From 16017f330475806fa4bd680c34f74b80afda2963 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 28 Mar 2022 16:11:04 -0700
Subject: [PATCH] bug fix

---
 .../web/sql_injection_with_long_urls.yml      | 33 +++++++++----------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/detections/experimental/web/sql_injection_with_long_urls.yml b/detections/experimental/web/sql_injection_with_long_urls.yml
index 780f42ccb3..774998b173 100644
--- a/detections/experimental/web/sql_injection_with_long_urls.yml
+++ b/detections/experimental/web/sql_injection_with_long_urls.yml
@@ -1,7 +1,7 @@
 name: SQL Injection with Long URLs
 id: e0aad4cf-0790-423b-8328-7564d0d938f9
-version: 2
-date: '2020-07-21'
+version: 3
+date: '2022-03-28'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
@@ -10,7 +10,7 @@ description: This search looks for long URLs that have several SQL commands visi
   within them.
 search: '| tstats `security_content_summariesonly` count from datamodel=Web where
   Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length
-  > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")`
+  > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")` | eval url=lower(url)
   | eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url, "between"))
   + mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database"))
   + mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view")) +
@@ -48,6 +48,18 @@ tags:
   - PR.PT
   - PR.IP
   - DE.CM
+  confidence: 50
+  impact: 50
+  risk_score: 25
+  message: SQL injection attempt with url $url$ detected on $dest$
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,17 +74,4 @@ tags:
   - Web.url
   - Web.http_user_agent
   security_domain: network
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context: []
-  message: tbd
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
+  assest_type: Endpoint
\ No newline at end of file