WIP

detections/application/okta_account_lockout_events.yml

@@ -29,4 +29,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - client.geographicalContext.country
+  - client.geographicalContext.state
+  - client.geographicalContext.city
   security_domain: access

detections/application/okta_failed_sso_attempts.yml

@@ -29,4 +29,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - app
+  - user
+  - result
+  - src_ip
   security_domain: access

detections/application/okta_user_logins_from_multiple_cities.yml

@@ -35,4 +35,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - client.geographicalContext.city
+  - client.geographicalContext.state
+  - user
   security_domain: access

detections/application/web_servers_executing_suspicious_processes.yml

@@ -39,4 +39,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest_category
+  - Processes.process
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint

detections/cloud/abnormally_high_cloud_instances_destroyed.yml

@@ -47,6 +47,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/cloud/abnormally_high_cloud_instances_launched.yml

@@ -48,6 +48,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 40

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -46,6 +46,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.command
+  - All_Changes.user
+  - All_Changes.status
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -47,6 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.command
+  - All_Changes.object_category
+  - All_Changes.status
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -50,6 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.vendor_account
+  - Authentication.user
+  - Authentication.user_role
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 15

detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

@@ -38,4 +38,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - eventSource
+  - eventID
+  - awsRegion
+  - requestParameters.policy
+  - userIdentity.principalId
   security_domain: threat

detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml

@@ -33,4 +33,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.x-amz-server-side-encryption
+  - requestParameters.bucketName
+  - requestParameters.x-amz-copy-source
+  - requestParameters.key
+  - userAgent
+  - region
   security_domain: threat

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -44,6 +44,18 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.ruleAction
+  - requestParameters.egress
+  - requestParameters.aclProtocol
+  - requestParameters.portRange.to
+  - requestParameters.portRange.from
+  - requestParameters.cidrBlock
+  - userName
+  - userIdentity.principalId
+  - userAgent
   risk_object: userName
   risk_object_type: user
   risk_score: 10

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -40,6 +40,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.egress
+  - userName
+  - userIdentity.principalId
+  - src
+  - userAgent
   risk_object: userName
   risk_object_type: user
   risk_score: 5

detections/cloud/aws_saml_access_by_provider_user_and_principal.yml

@@ -40,4 +40,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.principalArn
+  - requestParameters.roleArn
+  - requestParameters.roleSessionName
+  - recipientAccountId
+  - responseElements.issuer
+  - sourceIPAddress
+  - userAgent
   security_domain: threat

detections/cloud/aws_saml_update_identity_provider.yml

@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - eventType
+  - requestParameters.sAMLProviderArn
+  - userIdentity.sessionContext.sessionIssuer.arn
+  - sourceIPAddress
+  - userIdentity.accessKeyId
+  - userIdentity.principalId
   security_domain: threat

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -44,6 +44,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - All_Changes.user_type
+  - All_Changes.status
+  - All_Changes.command
+  - All_Changes.object
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -42,6 +42,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object
+  - All_Changes.action
+  - All_Changes.user
+  - All_Changes.vendor_region
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -48,6 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.vendor_region
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -43,6 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.image_id
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -43,6 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.instance_type
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -43,6 +43,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.command
+  - All_Changes.action
+  - All_Changes.change_type
+  - All_Changes.status
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -57,6 +57,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -48,6 +48,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
   risk_object: user
   risk_object_type: user
   risk_score: 30

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml

@@ -54,4 +54,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - sc_status_
+  - cs_object_
+  - c_ip_ 
+  - cs_uri_
+  - cs_method_
   security_domain: network

detections/cloud/detect_new_open_gcp_storage_buckets.yml

@@ -42,4 +42,15 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - data.resource.type
+  - data.protoPayload.methodName
+  - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action
+  - data.protoPayload.authenticationInfo.principalEmail
+  - data.protoPayload.resourceLocation.currentLocations{}
+  - data.protoPayload.requestMetadata.callerIp
+  - data.protoPayload.resourceName
+  - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role
+  - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member
   security_domain: network

detections/cloud/detect_new_open_s3_buckets.yml

@@ -43,6 +43,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventSource
+  - eventName
+  - requestParameters.bucketName
+  - userName
+  - userIdentity.principalId
+  - userAgent
+  - uri
+  - permission
   risk_object: src
   risk_object_type: system
   risk_score: 20

detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml

@@ -44,6 +44,19 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventSource
+  - eventName
+  - requestParameters.accessControlList.x-amz-grant-read-acp
+  - requestParameters.accessControlList.x-amz-grant-write
+  - requestParameters.accessControlList.x-amz-grant-write-acp
+  - requestParameters.accessControlList.x-amz-grant-full-control
+  - requestParameters.bucketName
+  - userName
+  - userIdentity.principalId
+  - userAgent
+  - bucketName
   risk_object: src
   risk_object_type: system
   risk_score: 20

detections/cloud/detect_s3_access_from_a_new_ip.yml

@@ -43,6 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - http_status
+  - bucket_name
+  - remote_ip
   risk_object: src_ip
   risk_object_type: system
   risk_score: 10

detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Resources{}.Type
+  - Title
+  - Types{}
+  - vendor_account
+  - vendor_region
+  - severity
+  - dest
   security_domain: network

detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml

@@ -31,4 +31,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - findings{}.Resources{}.Type
+  - indings{}.Resources{}.Id
+  - user
   security_domain: network

detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml

@@ -59,6 +59,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - action
+  - src_ip
+  - dest_ip
   risk_object: src_ip
   risk_object_type: system
   risk_score: 20

detections/cloud/detect_spike_in_s3_bucket_deletion.yml

@@ -52,6 +52,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userIdentity.arn
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/cloud/high_number_of_login_failures_from_a_single_source.yml

@@ -33,4 +33,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - record_type
+  - app
+  - user
+  - LogonError
+  - authentication_method
+  - signature
+  - UserAgent
+  - src_ip
+  - record_type
   security_domain: threat

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - Operation
+  - Actor{}.ID
+  - Actor{}.Type
+  - ActorIpAddress
+  - dest
+  - ResultStatus
   security_domain: threat

detections/cloud/o365_added_service_principal.yml

@@ -39,4 +39,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - signature
+  - Actor{}.ID
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - Target{}.ID
+  - ActorIpAddress
   security_domain: threat

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -39,4 +39,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - signature
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - ModifiedProperties{}.OldValue
+  - user
+  - vendor_product
+  - vendor_account
+  - status
+  - user_id
+  - action
   security_domain: threat

detections/cloud/o365_disable_mfa.yml

@@ -32,4 +32,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - UserType
+  - user
+  - status
+  - signature
+  - dest
+  - ResultStatus
   security_domain: threat

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -33,4 +33,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - UserAuthenticationMethod
+  - status
+  - UserAgent
+  - src_ip
+  - user
   security_domain: threat

detections/cloud/o365_excessive_sso_logon_errors.yml

@@ -34,4 +34,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - LogonError
+  - ActorIpAddress
+  - UserAgent
+  - UserId
   security_domain: threat

detections/cloud/o365_new_federated_domain_added.yml

@@ -38,4 +38,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - Operation
+  - Parameters{}.Value
+  - ObjectId
+  - OrganizationName
+  - OriginatingServer
+  - UserId
+  - UserKey
   security_domain: threat

detections/cloud/o365_pst_export_alert.yml

@@ -33,4 +33,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Category
+  - Name
+  - Source
+  - Severity
+  - AlertEntityId
+  - Operation
   security_domain: threat

detections/cloud/o365_suspicious_admin_email_forwarding.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat

detections/cloud/o365_suspicious_rights_delegation.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat

detections/cloud/o365_suspicious_user_email_forwarding.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat

detections/deprecated/dns_record_changed.yml

@@ -57,4 +57,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: network

detections/deprecated/new_container_uploaded_to_aws_ecr.yml

@@ -30,4 +30,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - 
   security_domain: threat

detections/deprecated/suspicious_email___uba_anomaly.yml

@@ -41,4 +41,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/endpoint/access_lsass_memory_for_dump_creation.yml

@@ -40,4 +40,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
   security_domain: endpoint

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint

detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   security_domain: endpoint

detections/endpoint/attempt_to_stop_security_service.yml

@@ -52,4 +52,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -42,4 +42,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint

detections/endpoint/batch_file_write_to_system32.yml

@@ -46,4 +46,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
   security_domain: endpoint

detections/endpoint/bcdedit_failure_recovery_modification.yml

@@ -41,4 +41,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -33,4 +33,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint

detections/endpoint/common_ransomware_extensions.yml

@@ -57,4 +57,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   security_domain: endpoint

detections/endpoint/common_ransomware_notes.yml

@@ -43,4 +43,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   security_domain: endpoint

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -44,4 +44,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -43,4 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.parent_process
+  - Processs.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint

detections/endpoint/create_remote_thread_into_lsass.yml

@@ -40,4 +40,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - TargetImage
+  - Computer
+  - EventCode
+  - TargetImage
+  - TargetProcessId
   security_domain: endpoint

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -46,4 +46,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - TargetFilename
+  - Computer
+  - object_category
   security_domain: endpoint

detections/endpoint/creation_of_shadow_copy.yml

@@ -43,4 +43,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -39,4 +39,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -42,4 +42,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -40,4 +40,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint

detections/endpoint/deleting_shadow_copies.yml

@@ -48,4 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -41,4 +41,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - Logon_Process
+  - WorkstationName
+  - user
+  - dest
   security_domain: access

detections/endpoint/detect_computer_changed_with_anonymous_account.yml

@@ -37,4 +37,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetUserName
+  - LogonType
+  - TargetDomainName
+  - user
   security_domain: endpoint

detections/endpoint/detect_credential_dumping_through_lsass_access.yml

@@ -47,4 +47,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - GrantedAccess
+  - Computer
+  - SourceImage
+  - SourceProcessId
+  - TargetImage
+  - TargetProcessId
   security_domain: endpoint

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -49,4 +49,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - nodename
+  - All_Changes.result
+  - All_Changes.dest
   security_domain: access