
   detection_name: Detect Rogue DHCP Server

deployments/14_credential_dumping_story.yml

@@ -1,10 +1,10 @@
 name: Credential Dumping Story
 id: 52f52a7c-078f-4413-84da-388b61ccac26
 date: '2021-01-13'
-description: Example for a deployment for a specific Analytics Story
 author: Patrick Bareiss
+description: Example for a deployment for a specific Analytics Story
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
   earliest_time: -40m@m
   latest_time: -10m@m
   schedule_window: auto

deployments/15_detection_access_LSASS_memory_for_dump_creation.yml

@@ -1,10 +1,10 @@
 name: Access LSASS Memory for Dump Creation Deployment
 id: 974c422f-db3f-4538-8f2a-ee5bf8eec0fa
 date: '2021-01-13'
-description: Example for a deployment for a specific Detection
 author: Patrick Bareiss
+description: Example for a deployment for a specific Detection
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
   earliest_time: -30m@m
   latest_time: now
   schedule_window: auto
@@ -13,6 +13,6 @@ alert_action:
     rule_description: '%description%'
     rule_title: '%name% Notable'
     nes_fields:
-      - dest
+    - dest
 tags:
   detection_name: Access LSASS Memory for Dump Creation

deployments/16_splunk_security_analytics_for_aws.yml

@@ -1,10 +1,12 @@
 name: Enterprise Security config for Splunk Security Analytics for AWS customers
 id: bc91a8cd-35e7-4bb2-6140-e756cc46f211
 date: '2021-01-20'
-description: This configuration file applies to all correlation searches that are used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics for AWS searches do not need notable  configurations 
 author: Bhavin Patel
+description: This configuration file applies to all correlation searches that are
+  used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics
+  for AWS searches do not need notable  configurations
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
   earliest_time: -70m@m
   latest_time: -10m@m
   schedule_window: auto

deployments/20_baseline_cache_hourly_updates.yml

@@ -1,13 +1,14 @@
 name: Baseline Cache Hourly Updates
 id: 1030c701-2acf-4b1a-9970-46c7145caf2d
 date: '2020-06-24'
-description: This configuration file applies to all baselines with tag deployments Hourly Cache Updates
 author: Bhavin Patel
+description: This configuration file applies to all baselines with tag deployments
+  Hourly Cache Updates
 scheduling:
-  cron_schedule: '55 * * * *'
+  cron_schedule: 55 * * * *
   earliest_time: -70m@m
   latest_time: -10m@m
   schedule_window: auto
 tags:
   deployments:
-    - Hourly Cache Updates
+  - Hourly Cache Updates

deployments/21_baseline_cache_daily_updates.yml

@@ -1,13 +1,14 @@
 name: Baseline Cache Daily Updates
 id: 9541d6f8-fa58-4d48-bb44-6720e39b7b0d
 date: '2020-08-18'
-description: This configuration file applies to all baselines with tag deployments Daily Cache Updates
 author: David Dorsey
+description: This configuration file applies to all baselines with tag deployments
+  Daily Cache Updates
 scheduling:
-  cron_schedule: '10 0 * * *'
+  cron_schedule: 10 0 * * *
   earliest_time: -1450m@m
   latest_time: -10m@m
   schedule_window: auto
 tags:
   deployments:
-    - Daily Cache Updates
+  - Daily Cache Updates

deployments/30_long_running_baseline_searches.yml

@@ -1,8 +1,9 @@
 name: 90 Day Baseline Searches
 id: 6eac9f8b-a35d-4b64-b57f-e5ecde43be6b
 date: '2020-06-24'
-description: This configuration file applies to all baselines with tag deployments Long Running Baseline
 author: Bhavin Patel
+description: This configuration file applies to all baselines with tag deployments
+  Long Running Baseline
 scheduling:
   cron_schedule: 0 1 1 1,4,7,10 *
   earliest_time: -90d@d
@@ -10,4 +11,4 @@ scheduling:
   schedule_window: auto
 tags:
   deployments:
-    - 90 Day Baseline
+  - 90 Day Baseline

deployments/31_weeky_model_rebuild_90_days.yml

@@ -1,13 +1,14 @@
 name: Weekly Model Rebuild 90 Day Lookback
 id: 4b329568-bcff-49fa-8c85-92e95f0f270d
 date: '2020-09-07'
-description: This configuration file applies to all baselines with tag deployments Weekly Model Rebuild 90 Day Lookback
 author: David Dorsey
+description: This configuration file applies to all baselines with tag deployments
+  Weekly Model Rebuild 90 Day Lookback
 scheduling:
-  cron_schedule: '0 2 * * 0'
+  cron_schedule: 0 2 * * 0
   earliest_time: -90d@d
   latest_time: -1d@d
   schedule_window: auto
 tags:
   deployments:
-    - Weekly Model Rebuild 90 Day Lookback
+  - Weekly Model Rebuild 90 Day Lookback

detections/application/email_files_written_outside_of_the_outlook_directory.yml

@@ -2,17 +2,12 @@ name: Email files written outside of the Outlook directory
 id: ee18ed37-0802-4268-9435-b3b91aaa18xx
 version: 3
 date: '2020-07-21'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: The search looks at the change-analysis data model and detects email
   files created outside the normal Outlook directory.
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records the file-system activity from your hosts to populate the Endpoint.Filesystem
-  data model node. This is typically populated via endpoint detection-and-response
-  products, such as Carbon Black, or by other endpoint data sources, such as Sysmon.
-  The data used for this search is typically generated via logs that report file-system
-  reads and writes.
-type: ESCU
-references: []
-author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path)
   as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
   where (Filesystem.file_name=*.pst OR Filesystem.file_name=*.ost) Filesystem.file_path
@@ -20,17 +15,28 @@ search: '| tstats `security_content_summariesonly` count values(Filesystem.file_
   by Filesystem.action Filesystem.process_id Filesystem.file_name Filesystem.dest
   | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `email_files_written_outside_of_the_outlook_directory_filter` '
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records the file-system activity from your hosts to populate the Endpoint.Filesystem
+  data model node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black, or by other endpoint data sources, such as Sysmon.
+  The data used for this search is typically generated via logs that report file-system
+  reads and writes.
 known_false_positives: Administrators and users sometimes prefer backing up their
   email data by moving the email files into a different folder. These attempts will
   be detected by the search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Collection and Staging
-  mitre_attack_id:
-  - T1114.001
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: Endpoint
   cis20:
   - CIS 8
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1114.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   security_domain: endpoint
-  asset_type: Endpoint

detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml

@@ -2,30 +2,36 @@ name: Multiple Okta Users With Invalid Credentails From The Same IP
 id: 19cba45f-cad3-4032-8911-0c09e0444552
 version: 2
 date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
 description: This search detects Okta login failures due to bad credentials for multiple
   users originating from the same ip address.
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-type: ESCU
-author: Rico Valdez, Splunk
 search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country
   as country, client.geographicalContext.state as state, client.geographicalContext.city
   as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users
   values(user) as users by src_ip, displayMessage, outcome.reason, country, state,
   city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
 known_false_positives: A single public IP address servicing multiple legitmate users
   may trigger this search. In addition, the threshold of 5 distinct users may be too
   low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise
   the threshold or except specific IP adresses from triggering this search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Okta Activity
-  mitre_attack_id:
-  - T1078.001
+  asset_type: Infrastructure
   cis20:
   - CIS 16
+  mitre_attack_id:
+  - T1078.001
   nist:
   - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   security_domain: access
-  asset_type: Infrastructure

detections/application/okta_account_lockout_events.yml

@@ -2,25 +2,31 @@ name: Okta Account Lockout Events
 id: 62b70968-a0a5-4724-8ac4-67871e6f544d
 version: 2
 date: '2020-07-21'
-description: Detect Okta user lockout events
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-type: ESCU
 author: Rico Valdez, Splunk
+type: batch
+datamodel: []
+description: Detect Okta user lockout events
 search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
   as country, client.geographicalContext.state as state, client.geographicalContext.city
   as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
 known_false_positives: None. Account lockouts should be followed up on to determine
   if the actual user was the one who caused the lockout, or if it was an unauthorized
   actor.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Okta Activity
-  mitre_attack_id:
-  - T1078.001
+  asset_type: Infrastructure
   cis20:
   - CIS 16
+  mitre_attack_id:
+  - T1078.001
   nist:
   - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   security_domain: access
-  asset_type: Infrastructure

detections/application/okta_failed_sso_attempts.yml

@@ -2,24 +2,31 @@ name: Okta Failed SSO Attempts
 id: 371a6545-2618-4032-ad84-93386b8698c5
 version: 2
 date: '2020-07-21'
-description: Detect failed Okta SSO events
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-type: ESCU
 author: Rico Valdez, Splunk
+type: batch
+datamodel: []
+description: Detect failed Okta SSO events
 search: '`okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time)
   as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage,
-  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_failed_sso_attempts_filter` '
+  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `okta_failed_sso_attempts_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
 known_false_positives: There may be a faulty config preventing legitmate users from
   accessing apps they should have access to.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Okta Activity
-  mitre_attack_id:
-  - T1078.001
+  asset_type: Infrastructure
   cis20:
   - CIS 16
+  mitre_attack_id:
+  - T1078.001
   nist:
   - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   security_domain: access
-  asset_type: Infrastructure

detections/application/okta_user_logins_from_multiple_cities.yml

@@ -2,31 +2,37 @@ name: Okta User Logins From Multiple Cities
 id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
 version: 2
 date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
 description: This search detects logins from the same user from different states in
   a 24 hour period.
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-type: ESCU
-author: Rico Valdez, Splunk
 search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
   | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)
   as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state)
   as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `okta_user_logins_from_multiple_cities_filter` | search locations > 1'
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
 known_false_positives: Users in your enviornment may legitmately be travelling and
   loggin in from different locations. This search is useful for those users that should
   *not* be travelling for some reason, such as the COVID-19 pandemic. The search also
   relies on the geographical information being populated in the Okta logs. It is also
   possible that a connection from another region may be attributed to a login from
   a remote VPN endpoint.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Okta Activity
-  mitre_attack_id:
-  - T1078.001
+  asset_type: Infrastructure
   cis20:
   - CIS 16
+  mitre_attack_id:
+  - T1078.001
   nist:
   - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   security_domain: access
-  asset_type: Infrastructure

detections/application/web_servers_executing_suspicious_processes.yml

@@ -2,35 +2,41 @@ name: Web Servers Executing Suspicious Processes
 id: ec3b7601-689a-4463-94e0-c9f45638efb9
 version: 1
 date: '2019-04-01'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search looks for suspicious processes on all systems labeled as
   web servers.
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. In addition, web servers will need to be identified in the Assets and Identity
-  Framework of Enterprise Security.
-type: ESCU
-references: []
-author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.dest_category="web_server"
   AND (Processes.process="*whoami*" OR Processes.process="*ping*" OR Processes.process="*iptables*"
   OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*")
   by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model. In addition, web servers will need to be identified in the Assets and Identity
+  Framework of Enterprise Security.
 known_false_positives: Some of these processes may be used legitimately on web servers
   during maintenance or other administrative tasks.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Apache Struts Vulnerability
-  mitre_attack_id:
-  - T1082
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: Web Server
   cis20:
   - CIS 3
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1082
   nist:
   - PR.IP
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   security_domain: endpoint
-  asset_type: Web Server

detections/cloud/abnormally_high_cloud_instances_destroyed.yml

@@ -2,48 +2,52 @@ name: Abnormally High Number Of Cloud Instances Destroyed
 id: ef629fc9-1583-4590-b62a-f2247fbf7bbf
 version: 1
 date: '2020-08-21'
-description: This search finds for the number successfully destroyed cloud instances for every 4 hour
-  block. This is split up between weekdays and the weekend. It then applies the probability densitiy model
-  previously created and alerts on any outliers. 
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must run the baseline search
- `Baseline Of Cloud Instances Destroyed` to create the probability density function.
-type: ESCU
-references: []
 author: David Dorsey, Splunk
-search: '| tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where
-   All_Changes.action=deleted
-   AND All_Changes.status=success AND All_Changes.object_category=instance
-   by All_Changes.user _time span=1h
-   | `drop_dm_object_name("All_Changes")`
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-   | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1]
-   | where cardinality >=16
-   | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier
-   | where isOutlier=1
-   | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
-   | eval distance_from_threshold = instances_destroyed - expected_upper_threshold
-   | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id
-   | `abnormally_high_number_of_cloud_instances_destroyed_filter`'
+type: batch
+datamodel:
+- Change
+description: This search finds for the number successfully destroyed cloud instances
+  for every 4 hour block. This is split up between weekdays and the weekend. It then
+  applies the probability densitiy model previously created and alerts on any outliers.
+search: '| tstats count as instances_destroyed values(All_Changes.object_id) as object_id
+  from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success
+  AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1]
+  | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005
+  | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval
+  expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) |
+  eval distance_from_threshold = instances_destroyed - expected_upper_threshold |
+  table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold,
+  object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability
+  density function.
 known_false_positives: Many service accounts configured within a cloud infrastructure
   are known to exhibit this behavior. Please adjust the threshold values and filter
   out service accounts from the output. Always verify if this search alerted on a
   human user.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Instance Activities
+  asset_type: Cloud Instance
+  cis20:
+  - CIS 13
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
   - T1078.004
-  cis20:
-  - CIS 13
   nist:
   - DE.DP
   - DE.AE
   product:
   - Splunk Security Analytics for AWS
-  security_domain: Cloud
-  asset_type: Cloud Instance
-  risk_score: 10
-  risk_object_type: user
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   risk_object: user
+  risk_object_type: user
+  risk_score: 10
+  security_domain: Cloud

detections/cloud/abnormally_high_cloud_instances_launched.yml

@@ -2,50 +2,53 @@ name: Abnormally High Number Of Cloud Instances Launched
 id: f2361e9f-3928-496c-a556-120cd4223a65
 version: 2
 date: '2020-08-21'
-description: This search finds for the number successfully created cloud instances for every 4 hour
-  block. This is split up between weekdays and the weekend. It then applies the probability densitiy model
-  previously created and alerts on any outliers.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must run the baseline search
- `Baseline Of Cloud Instances Launched` to create the probability density function.
-type: ESCU
-references: []
 author: David Dorsey, Splunk
-search: '| tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where
-   (All_Changes.action=created)
-   AND All_Changes.status=success AND All_Changes.object_category=instance
-   by All_Changes.user _time span=1h
-   | `drop_dm_object_name("All_Changes")`
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-   | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1]
-   | where cardinality >=16
-   | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier
-   | where isOutlier=1
-   | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
-   | eval distance_from_threshold = instances_launched - expected_upper_threshold
-   | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id
-   | `abnormally_high_number_of_cloud_instances_launched_filter`'
+type: batch
+datamodel:
+- Change
+description: This search finds for the number successfully created cloud instances
+  for every 4 hour block. This is split up between weekdays and the weekend. It then
+  applies the probability densitiy model previously created and alerts on any outliers.
+search: '| tstats count as instances_launched values(All_Changes.object_id) as object_id
+  from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success
+  AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1]
+  | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005
+  | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval
+  expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) |
+  eval distance_from_threshold = instances_launched - expected_upper_threshold | table
+  _time, user, instances_launched, expected_upper_threshold, distance_from_threshold,
+  object_id | `abnormally_high_number_of_cloud_instances_launched_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Instances Launched` to create the probability
+  density function.
 known_false_positives: Many service accounts configured within an AWS infrastructure
   are known to exhibit this behavior. Please adjust the threshold values and filter
   out service accounts from the output. Always verify if this search alerted on a
   human user.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Cloud Cryptomining
   - Suspicious Cloud Instance Activities
+  asset_type: Cloud Instance
+  cis20:
+  - CIS 13
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
   - T1078.004
-  cis20:
-  - CIS 13
   nist:
   - DE.DP
   - DE.AE
   product:
   - Splunk Security Analytics for AWS
-  security_domain: Cloud
-  asset_type: Cloud Instance
-  risk_score: 40
-  risk_object_type: user
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   risk_object: user
-
+  risk_object_type: user
+  risk_score: 40
+  security_domain: Cloud

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -2,14 +2,12 @@ name: Abnormally High Number Of Cloud Infrastructure API Calls
 id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
 version: 1
 date: '2020-09-07'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment by a user.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
-  create the probability density function.
-type: ESCU
-references: []
-author: David Dorsey, Splunk
 search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change
   where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time
   span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time,
@@ -21,27 +19,34 @@ search: '| tstats count as api_calls values(All_Changes.command) as command from
   -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold
   = api_calls - expected_upper_threshold | table _time, user, command, api_calls,
   expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
+  create the probability density function.
 known_false_positives: ''
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud User Activities
+  asset_type: AWS Instance
+  automated_detection_testing: passed
+  cis20:
+  - CIS 16
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
   - T1078.004
-  cis20:
-  - CIS 16
   nist:
   - DE.DP
   - DE.CM
   - PR.AC
-  security_domain: network
-  asset_type: AWS Instance
   product:
   - Splunk Security Analytics for AWS
-  risk_score: 25
-  risk_object_type: user
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   risk_object: user
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
+  risk_object_type: user
+  risk_score: 25
+  security_domain: network

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -2,14 +2,12 @@ name: Abnormally High Number Of Cloud Security Group API Calls
 id: d4dfb7f3-7a37-498a-b5df-f19334e871af
 version: 1
 date: '2020-09-07'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment about security groups by a user.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
-  create the probability density function model.
-type: ESCU
-references: []
-author: David Dorsey, Splunk
 search: '| tstats count as security_group_api_calls values(All_Changes.command) as
   command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success
   by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval
@@ -22,27 +20,34 @@ search: '| tstats count as security_group_api_calls values(All_Changes.command)
   > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls
   - expected_upper_threshold | table _time, user, command, security_group_api_calls,
   expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
+  create the probability density function model.
 known_false_positives: ''
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud User Activities
+  asset_type: AWS Instance
+  automated_detection_testing: passed
+  cis20:
+  - CIS 16
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
   - T1078.004
-  cis20:
-  - CIS 16
   nist:
   - DE.DP
   - DE.CM
   - PR.AC
   product:
   - Splunk Security Analytics for AWS
-  security_domain: network
-  asset_type: AWS Instance
-  risk_score: 25
-  risk_object_type: user
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   risk_object: user
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
+  risk_object_type: user
+  risk_score: 25
+  security_domain: network

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -2,18 +2,13 @@ name: AWS Cross Account Activity From Previously Unseen Account
 id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
 version: 1
 date: '2020-05-28'
-description: This search looks for AssumeRole events where an IAM role in a different
-  account is requested for the first time.  This search is deprecated and have been translated to use the latest Authentication Datamodel.
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider. You should run the baseline search `Previously Seen AWS Cross Account
-  Activity - Initial` to build the initial table of source IP address, geographic
-  locations, and times. You must also enable the second baseline search `Previously
-  Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
-  out old data. You can also provide additional filtering for this search by customizing
-  the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
-type: ESCU
-references: []
 author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
+description: This search looks for AssumeRole events where an IAM role in a different
+  account is requested for the first time.  This search is deprecated and have been
+  translated to use the latest Authentication Datamodel.
 search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication
   where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
   Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -24,27 +19,38 @@ search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=
   Cross Account Activity","Previously Seen") |  where status = "New Cross Account
   Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `aws_cross_account_activity_from_previously_unseen_account_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider. You should run the baseline search `Previously Seen AWS Cross Account
+  Activity - Initial` to build the initial table of source IP address, geographic
+  locations, and times. You must also enable the second baseline search `Previously
+  Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
+  out old data. You can also provide additional filtering for this search by customizing
+  the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
 known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
   It's suspicious when an account requests privileges of an account it hasn't before.
   You should validate with the account owner that this is a legitimate request.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - Suspicious Cloud Authentication Activities
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: AWS Instance
+  automated_detection_testing: passed
   cis20:
   - CIS 16
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
+  kill_chain_phases:
+  - Actions on Objectives
   nist:
   - PR.AC
   - PR.DS
   - DE.AE
-  security_domain: network
-  asset_type: AWS Instance
-  risk_score: 15
-  risk_object_type: user
-  risk_object: user
   product:
   - Splunk Security Analytics for AWS
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_object: user
+  risk_object_type: user
+  risk_score: 15
+  security_domain: network

detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

@@ -1,18 +1,14 @@
-author: Rod Soto, Patrick Bareiss Splunk
+name: AWS Detect Users creating keys with encrypt policy without MFA
+id: c79c164f-4b21-4847-98f9-cf6a9f49179e
+version: 1
 date: '2021-01-11'
+author: Rod Soto, Patrick Bareiss Splunk
+type: batch
+datamodel: []
 description: This search provides detection of KMS keys which action kms:Encrypt is
   accessible for everyone (also outside of your organization). This is an identicator
   that your account is compromised and the attacker uses the encryption key to compromise
   another company.
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
-id: c79c164f-4b21-4847-98f9-cf6a9f49179e
-known_false_positives: unknown
-name: AWS Detect Users creating keys with encrypt policy without MFA
-references:
-- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
-- https://github.com/d1vious/git-wild-hunt
-- https://www.youtube.com/watch?v=PgzNib37g0M
 search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy
   output=key_policy_statements path=Statement{} | mvexpand key_policy_statements |
   spath input=key_policy_statements output=key_policy_action_1 path=Action | spath
@@ -22,15 +18,24 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
   | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource
   eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+known_false_positives: unknown
+references:
+- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
+- https://github.com/d1vious/git-wild-hunt
+- https://www.youtube.com/watch?v=PgzNib37g0M
 tags:
-  analytics_story:
+  analytic_story:
   - Ransomware Cloud
   asset_type: AWS Account
-  mitre_attack_id:
-  - T1486
-  security_domain: threat
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events.json
-type: ESCU
-version: 1
+  mitre_attack_id:
+  - T1486
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: threat

detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml

@@ -1,31 +1,36 @@
-author: Rod Soto, Patrick Bareiss Splunk
+name: AWS Detect Users with KMS keys performing encryption S3
+id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
+version: 1
 date: '2021-01-11'
+author: Rod Soto, Patrick Bareiss Splunk
+type: batch
+datamodel: []
 description: This search provides detection of users with KMS keys performing encryption
   specifically against S3 buckets.
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
-id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
-known_false_positives: bucket with S3 encryption
-name: AWS Detect Users with KMS keys performing encryption S3
-references:
-- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
-- https://github.com/d1vious/git-wild-hunt
-- https://www.youtube.com/watch?v=PgzNib37g0M
 search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
   | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source
   AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime
   max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file
   values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+known_false_positives: bucket with S3 encryption
+references:
+- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
+- https://github.com/d1vious/git-wild-hunt
+- https://www.youtube.com/watch?v=PgzNib37g0M
 tags:
-  analytics_story:
+  analytic_story:
   - Ransomware Cloud
   asset_type: S3 Bucket
-  mitre_attack_id:
-  - T1486
-  security_domain: threat
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json
-type: ESCU
-version: 1
+  mitre_attack_id:
+  - T1486
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: threat

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -2,14 +2,11 @@ name: AWS Network Access Control List Created with All Open Ports
 id: ada0f478-84a8-4641-a3f1-d82362d6bd75
 version: 2
 date: '2021-01-11'
+author: Bhavin Patel, Patrick Bareiss, Splunk
+type: batch
+datamodel: []
 description: The search looks for CloudTrail events to detect if any network ACLs
   were created with all the ports open to a specified CIDR.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
-  inputs.
-type: ESCU
-references: []
-author: Bhavin Patel, Patrick Bareiss, Splunk
 search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
   requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
   | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
@@ -20,26 +17,34 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
   requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
   requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
+  inputs.
 known_false_positives: It's possible that an admin has created this ACL with all ports
   open for some legitimate purpose however, this should be scoped and not allowed
   in production environment.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Network ACL Activity
-  mitre_attack_id:
-  - T1562.007
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: AWS Instance
+  automated_detection_testing: passed
   cis20:
   - CIS 11
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1562.007
   nist:
   - DE.DP
   - DE.AE
-  security_domain: network
-  asset_type: AWS Instance
-  risk_score: 10
-  risk_object_type: user
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   risk_object: userName
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json
+  risk_object_type: user
+  risk_score: 10
+  security_domain: network

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -2,40 +2,45 @@ name: AWS Network Access Control List Deleted
 id: ada0f478-84a8-4641-a3f1-d82362d6fd75
 version: 2
 date: '2021-01-12'
+author: Bhavin Patel, Patrick Bareiss, Splunk
+type: batch
+datamodel: []
 description: Enforcing network-access controls is one of the defensive mechanisms
   used by cloud administrators to restrict access to a cloud instance. After the attacker
   has gained control of the AWS console by compromising an admin account, they can
   delete a network ACL and gain access to the instance from anywhere. This search
   will query the CloudTrail logs to detect users deleting network ACLs.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.
-type: ESCU
-references: []
-author: Bhavin Patel, Patrick Bareiss, Splunk
 search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
   | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
   userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs.
 known_false_positives: It's possible that a user has legitimately deleted a network
   ACL.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
   - AWS Network ACL Activity
-  mitre_attack_id:
-  - T1562.007
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: AWS Instance
+  automated_detection_testing: passed
   cis20:
   - CIS 11
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1562.007
   nist:
   - DE.DP
   - DE.AE
-  security_domain: network
-  asset_type: AWS Instance
-  risk_score: 5
-  risk_object_type: user
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   risk_object: userName
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json
+  risk_object_type: user
+  risk_score: 5
+  security_domain: network

detections/cloud/aws_saml_access_by_provider_user_and_principal.yml

@@ -0,0 +1,43 @@
+name: AWS SAML Access by Provider User and Principal
+id: bbe23980-6019-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-26'
+author: Rod Soto, Splunk
+type: batch
+datamodel: []
+description: This search provides specific SAML access from specific Service Provider,
+  user and targeted principal at AWS. This search provides specific information to
+  detect abnormal access or potential credential hijack or forgery, specially in federated
+  environments using SAML protocol inside the perimeter or cloud provider.
+search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
+  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
+  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
+  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_access_by_provider_user_and_principal_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
+  are very difficult to detect as accessing cloud providers with these assertions
+  looks exactly like normal access, however things such as source IP sourceIPAddress
+  user, and principal targeted at receiving cloud provider along with endpoint credential
+  access and abuse detection searches can provide the necessary context to detect
+  these attacks.
+references:
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+tags:
+  analytic_story:
+  - Cloud Federated Credential Abuse
+  asset_type: AWS Federated Account
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud

detections/cloud/aws_saml_update_identity_provider.yml

@@ -0,0 +1,39 @@
+name: AWS SAML Update identity provider
+id: 2f0604c6-6030-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-26'
+author: Rod Soto, Splunk
+type: batch
+datamodel: []
+description: This search provides detection of updates to SAML provider in AWS. Updates
+  to SAML provider need to be monitored closely as they may indicate possible perimeter
+  compromise of federated credentials, or backdoor access from another cloud provider
+  set by attacker.
+search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
+  max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
+  userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
+  userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_update_identity_provider_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs.
+known_false_positives: Updating a SAML provider or creating a new one may not necessarily
+  be malicious however it needs to be closely monitored.
+references:
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+tags:
+  analytic_story:
+  - Cloud Federated Credential Abuse
+  asset_type: AWS Federated Account
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud