Updates with develop

detections/endpoint/microsoft_defender_atp_alerts.yml

@@ -31,6 +31,26 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: $severity$ alert for $src$ - $signature$
+  risk_objects:
+  - field: src
+    type: system
+    score: 81
+  - field: user
+    type: user
+    score: 81
+  threat_objects:
+  - field: file_name
+    type: file_name
+  - field: process
+    type: process_name
+  - field: ip_address
+    type: ip_address
+  - field: registry_key
+    type: registry_path
+  - field: url
+    type: url
 tags:
   analytic_story:
   - Critical Alerts
@@ -38,37 +58,7 @@ tags:
   atomic_guid: []
   confidence: 90
   impact: 90
-  message: $severity$ alert for $src$ - $signature$
   mitre_attack_id: []
-  observable:
-  - name: src
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: file_name
-    type: File Name
-    role:
-    - Attacker
-  - name: process
-    type: Process Name
-    role:
-    - Attacker
-  - name: ip_address
-    type: IP Address
-    role:
-    - Attacker
-  - name: registry_key
-    type: Registry Key
-    role:
-    - Attacker
-  - name: url
-    type: URL String
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/microsoft_defender_incident_alerts.yml

@@ -37,6 +37,26 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba:
+  message: $severity$ alert for $dest$ - $signature$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 81
+  - field: user
+    type: user
+    score: 81
+  threat_objects:
+  - field: file_name
+    type: file_name
+  - field: process
+    type: process_name
+  - field: ip_address
+    type: ip_address
+  - field: registry_key
+    type: registry_path
+  - field: url
+    type: url
 tags:
   analytic_story:
   - Critical Alerts
@@ -44,37 +64,7 @@ tags:
   atomic_guid: []
   confidence: 90
   impact: 90
-  message: $severity$ alert for $dest$ - $signature$
   mitre_attack_id: []
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: file_name
-    type: File Name
-    role:
-    - Attacker
-  - name: process
-    type: Process Name
-    role:
-    - Attacker
-  - name: ip_address
-    type: IP Address
-    role:
-    - Attacker
-  - name: registry_key
-    type: Registry Key
-    role:
-    - Attacker
-  - name: url
-    type: URL String
-    role:
-    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/windows_runmru_command_execution.yml

@@ -26,28 +26,26 @@ drilldown_searches:
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+rba: 
+  message: An instance of $registry_value_data$ was identified on endpoint $dest$ by user $user$ attempting to execute a command through the Run dialog box.
+  risk_objects:
+  - field: dest
+    type: system
+    score: 48
+  - field: user
+    type: user
+    score: 48
+  threat_objects:
+  - field: registry_value_data
+    type: registry_value_text
 tags:
   analytic_story:
   - Lumma Stealer
   asset_type: Endpoint
   confidence: 60
   impact: 80
-  message: An instance of $registry_value_data$ was identified on endpoint $dest$ by user $user$ attempting to execute a command through the Run dialog box.
   mitre_attack_id:
   - T1202
-  observable:
-  - name: registry_value_data
-    type: Registry Value
-    role:
-    - Attacker
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security