mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
changing the bucket name
This commit is contained in:
+1
-1
@@ -11,7 +11,7 @@ search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min
|
||||
| `drop_dm_object_name("DNS")` | rename query AS domain | fields IPs, src, domain, firstTime, lastTime, src | apply pretrained_dga_model_dsdl | rename pred_dga_proba AS dga_score | where dga_score>0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table src, domain, IPs, firstTime, lastTime, dga_score | `detect_dga_domains_using_pretrained_model_in_dsdl_filter`'
|
||||
how_to_implement: "
|
||||
* Steps to deploy DGA detection model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL app. Follow the steps for deployment here - https://github.com/splunk/security_content/wiki/How-to-deploy-Deep-Learning-models-for-ESCU.
|
||||
* Download the artifacts .tar.gz file from the S3 bucket - http://seal.splunkresearch.com/pretrained_dga_model_dsdl.tar.gz
|
||||
* Download the artifacts .tar.gz file from the S3 bucket - https://seal.splunkresearch.com.s3-us-west-2.amazonaws.com/pretrained_dga_model_dsdl.tar.gz
|
||||
* Download the pretrained_dga_model_dsdl.ipynb Jupyter notebook from https://github.com/splunk/security_content/notebooks
|
||||
* Login to the Jupyter Lab for pretrained_dga_model_dsdl container. This container should be listed on Containers page for DSDL app.
|
||||
* Below steps need to be followed inside Jupyter lab
|
||||
|
||||
Reference in New Issue
Block a user