Merge branch 'develop' into awsgcpk8s

2026-06-08 17:32:49 +00:00 · 2020-06-25 13:26:56 -07:00
parent e432a4ab50 4b13ddff94
commit 957b39837f
163 changed files with 6398 additions and 3187 deletions
@@ -6,6 +6,7 @@
 version: 2.1
 orbs:
  aws-cli: circleci/aws-cli@0.1.19
+  slack: circleci/slack@3.4.2

 dependencies:
  cache_directories:
@@ -81,19 +82,10 @@ jobs:
            cd security-content
            source venv/bin/activate
            python bin/doc-gen.py --path . --output docs -v
-      - run:
-          name: check for broken links using liche
-          command: |
-            echo 'export GOROOT=~/.go' >> $BASH_ENV
-            echo 'export PATH=$GOROOT/bin:$PATH' >> $BASH_ENV
-            echo 'export GOPATH=~/go' >> $BASH_ENV
-            echo 'export PATH=$GOPATH/bin:$PATH' >> $BASH_ENV
-            echo 'export GO111MODULE="on"' >> $BASH_ENV
-            source $BASH_ENV
-            go get -u github.com/raviqqe/liche
-            cd security-content
-            liche docs/stories_categories.md -v -t 45
-            liche README.md -v -t 45
+      - slack/status:
+          webhook: '${SLACK_WEBHOOK}'
+          fail_only: true
+        
  build-sources:
    executor: content-executor
    steps:
@@ -127,7 +119,7 @@ jobs:
            python bin/generate.py --path . --output package -v
            # make a copy of use_case_lib in order to have ES work :-(
            cp package/default/use_case_library.conf package/default/analyticstories.conf
-      - run: 
+      - run:
          name: copy lookups .csv files
          command: |
            cd security-content
@@ -159,6 +151,10 @@ jobs:
          root: security-content/
          paths:
              - content-pack-build.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
  build-package:
    executor: content-executor
    steps:
@@ -196,6 +192,10 @@ jobs:
          root: ~/dist
          paths:
             - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
  run-appinspect:
    executor: content-executor
    steps:
@@ -228,6 +228,10 @@ jobs:
          root: ~/
          paths:
             - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
  community-api-update:
    executor: aws-cli/default
    steps:
@@ -244,17 +248,19 @@ jobs:
      - run: *apt-install
      - aws-cli/setup:
          profile-name: default
-      - run: 
+      - run:
          name: update community api sources
          command: |
            cd security-content
-            aws s3 cp stories s3://security-content-community/stories --recursive --exclude "*" --include "*.yml"
-            aws s3 cp baselines s3://security-content-community/baselines --recursive --exclude "*" --include "*.yml"
-            aws s3 cp detections s3://security-content-community/detections --recursive --exclude "*" --include "*.yml"
-            aws s3 cp investigations s3://security-content-community/investigations --recursive --exclude "*" --include "*.yml"
-            aws s3 cp responses s3://security-content-community/responses --recursive --exclude "*" --include "*.yml"
-            aws s3 cp lookups s3://security-content-community/lookups --recursive --exclude "*" --include "*.yml"
-            aws s3 cp macros s3://security-content-community/macros --recursive --exclude "*" --include "*.yml"
+            aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml"
+            aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml"
+            aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml"
+            aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml"
+            aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml"
+            aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml"
+            aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv"
+            aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml"
+            aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml"
      - persist_to_workspace:
          root: ~/
          paths:
@@ -309,6 +315,10 @@ jobs:
          root: ~/
          paths:
              - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
  publish-github-release:
    docker:
      - image: cibuilds/github:0.10
@@ -324,6 +334,10 @@ jobs:
          root: ~/
          paths:
              - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
  attack-range-update:
    executor: aws-cli/default
    steps:
@@ -334,9 +348,13 @@ jobs:
      - run:
          name: sync latest ESCU to the Attack Range S3 bucket for apps
          command: |
-            aws s3 cp ~/DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/ 
+            aws s3 cp ~/DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
            # make the file public since it is not by default
            aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
  master-api-update:
    executor: aws-cli/default
    steps:
@@ -351,17 +369,23 @@ jobs:
      - run: *apt-install
      - aws-cli/setup:
          profile-name: default
-      - run: 
+      - run:
          name: update api sources
          command: |
            cd security-content
            aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml"
            aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml"
            aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml"
-            aws s3 cp investigations s3://security-content/investigations --recursive --exclude "*" --include "*.yml"
+            aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml"
            aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml"
            aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml"
+            aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv"
            aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml"
+            aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml"
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
 workflows:
  version: 2.1
  validate-and-build:
@@ -9,7 +9,4 @@ repos:
    - id: check-yaml
    - id: pretty-format-json
      args: [--autofix]
-    - id: flake8
-      args: [--max-line-length=131]
-      exclude: 'package/bin/da_ess_contentupdate/|package/bin/splunklib/|venv/|package/bin/escu_contextualize.py|package/bin/escu_investigate.py|package/bin/runstory.py|package/bin/detect.py|package/bin/investigate.py'
    - id: requirements-txt-fixer
@@ -1 +1,84 @@
-new version of the README needs to be done
+
+
+
+# Splunk Security Content
+![security-content](docs/static/logo.png)
+=====
+
+| branch | build status |
+| ---    | ---          |
+| develop| [![develop status](https://circleci.com/gh/splunk/security-content/tree/develop.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/develop)|
+| master | [![master status](https://circleci.com/gh/splunk/security-content/tree/master.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/master)|
+
+Welcome to the Splunk Security Content
+
+This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
+
+# Usage
+The Splunk Security Content can be used via:
+
+#### [Splunk App](https://github.com/splunk/security-content/releases)
+Grab the latest release of DA-ESS-ContentUpdate and install it on a Splunk Enterprise instance.
+
+#### [API](https://docs.splunkresearch.com/?version=latest)
+```
+curl -s https://content.splunkresearch.com | jq
+{
+  "hello": "welcome to Splunks Research security content api"
+}
+```
+
+#### [GitHub Workflow](https://github.com/splunk/security-content/wiki/Installation-and-Usage)
+Create your customized version of Security Content by forking this project and following this guide.
+
+# What's in an Analytic Story?
+[Analytic Stories](https://github.com/splunk/security-content/blob/develop/docs/stories_categories.md) and their corresponding searches are composed of **.yml** files (manifests) and associated .conf files. The stories reside in [/stories](https://github.com/splunk/security-content/tree/develop/stories) and the searches live in [/detections](https://github.com/splunk/security-content/tree/develop/detections).
+
+Manifests contain a number of mandatory and optional fields. You can see the full field list for each piece of content [here](https://github.com/splunk/security-content/tree/develop/docs#spec-documentation).
+
+# Customize to your Environment
+
+After release [1.0.46](https://github.com/splunk/security-content/releases) we introduced a concept of **input(pre-filter)** and **output(post-filter)** macros for each of our detection search. The intention behind introducing these macros is primarily to help our users to update the macro definition “once” and those changes will be applicable across all detections that leverage that macro and  local to your Splunk Environment.
+
+**input(pre-filter):** This macro is to  specify your environment-specific configurations (index, source, sourcetype, etc.) to get the specific data sources that you would like to bring in. Replace the macro definition with configurations for your Splunk environment. For example the [sysmon](macros/sysmon.yml) **input macro** can be modified to the local splunk deployments index or sourcetype.
+
+**output(post-filter):** This macro is to  specify your environment-specific values (eg: dest, user), to filter out known false positives.. Replace the macro definition with values that you’d like to exclude from detection results. Think of this as a whitelisting/blacklisting using macros. A good example
+
+
+# Execute an Analytic Story
+
+Download and install the latest version of [Splunk Analytic Story Execution]
+(https://github.com/splunk/analytic_story_execution/releases). This Splunk application will help the user do the following:
+
+1. Execute an analytic story in an adhoc mode and view the results.
+2. Schedule all the detection searches in an analytic story.
+3. Update security-content via an API
+
+
+# Writing Content
+Before you begin, follow the steps to install **dependencies and pre-commit hooks** under [Developing Content](https://github.com/splunk/security-content/wiki/Developing-Content).
+
+# Security Content
+
+#### Content Parts
+* [stories/](stories/): All Analytic Stories
+* [detections/](detections/): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
+* [response_tasks/](response_tasks/): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
+* [responses/](responses/): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
+* [baselines/](baselines/): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+
+#### Supporting Parts
+* [package/](package/): Splunk content app-source files, including lookups, binaries, and default config files
+* [bin/](bin/): All binaries required to produce and test content
+
+# Contribution
+We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security-content/wiki/Contributing-to-the-Project) for more information on how to get involved.
+
+## Support
+Please use the [GitHub Issue Tracker](https://github.com/splunk/security-content/issues) to submit bugs or request features.
+
+If you have questions or need support, you can:
+
+* Post a question to [Splunk Answers](http://answers.splunk.com)
+* Join the [#security-research](https://splunk-usergroups.slack.com/messages/C1RH09ERM/) room in the [Splunk Slack channel](http://splunk-usergroups.slack.com)
+* If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can also open a support case on the https://www.splunk.com/ support portal
@@ -31,5 +31,5 @@ tags:
  - Suspicious MSHTA Activity
  - Unusual Processes
  detections:
-  - Unusually Long Command Line - MLTK
  - Detect Prohibited Applications Spawning cmd.exe
+  - Unusually Long Command Line - MLTK
@@ -36,5 +36,5 @@ tags:
  - Netsh Abuse
  - Ransomware
  detections:
-  - SMB Traffic Spike - MLTK
  - Processes launching netsh
+  - SMB Traffic Spike - MLTK
@@ -17,5 +17,5 @@ tags:
  - Suspicious Emails
  detections:
  - Monitor Email For Brand Abuse
-  - Monitor Web Traffic For Brand Abuse
  - Monitor DNS For Brand Abuse
+  - Monitor Web Traffic For Brand Abuse
@@ -17,7 +17,7 @@ tags:
  analytics_story:
  - AWS Suspicious Provisioning Activities
  detections:
-  - AWS Cloud Provisioning From Previously Unseen City
  - AWS Cloud Provisioning From Previously Unseen IP Address
-  - AWS Cloud Provisioning From Previously Unseen Region
+  - AWS Cloud Provisioning From Previously Unseen City
  - AWS Cloud Provisioning From Previously Unseen Country
+  - AWS Cloud Provisioning From Previously Unseen Region
@@ -25,6 +25,6 @@ tags:
  - Suspicious Command-Line Executions
  - Suspicious MSHTA Activity
  detections:
+  - Detect Prohibited Applications Spawning cmd.exe
  - Processes launching netsh
  - First time seen command line argument
-  - Detect Prohibited Applications Spawning cmd.exe
@@ -1,17 +1,16 @@
 name: Previously Seen Running Windows Services
 id: 64ce0ade-cb01-4678-bddd-d31c0b175394
-version: 2
-date: '2020-01-13'
+version: 3
+date: '2020-06-15'
 description: This collects the services that have been started across your entire
  enterprise.
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
  you must be ingesting your Windows security-event logs for it to execute successfully.
  Please ensure that the Splunk Add-on for Microsoft Windows is version 5.0.0 or above.
 author: David Dorsey, Splunk
-search: '`wineventlog_system` signature_id=7036 | rename param1 as service_name |
+search: '`wineventlog_system` EventCode=7036 | rename param1 as service_name |
  rename param2 as action | search action="running" | stats earliest(_time) as firstTime,
-  latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services
-  | stats count'
+  latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services'
 tags:
  analytics_story:
  - Orangeworm Attack Group
@@ -20,6 +20,6 @@ tags:
  - Suspicious AWS Login Activities
  detections:
  - Detect AWS Console Login by User from New Country
-  - Detect AWS Console Login by User from New City
  - Detect AWS Console Login by User from New Region
+  - Detect AWS Console Login by User from New City
  - Detect new user AWS Console Login
@@ -0,0 +1,25 @@
+name: Previously seen users in CloudTrail - DM
+id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
+version: 1
+date: '2020-05-28'
+description: This search looks for CloudTrail events where a user logs into the console,
+  then creates a baseline of the latest and earliest times, City, Region, and Country
+  we have encountered this user in our dataset, grouped by username, within the last 30
+  days.
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
+  and Enterprise Security 6.2, which contains the required updates to the Authentication data model  
+  for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins.csv`,
+  which is a lookup file created by this support search.
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
+  | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src
+  | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins.csv | stats count'
+tags:
+  analytics_story:
+  - Suspicious Cloud Authentication Activities
+  detections:
+  - Detect AWS Console Login by User from New Country
+  - Detect AWS Console Login by User from New Region
+  - Detect AWS Console Login by User from New City
+  - Detect new user AWS Console Login - DM
@@ -0,0 +1,20 @@
+name: Previously Seen Zoom Child Processes - Initial
+id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b
+version: 1
+date: '2020-05-20'
+description: This search returns the first and last time a process was seen per endpoint with
+    a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is outputed to disk.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node.
+author: David Dorsey, Splunk
+search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen
+        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
+        by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)`
+        | table dest, process_name, firstTimeSeen, lastTimeSeen
+        | outputlookup zoom_first_time_child_process'
+tags:
+  analytics_story:
+  - Suspicious Zoom Child Processes
+  detections:
+  - First Time Seen Child Process of Zoom
@@ -0,0 +1,25 @@
+name: Previously Seen Zoom Child Processes - Update
+id: 80aea7fd-5da2-4533-b3c2-560533bfbaee
+version: 1
+date: '2020-05-20'
+description: This search returns the first and last time a process was seen per endpoint with
+    a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates
+    this information with historical data and filters out proces_name and endpoint pairs that have not
+    been seen within the specified time window. This updated table is outputed to disk.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node.
+author: David Dorsey, Splunk
+search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen
+        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
+        by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)`
+        | table firstTimeSeen, lastTimeSeen, process_name, dest
+        | inputlookup zoom_first_time_child_process append=t
+        | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest
+        | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`")
+        | outputlookup zoom_first_time_child_process'
+tags:
+  analytics_story:
+  - Suspicious Zoom Child Processes
+  detections:
+  - First Time Seen Child Process of Zoom
@@ -21,6 +21,6 @@ tags:
  - Suspicious AWS Login Activities
  detections:
  - Detect AWS Console Login by User from New Country
-  - Detect AWS Console Login by User from New City
  - Detect AWS Console Login by User from New Region
+  - Detect AWS Console Login by User from New City
  - Detect new user AWS Console Login
@@ -0,0 +1,27 @@
+name: Update previously seen users in CloudTrail - DM
+id: 66ff71c2-7e01-47dd-a041-906688c9d322
+version: 1
+date: '2020-05-28'
+description: This search looks for CloudTrail events where a user logs into the console,
+  then updates the baseline of the latest and earliest times, City, Region, and Country
+  we have encountered this user in our dataset, grouped by user, within the last hour.
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
+  and Enterprise Security 6.2, which contains the required updates to the Authentication data model
+  for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins.csv`,
+  which is a lookup file created by this support search.
+author: Rico Valdez, Splunk
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from
+      datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user
+      Authenticaiton.src | iplocation Authentication.src | rename Authentication.user as user
+      Authentciation.src as src | table user src City Region Country firstTime lastTime
+      | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as
+      firstTime max(lastTime) as lastTime by user src City Region Country
+      | outputlookup previously_seen_users_console_logins.csv'
+tags:
+  analytics_story:
+  - Suspicious Cloud Authentication Activities
+  detections:
+  - Detect AWS Console Login by User from New Country
+  - Detect AWS Console Login by User from New Region
+  - Detect AWS Console Login by User from New City
+  - Detect new user AWS Console Login - DM
@@ -12,6 +12,8 @@ import sys
 import datetime
 from jinja2 import Environment, FileSystemLoader
 import re
+from attackcti import attack_client
+import csv


 # global variables
@@ -19,14 +21,13 @@ REPO_PATH = ''
 VERBOSE = False
 OUTPUT_PATH = ''

-
-def load_objects(file_path):
+def load_objects(file_path, VERBOSE):
    files = []
    manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
-
    for file in sorted(glob.glob(manifest_files)):
+        if VERBOSE:
+            print("processing manifest: {0}".format(file))
        files.append(load_file(file))
-
    return files


@@ -55,6 +56,22 @@ def generate_transforms_conf(lookups):

    return output_path

+def generate_collections_conf(lookups):
+    filtered_lookups = list(filter(lambda i: 'collection' in i, lookups))
+    sorted_lookups = sorted(filtered_lookups, key=lambda i: i['name'])
+
+    utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
+
+    j2_env = Environment(loader=FileSystemLoader('bin/jinja2_templates'),
+                         trim_blocks=True)
+    template = j2_env.get_template('collections.j2')
+    output_path = OUTPUT_PATH + "/default/collections.conf"
+    output = template.render(lookups=sorted_lookups, time=utc_time)
+    with open(output_path, 'w') as f:
+        f.write(output)
+
+    return output_path
+

 def generate_savedsearches_conf(detections, response_tasks, baselines, deployments):

@@ -150,6 +167,7 @@ def generate_use_case_library_conf(stories, detections, response_tasks, baseline
    sto_res = map_response_tasks_to_stories(response_tasks)

    for story in stories:
+        story['author_name'], story['author_company'] = parse_author_company(story)
        if story['name'] in sto_det:
            story['detections'] = list(sto_det[story['name']])
        if story['name'] in sto_res:
@@ -235,6 +253,12 @@ def generate_workbench_panels(response_tasks, stories):
                                     trim_blocks=True)
                template = j2_env.get_template('panel.j2')
                output_path = OUTPUT_PATH + "/default/data/ui/panels/workbench_panel_" + response_file_name + ".xml"
+                
+                if response_task['search'].find(">") is not -1:
+                    response_task['search']= response_task['search'].replace(">","&gt;")
+                if response_task['search'].find("<") is not -1:
+                    response_task['search']= response_task['search'].replace("<","&lt;")
+
                output = template.render(search=response_task['search'])
                with open(output_path, 'w') as f:
                    f.write(output)
@@ -263,6 +287,22 @@ def parse_data_models_from_search(search):
    return False


+def parse_author_company(story):
+    match_author = re.search(r'^([^,]+)', story['author'])
+    if match_author is None:
+        match_author = 'no'
+    else:
+        match_author = match_author.group(1)
+
+    match_company = re.search(r',\s?(.*)$', story['author'])
+    if match_company is None:
+        match_company = 'no'
+    else:
+        match_company = match_company.group(1)
+
+    return match_author, match_company
+
+
 def get_deployments(object, deployments):
    matched_deployments = []

@@ -436,6 +476,33 @@ def prepare_stories(stories, detections):
    return stories


+def generate_mitre_lookup():
+
+    csv_mitre_rows = [["mitre_id", "technique", "tactics", "groups"]]
+
+    lift = attack_client()
+    all_enterprise = lift.get_enterprise(stix_format=False)
+    enterprise_relationships = lift.get_enterprise_relationships()
+    enterprise_groups = lift.get_enterprise_groups()
+
+    for technique in all_enterprise['techniques']:
+        apt_groups = []
+        for relationship in enterprise_relationships:
+            if (relationship['target_ref'] == technique['id']) and relationship['source_ref'].startswith('intrusion-set'):
+                for group in enterprise_groups:
+                    if relationship['source_ref'] == group['id']:
+                        apt_groups.append(group['name'])
+
+        if len(apt_groups) == 0:
+            apt_groups.append('no')
+        csv_mitre_rows.append([technique['technique_id'], technique['technique'], '|'.join(technique['tactic']).replace('-',' ').title(), '|'.join(apt_groups)])
+
+    with open('lookups/mitre_enrichment.csv', 'w', newline='') as file:
+        writer = csv.writer(file)
+        writer.writerows(csv_mitre_rows)
+
+
+
 if __name__ == "__main__":

    parser = argparse.ArgumentParser(description="generates splunk conf files out of security-content manifests", epilog="""
@@ -450,16 +517,24 @@ if __name__ == "__main__":
    REPO_PATH = args.path
    OUTPUT_PATH = args.output
    VERBOSE = args.verbose
-    stories = load_objects("stories/*.yml")
-    macros = load_objects("macros/*.yml")
-    lookups = load_objects("lookups/*.yml")
-    baselines = load_objects("baselines/*.yml")
-    detections = load_objects("detections/*.yml")
-    responses = load_objects("responses/*.yml")
-    response_tasks = load_objects("response_tasks/*.yml")
-    deployments = load_objects("deployments/*.yml")
+    stories = load_objects("stories/*.yml", VERBOSE)
+    macros = load_objects("macros/*.yml", VERBOSE)
+    lookups = load_objects("lookups/*.yml", VERBOSE)
+    baselines = load_objects("baselines/*.yml", VERBOSE)
+    detections = load_objects("detections/*.yml", VERBOSE)
+    responses = load_objects("responses/*.yml", VERBOSE)
+    response_tasks = load_objects("response_tasks/*.yml", VERBOSE)
+    deployments = load_objects("deployments/*.yml", VERBOSE)
+
+    try:
+        if VERBOSE:
+            print("generating Mitre lookups")
+        generate_mitre_lookup()
+    except:
+        print("WARNING: Generation of Mitre lookup failed.")

    lookups_path = generate_transforms_conf(lookups)
+    lookups_path = generate_collections_conf(lookups)

    detections = sorted(detections, key=lambda d: d['name'])
    response_tasks = sorted(response_tasks, key=lambda i: i['name'])
@@ -476,6 +551,7 @@ if __name__ == "__main__":

    generate_workbench_panels(response_tasks, stories)

+
    if VERBOSE:
        print("{0} stories have been successfully written to {1}".format(len(stories), story_path))
        print("{0} detections have been successfully written to {1}".format(len(detections), detection_path))
@@ -0,0 +1,13 @@
+#############
+# Automatically generated by generator.py in splunk/security-content
+# On Date: {{ time }} UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+{% for lookup in lookups %}
+[{{ lookup.name }}]
+enforceTypes = false
+replicate = false
+
+{% endfor %}
@@ -94,7 +94,7 @@ search = {{ detection.search }}
 ### ESCU BASELINES ###

 {% for baseline in baselines %}
-[ESCU - {{ baseline.name }} - Baseline]
+[ESCU - {{ baseline.name }}]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -11,6 +11,7 @@
 filename = {{ lookup.filename }}
 {% else %}
 collection = {{ lookup.collection }}
+external_type = kvstore
 {% endif %}
 {% if lookup.default_match is defined %}
 default_match = {{ lookup.default_match }}
@@ -30,5 +31,11 @@ max_matches = {{ lookup.max_matches }}
 {% if lookup.min_matches is defined %}
 min_matches = {{ lookup.min_matches }}
 {% endif %}
+{% if lookup.fields_list is defined %}
+fields_list = {{ lookup.fields_list }}
+{% endif %}
+{% if lookup.filter is defined %}
+filter = {{ lookup.filter }}
+{% endif %}

-{% endfor %}
+{% endfor %}
@@ -13,7 +13,7 @@ category = {{ story.tags.category[0] }}
 last_updated = {{ story.date }}
 version = {{ story.version }}
 references = {{ story.references | tojson }}
-maintainers = {{ story.author | tojson }}
+maintainers = [{"company": "{{ story.author_company }}", "email": "-", "name": "{{ story.author_name }}"}]
 spec_version = 3
 searches = {{ story.searches | tojson }}
 description = {{ story.description }}
@@ -29,7 +29,7 @@ narrative = {{ story.narrative }}
 {% for detection in detections %}
 [savedsearch://ESCU - {{ detection.name }} - Rule]
 type = detection
-asset_type = {{ detection.asset_type }}
+asset_type = {{ detection.tags.asset_type }}
 confidence = medium
 explanation = {{ detection.description }}
 {% if detection.how_to_implement is defined %}
@@ -39,7 +39,7 @@ how_to_implement = none
 {% endif %}
 annotations = {{ detection.mappings | tojson }}
 known_false_positives = {{ detection.known_false_positives }}
-providing_technologies = none
+providing_technologies = []

 {% endfor %}
 ### END DETECTIONS ###
@@ -4,9 +4,9 @@ date: '2020-04-27'
 description: This configuration file applies to all correlation searches that are used for detection
 author: Bhavin Patel
 scheduling:
-  cron_schedule: '*/30 * * * *'
-  earliest_time: -30m
-  latest_time: now
+  cron_schedule: '1 * * * *'
+  earliest_time: -70m@m
+  latest_time: -10m@m
  schedule_window: auto
 alert_action:
  notable:
@@ -0,0 +1,13 @@
+name: Baseline Cache Hourly Updates
+id: 1030c701-2acf-4b1a-9970-46c7145caf2d
+date: '2020-06-24'
+description: This configuration file applies to all baselines with tag deployments Hourly Cache Updates
+author: Bhavin Patel
+scheduling:
+  cron_schedule: '55 * * * *'
+  earliest_time: -70m@m
+  latest_time: -10m@m
+  schedule_window: auto
+tags:
+  deployments:
+    - Hourly Cache Updates
@@ -0,0 +1,13 @@
+name: Long Running Baseline Searches
+id: 6eac9f8b-a35d-4b64-b57f-e5ecde43be6b
+date: '2020-06-24'
+description: This configuration file applies to all baselines with tag deployments Long Running Baseline
+author: Bhavin Patel
+scheduling:
+  cron_schedule: '0 7 * * *'
+  earliest_time: -7d
+  latest_time: -now
+  schedule_window: auto
+tags:
+  deployments:
+    - Long Running Baseline
@@ -14,7 +14,7 @@ author: Rico Valdez, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
  (Processes.process=*-addstore* AND Processes.process=*disallowed* ) by Processes.parent_process
-  Processes.process_name Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  Processes.process_name Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
  | `attempt_to_add_certificate_to_untrusted_store_filter`'
 known_false_positives: There may be legitimate reasons for administrators to add a
  certificate to the untrusted certificate store. In such cases, this will typically
@@ -17,7 +17,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime
  \ (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)\
  \ by Registry.registry_path Registry.registry_key_name Registry.registry_value_name\
  \ Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|\
-  \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` "
+  \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`\_"
 known_false_positives: Administrators may attempt to change the default execution
  policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
  or "bypass" as this search is designed to identify, would be unusual. Hits should
@@ -1,6 +1,6 @@
 name: AWS Cross Account Activity From Previously Unseen Account
 id: 64fbbddf-fabf-4edf-80b3-0cc36ef37727
-version: 2
+version: 3
 date: '2018-11-02'
 description: This search looks for AssumeRole events where an IAM role in a different
  account is requested for the first time.
@@ -15,12 +15,10 @@ author: David Dorsey, Splunk
 search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
  | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
  | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity
-  | multireport [| stats min(eval(coalesce(firstTime, strptime(_time,"%Y-%m-%d %H:%M:%S"))))
-  as firstTime max(eval(coalesce(strptime(_time,"%Y-%m-%d %H:%M:%S"), lastTime)))
+  | multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time)))
  as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity
-  | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, strptime(_time,"%Y-%m-%d
-  %H:%M:%S")))) as firstTime, max(eval(coalesce(strptime(_time,"%Y-%m-%d %H:%M:%S"),
-  lastTime))) as lastTime by requestingAccountId, requestedAccountId | where firstTime
+  | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime, 
+  max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime
  >= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId
  path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN
  | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime)
@@ -27,10 +27,10 @@ known_false_positives: It's possible that an enterprise has more than five DNS s
  that are configured in a round-robin rotation. Please customize the search, as appropriate.
 tags:
  analytics_story:
-  - Command and Control
-  - Host Redirection
-  - Suspicious DNS Traffic
  - DNS Hijacking
+  - Command and Control
+  - Suspicious DNS Traffic
+  - Host Redirection
  mitre_attack_id:
  - T1048
  kill_chain_phases:
@@ -15,7 +15,7 @@ author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
  as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`ransomware_notes`|
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` |
  `common_ransomware_notes_filter`'
 known_false_positives: It's possible that a legitimate file could be created with
  the same name used by ransomware note files.
@@ -14,11 +14,11 @@ references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
  user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
-  OR Processes.process_name=net1.exe) by Processes.process Processes.process_name
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`  | search (process=*localgroup* OR process=*/add*
-  OR process=*user*) |`create_local_admin_accounts_using_net_exe_filter` '
+  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
+  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add*
+  OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`create_local_admin_accounts_using_net_exe_filter` '
 known_false_positives: Administrators often leverage net.exe to create admin accounts.
 tags:
  analytics_story:
@@ -19,8 +19,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.user)
  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
  OR Processes.process_name=net1.exe) by Processes.process Processes.process_name
  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | search (process=*share* AND process=*delete*)
-  | `create_or_delete_windows_shares_using_net_exe_filter` '
+  `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
 known_false_positives: Administrators often leverage net.exe to create or delete network
  shares. You should verify that the activity was intentional and is legitimate.
 tags:
@@ -16,7 +16,7 @@ author: Patrick Bareiss, Splunk
 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime
  max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename
  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`create_remote_thread_into_lsass_filter`'
+  | `create_remote_thread_into_lsass_filter`'
 known_false_positives: Other tools can access LSASS for legitimate reasons and generate
  an event. In these cases, tweaking the search may help eliminate noise.
 tags:
@@ -4,20 +4,15 @@ version: 1
 date: '2019-12-10'
 description: This search detects the use of wmic and Powershell to create a shadow
  copy.
-how_to_implement: You must enable Powershell scriptblock logging in order to detect
-  this attack.This search uses an input macro named `sysmon`. We strongly recommend
-  that you specify your environment-specific configurations (index, source, sourcetype,
-  etc.) for Windows Sysmon logs. Replace the macro definition with configurations
-  for your Splunk environment. The search also uses a post-filter macro designed to
-  filter out known false positives.
 type: ESCU
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 author: Patrick Bareiss, Splunk
-search: '`sysmon` Message=*win32_shadowcopy* Message=*Create* | stats count min(_time)
-  as firstTime max(_time) as lastTime by dvc User EventCode Message | rename User
-  as user, dvc as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `creation_of_shadow_copy_with_wmic_and_powershell_filter` '
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name=wmic* OR Processes.process_name=powershell* Processes.process=*shadowcopy* Processes.process=*create*
+  by Processes.user Processes.process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
 known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
 tags:
  analytics_story:
@@ -24,8 +24,8 @@ known_false_positives: vssadmin.exe and wmic.exe are standard applications shipp
  delete old backup copies, although this is typically rare.
 tags:
  analytics_story:
-  - SamSam Ransomware
  - Windows Log Manipulation
+  - SamSam Ransomware
  - Ransomware
  kill_chain_phases:
  - Actions on Objectives
@@ -19,8 +19,8 @@ known_false_positives: It's possible for legitimate HTTP requests to be made to
  containing the suspicious paths.
 tags:
  analytics_story:
-  - SamSam Ransomware
  - JBoss Vulnerability
+  - SamSam Ransomware
  mitre_attack_id:
  - T1082
  kill_chain_phases:
@@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi
 tags:
  analytics_story:
  - Suspicious AWS Login Activities
+  - Suspicious Cloud Authentication Activities
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi
 tags:
  analytics_story:
  - Suspicious AWS Login Activities
+  - Suspicious Cloud Authentication Activities
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -30,6 +30,7 @@ known_false_positives: When a legitimate new user logins for the first time, thi
 tags:
  analytics_story:
  - Suspicious AWS Login Activities
+  - Suspicious Cloud Authentication Activities
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -44,12 +44,12 @@ known_false_positives: Some users and applications may leverage Dynamic DNS to r
  however this activity must be verified.
 tags:
  analytics_story:
+  - Data Protection
  - Prohibited Traffic Allowed or Protocol Mismatch
-  - Suspicious DNS Traffic
  - DNS Hijacking
+  - Suspicious DNS Traffic
  - Dynamic DNS
  - Command and Control
-  - Data Protection
  kill_chain_phases:
  - Command and Control
  - Actions on Objectives
@@ -28,8 +28,8 @@ known_false_positives: It's possible that legitimate TXT record responses can be
  to help mitigate false positives.
 tags:
  analytics_story:
-  - Command and Control
  - Suspicious DNS Traffic
+  - Command and Control
  mitre_attack_id:
  - T1043
  kill_chain_phases:
@@ -20,8 +20,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 known_false_positives: No known false positives for this detection.
 tags:
  analytics_story:
-  - SamSam Ransomware
  - JBoss Vulnerability
+  - SamSam Ransomware
  kill_chain_phases:
  - Delivery
  cis20:
@@ -0,0 +1,33 @@
+name: Detect new user AWS Console Login - DM
+id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
+version: 1
+date: '2020-05-28'
+description: This search looks for CloudTrail events wherein a console login event
+  by a user was recorded within the last hour, then compares the event to a lookup
+  file of previously seen users (by ARN values) who have logged into the console.
+  The alert is fired if the user has logged into the console for the first time within
+  the last hour
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
+  and Enterprise Security 6.2, which contains the required updates to the Authentication data model
+  for cloud use cases. Run the "Previously seen users in CloudTrail" support search only once to
+  create a baseline of previously seen IAM users within the last 30 days. Run "Update
+  previously seen users in CloudTrail" hourly (or more frequently depending on how
+  often you run the detection searches) to refresh the baselines.
+type: ESCU
+author: Rico Valdez, Splunk
+search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(), '-70m@m'), 'First Time Logging into AWS Console','Previously Seen User')| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_new_user_aws_console_login___dm_filter`"
+known_false_positives: When a legitimate new user logins for the first time, this
+  activity will be detected. Check how old the account is and verify that the user
+  activity is legitimate.
+tags:
+  analytics_story:
+  - Suspicious Cloud Authentication Activities
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 16
+  nist:
+  - DE.DP
+  - DE.AE
+  security_domain: network
+  asset_type: AWS Instance
@@ -24,6 +24,7 @@ tags:
  analytics_story:
  - Suspicious Command-Line Executions
  - Suspicious MSHTA Activity
+  - Suspicious Zoom Child Processes
  mitre_attack_id:
  - T1059
  kill_chain_phases:
@@ -41,9 +41,9 @@ known_false_positives: The false-positive rate may vary based on the values of`d
  of blocked outbound connections.
 tags:
  analytics_story:
-  - Command and Control
  - AWS Network ACL Activity
  - Suspicious AWS Traffic
+  - Command and Control
  kill_chain_phases:
  - Actions on Objectives
  - Command and Control
@@ -22,8 +22,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
 known_false_positives: Some legitimate applications may exhibit this behavior.
 tags:
  analytics_story:
-  - Suspicious Command-Line Executions
  - 'Emotet Malware  DHS Report TA18-201A '
+  - Suspicious Command-Line Executions
  mitre_attack_id:
  - T1059
  kill_chain_phases:
@@ -39,9 +39,9 @@ known_false_positives: It's possible that normal DNS traffic will exhibit this b
  can also be modified to better suit your environment.
 tags:
  analytics_story:
-  - Command and Control
  - Data Protection
  - Suspicious DNS Traffic
+  - Command and Control
  mitre_attack_id:
  - T1043
  kill_chain_phases:
@@ -21,8 +21,8 @@ known_false_positives: This registry key may be modified via administrators to i
  a change in system policy. This type of change should be a very rare occurrence.
 tags:
  analytics_story:
-  - Suspicious Windows Registry Activities
  - Windows Defense Evasion Tactics
+  - Suspicious Windows Registry Activities
  mitre_attack_id:
  - T1112
  kill_chain_phases:
@@ -47,9 +47,9 @@ known_false_positives: If you are seeing more results than desired, you may cons
  the support search to re-build the ML model on the latest data.
 tags:
  analytics_story:
-  - Command and Control
  - Hidden Cobra Malware
  - Suspicious DNS Traffic
+  - Command and Control
  mitre_attack_id:
  - T1043
  kill_chain_phases:
@@ -18,9 +18,9 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Network_
 known_false_positives: It's possible there can be long domain names that are legitimate.
 tags:
  analytics_story:
-  - Command and Control
  - Hidden Cobra Malware
  - Suspicious DNS Traffic
+  - Command and Control
  mitre_attack_id:
  - T1043
  kill_chain_phases:
@@ -18,10 +18,10 @@ known_false_positives: Legitimate DNS activity can be detected in this search. I
  verify and update the list of authorized DNS servers as appropriate.
 tags:
  analytics_story:
-  - Command and Control
-  - Host Redirection
-  - Suspicious DNS Traffic
  - DNS Hijacking
+  - Command and Control
+  - Suspicious DNS Traffic
+  - Host Redirection
  kill_chain_phases:
  - Command and Control
  cis20:
@@ -29,8 +29,8 @@ search: '| tstats `security_content_summariesonly` count values(All_Email.recipi
 known_false_positives: None at this time
 tags:
  analytics_story:
-  - Suspicious Emails
  - 'Emotet Malware  DHS Report TA18-201A '
+  - Suspicious Emails
  kill_chain_phases:
  - Delivery
  cis20:
@@ -21,8 +21,8 @@ known_false_positives: It is possible legitimate traffic can trigger this rule.
  to better suit your environment.
 tags:
  analytics_story:
-  - Command and Control
  - Suspicious DNS Traffic
+  - Command and Control
  mitre_attack_id:
  - T1048
  - T1043
@@ -0,0 +1,38 @@
+name: First Time Seen Child Process of Zoom
+id: e91bd102-d630-4e76-ab73-7e3ba22c5961
+version: 1
+date: '2020-05-20'
+description: This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You should run the baseline search `Previously Seen Zoom Child Processes - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Zoom Child Processes - Update` to keep this table up to date and to age out old child processes. Please update the `previously_seen_zoom_child_processes_window` macro to adjust the time window. 
+type: ESCU
+references: []
+author: David Dorsey, Splunk
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime
+        values(Processes.parent_process_name) as parent_process_name
+        values(Processes.parent_process_id) as parent_process_id
+        values(Processes.process_name) as process_name values(Processes.process) as process
+        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
+        by Processes.process_id Processes.dest 
+        | `drop_dm_object_name(Processes)` 
+        | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen 
+        | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`")
+        | `security_content_ctime(firstTime)`
+        | table firstTime dest, process_id, process_name, parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter`'
+known_false_positives: A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
+tags:
+  analytics_story:
+  - Suspicious Zoom Child Processes
+  mitre_attack_id:
+  - T1068
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 3
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  - PR.IP
+  security_domain: endpoint
+  asset_type: Endpoint
@@ -34,11 +34,11 @@ known_false_positives: Legitimate programs can also use command-line arguments t
  macro to exclude legitimate parent_process_name
 tags:
  analytics_story:
-  - Suspicious Command-Line Executions
-  - Hidden Cobra Malware
  - DHS Report TA18-074A
-  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - Suspicious Command-Line Executions
  - Orangeworm Attack Group
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - Hidden Cobra Malware
  mitre_attack_id:
  - T1064
  - T1059
@@ -1,7 +1,7 @@
 name: First Time Seen Running Windows Service
 id: 823136f2-d755-4b6d-ae04-372b486a5808
-version: 2
-date: '2020-01-13'
+version: 3
+date: '2020-06-15'
 description: This search looks for the first time a Windows service is seen running
  in your environment.
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
@@ -12,9 +12,9 @@ how_to_implement: While this search does not require you to adhere to Splunk CIM
 type: ESCU
 references: []
 author: David Dorsey, Splunk
-search: '`wineventlog_system` signature_id=7036 | rename param1 as service_name |
+search: '`wineventlog_system` EventCode=7036 | rename param1 as service_name |
  rename param2 as action | search action="running" [ search `wineventlog_system`
-  signature_id=7036 | rename param1 as service_name | rename param2 as action | search
+  EventCode=7036 | rename param1 as service_name | rename param2 as action | search
  action="running" | stats earliest(_time) as firstTime, latest(_time) as lastTime
  by service_name | inputlookup append=t previously_seen_running_windows_services
  | stats min(firstTime) as firstTime max(lastTime) as lastTime by service_name |
@@ -17,14 +17,14 @@ author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) values(Processes.process)
  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe
  (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user
-  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
+  Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
  `hiding_files_and_directories_with_attrib_exe_filter` '
 known_false_positives: 'Some applications and users may legitimately use attrib.exe
  to interact with the files. '
 tags:
  analytics_story:
-  - Windows Persistence Techniques
  - Windows Defense Evasion Tactics
+  - Windows Persistence Techniques
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -0,0 +1,31 @@
+name: Kerberoasting spn request with RC4 encryption 
+id: 5cc67381-44fa-4111-8a37-7a230943f027
+version: 1
+date: '2020-06-11'
+description: This search detects a potential kerberoasting attack via service principal name requests
+how_to_implement: You must be ingesting endpoint data that tracks process activity, and include the windows security event logs that contain kerberos
+type: ESCU
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md
+  - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity
+author: Jose Hernandez, Splunk
+search: '`wineventlog_security` EventID=4769 TicketOptions=0x40810000 TicketEncryptionType=0x17 
+| stats count min(_time) as firstTime max(_time) as lastTime values(ServiceName) values(TargetUserName) values(user)  by TargetDomainName 
+| `security_content_ctime(lastTime)`
+| `security_content_ctime(firstTime)` 
+| `kerberoasting_spn_request_with_rc4_encryption_filter`'
+known_false_positives: Older systems that support kerberos RC4 by default NetApp may generate false positives
+tags:
+  analytics_story:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1208
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes RBAC authorizations
 how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs"
 id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8
 known_false_positives: "Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted."
-name: "AWS EKS Kubernetes RBAC authorizations by account"
+name: "Kubernetes AWS detect RBAC authorization by account"
 references: []
-search: sourcetype="aws:cloudwatchlogs:eks" annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason | stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_aws_detect_RBAC_authorization_by_account`
+search: "`aws_cloudwatchlogs_eks` annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason | stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_aws_detect_rbac_authorization_by_account_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Role Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes service accounts,ac
 how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs"
 id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6
 known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness."
-name: "AWs EKS Kubernetes detect most active service accounts by pod."
+name: "Kubernetes AWS detect most active service accounts by pod"
 references: []
-search: sourcetype=aws:cloudwatchlogs:eks user.groups{}=system:serviceaccounts  objectRef.resource=pods | table  sourceIPs{} user.username userAgent verb annotations.authorization.k8s.io/decision  | top  sourceIPs{} user.username verb annotations.authorization.k8s.io/decision |`kubernetes_aws_detect_most_active_service_accounts_by_pod`
+search: "`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts  objectRef.resource=pods | table  sourceIPs{} user.username userAgent verb annotations.authorization.k8s.io/decision  | top  sourceIPs{} user.username verb annotations.authorization.k8s.io/decision |`kubernetes_aws_detect_most_active_service_accounts_by_pod_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Role Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes accounts accessing
 how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs."
 id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c
 known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
-name: "AWS EKS Kubernetes cluster sensitive object access detection"
+name: "AWS EKS Kubernetes cluster sensitive object access"
 references: []
-search: sourcetype="aws:cloudwatchlogs:eks" objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1  |table sourceIPs{} user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_object_access`"
+search: "`aws_cloudwatchlogs_eks` objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1  |table sourceIPs{} user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`aws_eks_kubernetes_cluster_sensitive_object_access_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Object Access Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes accounts accessing
 how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs."
 id: b6013a7b-85e0-4a45-b051-10b252d69569
 known_false_positives: "Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. "
-name: "AWS EKS Kubernetes cluster sensitive role access detection"
+name: "Kubernetes AWS detect sensitive role access"
 references: []
-search: sourcetype="aws:cloudwatchlogs:eks" objectRef.resource=clusterroles OR clusterrolebindings sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1  | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_role_access`
+search: "`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrolebindings sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1  | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_role_access_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Role Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes service accounts wi
 how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs."
 id: a6959c57-fa8f-4277-bb86-7c32fba579d5
 known_false_positives: "This search can give false positives as there might be inherent issues with authentications and permissions at cluster."
-name: "AWS EKS Kubernetes cluster sensitive object access detection"
+name: "Kubernetes AWS detect service accounts forbidden failure access"
 references: []
-search: sourcetype=aws:cloudwatchlogs:eks user.groups{}=system:serviceaccounts responseStatus.status = Failure | table sourceIPs{} src_user userAgent verb responseStatus.status requestURI | `kubernetes_aws_detect_service_accounts_forbidden_failure_access`
+search: "`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts responseStatus.status = Failure | table sourceIPs{} src_user userAgent verb responseStatus.status requestURI | `kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Object Access Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on anonymous Kubectl calls with I
 how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs."
 id: 042a3d32-8318-4763-9679-09db2644a8f2
 known_false_positives: "Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets"
-name: "AWS EKS Kubernetes detect suspicious kubectl calls"
+name: "Kubernetes AWS detect suspicious kubectl calls"
 references: []
-search: "sourcetype=aws:cloudwatchlogs:eks userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous  | table  src_ip src_user verb userAgent requestURI  | stats  count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls`"
+search: "`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous  | table  src_ip src_user verb userAgent requestURI  | stats  count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Object Access Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes service accounts,ac
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
 known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness."
-name: "Azure AKS Kubernetes detect most active service accounts by pod and namespaces"
+name: "Kubernetes Azure detect most active service accounts by pod namespace"
 references: []
-search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Role Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes RBAC authorizations
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: 47af7d20-0607-4079-97d7-7a29af58b54e
 known_false_positives: "Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted."
-name: "Azure AKS Kubernetes RBAC authorizations by account"
+name: "Kubernetes Azure detect RBAC authorization by account"
 references: []
-search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason |stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_RBAC_authorization_by_account`"
+search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason |stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_rbac_authorization_by_account_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Role Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes accounts accessing
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: 1bba382b-07fd-4ffa-b390-8002739b76e8
 known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
-name: "Azure AKS Kubernetes cluster sensitive object access detection"
+name: "Kubernetes Azure detect sensitive object access"
 references: []
-search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Object Access Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes accounts accessing
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: f27349e5-1641-4f6a-9e68-30402be0ad4c
 known_false_positives: "Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. "
-name: "Azure AKS Kubernetes cluster sensitive role access detection"
+name: "Kubernetes Azure detect sensitive role access"
 references: []
-search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log| search objectRef.resource=clusterroles OR clusterrolebindings | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=clusterroles OR clusterrolebindings | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Role Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on Kubernetes service accounts wi
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: 019690d7-420f-4da0-b320-f27b09961514
 known_false_positives: "This search can give false positives as there might be inherent issues with authentications and permissions at cluster."
-name: "Azure AKS Kubernetes cluster sensitive object access detection"
+name: "Kubernetes Azure detect service accounts forbidden failure access"
 references: []
-search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Object Access Activity"
@@ -4,9 +4,9 @@ description: "This search provides information on rare Kubectl calls with IP, ve
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5
 known_false_positives: "Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets"
-name: "Azure AKS Kubernetes detect suspicious kubectl calls"
+name: "Kubernetes Azure detect suspicious kubectl calls"
 references: []
-search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log | spath input=responseObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration | search userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 | table sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI | rare sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI|`kubernetes_azure_detect_suspicious_kubectl_calls`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | spath input=responseObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration | search userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 | table sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI | rare sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI|`kubernetes_azure_detect_suspicious_kubectl_calls_filter`"
 tags:
  analytics_story:
    - "Kubernetes Sensitive Object Access Activity"
@@ -4,9 +4,9 @@ description: "This search provides information of unauthenticated requests via s
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: 86aad3e0-732f-4f66-bbbc-70df448e461d
 known_false_positives: "Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context."
-name: "Azure AKS Kubernetes cluster pod scan detection"
+name: "Kubernetes Azure pod scan fingerprint"
 references: []
-search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_detection`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter`"
 tags:
  analytics_story:
    - "Kubernetes Scanning Activity"
@@ -4,9 +4,9 @@ description: "This search provides information of unauthenticated requests via s
 how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
 id: c5e5bd5c-1013-4841-8b23-e7b3253c840a
 known_false_positives: "Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context."
-name: "Azure AKS Kubernetes cluster scan detection"
+name: "Kubernetes Azure scan fingerprint"
 references: []
-search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_detection`"
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_filter`"
 tags:
  analytics_story:
    - "Kubernetes Scanning Activity"
@@ -26,8 +26,8 @@ known_false_positives: Legitimate process can have this combination of command-l
  options, but it's not common.
 tags:
  analytics_story:
-  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Malicious PowerShell
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  mitre_attack_id:
  - T1086
  - T1064
@@ -21,8 +21,8 @@ search: '| tstats `security_content_summariesonly` values(All_Email.recipient) a
 known_false_positives: None at this time
 tags:
  analytics_story:
-  - Suspicious Emails
  - Brand Monitoring
+  - Suspicious Emails
  kill_chain_phases:
  - Delivery
  cis20:
@@ -9,7 +9,7 @@ type: ESCU
 author: Rico Valdez, Splunk
 search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, country, state, city, src_ip |`okta_account_lockout_events_filter` '
+  as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
 known_false_positives: None. Account lockouts should be followed up on to determine
  if the actual user was the one who caused the lockout, or if it was an unauthorized
  actor.
@@ -9,7 +9,7 @@ type: ESCU
 author: Rico Valdez, Splunk
 search: '`okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time)
  as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage,
-  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`okta_failed_sso_attempts_filter` '
+  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_failed_sso_attempts_filter` '
 known_false_positives: There may be a faulty config preventing legitmate users from
  accessing apps they should have access to.
 tags:
@@ -12,7 +12,7 @@ search: '`okta` displayMessage="User login to Okta" client.geographicalContext.c
  | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)
  as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state)
  as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`okta_user_logins_from_multiple_cities_filter`| search locations > 1'
+  | `okta_user_logins_from_multiple_cities_filter` | search locations > 1'
 known_false_positives: Users in your enviornment may legitmately be travelling and
  loggin in from different locations. This search is useful for those users that should
  *not* be travelling for some reason, such as the COVID-19 pandemic. The search also
@@ -23,9 +23,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 known_false_positives: None identified
 tags:
  analytics_story:
-  - Command and Control
-  - Ransomware
  - Prohibited Traffic Allowed or Protocol Mismatch
+  - Ransomware
+  - Command and Control
  mitre_attack_id:
  - T1043
  - T1048
@@ -24,9 +24,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 known_false_positives: None identified
 tags:
  analytics_story:
-  - SamSam Ransomware
-  - 'Emotet Malware  DHS Report TA18-201A '
  - Monitor for Unauthorized Software
+  - 'Emotet Malware  DHS Report TA18-201A '
+  - SamSam Ransomware
  kill_chain_phases:
  - Installation
  - Command and Control
@@ -26,8 +26,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 known_false_positives: None identified
 tags:
  analytics_story:
-  - Command and Control
  - Prohibited Traffic Allowed or Protocol Mismatch
+  - Command and Control
  mitre_attack_id:
  - T1043
  kill_chain_phases:
@@ -1,36 +1,27 @@
 name: Reg exe Manipulating Windows Services Registry Keys
 id: 8470d755-0c13-45b3-bd63-387a373c10cf
-version: 2
-date: '2019-03-01'
+version: 3
+date: '2020-06-15'
 description: The search looks for reg.exe modifying registry keys that define Windows
  services and their configurations.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on registry changes that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry`
-  nodes.
 type: ESCU
 references: []
 author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name)
-  as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name
-  = reg.exe by Processes.process_id Processes.dest | `drop_dm_object_name("Processes")`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join
-  [| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path
-  count  FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\services\\*"
-  by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table
-  process_id dest registry_path] | `reg_exe_manipulating_windows_services_registry_keys_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name
+  values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
+  where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services*
+  by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name("Processes")`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `reg_exe_manipulating_windows_services_registry_keys_filter`'
 known_false_positives: It is unusual for a service to be created or modified by directly
  manipulating the registry. However, there may be legitimate instances of this behavior.
  It is important to validate and investigate, as appropriate.
 tags:
  analytics_story:
-  - Windows Persistence Techniques
  - Windows Service Abuse
+  - Windows Persistence Techniques
  mitre_attack_id:
-  - T1050
-  - T1031
-  - T1089
+  - T1058
  kill_chain_phases:
  - Installation
  cis20:
@@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
 known_false_positives: None at the moment
 tags:
  analytics_story:
+  - Windows Defense Evasion Tactics
  - Suspicious Windows Registry Activities
  - Windows Persistence Techniques
-  - Windows Defense Evasion Tactics
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -28,12 +28,12 @@ known_false_positives: There are many legitimate applications that must execute
 tags:
  analytics_story:
  - Suspicious Windows Registry Activities
-  - Windows Persistence Techniques
-  - 'Emotet Malware  DHS Report TA18-201A '
-  - Ransomware
+  - Suspicious MSHTA Activity
  - DHS Report TA18-074A
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
-  - Suspicious MSHTA Activity
+  - Ransomware
+  - Windows Persistence Techniques
+  - 'Emotet Malware  DHS Report TA18-201A '
  mitre_attack_id:
  - T1103
  - T1131
@@ -20,9 +20,9 @@ known_false_positives: This technique may be legitimately used by administrators
  modify remote registries, so it's important to filter these events out.
 tags:
  analytics_story:
+  - Windows Defense Evasion Tactics
  - Suspicious Windows Registry Activities
  - Windows Persistence Techniques
-  - Windows Defense Evasion Tactics
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -1,14 +1,9 @@
 name: Sc exe Manipulating Windows Services
 id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
-version: 2
-date: '2019-02-27'
+version: 3
+date: '2020-06-15'
 description: This search looks for arguments to sc.exe indicating the creation or
  modification of a Windows service.
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
 type: ESCU
 references: []
 author: Rico Valdez, Splunk
@@ -23,15 +18,13 @@ known_false_positives: Using sc.exe to manipulate Windows services is uncommon.
  and investigate as appropriate.
 tags:
  analytics_story:
-  - Windows Persistence Techniques
  - Windows Service Abuse
-  - Disabling Security Tools
  - DHS Report TA18-074A
  - Orangeworm Attack Group
+  - Windows Persistence Techniques
+  - Disabling Security Tools
  mitre_attack_id:
  - T1050
-  - T1031
-  - T1089
  kill_chain_phases:
  - Installation
  cis20:
@@ -21,9 +21,9 @@ known_false_positives: A file server may experience high-demand loads that could
  this analytic to trigger.
 tags:
  analytics_story:
-  - Ransomware
  - 'Emotet Malware  DHS Report TA18-201A '
  - Hidden Cobra Malware
+  - Ransomware
  - DHS Report TA18-074A
  mitre_attack_id:
  - T1043
@@ -42,9 +42,9 @@ known_false_positives: If you are seeing more results than desired, you may cons
  the `smb_traffic_spike_mltk_filter` macro to filter out false positive results
 tags:
  analytics_story:
-  - Ransomware
  - 'Emotet Malware  DHS Report TA18-201A '
  - Hidden Cobra Malware
+  - Ransomware
  - DHS Report TA18-074A
  mitre_attack_id:
  - T1043
@@ -26,8 +26,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 known_false_positives: None identified
 tags:
  analytics_story:
-  - Suspicious Emails
  - 'Emotet Malware  DHS Report TA18-201A '
+  - Suspicious Emails
  kill_chain_phases:
  - Delivery
  cis20:
@@ -29,8 +29,8 @@ known_false_positives: It's possible for system administrators to write scripts
  to filter them out.
 tags:
  analytics_story:
-  - Disabling Security Tools
  - Windows Defense Evasion Tactics
+  - Disabling Security Tools
  - DHS Report TA18-074A
  mitre_attack_id:
  - T1112
@@ -21,8 +21,8 @@ known_false_positives: None identified
 tags:
  analytics_story:
  - Suspicious Command-Line Executions
-  - Ransomware
  - Unusual Processes
+  - Ransomware
  mitre_attack_id:
  - T1036
  kill_chain_phases:
@@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 known_false_positives: None at this time
 tags:
  analytics_story:
-  - Command and Control
-  - Ransomware
  - Prohibited Traffic Allowed or Protocol Mismatch
+  - Ransomware
+  - Command and Control
  mitre_attack_id:
  - T1043
  kill_chain_phases:
@@ -16,16 +16,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)`|  eval processlen=len(process) | eventstats stdev(processlen)
  as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev)
-  as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process|
-  `unusually_long_command_line_filter`  eval threshold = 10 | where maxlen > ((threshold*stdevperhost)
+  as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process |
+  `unusually_long_command_line_filter` | eval threshold = 10 | where maxlen > ((threshold*stdevperhost)
  + avgperhost)'
 known_false_positives: Some legitimate applications start with long command lines.
 tags:
  analytics_story:
-  - Ransomware
  - Suspicious Command-Line Executions
-  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Unusual Processes
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - Ransomware
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -35,10 +35,10 @@ known_false_positives: Some legitimate applications use long command lines for i
  build the associated model.
 tags:
  analytics_story:
-  - Ransomware
  - Suspicious Command-Line Executions
-  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Unusual Processes
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - Ransomware
  kill_chain_phases:
  - Actions on Objectives
  cis20:
@@ -19,8 +19,8 @@ references:
 author: Jim Apger, Splunk
 search: '`stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/"
  | rex field=cookie "form_key=(?<SessionID>\w+)" | rex field=form_data "login\[username\]=(?<Username>[^&|^$]+)"
-  | search Username=* | rex field=Username "@(?<email_domain>.*)"|stats dc(Username)
-  as UniqueUsernames list(Username) as src_user by email_domain|where UniqueUsernames>
+  | search Username=* | rex field=Username "@(?<email_domain>.*)" | stats dc(Username)
+  as UniqueUsernames list(Username) as src_user by email_domain | where UniqueUsernames>
  25 | `web_fraud___account_harvesting_filter`'
 known_false_positives: As is common with many fraud-related searches, we are usually
  looking to attribute risk or synthesize relevant context with loosely written detections
@@ -1,130 +0,0 @@
-# Contributing to the Project
-
-This document is the single source of truth on how to contribute to this codebase. Please feel free to browse the open issues and file new ones. All feedback is welcome!
-
----
-
-## Topics
-
-* [Prerequisites](#prerequisites)
-    * [Contributor License Agreement](#contributor-license-agreement)
-    * [Code of Conduct](#code-of-conduct)
-    * [Setup Development Environment](#setup-development-environment)
-* [Contribution Workflow](#contribution-workflow)
-    * [Feature Requests and Bug Reports](#feature-requests-and-bug-reports)
-    * [Fixing Issues](#fixing-issues)
-    * [Pull Requests](#pull-requests)
-    * [Code Review](#code-review)
-    * [Documentation](#documentation)
-* [Maintainers](#maintainers)
-
----
-
-## Prerequisites
-When contributing to this repository, please first discuss the change you wish to make via a GitHub issue, Slack message, email, or via other channels with the owners of this repository.
-
-##### Contributor License Agreement
-At the moment, we can only accept pull requests submitted from either:
-* Splunk employees or
-* Individuals that have signed our contributors' agreement
-
-If you wish to be a contributing member of our community, please see the agreement [for individuals](https://www.splunk.com/goto/individualcontributions) or [for organizations](https://www.splunk.com/goto/contributions).
-
-##### Code of Conduct
-Please make sure to read and observe our [Code of Conduct](contributing/code-of-conduct.md). Please follow it in all of your interactions involving the project.
-
-##### Setup Development Environment
-see [Developing section](https://github.com/splunk/security-content#developing)
-
-## Contribution Workflow
-Help is always welcome! For example, documentation can always use improvement. There's always code that can be clarified, functionality that can be extended, and tests to be added to guarantee behavior. If you see something you think should be fixed, don't be afraid to own it.
-
-##### Feature Requests and Bug Reports
-Have ideas on improvements? See something that needs work? While the community encourages everyone to contribute code, it is also appreciated when someone reports an issue. Please report any issues or bugs you find through [GitHub's issue tracker](https://github.com/splunk/security-content/issues). 
-
-If you are reporting a bug, please include:
-
-* Your operating system name and version
-* Any details about your local setup that might be helpful in troubleshooting (ex. Python interpreter version, Splunk version, etc.)
-* Detailed steps to reproduce the bug
-
-We'd also like to hear about your propositions and suggestions. Feel free to submit them as issues and:
-
-* Explain in detail how they should work
-* Note that keeping the scope as narrow as possible will make the suggestion easier to implement
-
-##### Fixing Issues
-Look through our [issue tracker](https://github.com/splunk/security-content/issues) to find problems to fix! Feel free to comment and tag corresponding stakeholders or full-time maintainers of this project with any questions or concerns.
-
-##### Pull Requests
-What is a "pull request"? It informs the project's core developers about the changes you want to review and merge. Once you submit a pull request, it enters a stage of code review where you and others can discuss its potential modifications and maybe even add more commits to it later on. 
-
-If you want to learn more, please consult this [tutorial on how pull requests work](https://help.github.com/articles/using-pull-requests/) in the [GitHub Help Center](https://help.github.com/).
-
-Here's an overview of how you can make a pull request against this project:
-
-1. Fork the [analytic\_story\_execution GitHub repository](https://github.com/splunk/security-content/issues)
-2. Clone your fork using git and create a branch off of develop
-
-    ```
-    $ git clone git@github.com:YOUR_GITHUB_USERNAME/security-content.git
-    $ cd security-content
-
-    # This project uses 'develop' for all development activity, so create your branch off that
-    $ git checkout -b your-bugfix-branch-name develop
-    ```
-    
-3. Make your changes, commit, and push (once your tests have passed)
-
-    ```
-    $ cd security-content
-    $ git commit -m "<insert helpful commit message>"
-    $ git push 
-    ```
-    
-4. Submit a pull request through the GitHub website, using the changes from your forked codebase
-
-##### Code Review
-There are two aspects of code review: giving and receiving.
-
-To make it easier for your PR to receive reviews, keep in mind that the reviewers will need you to:
-* Follow the project coding conventions
-* Write good commit messages
-* Break large changes into a logical series of smaller patches which individually make easily understandable changes, and in aggregate solve a broader issue
-
-Reviewers, the people providing the review, are highly encouraged to revisit the [Code of Conduct](contributing/code-of-conduct.md) and must go above and beyond to promote a collaborative, respectful community.
-
-When reviewing PRs from others, [The Gentle Art of Patch Review](http://sage.thesharps.us/2014/09/01/the-gentle-art-of-patch-review/) suggests an iterative series of focuses designed to lead new contributors to positive collaboration, such as:
-
-* Is the idea behind the contribution sound?
-* Is the contribution architected correctly?
-* Is the contribution polished?
-
-For this project, we require at least one approval. A build from our continuous integration system must also be successful off of your branch. Please note that any new changes made with your existing pull request during review will automatically unapprove and retrigger another build/round of tests.
-
-##### Documentation
-We can always use improvements to our documentation! Anyone can contribute to these docs--whether you’re new to the project, you’ve been around a long time, or if you just can’t stand seeing typos. 
-
-Here's what's needed?
-
-1. More complementary documentation. Have you something unclear?
-2. More examples or generic templates that others can use.
-3. Blog posts, articles, and such are all very appreciated.
-
-You can also edit documentation files directly in the GitHub web interface, without creating a local copy. This can be convenient for small typos or grammar fixes.
-
-## Maintainers
-
-If you need help, feel free to tag one of the active maintainers of this project in a post or comment. We'll do our best to reach out to you as quickly as we can.
-
-```
-# Active maintainers marked with (*)
-
-(*) Bhavin Patel
-(*) David Dorsey
-(*) Jose Hernandez
-(*) Rico Valdez
-(*) Patrick Bareib
-(*) Brianna Blacet
-```
-
@@ -1,9 +1,9 @@
-# Welcome to Splunk Security Research! 
+# Splunk Security Content 
 ![](static/logo.png) 

-Thanks for stopping by the Splunk Security Research Team's resource portal! Here you'll find background and links to our security content and other related tools.
+Welcome to the Splunk Security Content

-Splunk security content is organized into "Analytic Stories," themed security guides that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all built to work together to detect, investigate, and respond to threats. The other apps were designed to help you derive more value from this content. 
+This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.

 ## View Our Content
 You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security-content/releases). 
@@ -13,38 +13,40 @@ If you prefer working with the command line, check out our [API](https://docs.sp
 ```
 curl -s https://content.splunkresearch.com | jq
 {
-  "hello": "welcome to Splunks Research security content api",
-  "available_endpoints": [
-    "/stories",
-    "/detections",
-    "/investigations",
-    "/baselines",
-    "/responses",
-    "/package"
-  ]
+  "hello": "welcome to Splunks Research security content api"
 }
 ```

 ## Getting Started

-Once you've cloned the security-content repo, we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute all of the searches, machine-learning models, and Splunk Phantom playbooks in the story automatically.   
+Once you've installed our [app](https://github.com/splunk/security-content/releases), we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute and schedule all of the detections a story automatically.   

 ## Test Out The Detections
-The [attack_range](https://http://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it to test the detections. 
+The [attack_range](https://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it to test the detections. 

 ## Questions?
 If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security-content#support). 

 ## Contribute Content
-If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content#Contributing). Digital defenders unite!
+If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!


-## Content Spec Documentation 
-* [Story](spec/story.spec.md)
-* [Detections](spec/detections.spec.md) 
-* [Investigations](spec/investigations.spec.md) 
-* [Responses](spec/responses.spec.md) 
-* [Baselines](spec/baselines.spec.md)
+## Content Parts
+* [stories/](https://github.com/splunk/security-content/tree/develop/stories): All Analytic Stories
+* [detections/](https://github.com/splunk/security-content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
+* [response_tasks/](https://github.com/splunk/security-content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
+* [responses/](https://github.com/splunk/security-content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
+* [baselines/](https://github.com/splunk/security-content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+
+#### Content Spec Files
+* [stories](https://github.com/splunk/security-content/blob/develop/docs/spec/stories.spec.md) 
+* [detections](https://github.com/splunk/security-content/blob/develop/docs/spec/detections.spec.md)
+* [deployments](https://github.com/splunk/security-content/blob/develop/docs/spec/deployments.spec.md)
+* [responses](https://github.com/splunk/security-content/blob/develop/docs/spec/responses.spec.md)
+* [response_tasks](https://github.com/splunk/security-content/blob/develop/docs/spec/response_tasks.spec.md)
+* [baselines](https://github.com/splunk/security-content/blob/develop/docs/spec/baselines.spec.md)
+* [lookups](https://github.com/splunk/security-content/blob/develop/docs/spec/lookups.spec.md)
+* [macros](https://github.com/splunk/security-content/blob/develop/docs/spec/macros.spec.md)



@@ -1,73 +0,0 @@
-## Code of Conduct
-
-### Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, gender identity and expression, level of experience,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
-
-### Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or
-advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a professional setting
-
-### Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-### Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-### Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at support@splunk.com. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-### Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
-
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/
-
@@ -0,0 +1,107 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "description": "schema for baselines",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of the baseline",
+      "examples": [
+        "Bahvin Patel, Splunk"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "A detailed description of the baseline ",
+      "examples": [
+        "This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days"
+      ],
+      "type": "string"
+    },
+    "how_to_implement": {
+      "$id": "#/properties/how_to_implement",
+      "default": "",
+      "description": "information about how to implement. Only needed for non standard implementations.",
+      "examples": [
+        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fc0edc95-ff2b-48b0-9f6f-63da3789fd63"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "examples": [
+        "Previously Seen AWS Regions"
+      ],
+      "title": "Name of baseline",
+      "type": "string"
+    },
+    "search": {
+      "$id": "#/properties/search",
+      "default": "",
+      "description": "The Splunk search for the baseline",
+      "examples": [
+        "cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv"
+      ],
+      "type": "string"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "suspicious_aws_ec2_activities",
+          "custom_key": "custom_value"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of baseline, e.g. 1 or 2 ...",
+      "examples": [
+        1
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "author",
+    "search",
+    "tags"
+  ],
+  "title": "Baseline Schema",
+  "type": "object"
+}
@@ -0,0 +1,264 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "default": {},
+  "description": "schema for deployment",
+  "properties": {
+    "alert_action": {
+      "$id": "#/properties/alert_action",
+      "additionalProperties": true,
+      "default": {},
+      "description": "Set alert action parameter for search",
+      "examples": [
+        {
+          "email": {
+            "message": "Splunk Alert $name$ triggered %fields%",
+            "subject": "Splunk Alert $name$",
+            "to": "test@test.com"
+          },
+          "index": {
+            "name": "asx"
+          },
+          "notable": {
+            "rule_description": "%description%",
+            "rule_title": "%name%"
+          }
+        }
+      ],
+      "properties": {
+        "email": {
+          "$id": "#/properties/alert_action/properties/email",
+          "additionalProperties": true,
+          "default": {},
+          "description": "By enabling it, an email is sent with the results",
+          "examples": [
+            {
+              "message": "Splunk Alert $name$ triggered %fields%",
+              "subject": "Splunk Alert $name$",
+              "to": "test@test.com"
+            }
+          ],
+          "properties": {
+            "message": {
+              "$id": "#/properties/alert_action/properties/email/properties/message",
+              "default": "",
+              "description": "message of email",
+              "examples": [
+                "Splunk Alert $name$ triggered %fields%"
+              ],
+              "type": "string"
+            },
+            "subject": {
+              "$id": "#/properties/alert_action/properties/email/properties/subject",
+              "default": "",
+              "description": "Subject of email",
+              "examples": [
+                "Splunk Alert $name$"
+              ],
+              "type": "string"
+            },
+            "to": {
+              "$id": "#/properties/alert_action/properties/email/properties/to",
+              "default": "",
+              "description": "Recipient of email",
+              "examples": [
+                "test@test.com"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "to",
+            "subject",
+            "message"
+          ],
+          "type": "object"
+        },
+        "index": {
+          "$id": "#/properties/alert_action/properties/index",
+          "additionalProperties": true,
+          "default": {},
+          "description": "By enabling it, the results are stored in another index",
+          "examples": [
+            {
+              "name": "asx"
+            }
+          ],
+          "properties": {
+            "name": {
+              "$id": "#/properties/alert_action/properties/index/properties/name",
+              "default": "",
+              "description": "Name of the index",
+              "examples": [
+                "asx"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "notable": {
+          "$id": "#/properties/alert_action/properties/notable",
+          "additionalProperties": true,
+          "default": {},
+          "description": "By enabling it, a notable is generated",
+          "examples": [
+            {
+              "rule_description": "%description%",
+              "rule_title": "%name%"
+            }
+          ],
+          "properties": {
+            "rule_description": {
+              "$id": "#/properties/alert_action/properties/notable/properties/rule_description",
+              "default": "",
+              "description": "Rule description of the notable event",
+              "examples": [
+                "%description%"
+              ],
+              "type": "string"
+            },
+            "rule_title": {
+              "$id": "#/properties/alert_action/properties/notable/properties/rule_title",
+              "default": "",
+              "description": "Rule title of the notable event",
+              "examples": [
+                "%name%"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "rule_title",
+            "rule_description"
+          ],
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "description of the deployment configuration",
+      "examples": [
+        "This deployment configuration provides a standard scheduling policy over all rules."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "uuid as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "description": "Name of deployment configuration",
+      "examples": [
+        "Deployment Configuration all Detections"
+      ],
+      "type": "string"
+    },
+    "scheduling": {
+      "$id": "#/properties/scheduling",
+      "additionalProperties": true,
+      "default": {},
+      "description": "allows to set scheduling parameter",
+      "examples": [
+        {
+          "cron_schedule": "*/10 * * * *",
+          "earliest_time": "-10m",
+          "latest_time": "now",
+          "schedule_window": "auto"
+        }
+      ],
+      "properties": {
+        "cron_schedule": {
+          "$id": "#/properties/scheduling/properties/cron_schedule",
+          "default": "",
+          "description": "Cron schedule to schedule the Splunk searches.",
+          "examples": [
+            "*/10 * * * *"
+          ],
+          "type": "string"
+        },
+        "earliest_time": {
+          "$id": "#/properties/scheduling/properties/earliest_time",
+          "default": "",
+          "description": "earliest time of search",
+          "examples": [
+            "-10m"
+          ],
+          "type": "string"
+        },
+        "latest_time": {
+          "$id": "#/properties/scheduling/properties/latest_time",
+          "default": "",
+          "description": "latest time of search",
+          "examples": [
+            "now"
+          ],
+          "type": "string"
+        },
+        "schedule_window": {
+          "$id": "#/properties/scheduling/properties/schedule_window",
+          "default": "",
+          "description": "schedule window for search",
+          "examples": [
+            "auto"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "cron_schedule",
+        "earliest_time",
+        "latest_time"
+      ],
+      "type": "object"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "credential_dumping"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "date",
+    "description",
+    "scheduling",
+    "alert_action",
+    "tags"
+  ],
+  "title": "Deployment Schema",
+  "type": "object"
+}
@@ -0,0 +1,157 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "description": "schema for detections",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of the detection",
+      "examples": [
+        "Patrick Bareiss, Splunk"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "A detailed description of the detection",
+      "examples": [
+        "dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump."
+      ],
+      "type": "string"
+    },
+    "how_to_implement": {
+      "$id": "#/properties/how_to_implement",
+      "default": "",
+      "description": "information about how to implement. Only needed for non standard implementations.",
+      "examples": [
+        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "known_false_positives": {
+      "$id": "#/properties/knwon_false_positives",
+      "default": "",
+      "description": "known false postives",
+      "examples": [
+        "Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual."
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "examples": [
+        "Access LSASS Memory for Dump Creation"
+      ],
+      "title": "Name of detection",
+      "type": "string"
+    },
+    "references": {
+      "$id": "#/properties/references",
+      "additionalItems": true,
+      "default": [],
+      "description": "A list of references for this detection",
+      "examples": [
+        [
+          "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
+        ]
+      ],
+      "items": {
+        "$id": "#/properties/references/items",
+        "default": "",
+        "description": "An explanation about the purpose of this instance.",
+        "examples": [
+          "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
+        ],
+        "title": "The Items Schema",
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "search": {
+      "$id": "#/properties/search",
+      "default": "",
+      "description": "The Splunk search for the detection",
+      "examples": [
+        "`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`"
+      ],
+      "type": "string"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "credential_dumping",
+          "custom_key": "custom_value"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    },
+    "type": {
+      "$id": "#/properties/type",
+      "default": "",
+      "description": "type of detection",
+      "examples": [
+        "ESCU"
+      ],
+      "items": {
+        "enum": [
+          "ESCU",
+          "SSE",
+          "RBA"
+        ],
+        "type": "string"
+      },
+      "type": "string"
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of detection, e.g. 1 or 2 ...",
+      "examples": [
+        2
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "type",
+    "author",
+    "search",
+    "known_false_positives",
+    "tags"
+  ],
+  "title": "Detection Schema",
+  "type": "object"
+}
@@ -0,0 +1,88 @@
+{
+  "$id": "https://api.splunkresearch.com/schemas/lookups.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "description": "A object that defines a lookup file and its properties.",
+  "oneOf": [
+    {
+      "required": [
+        "collection"
+      ]
+    },
+    {
+      "required": [
+        "filename"
+      ]
+    }
+  ],
+  "properties": {
+    "case_sensitive_match": {
+      "description": "What the macro is intended to filter",
+      "enum": [
+        "true",
+        "false"
+      ],
+      "examples": [
+        "true"
+      ],
+      "type": "string"
+    },
+    "collection": {
+      "description": "Name of the collection to use for this lookup",
+      "examples": [
+        "prohibited_apps_launching_cmd"
+      ],
+      "type": "string"
+    },
+    "default_match": {
+      "description": "The default value if no match is found",
+      "examples": [
+        "true"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "description": "The description of this lookup",
+      "examples": [
+        "This lookup contains file names that exist in the Windows\\System32 directory"
+      ],
+      "type": "string"
+    },
+    "filename": {
+      "description": "The name of the file to use for this lookup",
+      "examples": [
+        "prohibited_apps_launching_cmd.csv"
+      ],
+      "type": "string"
+    },
+    "match_type": {
+      "description": "A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching",
+      "examples": [
+        "WILDCARD(process)"
+      ],
+      "type": "string"
+    },
+    "max_matches": {
+      "description": "The maximum number of possible matches for each input lookup value",
+      "examples": [
+        "100"
+      ],
+      "type": "integer"
+    },
+    "min_matches": {
+      "description": "Minimum number of possible matches for each input lookup value",
+      "examples": [
+        "1"
+      ],
+      "type": "integer"
+    },
+    "name": {
+      "description": "The name of the lookup to be used in searches",
+      "examples": [
+        "isWindowsSystemFile_lookup"
+      ],
+      "type": "string"
+    }
+  },
+  "title": "Lookup Manifest",
+  "type": "object"
+}
@@ -0,0 +1,43 @@
+{
+  "$id": "https://api.splunkresearch.com/schemas/macros.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "description": "An object that defines the parameters for a Splunk Macro",
+  "properties": {
+    "arguments": {
+      "description": "A list of the arguments being passed to this macro",
+      "items": {
+        "type": "string"
+      },
+      "minItems": 0,
+      "type": "array",
+      "uniqueItems": true
+    },
+    "definition": {
+      "description": "The macro definition",
+      "examples": [
+        "(query=fls-na* AND query = www* AND query=images*)"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "description": "What the macro is intended to filter",
+      "examples": [
+        "Use this macro to filter out known good objects"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "description": "The name of the macro",
+      "examples": [
+        "detection_search_output_filter"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "name",
+    "description"
+  ],
+  "title": "Macro Manifest",
+  "type": "object"
+}
--- a/Show More
+++ b/Show More