Branch was auto-updated.

.circleci/config.yml

@@ -11,7 +11,7 @@
 
 version: 2.1
 orbs:
-  aws-cli: circleci/aws-cli@0.1.19
+  aws-cli: circleci/aws-cli@2.0.3
 
 dependencies:
   cache_directories:
@@ -365,6 +365,24 @@ jobs:
                 git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
             fi
       - run: *apt-install
+      - run:
+          name: install python dependencies
+          command: |
+            cd security-content
+            rm -rf venv
+            virtualenv --python=/usr/bin/python3 --clear venv
+            source venv/bin/activate
+            pip install -q -r requirements.txt
+      - save_cache:
+          key: virtualenv
+          paths:
+            - "/security-content/venv"
+      - run:
+          name: create baseline folder
+          command: |
+            cd security-content
+            source venv/bin/activate
+            python bin/create_baseline_folder.py   
       - aws-cli/setup:
           profile-name: default
       - run:

bin/create_baseline_folder.py

@@ -0,0 +1,52 @@
+#!/usr/bin/python
+
+import glob
+import yaml
+import os
+from os import path
+import sys
+
+
+def load_objects(file_path, REPO_PATH):
+    files = []
+    manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
+    for file in sorted(glob.glob(manifest_files)):
+        files.append(load_file(file))
+    return files
+
+
+def load_file(file_path):
+    with open(file_path, 'r', encoding="utf-8") as stream:
+        try:
+            file = list(yaml.safe_load_all(stream))[0]
+        except yaml.YAMLError as exc:
+            print(exc)
+            sys.exit("ERROR: reading {0}".format(file_path))
+    return file
+
+
+def main(args):
+    print("copy baselines into it's own folder")
+
+    # process all detections
+    REPO_PATH = os.path.join(os.path.dirname(__file__), '../')
+    detections = []
+    detections = load_objects("detections/application/*.yml", REPO_PATH)
+    detections.extend(load_objects("detections/cloud/*.yml", REPO_PATH))
+    detections.extend(load_objects("detections/endpoint/*.yml", REPO_PATH))
+    detections.extend(load_objects("detections/network/*.yml", REPO_PATH))
+    detections.extend(load_objects("detections/web/*.yml", REPO_PATH))
+
+    baselines = []
+    os.mkdir('baselines')
+
+    for detection in detections:
+        if detection['type'] == 'Baseline':
+            baseline_file_name =  detection['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
+            file = open("baselines/" + baseline_file_name + ".yml", "w")
+            yaml.dump(detection, file)
+            file.close()
+
+
+if __name__ == "__main__":
+    main(sys.argv[1:])

bin/generate.py

@@ -88,16 +88,13 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH):
 
     return output_path
 
-def generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH):
+def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH):
     '''
     @param detections: input list of individual YAML detections in detections/ directory
-    @param response_tasks:
-    @param baselines:
     @param deployments:
     @return: the savedsearches.conf file located in package/default/
     '''
 
-
     utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
 
     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
@@ -105,14 +102,14 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
     j2_env.filters['custom_jinja2_enrichment_filter'] = custom_jinja2_enrichment_filter
     template = j2_env.get_template('savedsearches.j2')
     output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf')
-    output = template.render(detections=detections, baselines=baselines, response_tasks=response_tasks, time=utc_time)
+    output = template.render(detections=detections, time=utc_time)
     with open(output_path, 'w') as f:
         output = output.encode('ascii', 'ignore').decode('ascii')
         f.write(output)
 
     return output_path
 
-def generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
+def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
     utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
 
     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
@@ -125,7 +122,7 @@ def generate_analytic_story_conf(stories, detections, response_tasks, baselines,
 
     return output_path
 
-def generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
+def generate_use_case_library_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
     utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
 
     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
@@ -133,8 +130,7 @@ def generate_use_case_library_conf(stories, detections, response_tasks, baseline
     template = j2_env.get_template('use_case_library.j2')
     output_path = path.join(OUTPUT_PATH, 'default/use_case_library.conf')
     output = template.render(stories=stories, detections=detections,
-                             response_tasks=response_tasks,
-                             baselines=baselines, time=utc_time)
+                             time=utc_time)
     with open(output_path, 'w', encoding="utf-8") as f:
         f.write(output)
 
@@ -167,23 +163,24 @@ def generate_macros_conf(macros, detections, TEMPLATE_PATH, OUTPUT_PATH):
 def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PATH):
     workbench_panel_objects = []
     for response_task in response_tasks:
-        if 'search' in response_task:
-            if 'inputs' in response_task:
-                response_file_name = response_task['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
-                response_file_name_xml = response_file_name + "___response_task.xml"
-                response_task['lowercase_name'] = response_file_name
-                workbench_panel_objects.append(response_task)
-                j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
-                                     trim_blocks=True)
-                template = j2_env.get_template('panel.j2')
-                file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml
-                output_path = path.join(OUTPUT_PATH, file_path)
-                response_task['search']= response_task['search'].replace(">",">")
-                response_task['search']= response_task['search'].replace("<","&lt;")
+        if response_task['type'] == 'Investigation':
+            if 'search' in response_task:
+                if 'inputs' in response_task:
+                    response_file_name = response_task['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
+                    response_file_name_xml = response_file_name + "___response_task.xml"
+                    response_task['lowercase_name'] = response_file_name
+                    workbench_panel_objects.append(response_task)
+                    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
+                                        trim_blocks=True)
+                    template = j2_env.get_template('panel.j2')
+                    file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml
+                    output_path = path.join(OUTPUT_PATH, file_path)
+                    response_task['search']= response_task['search'].replace(">","&gt;")
+                    response_task['search']= response_task['search'].replace("<","&lt;")
 
-                output = template.render(search=response_task['search'])
-                with open(output_path, 'w') as f:
-                    f.write(output)
+                    output = template.render(search=response_task['search'])
+                    with open(output_path, 'w') as f:
+                        f.write(output)
 
     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
                          trim_blocks=True)
@@ -202,7 +199,6 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT
 
     return workbench_panel_objects
 
-
 def parse_data_models_from_search(search):
     match = re.search(r'from\sdatamodel\s?=\s?([^\s.]*)', search)
     if match is not None:
@@ -224,7 +220,6 @@ def parse_author_company(story):
 
     return match_author, match_company
 
-
 def get_deployments(object, deployments):
     matched_deployments = []
 
@@ -277,18 +272,19 @@ def get_nes_fields(search, deployment):
 def map_response_tasks_to_stories(response_tasks):
     sto_res = {}
     for response_task in response_tasks:
-        if 'tags' in response_task:
-            if 'analytic_story' in response_task['tags']:
-                for story in response_task['tags']['analytic_story']:
-                    if 'type' in response_task.keys():
-                        if response_task['type'] == 'response':
+        if response_task['type'] == 'Investigation':
+            if 'tags' in response_task:
+                if 'analytic_story' in response_task['tags']:
+                    for story in response_task['tags']['analytic_story']:
+                        if 'type' in response_task.keys():
+                            if response_task['type'] == 'Investigation':
+                                task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
+                        else:
                             task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
-                    else:
-                        task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
-                    if not (story in sto_res):
-                        sto_res[story] = {task_name}
-                    else:
-                        sto_res[story].add(task_name)
+                        if not (story in sto_res):
+                            sto_res[story] = {task_name}
+                        else:
+                            sto_res[story].add(task_name)
     return sto_res
 
 def map_baselines_to_stories(baselines):
@@ -297,11 +293,9 @@ def map_baselines_to_stories(baselines):
         if 'tags' in baseline:
             if 'analytic_story' in baseline['tags']:
                 for story in baseline['tags']['analytic_story']:
-                    if 'type' in baseline.keys():
-                        if baseline['type'] == 'batch':
-                            baseline_name = str('ESCU - ' + baseline['name'])
-                    else:
-                        baseline_name = str('ESCU - ' + baseline['name'])
+                    if 'Splunk Behavioral Analytics' in baseline['tags']['product']:
+                        continue
+                    baseline_name = str('ESCU - ' + baseline['name'])
                     if not (story in sto_bas):
                         sto_bas[story] = {baseline_name}
                     else:
@@ -404,59 +398,38 @@ def prepare_detections(detections, deployments, OUTPUT_PATH):
         if data_model:
             detection['data_model'] = data_model
 
-        matched_deployment = get_deployments(detection, deployments)
-        detection['deployment'] = matched_deployment
-        nes_fields = get_nes_fields(detection['search'], detection['deployment'])
-        if len(nes_fields) > 0:
-            detection['nes_fields'] = nes_fields
+        if detection['type'] != 'Investigation':
+            matched_deployment = get_deployments(detection, deployments)
+            detection['deployment'] = matched_deployment
+            nes_fields = get_nes_fields(detection['search'], detection['deployment'])
+            if len(nes_fields) > 0:
+                detection['nes_fields'] = nes_fields
 
-        keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
-        mappings = {}
-        for key in keys:
-            if key == 'mitre_attack':
-                if 'mitre_attack_id' in detection['tags']:
-                    mappings[key] = detection['tags']['mitre_attack_id']
-            else:
-                if key in detection['tags']:
-                    mappings[key] = detection['tags'][key]
-        detection['mappings'] = mappings
+            keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
+            mappings = {}
+            for key in keys:
+                if key == 'mitre_attack':
+                    if 'mitre_attack_id' in detection['tags']:
+                        mappings[key] = detection['tags']['mitre_attack_id']
+                else:
+                    if key in detection['tags']:
+                        mappings[key] = detection['tags'][key]
+            detection['mappings'] = mappings
 
-        detection = add_annotations(detection)
-        detection = add_rba(detection)
+            detection = add_annotations(detection)
+            detection = add_rba(detection)
 
-        # add additional metadata
-        if 'product' in detection['tags']:
-            detection['product'] = detection['tags']['product']
+            # add additional metadata
+            if 'product' in detection['tags']:
+                detection['product'] = detection['tags']['product']
 
-        # turn all SAAWS detections
-        if (OUTPUT_PATH) == 'dist/saaws':
-            detection['disabled'] = 'false'
+            # turn all SAAWS detections
+            if (OUTPUT_PATH) == 'dist/saaws':
+                detection['disabled'] = 'false'
 
     return detections
 
-def prepare_baselines(baselines, deployments, OUTPUT_PATH):
-    for baseline in baselines:
-        data_model = parse_data_models_from_search(baseline['search'])
-        if data_model:
-            baseline['data_model'] = data_model
-        if (OUTPUT_PATH) == 'dist/saaws':
-            baseline['disabled'] = 'false'
-
-        matched_deployment = get_deployments(baseline, deployments)
-        baseline['deployment'] = matched_deployment
-
-    return baselines
-
-def prepare_response_tasks(response_tasks):
-    for response_task in response_tasks:
-        if 'search' in response_task:
-            data_model = parse_data_models_from_search(response_task['search'])
-            if data_model:
-                response_task['data_model'] = data_model
-
-    return response_tasks
-
-def prepare_stories(stories, detections, response_tasks, baselines):
+def prepare_stories(stories, detections):
     # enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists
     sto_to_data_models = {}
     sto_to_mitre_attack_ids = {}
@@ -464,14 +437,15 @@ def prepare_stories(stories, detections, response_tasks, baselines):
     sto_to_ciss = {}
     sto_to_nists = {}
     sto_to_det = {}
+
+    baselines = [object for object in detections  if 'Baseline' in object['type']]
+
     for detection in detections:
+        if detection['type'] == 'Baseline':
+            continue
         if 'analytic_story' in detection['tags']:
             for story in detection['tags']['analytic_story']:
-                if 'type' in detection.keys():
-                    if detection['type'] == 'batch':
-                        rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
-                else:
-                    rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
+                rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
 
                 if story in sto_to_det.keys():
                     sto_to_det[story].add(rule_name)
@@ -513,7 +487,7 @@ def prepare_stories(stories, detections, response_tasks, baselines):
                     else:
                         sto_to_nists[story] = set(detection['tags']['nist'])
 
-    sto_res = map_response_tasks_to_stories(response_tasks)
+    sto_res = map_response_tasks_to_stories(detections)
     sto_bas = map_baselines_to_stories(baselines)
 
     for story in stories:
@@ -552,7 +526,6 @@ def prepare_stories(stories, detections, response_tasks, baselines):
 
     return stories
 
-
 def generate_mitre_lookup(OUTPUT_PATH):
 
     csv_mitre_rows = [["mitre_id", "technique", "tactics", "groups"]]
@@ -585,9 +558,7 @@ def import_objects(VERBOSE, REPO_PATH):
         "stories": load_objects("stories/*.yml", VERBOSE, REPO_PATH),
         "macros": load_objects("macros/*.yml", VERBOSE, REPO_PATH),
         "lookups": load_objects("lookups/*.yml", VERBOSE, REPO_PATH),
-        "baselines": load_objects("baselines/*.yml", VERBOSE, REPO_PATH),
         "responses": load_objects("responses/*.yml", VERBOSE, REPO_PATH),
-        "response_tasks": load_objects("response_tasks/*.yml", VERBOSE, REPO_PATH),
         "deployments": load_objects("deployments/*.yml", VERBOSE, REPO_PATH),
         "detections": load_objects("detections/*/*.yml", VERBOSE, REPO_PATH),
     }
@@ -599,22 +570,16 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
     if PRODUCT == "SAAWS":
         objects["detections"]  = [object for object in objects["detections"]  if 'Splunk Security Analytics for AWS' in object['tags']['product']]
         objects["stories"] = [object for object in objects["stories"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
-        objects["baselines"] = [object for object in objects["baselines"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
-        objects["response_tasks"] = [object for object in objects["response_tasks"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
 
     # only use ESCU detections to the configurations
-    objects["detections"] = sorted(filter(lambda d: d['type'].lower() == 'batch', objects["detections"]), key=lambda d: d['name'])
+    objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
     # only use ESCU stories to the configuration
-    objects["stories"] = sorted(filter(lambda s: s['type'].lower() == 'batch', objects["stories"]), key=lambda s: s['name'])
+    objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
 
-    objects["response_tasks"] = sorted(objects["response_tasks"], key=lambda i: i['name'])
-    objects["baselines"] = sorted(objects["baselines"], key=lambda b: b['name'])
     objects["macros"] = sorted(objects["macros"], key=lambda m: m['name'])
 
     objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH)
-    objects["baselines"] = prepare_baselines(objects["baselines"], objects["deployments"], OUTPUT_PATH)
-    objects["response_tasks"] = prepare_response_tasks(objects["response_tasks"])
-    objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"])
+    objects["stories"] = prepare_stories(objects["stories"], objects["detections"])
 
     return objects
 
@@ -641,15 +606,15 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
     lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
 
-    detection_path = generate_savedsearches_conf(objects["detections"], objects["response_tasks"], objects["baselines"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
+    detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
 
-    story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"], TEMPLATE_PATH, OUTPUT_PATH)
+    story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
 
-    use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"], TEMPLATE_PATH, OUTPUT_PATH)
+    use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
 
     macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
 
-    workbench_panels_objects = generate_workbench_panels(objects["response_tasks"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
+    workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
 
     # calculate deprecation totals
     deprecated = []
@@ -661,8 +626,6 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
         print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path))
         print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
         print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
-        print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path))
-        print("{0} baselines have been successfully written to {1}".format(len(objects["baselines"]), detection_path))
         print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
         print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
         print("security content generation completed..")

bin/jinja2_templates/savedsearches.j2

@@ -8,6 +8,7 @@
 ### ESCU DETECTIONS ###
 
 {% for detection in detections %}
+{% if (detection.type == 'TTP' or detection.type == 'Anomaly' or detection.type == 'Hunting' or detection.type == 'Correlation') %}
 [ESCU - {{ detection.name }} - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -32,7 +33,7 @@ action.escu.known_false_positives = None
 action.escu.creation_date = {{ detection.date }}
 action.escu.modification_date = {{ detection.date }}
 action.escu.confidence = high
-action.escu.full_search_name = ESCU - {{ detection.name }} - Rule
+action.escu.full_search_name = ESCU - {{ detection.name }} - Rule
 action.escu.search_type = detection
 {% if detection.product is defined %}
 action.escu.product = {{ detection.product | tojson }}
@@ -58,9 +59,9 @@ dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
 dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
 action.correlationsearch.enabled = 1
 {% if detection.deprecated is defined %}
-action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
+action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
 {% else %}
-action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
+action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
 {% endif %}
 action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
 {% if detection.deployment.scheduling.schedule_window is defined %}
@@ -70,11 +71,11 @@ schedule_window = {{ detection.deployment.scheduling.schedule_window }}
 {% if detection.deployment.alert_action.notable is defined %}
 action.notable = 1
 {% if detection.nes_fields is defined %}
-action.notable.param.nes_fields = {{ detection.nes_fields }}
+action.notable.param.nes_fields = {{ detection.nes_fields }}
 {% endif %}
 action.notable.param.rule_description = {{ detection.deployment.alert_action.notable.rule_description | custom_jinja2_enrichment_filter(detection) }}
 action.notable.param.rule_title = {{ detection.deployment.alert_action.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}
-action.notable.param.security_domain = {{ detection.tags.security_domain }}
+action.notable.param.security_domain = {{ detection.tags.security_domain }}
 action.notable.param.severity = high
 {% endif %}
 {% if detection.deployment.alert_action.email is defined %}
@@ -97,95 +98,100 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = {{ detection.search }}
+search = {{ detection.search }}
 
+{% endif %}
 {% endfor %}
 ### END ESCU DETECTIONS ###
 
 
 ### ESCU BASELINES ###
 
-{% for baseline in baselines %}
-[ESCU - {{ baseline.name }}]
+{% for detection in detections %}
+{% if (detection.type == 'Baseline') %}
+[ESCU - {{ detection.name }}]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
-action.escu.full_search_name = ESCU - {{ baseline.name }}
-description = {{ baseline.description }}
-action.escu.creation_date = {{ baseline.date }}
-action.escu.modification_date = {{ baseline.date }}
-{% if baseline.tags.analytic_story is defined %}
-action.escu.analytic_story = {{ baseline.tags.analytic_story | tojson }}
+action.escu.full_search_name = ESCU - {{ detection.name }}
+description = {{ detection.description }}
+action.escu.creation_date = {{ detection.date }}
+action.escu.modification_date = {{ detection.date }}
+{% if detection.tags.analytic_story is defined %}
+action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
 {% else %}
 action.escu.analytic_story = []
 {% endif %}
-{% if baseline.data_model is defined %}
-action.escu.data_models = [{{ baseline.data_model | tojson }}]
+{% if detection.data_model is defined %}
+action.escu.data_models = [{{ detection.data_model | tojson }}]
 {% else %}
 action.escu.data_models = []
 {% endif %}
-cron_schedule = {{ baseline.deployment.scheduling.cron_schedule }}
+cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
 enableSched = 1
-dispatch.earliest_time = {{ baseline.deployment.scheduling.earliest_time }}
-dispatch.latest_time = {{ baseline.deployment.scheduling.latest_time }}
-{% if baseline.deployment.scheduling.schedule_window is defined %}
-schedule_window = {{ baseline.deployment.scheduling.schedule_window }}
+dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
+dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
+{% if detection.deployment.scheduling.schedule_window is defined %}
+schedule_window = {{ detection.deployment.scheduling.schedule_window }}
 {% endif %}
-{% if baseline.providing_technologies is defined %}
-action.escu.providing_technologies = {{ baseline.providing_technologies | tojson }}
+{% if detection.providing_technologies is defined %}
+action.escu.providing_technologies = {{ detection.providing_technologies | tojson }}
 {% else %}
 action.escu.providing_technologies = []
 {% endif %}
-action.escu.eli5 = {{ baseline.description }}
-{% if baseline.how_to_implement is defined %}
-action.escu.how_to_implement = {{ baseline.how_to_implement }}
+action.escu.eli5 = {{ detection.description }}
+{% if detection.how_to_implement is defined %}
+action.escu.how_to_implement = {{ detection.how_to_implement }}
 {% else %}
 action.escu.how_to_implement = none
 {% endif %}
-{% if baseline.disabled is defined %}
+{% if detection.disabled is defined %}
 disabled = false
 {% else %}
 disabled = true
 {% endif %}
 is_visible = false
-search = {{ baseline.search }}
+search = {{ detection.search }}
 
+{% endif %}
 {% endfor %}
 
 
 ### ESCU RESPONSE TASKS ###
 
-{% for response_task in response_tasks %}
-{% if response_task.search is defined %}
-[ESCU - {{ response_task.name }} - Response Task]
+{% for detection in detections %}
+{% if (detection.type == 'Investigation') %}
+{% if detection.search is defined %}
+[ESCU - {{ detection.name }} - Response Task]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
-action.escu.full_search_name = ESCU - {{ response_task.name }} - Response Task
-description = {{ response_task.description }}
-action.escu.creation_date = {{ response_task.date }}
-action.escu.modification_date = {{ response_task.date }}
-{% if response_task.tags is defined %}
-action.escu.analytic_story = {{ response_task.tags.analytic_story | tojson }}
+action.escu.full_search_name = ESCU - {{ detection.name }} - Response Task
+description = {{ detection.description }}
+action.escu.creation_date = {{ detection.date }}
+action.escu.modification_date = {{ detection.date }}
+{% if detection.tags is defined %}
+action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
 {% else %}
 action.escu.analytic_story = []
 {% endif %}
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
-{% if response_task.data_model is defined %}
-action.escu.data_models = [{{ response_task.data_model | tojson}}]
+{% if detection.data_model is defined %}
+action.escu.data_models = [{{ detection.data_model | tojson}}]
 {% else %}
 action.escu.data_models = []
 {% endif %}
-action.escu.eli5 = {{ response_task.description }}
+action.escu.eli5 = {{ detection.description }}
 action.escu.how_to_implement = none
 action.escu.known_false_positives = None at this time
 disabled = true
 schedule_window = auto
 is_visible = false
-search = {{ response_task.search }}
+search = {{ detection.search }}
 
+{% endif %}
 {% endif %}
 {% endfor %}
 
@@ -263,3 +269,4 @@ search = index=_audit sourcetype="audittrail" \
 | table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
 
 ### END OF USAGE DASHBOARD CONFIGURATIONS ###
+

bin/jinja2_templates/use_case_library.j2

@@ -27,6 +27,7 @@ narrative = {{ story.narrative }}
 ### DETECTIONS ###
 
 {% for detection in detections %}
+{% if (detection.type == 'TTP' or detection.type == 'Anomaly' or detection.type == 'Hunting' or detection.type == 'Correlation') %}
 [savedsearch://ESCU - {{ detection.name }} - Rule]
 type = detection
 asset_type = {{ detection.tags.asset_type }}
@@ -41,17 +42,19 @@ annotations = {{ detection.mappings | tojson }}
 known_false_positives = {{ detection.known_false_positives }}
 providing_technologies = []
 
+{% endif %}
 {% endfor %}
 ### END DETECTIONS ###
 
 ### RESPONSE TASKS ###
 
-{% for response_task in response_tasks %}
-[savedsearch://ESCU - {{ response_task.name }} - Response Task]
+{% for detection in detections %}
+{% if (detection.type == 'Investigation') %}
+[savedsearch://ESCU - {{ detection.name }} - Response Task]
 type = investigation
 explanation = none
-{% if response_task.how_to_implement is defined %}
-how_to_implement = {{ response_task.how_to_implement }}
+{% if detection.how_to_implement is defined %}
+how_to_implement = {{ detection.how_to_implement }}
 {% else %}
 how_to_implement = none
 {% endif %}
@@ -59,25 +62,7 @@ known_false_positives = not defined
 earliest_time_offset = 14400
 latest_time_offset = 0
 
+{% endif %}
 {% endfor %}
 ### END RESPONSE TASKS ###
 
-### BASELINES ###
-{% for baseline in baselines %}
-[savedsearch://ESCU - {{ baseline.name }}]
-type = support
-explanation = {{ baseline.description }}
-{% if baseline.how_to_implement is defined %}
-how_to_implement = {{ baseline.how_to_implement }}
-{% else %}
-how_to_implement = none
-{% endif %}
-{% if baseline.known_false_positives is defined %}
-known_false_positives = {{ baseline.known_false_positives }}
-{% else %}
-known_false_positives = not defined
-{% endif %}
-providing_technologies = none
-
-{% endfor %}
-### END ESCU BASELINES ###

bin/reporting.py

@@ -47,22 +47,26 @@ def main(args):
     # detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
     # detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
     count_detections_all = len(detections_all)
-    print("detection count: {}".format(count_detections_all))
 
     tests = load_objects("tests/*/*.yml", REPO_PATH)
-    print("test count: {}".format(len(tests)))
 
     counter_tests=0
     counter_detection=0
 
     for detection in detections:
-        counter_detection=counter_detection+1
+        if detection['type'] != 'Baseline' and detection['type'] != 'Investigation':
+            counter_detection=counter_detection+1
 
     for test in tests:
         counter_tests=counter_tests+1
 
-    detection_coverage = "{:.0%}".format(counter_detection/counter_tests)
+    detection_coverage_tmp = counter_detection/counter_tests
+    if detection_coverage_tmp > 1:
+        detection_coverage_tmp = 1
+    detection_coverage = "{:.0%}".format(detection_coverage_tmp)
 
+    print("detection count: {}".format(counter_detection))
+    print("test count: {}".format(counter_tests))
     print("detection_coverage {}".format(detection_coverage))
 
     TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')

bin/reporting/detection_count.svg

@@ -13,6 +13,6 @@
 <rect rx="3" width="105" height="20" fill="url(#a)"/>
 <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="30" y="14">detections</text>
-    <text x="83" y="14">368</text>
+    <text x="83" y="14">514</text>
 </g>
 </svg>

bin/reporting/detection_coverage.svg

@@ -13,6 +13,6 @@
 <rect rx="3" width="100" height="20" fill="url(#a)"/>
 <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="30" y="14">coverage</text>
-    <text x="80" y="14">99%</text>
+    <text x="80" y="14">100%</text>
 </g>
 </svg>

bin/validate.py

@@ -73,19 +73,16 @@ def validate_objects(REPO_PATH, objects, verbose):
     for lookup in objects['lookups']:
         errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup)
 
-    objects_array = objects['stories'] + objects['detections'] + objects['baselines'] + objects['response_tasks'] + objects['responses']
+    objects_array = objects['stories'] + objects['detections'] + objects['response_tasks'] + objects['responses']
     for object in objects_array:
         validation_errors, uuids = validate_standard_fields(object, uuids)
         errors = errors + validation_errors
 
     for object in objects['detections']:
-        if object['type'] == 'batch':
+        if not 'Splunk Behavioral Analytics' in object['tags']['product']:
             errors = errors + validate_detection_search(object, objects['macros'])
             errors = errors + validate_fields(object)
 
-    for object in objects['baselines']:
-        errors = errors + validate_baseline_search(object, objects['macros'])
-
     for object in objects['tests']:
         errors = errors + validate_tests(REPO_PATH, object)
 
@@ -95,6 +92,9 @@ def validate_objects(REPO_PATH, objects, verbose):
 def validate_fields(object):
     errors = []
 
+    if object['type'] not in ['TTP', 'Anomaly', 'Hunting', 'Baseline', 'Investigation', 'Correlation']:
+        errors.append('ERROR: invalid type [TTP, Anomaly, Hunting, Baseline, Investigation, Correlation] for object: %s' % object['name'])
+
     if 'tags' in object:
 
         # check if required_fields is present
@@ -122,8 +122,9 @@ def validate_standard_fields(object, uuids):
     else:
         uuids.append(object['id'])
 
-    if (object['type']) == 'batch' and len(object['name']) > 75:
-        errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name']))
+    if 'products' in object['tags']: 
+        if (not 'Splunk Behavioral Analytics' in object['tags']['products']) and len(object['name']) > 75:
+            errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name']))
 
     # if object['name'].endswith(" "):
     #     errors.append(
@@ -183,8 +184,12 @@ def validate_standard_fields(object, uuids):
 def validate_detection_search(object, macros):
     errors = []
 
-    if not '_filter' in object['search']:
-        errors.append("ERROR: Missing filter for detection: " + object['name'])
+    if not (object['type'] == "Baseline" or object['type'] == "Investigation"):
+        if not '_filter' in object['search']:
+            errors.append("ERROR: Missing filter for detection: " + object['name'])
+    elif object['type'] == "Baseline":
+        if not 'deployments' in object['tags']:
+            errors.append("ERROR: Baseline need a corresponsing deployments: " + object['name'])
 
     filter_macro = re.search("([a-z0-9_]*_filter)", object['search'])
 
@@ -212,30 +217,6 @@ def validate_detection_search(object, macros):
 
     return errors
 
-def validate_baseline_search(object, macros):
-    errors = []
-
-    if any(x in object['search'] for x in ['eventtype=', 'sourcetype=', ' source=', 'index=']):
-        if not 'index=_internal' in object['search']:
-            errors.append("ERROR: Use source macro instead of eventtype, sourcetype, source or index in detection: " + object['name'])
-
-    macros_found = re.findall('\`([^\s]+)`',object['search'])
-    macros_filtered = []
-    for macro in macros_found:
-        if not '_filter' in macro and not 'security_content_ctime' in macro and not 'drop_dm_object_name' in macro and not 'cim_' in macro and not 'get_' in macro:
-            macros_filtered.append(macro)
-
-    for macro in macros_filtered:
-        found_macro = False
-        for macro_obj in macros:
-            if macro_obj['name'] == macro:
-                found_macro = True
-
-        if not found_macro:
-            errors.append("ERROR: macro definition for " + macro + " can't be found for detection " + object['name'])
-
-    return errors
-
 
 def validate_lookups_content(REPO_PATH, lookup_path, lookup):
     errors = []
@@ -263,7 +244,7 @@ def validate_tests(REPO_PATH, object):
 
 def main(REPO_PATH, verbose):
 
-    validation_objects = ['macros','lookups','stories','detections','baselines','response_tasks','responses','deployments', 'tests']
+    validation_objects = ['macros','lookups','stories','detections','response_tasks','responses','deployments', 'tests']
 
     objects = {}
     schema_error = False

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -3,7 +3,7 @@ id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
 version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search will detect a spike in the number of API calls made to your

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -3,7 +3,7 @@ id: d4dfb7f3-7a37-498a-b5df-f19334e871af
 version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search will detect a spike in the number of API calls made to your

detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml

@@ -1,4 +1,5 @@
 author: Rod Soto, Splunk
+datamodel: []
 date: '2020-04-13'
 description: This search provides investigation data about requests via user agent,
   authentication request URI, verb and cluster name data against Kubernetes cluster
@@ -9,16 +10,26 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: a636cca4-7434-4a15-a278-c70734938e39
 inputs:
 - src_ip
+known_false_positives: ''
 name: Amazon EKS Kubernetes activity by src ip
-search: sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search
+search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search
   src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username)
   values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision
-  src_ip
+  src_ip'
 tags:
   analytic_story:
   - Kubernetes Scanning Activity
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - sourceIPs{}
+  - user.username
+  - requestURI
+  - verb
+  - userAgent
+  - annotations.authorization.k8s.io/decision
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/aws_create_policy_version_to_allow_all_resources.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
 version: 2
 date: '2021-02-22'
 author: Bhavin Patel, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user created a policy
   version that allows them to access any resource in their account

detections/cloud/aws_createaccesskey.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
 version: 2
 date: '2021-07-19'
 author: Bhavin Patel, Splunk
-type: batch
+type: Hunting
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user A who has already
   permission to create access keys, makes an API call to create access keys for another

detections/cloud/aws_createloginprofile.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-11ad-212bf444d111
 version: 2
 date: '2021-07-19'
 author: Bhavin Patel, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user A(victim A)
   creates a login profile for user B, followed by a AWS Console login event from user

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -3,7 +3,7 @@ id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
 version: 1
 date: '2020-05-28'
 author: Rico Valdez, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Authentication
 description: This search looks for AssumeRole events where an IAM role in a different

detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

@@ -3,7 +3,7 @@ id: c79c164f-4b21-4847-98f9-cf6a9f49179e
 version: 1
 date: '2021-01-11'
 author: Rod Soto, Patrick Bareiss Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search provides detection of KMS keys where action kms:Encrypt is
   accessible for everyone (also outside of your organization). This is an indicator

detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml

@@ -3,7 +3,7 @@ id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
 version: 1
 date: '2021-01-11'
 author: Rod Soto, Patrick Bareiss Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search provides detection of users with KMS keys performing encryption
   specifically against S3 buckets.

detections/cloud/aws_excessive_security_scanning.yml

@@ -3,7 +3,7 @@ id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
 version: 1
 date: '2021-04-13'
 author: Patrick Bareiss, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events and analyse the amount of
   eventNames which starts with Describe by a single user. This indicates that this

detections/cloud/aws_iam_accessdenied_discovery_events.yml

@@ -3,7 +3,7 @@ id: 3e1f1568-9633-11eb-a69c-acde48001122
 version: 1
 date: '2021-04-05'
 author: Michael Haag, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: The following detection identifies excessive AccessDenied events within
   an hour timeframe. It is possible that an access key to AWS may have been stolen

detections/cloud/aws_iam_assume_role_policy_brute_force.yml

@@ -3,7 +3,7 @@ id: f19e09b0-9308-11eb-b7ec-acde48001122
 version: 1
 date: '2021-04-01'
 author: Michael Haag, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: The following detection identifies any malformed policy document exceptions
   with a status of `failure`. A malformed policy document exception occurs in instances

detections/cloud/aws_iam_delete_policy.yml

@@ -3,7 +3,7 @@ id: ec3a9362-92fe-11eb-99d0-acde48001122
 version: 1
 date: '2021-04-01'
 author: Michael Haag, Splunk
-type: batch
+type: Hunting
 datamodel: []
 description: The following detection identifes when a policy is deleted on AWS. This
   does not identify whether successful or failed, but the error messages tell a story

detections/cloud/aws_iam_failure_group_deletion.yml

@@ -3,7 +3,7 @@ id: 723b861a-92eb-11eb-93b8-acde48001122
 version: 1
 date: '2021-04-01'
 author: Michael Haag, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This detection identifies failure attempts to delete groups. We want
   to identify when a group is attempting to be deleted, but either access is denied,

detections/cloud/aws_iam_successful_group_deletion.yml

@@ -3,7 +3,7 @@ id: e776d06c-9267-11eb-819b-acde48001122
 version: 1
 date: '2021-03-31'
 author: Michael Haag, Splunk
-type: batch
+type: Hunting
 datamodel: []
 description: The following query uses IAM events to track the success of a group being
   deleted on AWS. This is typically not indicative of malicious behavior, but a precurser

detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2020-06-08'
 description: This search retrieves the all the alerts created by AWS Security Hub
   for a specific dest(instance_id).
@@ -8,12 +9,13 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822
 inputs:
 - dest
+known_false_positives: ''
 name: AWS Investigate Security Hub alerts by dest
-search: sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance
+search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance
   | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance
   as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text
   as Remediation |  table dest Title ProductArn Description FirstObservedAt RecordState
-  Remediation
+  Remediation'
 tags:
   analytic_story:
   - Cloud Compute Instance
@@ -23,5 +25,17 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - findings{}.Resources{}.Type
+  - findings{}.Resources{}.Id
+  - instance
+  - Remediation.Recommendation.Text
+  - Title
+  - ProductArn
+  - Description
+  - FirstObservedAt
+  - RecordState
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml

@@ -1,4 +1,5 @@
 author: David Dorsey, Splunk
+datamodel: []
 date: '2018-06-08'
 description: This search retrieves the times, ARN, source IPs, AWS regions, event
   names, and the result of the event for specific credentials.
@@ -8,8 +9,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: 703b65a4-a0ae-4171-965d-45507506c64f
 inputs:
 - accessKeyId
+known_false_positives: ''
 name: AWS Investigate User Activities By AccessKeyId
-search: '| search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId|
+search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId|
   search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn  | rename
   sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode,
   errorMessage'
@@ -20,5 +22,15 @@ tags:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - userIdentity.accessKeyId
+  - userIdentity.arn
+  - sourceIPAddress
+  - awsRegion
+  - eventName
+  - errorCode
+  - errorMessage
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/aws_investigate_user_activities_by_arn.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2019-04-30'
 description: This search lists all the logged CloudTrail activities by a specific
   user ARN and will create a table containing the source of the user, the region of
@@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72
 inputs:
 - user
+known_false_positives: ''
 name: AWS Investigate User Activities By ARN
-search: '| search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type
+search: '`cloudtrail` | search user=$user$| table _time userIdentity.type
   userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType'
 tags:
   analytic_story:
@@ -31,5 +33,17 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - user
+  - userIdentity.type
+  - userIdentity.userName
+  - userIdentity.arn
+  - aws_account_id
+  - src
+  - awsRegion
+  - eventName
+  - eventType
+  security_domain: network
+type: Investigation
 version: 2

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d6bd75
 version: 2
 date: '2021-01-11'
 author: Bhavin Patel, Patrick Bareiss, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: The search looks for AWS CloudTrail events to detect if any network ACLs
   were created with all the ports open to a specified CIDR.

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d6fd75
 version: 2
 date: '2021-01-12'
 author: Bhavin Patel, Patrick Bareiss, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: Enforcing network-access controls is one of the defensive mechanisms
   used by cloud administrators to restrict access to a cloud instance. After the attacker

detections/cloud/aws_network_acl_details_from_id.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2017-01-22'
 description: This search queries AWS description logs and returns all the information
   about a specific network ACL via network ACL ID
@@ -8,8 +9,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap
 id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
 inputs:
 - networkAclId
+known_false_positives: ''
 name: AWS Network ACL Details from ID
-search: '| search sourcetype=aws:description| rename id as networkAclId | search  networkAclId=$networkAclId$
+search: '`aws_description` | rename id as networkAclId | search  networkAclId=$networkAclId$
   | table id account_id vpc_id network_acl_entries{}.*'
 tags:
   analytic_story:
@@ -19,5 +21,12 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - id
+  - account_id
+  - vpc_id
+  - network_acl_entries{}.*
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/aws_network_interface_details_via_resourceid.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2018-05-07'
 description: This search queries AWS configuration logs and returns the information
   about a specific network interface via network interface ID. The information will
@@ -10,8 +11,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap
 id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
 inputs:
 - resourceId
+known_false_positives: ''
 name: AWS Network Interface details via resourceId
-search: '| search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN
+search: '`aws_config` resourceId=$resourceId$ | table _time ARN
   relationships{}.resourceType relationships{}.name relationships{}.resourceId  configuration.privateIpAddresses{}.privateIpAddress
   configuration.privateIpAddresses{}.association.publicIp'
 tags:
@@ -22,5 +24,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - resourceId
+  - ARN
+  - relationships{}.resourceType
+  - relationships{}.name
+  - relationships{}.resourceId
+  - configuration.privateIpAddresses{}.privateIpAddress
+  - configuration.privateIpAddresses{}.association.publicIp
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/aws_s3_bucket_details_via_bucketname.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2018-06-26'
 description: This search queries AWS configuration logs and returns the information
   about a specific S3 bucket. The information returned includes the time the S3 bucket
@@ -11,8 +12,9 @@ how_to_implement: To implement this search, you must install the AWS App for Spl
 id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242
 inputs:
 - bucketName
+known_false_positives: ''
 name: AWS S3 Bucket details via bucketName
-search: '| search sourcetype=aws:config | rename resourceId as bucketName |search
+search: '`aws_config` | rename resourceId as bucketName |search
   bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action
   aws_account_id supplementaryConfiguration.AccessControlList'
 tags:
@@ -21,5 +23,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - resourceId
+  - bucketName
+  - resourceCreationTime
+  - vendor_region
+  - action
+  - aws_account_id
+  - supplementaryConfiguration.AccessControlList
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/aws_saml_access_by_provider_user_and_principal.yml

@@ -3,7 +3,7 @@ id: bbe23980-6019-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-26'
 author: Rod Soto, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search provides specific SAML access from specific Service Provider,
   user and targeted principal at AWS. This search provides specific information to

detections/cloud/aws_saml_update_identity_provider.yml

@@ -3,7 +3,7 @@ id: 2f0604c6-6030-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-26'
 author: Rod Soto, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search provides detection of updates to SAML provider in AWS. Updates
   to SAML provider need to be monitored closely as they may indicate possible perimeter

detections/cloud/aws_setdefaultpolicyversion.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
 version: 1
 date: '2021-03-02'
 author: Bhavin Patel, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user has set a default
   policy versions. Attackers have been know to use this technique for Privilege Escalation

detections/cloud/aws_updateloginprofile.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
 version: 2
 date: '2021-07-19'
 author: Bhavin Patel, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user A who has already
   permission to update login profile, makes an API call to update login profile for

detections/cloud/baseline_of_api_calls_per_user_arn.yml

@@ -1,9 +1,9 @@
 name: Baseline of API Calls per User ARN
-id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
+id: 4b5119c3-5369-4040-9430-b63b1a314229
 version: 1
 date: '2018-04-09'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls made by each user. Also recorded is the number
@@ -17,13 +17,21 @@ search: '`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - AWS User Monitoring
   detections:
   - Detect Spike in AWS API Activity
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType
+  - userIdentity.arn
+  security_domain: network

detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml

@@ -3,7 +3,7 @@ id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
 version: 1
 date: '2018-05-07'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of outbound connections blocked in your VPC flow logs by
@@ -21,6 +21,7 @@ search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
   logs.`.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -29,7 +30,15 @@ tags:
   - Suspicious AWS Traffic
   detections:
   - Detect Spike in blocked Outbound Traffic from your AWS
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - action
+  - src_ip
+  - dest_ip
+  security_domain: network

detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml

@@ -3,7 +3,7 @@ id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
 version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
@@ -29,6 +29,7 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil
   90 days of data. You can modify the search window to build the model over a longer
   period of time, which may give you better results. You may also want to periodically
   re-run this search to rebuild the model with the latest data.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -42,3 +43,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - All_Changes.status
+  security_domain: network

detections/cloud/baseline_of_cloud_instances_destroyed.yml

@@ -3,7 +3,7 @@ id: a2f701f8-5296-4d74-829c-0b7eb346d549
 version: 1
 date: '2020-08-25'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
@@ -31,6 +31,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
   re-run this search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -45,3 +46,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  security_domain: network

detections/cloud/baseline_of_cloud_instances_launched.yml

@@ -3,7 +3,7 @@ id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
 version: 1
 date: '2020-08-14'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
@@ -31,6 +31,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
   re-run this search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -45,3 +46,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  security_domain: network

detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml

@@ -3,7 +3,7 @@ id: 67b84d51-8329-4909-849f-8d38ce54260a
 version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
@@ -28,6 +28,7 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil
   90 days of data. You can modify the search window to build the model over a longer
   period of time, which may give you better results. You may also want to periodically
   re-run this search to rebuild the model with the latest data.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -41,3 +42,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - All_Changes.status
+  - All_Changes.object_category
+  security_domain: network

detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml

@@ -3,7 +3,7 @@ id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
 version: 1
 date: '2019-11-14'
 author: Jason Brewer, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many RunInstances users do in the environment. By default, the search uses
@@ -27,6 +27,7 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
   search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -34,7 +35,15 @@ tags:
   - Suspicious AWS EC2 Activities
   detections:
   - Abnormally High AWS Instances Launched by User - MLTK
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - src_user
+  security_domain: network

detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml

@@ -3,7 +3,7 @@ id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
 version: 1
 date: '2019-11-14'
 author: Jason Brewer, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
   for how many TerminateInstances users do in the environment. By default, the search
@@ -28,13 +28,22 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
   search to rebuild the model with the latest data.\
 
   More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - Suspicious AWS EC2 Activities
   detections:
   - Abnormally High AWS Instances Terminated by User - MLTK
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - src_user
+  security_domain: network

detections/cloud/baseline_of_network_acl_activity_by_arn.yml

@@ -3,7 +3,7 @@ id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
 version: 1
 date: '2018-05-21'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation of the number of API calls that were related to network ACLs made by each
@@ -18,13 +18,20 @@ search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - AWS Network ACL Activity
   detections:
   - Detect Spike in Network ACL Activity
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userIdentity.arn
+  security_domain: network

detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml

@@ -3,7 +3,7 @@ id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
 version: 1
 date: '2018-07-17'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search establishes, on a per-hour basis, the average and standard
   deviation for the number of API calls related to deleting an S3 bucket by each user.
@@ -17,13 +17,20 @@ search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentit
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - Suspicious AWS S3 Activities
   detections:
   - Detect Spike in S3 Bucket deletion
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userIdentity.arn
+  security_domain: network

detections/cloud/baseline_of_security_group_activity_by_arn.yml

@@ -3,7 +3,7 @@ id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
 version: 1
 date: '2018-04-17'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
   deviation for the number of API calls related to security groups made by each user.
@@ -18,13 +18,20 @@ search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIde
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - AWS User Monitoring
   detections:
   - Detect Spike in Security Group Activity
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userIdentity.arn
+  security_domain: network

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -3,7 +3,7 @@ id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
 version: 1
 date: '2020-09-04'
 author: David Dorsey, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for new commands from each user role.

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -3,7 +3,7 @@ id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
 version: 2
 date: '2021-07-13'
 author: Rico Valdez, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud compute instances created by users who have

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -3,7 +3,7 @@ id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
 version: 1
 date: '2020-09-02'
 author: David Dorsey, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks at cloud-infrastructure events where an instance is

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -3,7 +3,7 @@ id: bc24922d-987c-4645-b288-f8c73ec194c4
 version: 1
 date: '2018-10-12'
 author: David Dorsey, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud compute instances being created with previously

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -3,7 +3,7 @@ id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
 version: 1
 date: '2020-09-12'
 author: David Dorsey, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: Find EC2 instances being created with previously unseen instance types.

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -3,7 +3,7 @@ id: 7fb15084-b14e-405a-bd61-a6de15a40722
 version: 1
 date: '2020-07-29'
 author: Rico Valdez, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud instances being modified by users who have

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -3,7 +3,7 @@ id: e7ecc5e0-88df-48b9-91af-51104c68f02f
 version: 1
 date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud provisioning activities from previously unseen

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -3,7 +3,7 @@ id: 94994255-3acf-4213-9b3f-0494df03bb31
 version: 1
 date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud provisioning activities from previously unseen

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -3,7 +3,7 @@ id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
 version: 1
 date: '2020-08-16'
 author: Rico Valdez, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud provisioning activities from previously unseen

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -3,7 +3,7 @@ id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
 version: 1
 date: '2020-08-16'
 author: Rico Valdez, Bhavin Patel, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Change
 description: This search looks for cloud provisioning activities from previously unseen

detections/cloud/create_a_list_of_approved_aws_service_accounts.yml

@@ -3,7 +3,7 @@ id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
 version: 2
 date: '2018-12-03'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search looks for successful API activity in CloudTrail within the
   last 30 days, filters out known users from the identity table, and outputs values
@@ -16,13 +16,21 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
   inputs. Please validate the service account entires in `aws_service_accounts.csv`,
   which is a lookup file created as a result of running this support search. Please
   remove the entries of service accounts that are not legitimate.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - AWS User Monitoring
   detections:
   - Detect AWS API Activities From Unapproved Accounts
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - errorCode
+  - userName
+  security_domain: network

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -3,7 +3,7 @@ id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
 version: 1
 date: '2020-05-28'
 author: Rico Valdez, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -3,7 +3,7 @@ id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
 version: 1
 date: '2020-10-07'
 author: Bhavin Patel, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -3,7 +3,7 @@ id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
 version: 1
 date: '2020-10-07'
 author: Bhavin Patel, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -3,7 +3,7 @@ id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
 version: 1
 date: '2020-10-07'
 author: Bhavin Patel, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event

detections/cloud/detect_new_open_s3_buckets.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
 version: 3
 date: '2021-07-19'
 author: Bhavin Patel, Patrick Bareiss, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user has created
   an open/public S3 bucket.

detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml

@@ -3,7 +3,7 @@ id: 39c61d09-8b30-4154-922b-2d0a694ecc22
 version: 2
 date: '2021-07-19'
 author: Patrick Bareiss, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search looks for AWS CloudTrail events where a user has created
   an open/public S3 bucket over the aws cli.

detections/cloud/detect_shared_ec2_snapshot.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
 version: 2
 date: '2021-07-20'
 author: Bhavin Patel, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: The following analytic utilizes AWS CloudTrail events to identify when
   an EC2 snapshot permissions are modified to be shared with a different AWS account.

detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

@@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
 version: 3
 date: '2021-01-26'
 author: Bhavin Patel, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search looks for a spike in number of of AWS security Hub alerts
   for an EC2 instance in 4 hours intervals

detections/cloud/gcp_kubernetes_activity_by_src_ip.yml

@@ -1,4 +1,5 @@
 author: Rod Soto, Splunk
+datamodel: []
 date: '2020-04-13'
 description: This search provides investigation data about requests via user agent,
   authentication request URI, resource path and cluster name data against Kubernetes
@@ -10,18 +11,30 @@ how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or late
 id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f
 inputs:
 - src_ip
+known_false_positives: ''
 name: GCP Kubernetes activity by src ip
-search: sourcetype="google:gcp:pubsub:message" | rename data.protoPayload.requestMetadata.callerIp
+search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp
   as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time)
   as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName)
   as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent)
   as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as
   user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name
-  data.resource.type
+  data.resource.type'
 tags:
   analytic_story:
   - Kubernetes Scanning Activity
   product:
   - Splunk Phantom
-type: response
+  required_fields:
+  - _time
+  - data.protoPayload.requestMetadata.callerIp
+  - data.protoPayload.methodName
+  - data.protoPayload.resourceName
+  - data.protoPayload.requestMetadata.callerSuppliedUserAgent
+  - data.protoPayload.authenticationInfo.principalEmail
+  - data.protoPayload.status.message
+  - data.resource.labels.cluster_name
+  - data.resource.type
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/get_all_aws_activity_from_city.yml

@@ -1,4 +1,5 @@
 author: David Dorsey, Splunk
+datamodel: []
 date: '2018-03-19'
 description: This search retrieves all the activity from a specific city and will
   create a table containing the time, city, ARN, username, the type of user, the source
@@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8
 inputs:
 - City
+known_false_positives: ''
 name: Get All AWS Activity From City
-search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search
+search: '`cloudtrail` | iplocation sourceIPAddress | search
   City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName
   path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
   sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip,
@@ -22,5 +24,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - sourceIPAddress
+  - userIdentity.arn
+  - userIdentity.userName
+  - userIdentity.type
+  - awsRegion
+  - eventName
+  - errorCode
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/get_all_aws_activity_from_country.yml

@@ -1,4 +1,5 @@
 author: David Dorsey, Splunk
+datamodel: []
 date: '2018-03-19'
 description: This search retrieves all the activity from a specific country and will
   create a table containing the time, country, ARN, username, the type of user, the
@@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: e763cdb9-00da-41e0-9bda-444debc9501a
 inputs:
 - Country
+known_false_positives: ''
 name: Get All AWS Activity From Country
-search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search
+search: '`cloudtrail` | iplocation sourceIPAddress | search
   Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName
   path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
   sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip,
@@ -22,5 +24,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - sourceIPAddress
+  - userIdentity.arn
+  - userIdentity.userName
+  - userIdentity.type
+  - awsRegion
+  - eventName
+  - errorCode
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/get_all_aws_activity_from_ip_address.yml

@@ -1,4 +1,5 @@
 author: David Dorsey, Splunk
+datamodel: []
 date: '2018-03-19'
 description: This search retrieves all the activity from a specific IP address and
   will create a table containing the time, ARN, username, the type of user, the IP
@@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: 446ec87a-85c6-40d4-b060-bea4498281d6
 inputs:
 - src_ip
+known_false_positives: ''
 name: Get All AWS Activity From IP Address
-search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search
+search: '`cloudtrail` | iplocation sourceIPAddress | search
   src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName
   path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
   sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion,
@@ -27,5 +29,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - sourceIPAddress
+  - userIdentity.arn
+  - userIdentity.userName
+  - userIdentity.type
+  - awsRegion
+  - eventName
+  - errorCode
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/get_all_aws_activity_from_region.yml

@@ -1,4 +1,5 @@
 author: David Dorsey, Splunk
+datamodel: []
 date: '2018-03-19'
 description: This search retrieves all the activity from a specific geographic region
   and will create a table containing the time, geographic region, ARN, username, the
@@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: 5b794bef-1743-4f6f-804a-43915a2702ff
 inputs:
 - Region
+known_false_positives: ''
 name: Get All AWS Activity From Region
-search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search
+search: '`cloudtrail` | iplocation sourceIPAddress | search
   Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName
   path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
   sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip,
@@ -22,5 +24,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - sourceIPAddress
+  - userIdentity.arn
+  - userIdentity.userName
+  - userIdentity.type
+  - awsRegion
+  - eventName
+  - errorCode
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/get_ec2_instance_details_by_instanceid.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2018-02-12'
 description: This search queries AWS description logs and returns all the information
   about a specific instance via the instanceId field
@@ -8,8 +9,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap
 id: f3db4d1b-5f33-4b01-c541-c7ah9514c242
 inputs:
 - instanceId
+known_false_positives: ''
 name: Get EC2 Instance Details by instanceId
-search: '| search sourcetype="aws:description" source="*:ec2_instances"| dedup id
+search: '`aws_description` | dedup id
   sortby -_time |rename id as instanceId|  search instanceId=$instanceId$ | spath
   output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address
   == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id,
@@ -28,5 +30,19 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - id
+  - ip_address
+  - tags
+  - aws_account_id
+  - placement
+  - instance_type
+  - key_name
+  - launch_time
+  - state
+  - vpc_id
+  - subnet_id
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/get_ec2_launch_details.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2018-03-12'
 description: This search returns some of the launch details for a EC2 instance.
 how_to_implement: In order to implement this search, you must install the AWS App
@@ -7,8 +8,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap
 id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
 inputs:
 - dest
+known_false_positives: ''
 name: Get EC2 Launch Details
-search: '| search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as
+search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as
   arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress
   as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
   as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
@@ -22,5 +24,15 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - dest 
+  - userIdentity.arn
+  - responseElements.instancesSet.items{}.instanceId
+  - responseElements.instancesSet.items{}.privateIpAddress
+  - responseElements.instancesSet.items{}.imageId
+  - responseElements.instancesSet.items{}.architecture
+  - responseElements.instancesSet.items{}.keyName
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/investigate_aws_activities_via_region_name.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2018-02-09'
 description: This search lists all the user activities logged by CloudTrail for a
   specific region in question and will create a table of the values of parameters
@@ -9,8 +10,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
 inputs:
 - vendor_region
+known_false_positives: ''
 name: Investigate AWS activities via region name
-search: '| search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename
+search: '`cloudtrail` vendor_region=$vendor_region$| rename
   requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName)
   by user instanceId vendor_region'
 tags:
@@ -22,5 +24,12 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - vendor_region
+  - requestParameters.instancesSet.items{}.instanceId
+  - eventName
+  - user
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/investigate_aws_user_activities_by_user_field.yml

@@ -1,4 +1,5 @@
 author: Bhavin Patel, Splunk
+datamodel: []
 date: '2018-03-12'
 description: This search lists all the logged CloudTrail activities by a specific
   user and will create a table containing the source of the user, the region of the
@@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
 id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
 inputs:
 - user
+known_false_positives: ''
 name: Investigate AWS User Activities by user field
-search: '| search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type
+search: '`cloudtrail` user=$user$ | table _time userIdentity.type
   userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType '
 tags:
   analytic_story:
@@ -20,5 +22,17 @@ tags:
   product:
   - Splunk Phantom
   - Splunk Security Analytics for AWS
-type: response
+  required_fields:
+  - _time
+  - user
+  - userIdentity.type
+  - userIdentity.userName
+  - userIdentity.arn
+  - aws_account_id
+  - src
+  - awsRegion
+  - eventName
+  - eventType
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/investigate_okta_activity_by_app.yml

@@ -1,18 +1,32 @@
 author: Rico Valdez, Splunk
+datamodel: []
 date: '2020-04-02'
 description: This search returns all okta events associated with a specific app
 how_to_implement: You must be ingesting Okta logs
 id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
 inputs:
 - app
+known_false_positives: ''
 name: Investigate Okta Activity by app
-search: eventtype=okta_log app=$app$ | rename client.geographicalContext.country as
+search: '`okta` app=$app$ | rename client.geographicalContext.country as
   country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason
+  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
 tags:
   analytic_story:
   - Suspicious Okta Activity
   product:
   - Splunk Phantom
-type: response
+  required_fields:
+  - _time
+  - app
+  - client.geographicalContext.country
+  - client.geographicalContext.state
+  - client.geographicalContext.city
+  - user
+  - displayMessage
+  - src_ip
+  - result
+  - outcome.reason
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/investigate_okta_activity_by_ip_address.yml

@@ -1,18 +1,32 @@
 author: Rico Valdez, Splunk
+datamodel: []
 date: '2020-04-02'
 description: This search returns all okta events from a specific IP address.
 how_to_implement: You must be ingesting Okta logs
 id: 56aae066-d619-477c-93e3-3fb83b2d23c3
 inputs:
 - user
+known_false_positives: ''
 name: Investigate Okta Activity by IP Address
-search: eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country
+search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country
   as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason
+  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
 tags:
   analytic_story:
   - Suspicious Okta Activity
   product:
   - Splunk Phantom
-type: response
+  required_fields:
+  - _time
+  - app
+  - client.geographicalContext.country
+  - client.geographicalContext.state
+  - client.geographicalContext.city
+  - user
+  - displayMessage
+  - src_ip
+  - result
+  - outcome.reason
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/investigate_user_activities_in_okta.yml

@@ -1,18 +1,31 @@
 author: Rico Valdez, Splunk
+datamodel: []
 date: '2020-04-02'
 description: This search returns all okta events by a specific user
 how_to_implement: You must be ingesting Okta logs
 id: 24ff145d-4d16-420a-b047-480f2a51c403
 inputs:
 - user
+known_false_positives: ''
 name: Investigate User Activities In Okta
-search: eventtype=okta_log user=$user$ | rename client.geographicalContext.country
+search: '`okta` user=$user$ | rename client.geographicalContext.country
   as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason
+  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
 tags:
   analytic_story:
   - Suspicious Okta Activity
   product:
   - Splunk Phantom
-type: response
+  required_fields:
+  - _time
+  - client.geographicalContext.country
+  - client.geographicalContext.state
+  - client.geographicalContext.city
+  - user
+  - displayMessage
+  - src_ip
+  - result
+  - outcome.reason
+  security_domain: network
+type: Investigation
 version: 1

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -3,7 +3,7 @@ id: b2c81cc6-6040-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-26'
 author: Rod Soto, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects the creation of a new Federation setting by alerting
   about an specific event related to its creation.

detections/cloud/o365_added_service_principal.yml

@@ -3,7 +3,7 @@ id: 1668812a-6047-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-26'
 author: Rod Soto, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects the creation of a new Federation setting by alerting
   about an specific event related to its creation.

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -3,7 +3,7 @@ id: c783dd98-c703-4252-9e8a-f19d9f66949e
 version: 2
 date: '2021-07-19'
 author: Bhavin Patel, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects newly added IP addresses/CIDR blocks to the list
   of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known

detections/cloud/o365_disable_mfa.yml

@@ -3,7 +3,7 @@ id: c783dd98-c703-4252-9e8a-f19d9f5c949e
 version: 1
 date: '2020-12-16'
 author: Rod Soto, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects when multi factor authentication has been disabled,
   what entitiy performed the action and against what user

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -3,7 +3,7 @@ id: d441364c-349c-453b-b55f-12eccab67cf9
 version: 1
 date: '2020-12-16'
 author: Rod Soto, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes

detections/cloud/o365_excessive_sso_logon_errors.yml

@@ -3,7 +3,7 @@ id: 8158ccc4-6038-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-26'
 author: Rod Soto, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search detects accounts with high number of Single Sign ON (SSO)
   logon errors. Excessive logon errors may indicate attempts to bruteforce of password

detections/cloud/o365_new_federated_domain_added.yml

@@ -3,7 +3,7 @@ id: e155876a-6048-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-26'
 author: Rod Soto, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects the addition of a new Federated domain.
 search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"

detections/cloud/o365_pst_export_alert.yml

@@ -3,7 +3,7 @@ id: 5f694cc4-a678-4a60-9410-bffca1b647dc
 version: 1
 date: '2020-12-16'
 author: Rod Soto, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects when a user has performed an Ediscovery search or
   exported a PST file from the search. This PST file usually has sensitive information

detections/cloud/o365_suspicious_admin_email_forwarding.yml

@@ -3,7 +3,7 @@ id: 7f398cfb-918d-41f4-8db8-2e2474e02c28
 version: 1
 date: '2020-12-16'
 author: Patrick Bareiss, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search detects when an admin configured a forwarding rule for multiple
   mailboxes to the same destination.

detections/cloud/o365_suspicious_rights_delegation.yml

@@ -3,7 +3,7 @@ id: b25d2973-303e-47c8-bacd-52b61604c6a7
 version: 1
 date: '2020-12-15'
 author: Patrick Bareiss, Splunk
-type: batch
+type: TTP
 datamodel: []
 description: This search detects the assignment of rights to accesss content from
   another mailbox. This is usually only assigned to a service account.

detections/cloud/o365_suspicious_user_email_forwarding.yml

@@ -3,7 +3,7 @@ id: f8dfe015-dbb3-4569-ba75-b13787e06aa4
 version: 1
 date: '2020-12-16'
 author: Patrick Bareiss, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search detects when multiple user configured a forwarding rule to
   the same destination.

detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml

@@ -3,7 +3,7 @@ id: fc0edc95-fq2c-48b0-9f6f-63da3289fd03
 version: 1
 date: '2018-04-16'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search looks for successful API calls made by different user roles,
   then creates a baseline of the earliest and latest times we have encountered this
@@ -17,13 +17,24 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`,
   which is a lookup file created as a result of running this support search.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - AWS User Monitoring
   detections:
   - Detect new API calls from user roles
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType
+  - errorCode
+  - userIdentity.type
+  - userName
+  - eventName
+  security_domain: network

detections/cloud/previously_seen_aws_cross_account_activity.yml

@@ -3,7 +3,7 @@ id: 1cc22b09-c867-416e-a511-cb36ac44aee2
 version: 1
 date: '2018-06-04'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search looks for **AssumeRole** events where the requesting account
   differs from the requested account, then writes these relationships to a lookup
@@ -17,13 +17,22 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
   a lookup file created by this support search.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
   - AWS Cross Account Activity
   detections:
   - AWS Cross Account Activity From Previously Unseen Account
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userIdentity.accountId
+  - resources{}.accountId
+  security_domain: network

detections/cloud/previously_seen_aws_cross_account_activity_initial.yml

@@ -3,7 +3,7 @@ id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
 version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Authentication
 description: This search looks for **AssumeRole** events where the requesting account
@@ -21,6 +21,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers
   to the Authentication data model for cloud use cases. Validate the user name entries
   in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
   support search.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -34,3 +35,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.vendor_account
+  - Authentication.user
+  - Authentication.src
+  - Authentication.user_role
+  security_domain: network

detections/cloud/previously_seen_aws_cross_account_activity_update.yml

@@ -3,7 +3,7 @@ id: dd6fb3a9-4906-48cb-8626-c88a25a056c3
 version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Authentication
 description: This search looks for **AssumeRole** events where the requesting account
@@ -22,6 +22,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers
   to the Authentication data model for cloud use cases. Validate the user name entries
   in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
   support search.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -35,3 +36,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.vendor_account
+  - Authentication.user
+  - Authentication.src
+  - Authentication.user_role
+  security_domain: network

detections/cloud/previously_seen_aws_provisioning_activity_sources.yml

@@ -3,7 +3,7 @@ id: ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee
 version: 1
 date: '2018-03-16'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search builds a table of the first and last times seen for every
   IP address (along with its physical location) previously associated with cloud-provisioning
@@ -15,6 +15,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
   inputs.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -24,7 +25,14 @@ tags:
   - AWS Cloud Provisioning From Previously Unseen City
   - AWS Cloud Provisioning From Previously Unseen Country
   - AWS Cloud Provisioning From Previously Unseen Region
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - sourceIPAddress
+  security_domain: network

detections/cloud/previously_seen_aws_regions.yml

@@ -3,7 +3,7 @@ id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63
 version: 1
 date: '2018-01-08'
 author: Bhavin Patel, Splunk
-type: batch
+type: Baseline
 datamodel: []
 description: This search looks for CloudTrail events where an AWS instance is started
   and creates a baseline of most recent time (latest) and the first time (earliest)
@@ -14,6 +14,7 @@ search: '`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
   inputs.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -21,7 +22,13 @@ tags:
   - Suspicious AWS EC2 Activities
   detections:
   - EC2 Instance Started In Previously Unseen Region
+  deployments:
+  - Daily Cache Updates
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - awsRegion
+  security_domain: network

detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml

@@ -3,7 +3,7 @@ id: 69d75f4b-b794-4a66-a777-730357b886b4
 version: 1
 date: '2020-09-03'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search builds a table of the first and last times seen for every
@@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
   enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
 how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
   provider.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -30,3 +31,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user_type
+  - All_Changes.status
+  - All_Changes.user
+  - All_Changes.command
+  security_domain: network

detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml

@@ -3,7 +3,7 @@ id: c4b760a0-6a97-47e9-b089-8ae9e57f210e
 version: 1
 date: '2020-09-03'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search updates the table of the first and last times seen for every
@@ -19,6 +19,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
   enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
 how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
   provider.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -32,3 +33,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user_type
+  - All_Changes.status
+  - All_Changes.user
+  - All_Changes.command
+  security_domain: network

detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml

@@ -3,7 +3,7 @@ id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
 version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search builds a table of previously seen users that have launched
@@ -14,6 +14,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
   | stats count'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the proper TAs installed.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -27,3 +28,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.object_category
+  - All_Changes.user
+  security_domain: network

detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml

@@ -3,7 +3,7 @@ id: 6bf75d69-7766-47bc-8097-e41696807a6f
 version: 1
 date: '2020-08-15'
 author: Rico Valdez, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search builds a table of previously seen users that have launched
@@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
   = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the proper TAs installed.
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -30,3 +31,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.object_category
+  - All_Changes.user
+  security_domain: network

detections/cloud/previously_seen_cloud_compute_images_initial.yml

@@ -3,7 +3,7 @@ id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
 version: 1
 date: '2020-10-08'
 author: David Dorsey, Splunk
-type: batch
+type: Baseline
 datamodel:
 - Change
 description: This search builds a table of previously seen images used to launch cloud
@@ -16,6 +16,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
   | outputlookup previously_seen_cloud_compute_images'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
   and have the latest Change Datamodel accelerated
+known_false_positives: none
 references: []
 tags:
   analytic_story:
@@ -29,3 +30,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.Instance_Changes.image_id
+  security_domain: network