admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

changing the desc to match the detection

Browse Source
This commit is contained in:
Namratha Sreekanta
2022-09-20 11:33:06 -07:00
parent 43c213a74c
commit 8fa7fffa2a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/network/detect_dga_domains_using_dltk.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
type: Anomaly
datamodel:
- Network_Resolution
description: 'The following analytic uses a pretrained deep learning classifier to detect DGA domains. The model is trained independently and the model file is available in AWS S3. A domain is classified as DGA generated when the domain name consists of unusual character sequences or concatenated english words. The model uses the domain name to anlayze patterns of character sequences along with custom features to classify a domain as DGA or not. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a pred_is_dga, either a 0 or 1. If pred_is_dga is 1 then the domain name is DGA generated else it is non DGA.'
description: 'The following analytic uses a pretrained deep learning classifier to detect DGA domains. The model is trained independently and the model file is available in AWS S3. A domain is classified as DGA generated when the domain name consists of unusual character sequences or concatenated english words. The model uses the domain name to anlayze patterns of character sequences along with custom features to classify a domain as DGA or not. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a dga_score. Higher the dga_score, the more likely the input domain is a dga domain. The threshold for flagging a domain as dga is set at 0.5.'
search: "| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query
| `drop_dm_object_name("DNS")` | rename query AS domain | fields domain | apply dga_model_dltk | rename pred_dga_proba AS dga_score | where dga_score>0.5 | table domain, dga_score"
how_to_implement: This detection depends on the DSDL app which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The dga_score threshold is set at 0.5 and this should be adjusted based on the environment. The detection uses a pre-trained deep learning model that needs to be deployed in DLTK. Steps for deployment are outlined here - ** update gist here **.