Merge pull request #2264 from splunk/TR-2153

Adding Providing technologies

bin/contentctl_project/contentctl_core/application/builder/detection_builder.py

@@ -19,6 +19,10 @@ class DetectionBuilder(abc.ABC):
     @abc.abstractmethod
     def addNesFields(self) -> None:
         pass
+        
+    @abc.abstractmethod
+    def addProvidingTechnologies(self) -> None:
+        pass
 
     @abc.abstractmethod
     def addMappings(self) -> None:

bin/contentctl_project/contentctl_core/domain/entities/detection.py

@@ -60,6 +60,7 @@ class Detection(BaseModel, SecurityContentObject):
     file_path: str = None
     source: str = None
     nes_fields: str = None
+    providing_technologies: list = None
 
 
     # @validator('name')

bin/contentctl_project/contentctl_infrastructure/adapter/templates/analyticstories_detections.j2

@@ -15,7 +15,7 @@ how_to_implement = none
 {% endif %}
 annotations = {{ detection.mappings | tojson }}
 known_false_positives = {{ detection.known_false_positives }}
-providing_technologies = []
+providing_technologies = {{ detection.providing_technologies | tojson }}
 
 {% endif %}
 {% endfor %}

bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py

@@ -100,6 +100,18 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
 
             self.security_content_obj.risk = risk_objects
 
+    def addProvidingTechnologies(self) -> None:
+        if self.security_content_obj:
+            # if self.security_content_obj.tags.supported_tas:
+                if 'Endpoint' in self.security_content_obj.datamodel:
+                    self.security_content_obj.providing_technologies = ["Sysmon", "Microsoft Windows","Carbon Black Response","CrowdStrike Falcon", "Symantec Endpoint Protection"]
+                if "`cloudtrail`" in str(self.security_content_obj.search):
+                    self.security_content_obj.providing_technologies = ["Amazon Web Services - Cloudtrail"]
+                if '`wineventlog_security`' in self.security_content_obj.search or '`powershell`' in self.security_content_obj.search:
+                    self.security_content_obj.providing_technologies = ["Microsoft Windows"]
+
+    
+
 
     def addNesFields(self) -> None:
         if self.security_content_obj:

bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py

@@ -17,6 +17,7 @@ class SecurityContentDirector(Director):
         builder.setObject(os.path.join(os.path.dirname(__file__), path))
         builder.addDeployment(deployments)
         builder.addRBA()
+        builder.addProvidingTechnologies()
         builder.addNesFields()
         builder.addAnnotations()
         builder.addMappings()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/analyticstories.conf

@@ -15,7 +15,7 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect new user AWS Console Login - Rule]
 type = detection
@@ -25,7 +25,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 ### END DETECTIONS ###
 

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf

@@ -21,7 +21,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.
@@ -67,7 +67,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect new user AWS Console Login - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf

@@ -15,7 +15,7 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect new user AWS Console Login - Rule]
 type = detection
@@ -25,7 +25,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 ### END DETECTIONS ###
 

bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf

@@ -21,7 +21,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.
@@ -67,7 +67,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect new user AWS Console Login - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd