app inspect failures fixes

baselines/discover_dns_records.yml

@@ -18,7 +18,7 @@ search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T ci
   DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query |
   where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"] | makemv
   delim=" " answer |  makemv delim=" " type | sort -count | table count,domain,type,query,answer
-  | outputlookup createinapp=true discovered_dns_records.csv'
+  | outputlookup createinapp=true discovered_dns_records'
 tags:
   analytics_story:
   - DNS Hijacking

detections/network/dns_record_changed.yml

@@ -20,7 +20,7 @@ how_to_implement: "To successfully implement this search you will need to ensure
   \n"
 type: ESCU
 author: Jose Hernandez, Splunk
-search: '| inputlookup discovered_dns_records.csv | rename answer as discovered_answer
+search: '| inputlookup discovered_dns_records | rename answer as discovered_answer
   | join domain[|tstats `security_content_summariesonly` count values(DNS.record_type)
   as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution
   where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query

lookups/discovered_dns_records.csv

@@ -0,0 +1 @@
+count,domain,type,query,answer

lookups/ransomware_extensions.csv

@@ -106,7 +106,7 @@ Extensions,Name
 .kostya,Kostya
 .kratos,KratosCrypt
 .LeChiffre,LeChiffre
-.locky
+.locky,Locky
 .zepto,Locky
 .odin,Locky
 .shit,Locky
@@ -289,4 +289,4 @@ Extensions,Name
 .wnry,WannaCry
 .wncryt,WannaCry
 .WNCRYT,WannaCry
-.RYK,Ryuk
+.RYK,Ryuk

macros/clients_connecting_to_multiple_dns_servers.yml

@@ -1,3 +0,0 @@
-description: Use this macro to add additional filters for monitoring clients connecting to multiple dns servers 
-name: clients_connecting_to_multiple_dns_servers_output_filter
-definition: search *

macros/create_or_delete_windows_shares.yml

@@ -1,3 +0,0 @@
-definition: search *
-description: Use this macro to add additional filter for create or delete windows shares
-name: create_or_delete_windows_shares_filter

macros/detect_traffic_mirroring_filter.yml

@@ -1,3 +0,0 @@
-definition: search *
-description: Use this macro to add additional filters to prevent i.e. false positives
-name: detect_traffic_mirroring_filter

macros/ec2_excessive_runinstances_mltk_input_filter.yml

@@ -1,3 +0,0 @@
-definition: search *
-description: Use this macro to add additional filters
-name: ec2_excessive_runinstances_mltk_input_filter

macros/ec2_excessive_terminateinstances_mltk_input_filter.yml

@@ -1,3 +0,0 @@
-definition: search *
-description: Use this macro to add additional filters
-name: ec2_excessive_terminateinstances_mltk_input_filter