From 1a16ff5f293491154be63466784b040422fc4fa6 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 28 Jan 2025 18:12:48 -0800 Subject: [PATCH 1/6] remove falcon data --- detections/endpoint/suspicious_process_file_path.yml | 2 +- ...indows_sensitive_registry_hive_dump_via_commandline.yml | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index c055850294..1d636ec76c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 27d9a6ccb8..532d2d864b 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of `reg.exe` to export Windo data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. @@ -65,8 +65,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog -- name: True Positive Test - CrowdStrike - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor From bd608b061fe138b453e79b0790849fe4334a6c8c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 28 Jan 2025 18:24:23 -0800 Subject: [PATCH 2/6] Update windows_sensitive_registry_hive_dump_via_commandline.yml --- .../windows_sensitive_registry_hive_dump_via_commandline.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 532d2d864b..d8050741e3 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of `reg.exe` to export Windo data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. From 857590e1f064b0c77fd849bd8938d7b8225e0f9e Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 08:57:48 -0600 Subject: [PATCH 3/6] Renamed files and updated playbook field so site functions --- ...igence_Identifier_Reputation_Analysis.json | 752 ++++++++++++++++++ ...igence_Identifier_Reputation_Analysis.png} | Bin ...ligence_Identifier_Reputation_Analysis.py} | 0 ...igence_Identifier_Reputation_Analysis.yml} | 2 +- ...igence_Identifier_Reputation_Analysis.json | 752 ------------------ 5 files changed, 753 insertions(+), 753 deletions(-) create mode 100644 playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png => CiscoTalosIntelligence_Identifier_Reputation_Analysis.png} (100%) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py => CiscoTalosIntelligence_Identifier_Reputation_Analysis.py} (100%) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml => CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml} (93%) delete mode 100644 playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json new file mode 100644 index 0000000000..24bb6ab01d --- /dev/null +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json @@ -0,0 +1,752 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Identifier Reputation Analysis", + "coa": { + "data": { + "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "conditions": [ + { + "index": 1 + } + ], + "id": "port_2_to_port_4", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "4", + "targetPort": "4_in" + }, + { + "conditions": [ + { + "index": 2 + } + ], + "id": "port_2_to_port_5", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "id": "port_3_to_port_6", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "6", + "targetPort": "6_in" + }, + { + "id": "port_4_to_port_10", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "10", + "targetPort": "10_in" + }, + { + "id": "port_5_to_port_13", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "13", + "targetPort": "13_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_6_to_port_17", + "sourceNode": "6", + "sourcePort": "6_out", + "targetNode": "17", + "targetPort": "17_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_10_to_port_16", + "sourceNode": "10", + "sourcePort": "10_out", + "targetNode": "16", + "targetPort": "16_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_13_to_port_18", + "sourceNode": "13", + "sourcePort": "13_out", + "targetNode": "18", + "targetPort": "18_in" + }, + { + "id": "port_17_to_port_26", + "sourceNode": "17", + "sourcePort": "17_out", + "targetNode": "26", + "targetPort": "26_in" + }, + { + "id": "port_26_to_port_1", + "sourceNode": "26", + "sourcePort": "26_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_16_to_port_27", + "sourceNode": "16", + "sourcePort": "16_out", + "targetNode": "27", + "targetPort": "27_in" + }, + { + "id": "port_27_to_port_1", + "sourceNode": "27", + "sourcePort": "27_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_18_to_port_28", + "sourceNode": "18", + "sourcePort": "18_out", + "targetNode": "28", + "targetPort": "28_in" + }, + { + "id": "port_28_to_port_1", + "sourceNode": "28", + "sourcePort": "28_out", + "targetNode": "1", + "targetPort": "1_in" + } + ], + "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 1000, + "y": 419.9999999999985 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 1000, + "y": 1520 + }, + "10": { + "data": { + "advanced": { + "customName": "domain reputation filter", + "customNameId": 0, + "description": "Exclude failing domain reputations", + "join": [], + "note": "Exclude failing domain reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "domain_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 3, + "functionName": "domain_reputation_filter", + "id": "10", + "type": "filter" + }, + "errors": {}, + "id": "10", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 840 + }, + "13": { + "data": { + "advanced": { + "customName": "ip reputation filter", + "customNameId": 0, + "description": "Exclude failing ip reputations", + "join": [], + "note": "Exclude failing ip reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "ip_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 4, + "functionName": "ip_reputation_filter", + "id": "13", + "type": "filter" + }, + "errors": {}, + "id": "13", + "type": "filter", + "warnings": {}, + "x": 1380, + "y": 840 + }, + "16": { + "customCode": null, + "data": { + "advanced": { + "customName": "format 2", + "customNameId": 0, + "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", + "join": [], + "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." + }, + "functionId": 4, + "functionName": "format_2", + "id": "16", + "parameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "16", + "type": "format", + "userCode": null, + "warnings": {}, + "x": 980, + "y": 1160 + }, + "17": { + "data": { + "advanced": { + "customName": "format 1", + "customNameId": 0, + "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", + "join": [], + "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." + }, + "functionId": 5, + "functionName": "format_1", + "id": "17", + "parameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "17", + "type": "format", + "warnings": {}, + "x": 640, + "y": 1160 + }, + "18": { + "data": { + "advanced": { + "customName": "format 3", + "customNameId": 0, + "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", + "join": [], + "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " + }, + "functionId": 6, + "functionName": "format_3", + "id": "18", + "parameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "18", + "type": "format", + "warnings": {}, + "x": 1320, + "y": 1160 + }, + "2": { + "data": { + "advanced": { + "customName": "input filter", + "customNameId": 0, + "description": "Filter to pass in a url, domain or ip to it's appropriate action", + "join": [], + "note": "Filter to pass in a url, domain or ip to it's appropriate action" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:url", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "url", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 1, + "op": "!=", + "param": "playbook_input:domain", + "value": "" + } + ], + "conditionIndex": 1, + "customName": "domain", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 2, + "op": "!=", + "param": "playbook_input:ip", + "value": "" + } + ], + "conditionIndex": 2, + "customName": "ip", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "input_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 564.5 + }, + "26": { + "customCode": null, + "data": { + "advanced": { + "customName": "build url output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 1, + "functionName": "build_url_output", + "id": "26", + "inputParameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "26", + "type": "code", + "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 640, + "y": 1380 + }, + "27": { + "customCode": null, + "data": { + "advanced": { + "customName": "build domain output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 2, + "functionName": "build_domain_output", + "id": "27", + "inputParameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "27", + "type": "code", + "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 980, + "y": 1380 + }, + "28": { + "customCode": null, + "data": { + "advanced": { + "customName": "build ip output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 3, + "functionName": "build_ip_output", + "id": "28", + "inputParameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "28", + "type": "code", + "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 1320, + "y": 1380 + }, + "3": { + "data": { + "action": "url reputation", + "actionType": "investigate", + "advanced": { + "customName": "url reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an url", + "join": [], + "note": "Use Talos to get threat data on an url" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "url_reputation", + "id": "3", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "url": "filtered-data:input_filter:condition_1:playbook_input:url" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "url" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 640, + "y": 700 + }, + "4": { + "data": { + "action": "domain reputation", + "actionType": "investigate", + "advanced": { + "customName": "domain reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on a domain", + "join": [], + "note": "Use Talos to get threat data on a domain" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "domain_reputation", + "id": "4", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "domain" + } + ], + "type": "action" + }, + "errors": {}, + "id": "4", + "type": "action", + "warnings": {}, + "x": 980, + "y": 700 + }, + "5": { + "data": { + "action": "ip reputation", + "actionType": "investigate", + "advanced": { + "customName": "ip reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an ip", + "join": [], + "note": "Use Talos to get threat data on an ip" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "ip_reputation", + "id": "5", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "ip" + } + ], + "type": "action" + }, + "errors": {}, + "id": "5", + "type": "action", + "warnings": {}, + "x": 1320, + "y": 700 + }, + "6": { + "data": { + "advanced": { + "customName": "url reputation filter", + "customNameId": 0, + "description": "Exclude failing url reputations", + "join": [], + "note": "Exclude failing url reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "url_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "url_reputation_filter", + "id": "6", + "type": "filter" + }, + "errors": {}, + "id": "6", + "type": "filter", + "warnings": {}, + "x": 700, + "y": 840 + } + }, + "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" + }, + "input_spec": [ + { + "contains": [ + "url" + ], + "description": "A URL provided for reputation analysis", + "name": "url" + }, + { + "contains": [ + "domain" + ], + "description": "A Domain provided for reputation analysis", + "name": "domain" + }, + { + "contains": [ + "ip" + ], + "description": "An IP provided for reputation analysis", + "name": "ip" + } + ], + "output_spec": [ + { + "contains": [], + "datapaths": [ + "build_url_output:custom_function:observable_array", + "build_domain_output:custom_function:observable_array", + "build_ip_output:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", + "metadata": {}, + "name": "observable" + }, + { + "contains": [], + "datapaths": [ + "format_1:formatted_data", + "format_2:formatted_data", + "format_3:formatted_data" + ], + "deduplicate": false, + "description": "An array of reports. One report per observable type.", + "metadata": {}, + "name": "markdown_report" + } + ], + "playbook_trigger": "artifact_created", + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.15", + "version": "6.3.1.176" + }, + "create_time": "2024-12-11T22:12:36.759275+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "reputation", + "url", + "ip", + "domain", + "Cisco Talos Intelligence" + ] +} diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml similarity index 93% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml index de5b0d3276..a66cd2fd49 100644 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml @@ -5,7 +5,7 @@ date: '2025-01-17' author: Kelby Shelton, Tapish Jain, Splunk type: Investigation description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." -playbook: Cisco_Talos_Intelligence_Identifier_Reputation_Analysis +playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json deleted file mode 100644 index 827ec3798e..0000000000 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json +++ /dev/null @@ -1,752 +0,0 @@ -{ - "blockly": false, - "blockly_xml": "", - "category": "Identifier Reputation Analysis", - "coa": { - "data": { - "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", - "edges": [ - { - "id": "port_0_to_port_2", - "sourceNode": "0", - "sourcePort": "0_out", - "targetNode": "2", - "targetPort": "2_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_2_to_port_3", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "3", - "targetPort": "3_in" - }, - { - "conditions": [ - { - "index": 1 - } - ], - "id": "port_2_to_port_4", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "4", - "targetPort": "4_in" - }, - { - "conditions": [ - { - "index": 2 - } - ], - "id": "port_2_to_port_5", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "5", - "targetPort": "5_in" - }, - { - "id": "port_3_to_port_6", - "sourceNode": "3", - "sourcePort": "3_out", - "targetNode": "6", - "targetPort": "6_in" - }, - { - "id": "port_4_to_port_10", - "sourceNode": "4", - "sourcePort": "4_out", - "targetNode": "10", - "targetPort": "10_in" - }, - { - "id": "port_5_to_port_13", - "sourceNode": "5", - "sourcePort": "5_out", - "targetNode": "13", - "targetPort": "13_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_6_to_port_17", - "sourceNode": "6", - "sourcePort": "6_out", - "targetNode": "17", - "targetPort": "17_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_10_to_port_16", - "sourceNode": "10", - "sourcePort": "10_out", - "targetNode": "16", - "targetPort": "16_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_13_to_port_18", - "sourceNode": "13", - "sourcePort": "13_out", - "targetNode": "18", - "targetPort": "18_in" - }, - { - "id": "port_17_to_port_26", - "sourceNode": "17", - "sourcePort": "17_out", - "targetNode": "26", - "targetPort": "26_in" - }, - { - "id": "port_26_to_port_1", - "sourceNode": "26", - "sourcePort": "26_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_16_to_port_27", - "sourceNode": "16", - "sourcePort": "16_out", - "targetNode": "27", - "targetPort": "27_in" - }, - { - "id": "port_27_to_port_1", - "sourceNode": "27", - "sourcePort": "27_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_18_to_port_28", - "sourceNode": "18", - "sourcePort": "18_out", - "targetNode": "28", - "targetPort": "28_in" - }, - { - "id": "port_28_to_port_1", - "sourceNode": "28", - "sourcePort": "28_out", - "targetNode": "1", - "targetPort": "1_in" - } - ], - "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", - "nodes": { - "0": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_start", - "id": "0", - "type": "start" - }, - "errors": {}, - "id": "0", - "type": "start", - "warnings": {}, - "x": 1000, - "y": 419.9999999999985 - }, - "1": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_finish", - "id": "1", - "type": "end" - }, - "errors": {}, - "id": "1", - "type": "end", - "warnings": {}, - "x": 1000, - "y": 1520 - }, - "10": { - "data": { - "advanced": { - "customName": "domain reputation filter", - "customNameId": 0, - "description": "Exclude failing domain reputations", - "join": [], - "note": "Exclude failing domain reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "domain_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 3, - "functionName": "domain_reputation_filter", - "id": "10", - "type": "filter" - }, - "errors": {}, - "id": "10", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 840 - }, - "13": { - "data": { - "advanced": { - "customName": "ip reputation filter", - "customNameId": 0, - "description": "Exclude failing ip reputations", - "join": [], - "note": "Exclude failing ip reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "ip_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 4, - "functionName": "ip_reputation_filter", - "id": "13", - "type": "filter" - }, - "errors": {}, - "id": "13", - "type": "filter", - "warnings": {}, - "x": 1380, - "y": 840 - }, - "16": { - "customCode": null, - "data": { - "advanced": { - "customName": "format 2", - "customNameId": 0, - "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", - "join": [], - "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." - }, - "functionId": 4, - "functionName": "format_2", - "id": "16", - "parameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "16", - "type": "format", - "userCode": null, - "warnings": {}, - "x": 980, - "y": 1160 - }, - "17": { - "data": { - "advanced": { - "customName": "format 1", - "customNameId": 0, - "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", - "join": [], - "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." - }, - "functionId": 5, - "functionName": "format_1", - "id": "17", - "parameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "17", - "type": "format", - "warnings": {}, - "x": 640, - "y": 1160 - }, - "18": { - "data": { - "advanced": { - "customName": "format 3", - "customNameId": 0, - "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", - "join": [], - "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " - }, - "functionId": 6, - "functionName": "format_3", - "id": "18", - "parameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "18", - "type": "format", - "warnings": {}, - "x": 1320, - "y": 1160 - }, - "2": { - "data": { - "advanced": { - "customName": "input filter", - "customNameId": 0, - "description": "Filter to pass in a url, domain or ip to it's appropriate action", - "join": [], - "note": "Filter to pass in a url, domain or ip to it's appropriate action" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "!=", - "param": "playbook_input:url", - "value": "" - } - ], - "conditionIndex": 0, - "customName": "url", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 1, - "op": "!=", - "param": "playbook_input:domain", - "value": "" - } - ], - "conditionIndex": 1, - "customName": "domain", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 2, - "op": "!=", - "param": "playbook_input:ip", - "value": "" - } - ], - "conditionIndex": 2, - "customName": "ip", - "logic": "and" - } - ], - "functionId": 1, - "functionName": "input_filter", - "id": "2", - "type": "filter" - }, - "errors": {}, - "id": "2", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 564.5 - }, - "26": { - "customCode": null, - "data": { - "advanced": { - "customName": "build url output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 1, - "functionName": "build_url_output", - "id": "26", - "inputParameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "26", - "type": "code", - "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 640, - "y": 1380 - }, - "27": { - "customCode": null, - "data": { - "advanced": { - "customName": "build domain output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 2, - "functionName": "build_domain_output", - "id": "27", - "inputParameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "27", - "type": "code", - "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 980, - "y": 1380 - }, - "28": { - "customCode": null, - "data": { - "advanced": { - "customName": "build ip output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 3, - "functionName": "build_ip_output", - "id": "28", - "inputParameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "28", - "type": "code", - "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 1320, - "y": 1380 - }, - "3": { - "data": { - "action": "url reputation", - "actionType": "investigate", - "advanced": { - "customName": "url reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an url", - "join": [], - "note": "Use Talos to get threat data on an url" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "url_reputation", - "id": "3", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "url": "filtered-data:input_filter:condition_1:playbook_input:url" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "url" - } - ], - "type": "action" - }, - "errors": {}, - "id": "3", - "type": "action", - "warnings": {}, - "x": 640, - "y": 700 - }, - "4": { - "data": { - "action": "domain reputation", - "actionType": "investigate", - "advanced": { - "customName": "domain reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on a domain", - "join": [], - "note": "Use Talos to get threat data on a domain" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "domain_reputation", - "id": "4", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "domain" - } - ], - "type": "action" - }, - "errors": {}, - "id": "4", - "type": "action", - "warnings": {}, - "x": 980, - "y": 700 - }, - "5": { - "data": { - "action": "ip reputation", - "actionType": "investigate", - "advanced": { - "customName": "ip reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an ip", - "join": [], - "note": "Use Talos to get threat data on an ip" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "ip_reputation", - "id": "5", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "ip" - } - ], - "type": "action" - }, - "errors": {}, - "id": "5", - "type": "action", - "warnings": {}, - "x": 1320, - "y": 700 - }, - "6": { - "data": { - "advanced": { - "customName": "url reputation filter", - "customNameId": 0, - "description": "Exclude failing url reputations", - "join": [], - "note": "Exclude failing url reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "url_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 2, - "functionName": "url_reputation_filter", - "id": "6", - "type": "filter" - }, - "errors": {}, - "id": "6", - "type": "filter", - "warnings": {}, - "x": 700, - "y": 840 - } - }, - "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" - }, - "input_spec": [ - { - "contains": [ - "url" - ], - "description": "A URL provided for reputation analysis", - "name": "url" - }, - { - "contains": [ - "domain" - ], - "description": "A Domain provided for reputation analysis", - "name": "domain" - }, - { - "contains": [ - "ip" - ], - "description": "An IP provided for reputation analysis", - "name": "ip" - } - ], - "output_spec": [ - { - "contains": [], - "datapaths": [ - "build_url_output:custom_function:observable_array", - "build_domain_output:custom_function:observable_array", - "build_ip_output:custom_function:observable_array" - ], - "deduplicate": false, - "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", - "metadata": {}, - "name": "observable" - }, - { - "contains": [], - "datapaths": [ - "format_1:formatted_data", - "format_2:formatted_data", - "format_3:formatted_data" - ], - "deduplicate": false, - "description": "An array of reports. One report per observable type.", - "metadata": {}, - "name": "markdown_report" - } - ], - "playbook_trigger": "artifact_created", - "playbook_type": "data", - "python_version": "3", - "schema": "5.0.15", - "version": "6.3.1.176" - }, - "create_time": "2024-12-11T22:12:36.759275+00:00", - "draft_mode": false, - "labels": [ - "*" - ], - "tags": [ - "reputation", - "url", - "ip", - "domain", - "Cisco Talos Intelligence" - ] -} \ No newline at end of file From 41eb86190484e3a44e84173712fbdf9b747992d5 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 09:04:37 -0600 Subject: [PATCH 4/6] Renaming again for a new reason --- ...ntelligence_Identifier_Reputation_Analysis.json} | 0 ...Intelligence_Identifier_Reputation_Analysis.png} | Bin ..._Intelligence_Identifier_Reputation_Analysis.py} | 0 ...Intelligence_Identifier_Reputation_Analysis.yml} | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.json => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.png => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.py => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml} (100%) diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml From 7d265c8efa185fd6d339a787eddc09a082572ccb Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 09:15:53 -0600 Subject: [PATCH 5/6] Renaming file again, maybe this won't break --- ...Intelligence_Identifier_Reputation_Analysis.png} | Bin 1 file changed, 0 insertions(+), 0 deletions(-) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png => CiscoTalosIntelligence_Identifier_Reputation_Analysis.png} (100%) diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png From cc90411ace7ffeb602e6e2813c4072930e59bcf4 Mon Sep 17 00:00:00 2001 From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Date: Fri, 31 Jan 2025 06:57:58 +0000 Subject: [PATCH 6/6] Updated TAs --- contentctl.yml | 4 ++-- data_sources/azure_active_directory.yml | 2 +- ...p_role_assignment_to_service_principal.yml | 2 +- ...re_active_directory_add_member_to_role.yml | 2 +- ...ive_directory_add_owner_to_application.yml | 2 +- ...active_directory_add_service_principal.yml | 2 +- ...active_directory_add_unverified_domain.yml | 2 +- ...ctive_directory_consent_to_application.yml | 2 +- ...irectory_disable_strong_authentication.yml | 2 +- .../azure_active_directory_enable_account.yml | 2 +- ..._active_directory_invite_external_user.yml | 2 +- ...ve_directory_reset_password_(by_admin).yml | 2 +- ...ve_directory_set_domain_authentication.yml | 2 +- ...zure_active_directory_sign_in_activity.yml | 2 +- ...re_active_directory_update_application.yml | 2 +- ..._directory_update_authorization_policy.yml | 2 +- .../azure_active_directory_update_user.yml | 2 +- ...irectory_user_registered_security_info.yml | 2 +- ..._or_update_an_azure_automation_account.yml | 2 +- ..._or_update_an_azure_automation_runbook.yml | 2 +- ..._or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 21 ++++++++++++++++--- 22 files changed, 40 insertions(+), 25 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 1608f85298..3cc7816952 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -155,9 +155,9 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 5.4.1 + version: 5.4.2 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz - uid: 4055 title: Splunk Add-on for Microsoft Office 365 appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365 diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 5acf9c76b5..2fa460b33f 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9db213655d..f527bda794 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index c62d91a8c2..3a0db1013e 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6e3b00d39a..a58de4a47b 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 798a1dd0c9..e3970586a3 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 2cb8e93738..d4103cfef6 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 9464b69c7a..d7a04aa5ad 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 2b1fd79f79..2ef98d1f69 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 710007e9f8..b09a4f4204 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index ebb0a4dea9..e66920d152 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 1247baa3b5..b3fb17cd5e 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 07fbd4945f..dda3730b7f 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 71e28dc986..7b53354989 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 821d432ecf..b77b1dfa80 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 6d43b471e6..d04c125346 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 4efa2a3816..c589966ec2 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index f7bef825fe..5880ca36cd 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 8e30686b23..b341d24461 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 024427c038..6511f9fe3e 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 35fccd817e..da046c0e0b 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 4a4eb3f0b0..d3526f723c 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2 version: 1 date: '2025-01-13' author: Bhavin Patel, Splunk -description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. +description: Data source object for Azure Monitor Activity. The Splunk Add-on for + Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure + EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic + settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD sourcetype: azure:monitor:activity separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - column - action @@ -93,4 +96,16 @@ fields: - vendor_product - vendor_region - _time -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}' +example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", + "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", + "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, + "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", + "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, + "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": + "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, + "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", + "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": + ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": + "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, + "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", + "identity": "brian.cove@frothlydev.onmicrosoft.com"}'