Merge branch 'duo_detections_1' of github.com:splunk/security_content into duo_detections_1

contentctl.yml

@@ -38,9 +38,9 @@ apps:
 - uid: 6553
   title: Splunk Add-on for Okta Identity Cloud
   appid: Splunk_TA_okta_identity_cloud
-  version: 3.0.0
+  version: 4.0.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_300.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_400.tgz
 - uid: 7404
   title: Cisco Security Cloud
   appid: CiscoSecurityCloud
@@ -229,8 +229,11 @@ apps:
   title: Cisco NVM Add-on for Splunk
   appid: TA-Cisco-NVM
   version: 4.0.7
-  description: The Cisco Endpoint Security Analytics (CESA) Add-On for Splunk allows IT administrators to analyze and correlate user and endpoint behavior in Splunk Enterprise. 
-    This Add-on provides configuration and collection of data from the Cisco AnyConnect Network Visibility Module IPFIX (nvzFlow) Collector. 
-    This module collects additional context such as user, device, application, location and destination for flows both on and off premise.
+  description: The Cisco Endpoint Security Analytics (CESA) Add-On for Splunk allows
+    IT administrators to analyze and correlate user and endpoint behavior in Splunk
+    Enterprise. This Add-on provides configuration and collection of data from the
+    Cisco AnyConnect Network Visibility Module IPFIX (nvzFlow) Collector. This module
+    collects additional context such as user, device, application, location and destination
+    for flows both on and off premise.
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-endpoint-security-analytics-cesa-add-on-for-splunk_407.tgz
 githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd

data_sources/okta.yml

@@ -16,8 +16,8 @@ sourcetype: OktaIM2:log
 supported_TA:
 - name: Splunk Add-on for Okta Identity Cloud
   url: https://splunkbase.splunk.com/app/6553
-  version: 3.0.0
+  version: 4.0.0
 output_fields:
 - dest
 - src
-- user
+- user

detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml

@@ -34,14 +34,13 @@ search: |
           values(dest_port) as dest_port
           values(aliul) as additional_logged_in_users_list
           values(dest_hostname) as dest_hostname
-          by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
+          by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport package_name comment package_official_url
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
-  | table
+  | table firstTime lastTime src dest_hostname dest dest_port transport  package_name comment package_official_url
     parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
     process_integrity_level process_path process_name process_arguments process_hash process_id
     additional_logged_in_users_list module_name_list module_hash_list
-    src dest_hostname dest dest_port transport firstTime lastTime
   | `cisco_nvm___installation_of_typosquatted_python_package_filter`
 how_to_implement: |
   This search requires Network Visibility Module logs, which includes the flow data sourcetype.

detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml

@@ -13,7 +13,7 @@ description: |
 data_source:
   - Cisco Network Visibility Module Flow Data
 search: |
-  `cisco_network_visibility_module_flowdata`
+ `cisco_network_visibility_module_flowdata`
 
   ``` Usually the initiator of the connection is the child process, meaning the parent will contain the suspicious command.``` 
 
@@ -40,7 +40,7 @@ search: |
   | rex field=parent_process_arguments "(?i)\\b(?:https?|ftp)://(?<extracted_ip_parent>(?:\\d{1,3}\\.){3}\\d{1,3})"
   | rex field=process_arguments "(?i)\\b(?:https?|ftp)://(?<extracted_ip_child>(?:\\d{1,3}\\.){3}\\d{1,3})"
   | eval direct_ip_match=if(dest == extracted_ip_child, 1, if(dest == extracted_ip_parent, 1, 0))
-  
+
   | where (
       dest_hostname IN (
           "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*",
@@ -53,7 +53,7 @@ search: |
       )
       OR direct_ip_match = 1
     )
-  
+
   | stats count min(_time) as firstTime max(_time) as lastTime
           values(parent_process_arguments) as parent_process_arguments
           values(process_arguments) as process_arguments
@@ -64,11 +64,11 @@ search: |
           values(dest_port) as dest_port
           values(aliul) as additional_logged_in_users_list
           values(dest_hostname) as dest_hostname
-          by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
+          by src dest parent_process_path parent_process_name parent_process_integrity_level process_path process_name process_integrity_level process_id transport
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | table
-    parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
+    parent_process_integrity_level parent_process_path parent_process_name parent_process_arguments parent_process_hash
     process_integrity_level process_path process_name process_arguments process_hash process_id
     additional_logged_in_users_list module_name_list module_hash_list
     src dest_hostname dest dest_port transport firstTime lastTime