Merge pull request #208 from splunk/CRL-1617_bug

CRL-1617 changed process to process name

detections/prohibited_software_on_endpoint.json

@@ -29,7 +29,7 @@
     "splunk": {
       "correlation_rule": {
         "notable": {
-          "nes_fields": "dest, process, user",
+          "nes_fields": "dest, process_name, user",
           "rule_description": "Prohibited software $process_name$ has been detected on $dest$.",
           "rule_title": "Prohibited Software Detected On $dest$"
         },
@@ -45,7 +45,7 @@
           "earliest_time": "-70m@m",
           "latest_time": "-10m@m"
         },
-        "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process | `ctime(firstTime)`| `ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares`",
+        "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `ctime(firstTime)`| `ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares`",
         "suppress": {
           "suppress_fields": "dest,user",
           "suppress_period": "86400s"
@@ -57,7 +57,7 @@
   "entities": [
     "dest"
   ],
-  "how_to_implement": "To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or populated via Windows event logs, after enabling process tracking in your Windows audit settings. In addition, you must also have processes marked as \"prohibited\" in the Enterprise Security `interesting processes` table. To include the processes marked as \"prohibited\", which is included with ES Content Updates, run the included search `Support - Add Prohibited Processes to ES`.",
+  "how_to_implement": "To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as \"prohibited\" in the Enterprise Security `interesting processes` table. To include the process names marked as \"prohibited\", which is included with ES Content Updates, run the included search <code>Add Prohibited Processes to Enterprise Security</code>.",
   "id": "a51bfe1a-94f0-48cc-b4e4-b6ae50145893",
   "investigations": [
     {
@@ -141,7 +141,7 @@
       "PR.DS"
     ]
   },
-  "modification_date": "2010-11-02",
+  "modification_date": "2019-10-11",
   "name": "Prohibited Software On Endpoint",
   "original_authors": [
     {
@@ -154,5 +154,5 @@
   "security_domain": "endpoint",
   "spec_version": 2,
   "type": "splunk",
-  "version": "1.0"
+  "version": "2.0"
 }

package/default/macros.conf

@@ -23,7 +23,7 @@ definition = lookup update=true lookup_uncommon_processes_default process_name a
 definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
 
 [prohibited_softwares]
-definition = lookup interesting_processes_lookup app as process OUTPUT is_prohibited | search is_prohibited=True
+definition = lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True
 
 [brand_abuse_dns]
 definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true

requirements.txt

@@ -1,7 +1,7 @@
 aspy.yaml==1.3.0
 attrs==19.1.0
 cfgv==2.0.1
-configparser==4.0.1
+configparser==4.0.2
 contextlib2==0.5.5
 functools32==3.2.3.post2
 futures==3.2.0