diff --git a/contentctl.yml b/contentctl.yml index d7ed077e3c..6b1f9b54b2 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -38,9 +38,9 @@ apps: - uid: 6553 title: Splunk Add-on for Okta Identity Cloud appid: Splunk_TA_okta_identity_cloud - version: 3.0.0 + version: 4.0.0 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_300.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_400.tgz - uid: 7404 title: Cisco Security Cloud appid: CiscoSecurityCloud @@ -229,8 +229,11 @@ apps: title: Cisco NVM Add-on for Splunk appid: TA-Cisco-NVM version: 4.0.7 - description: The Cisco Endpoint Security Analytics (CESA) Add-On for Splunk allows IT administrators to analyze and correlate user and endpoint behavior in Splunk Enterprise. - This Add-on provides configuration and collection of data from the Cisco AnyConnect Network Visibility Module IPFIX (nvzFlow) Collector. - This module collects additional context such as user, device, application, location and destination for flows both on and off premise. + description: The Cisco Endpoint Security Analytics (CESA) Add-On for Splunk allows + IT administrators to analyze and correlate user and endpoint behavior in Splunk + Enterprise. This Add-on provides configuration and collection of data from the + Cisco AnyConnect Network Visibility Module IPFIX (nvzFlow) Collector. This module + collects additional context such as user, device, application, location and destination + for flows both on and off premise. hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-endpoint-security-analytics-cesa-add-on-for-splunk_407.tgz githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 64071d80af..2fbd630605 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,8 +16,8 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 3.0.0 + version: 4.0.0 output_fields: - dest - src -- user \ No newline at end of file +- user diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 52f30f90f2..f9884d15ef 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -34,14 +34,13 @@ search: | values(dest_port) as dest_port values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname - by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport + by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport package_name comment package_official_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table + | table firstTime lastTime src dest_hostname dest dest_port transport package_name comment package_official_url parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list - src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___installation_of_typosquatted_python_package_filter` how_to_implement: | This search requires Network Visibility Module logs, which includes the flow data sourcetype. diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index ac7c7c6304..c3898b7a5f 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -13,7 +13,7 @@ description: | data_source: - Cisco Network Visibility Module Flow Data search: | - `cisco_network_visibility_module_flowdata` + `cisco_network_visibility_module_flowdata` ``` Usually the initiator of the connection is the child process, meaning the parent will contain the suspicious command.``` @@ -40,7 +40,7 @@ search: | | rex field=parent_process_arguments "(?i)\\b(?:https?|ftp)://(?(?:\\d{1,3}\\.){3}\\d{1,3})" | rex field=process_arguments "(?i)\\b(?:https?|ftp)://(?(?:\\d{1,3}\\.){3}\\d{1,3})" | eval direct_ip_match=if(dest == extracted_ip_child, 1, if(dest == extracted_ip_parent, 1, 0)) - + | where ( dest_hostname IN ( "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", @@ -53,7 +53,7 @@ search: | ) OR direct_ip_match = 1 ) - + | stats count min(_time) as firstTime max(_time) as lastTime values(parent_process_arguments) as parent_process_arguments values(process_arguments) as process_arguments @@ -64,11 +64,11 @@ search: | values(dest_port) as dest_port values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname - by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport + by src dest parent_process_path parent_process_name parent_process_integrity_level process_path process_name process_integrity_level process_id transport | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table - parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash + parent_process_integrity_level parent_process_path parent_process_name parent_process_arguments parent_process_hash process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime