Large number of changes to the

format of datamodels in searches.
This is in support of the script
to automatically parse searches in
order to pull out required fields
and datamodels used or not used
in a search.

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -5,10 +5,10 @@ date: '2020-09-07'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment by a user.
-search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change
+search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change.All_Changes
   where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time
   span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time,
   "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w")

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment about security groups by a user.
 search: '| tstats count as security_group_api_calls values(All_Changes.command) as
-  command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success
+  command from datamodel=Change.All_Changes where All_Changes.object_category=firewall AND All_Changes.status=success
   by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval
   HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time,
   "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -8,7 +8,7 @@ datamodel:
 - Authentication
 description: This search looks for AssumeRole events where an IAM role in a different
   account is requested for the first time.
-search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication
+search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
   Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
   | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Change
 description: This search looks for new commands from each user role.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
   All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` |
   lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for cloud compute instances created by users who have
   not created them before.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
-  latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change
+  latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change.All_Changes
   where All_Changes.action=created by All_Changes.user All_Changes.vendor_region |
   `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_compute_creations_by_user
   user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data)

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -10,7 +10,7 @@ description: This search looks at cloud-infrastructure events where an instance
   created in any region within the last hour and then compares it to a lookup file
   of previously seen regions where instances have been created.
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
-  as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region,
+  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions
   vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats
   max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen)

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for cloud compute instances being created with previously
   unseen image IDs.
 search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
-  as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
+  as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
   | where image_id != "unknown" | lookup previously_seen_cloud_compute_images image_id
   as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -8,7 +8,7 @@ datamodel:
 - Change
 description: Find EC2 instances being created with previously unseen instance types.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
-  as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
+  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
   | where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types
   instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -10,7 +10,7 @@ description: This search looks for cloud instances being modified by users who h
   not previously modified them.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
   latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
-  as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
+  as command from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2
   All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
   | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW
   firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for cloud provisioning activities from previously unseen
   cities. Provisioning activities are defined broadly as any event that runs or creates
   something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
   by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
   `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for cloud provisioning activities from previously unseen
   countries. Provisioning activities are defined broadly as any event that runs or
   creates something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
   by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
   `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -10,7 +10,7 @@ description: This search looks for cloud provisioning activities from previously
   IP addresses. Provisioning activities are defined broadly as any event that runs
   or creates something.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
-  as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created)
+  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
   All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command
   | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
   src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for cloud provisioning activities from previously unseen
   regions. Provisioning activities are defined broadly as any event that runs or creates
   something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
   by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
   `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
   | join user type=outer [ inputlookup previously_seen_users_console_logins | stats
   min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
   firstTime lastTime user City | join user  type=outer [| inputlookup previously_seen_users_console_logins

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
   firstTime lastTime user Country | join user  type=outer [| inputlookup previously_seen_users_console_logins

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
   firstTime lastTime user Region | join user  type=outer [| inputlookup previously_seen_users_console_logins

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
 description: This search identifies endpoints that have caused a relatively high number
   of account lockouts in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -68,9 +68,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - All_Changes.user
-  - nodename
-  - All_Changes.result
-  - All_Changes.dest
+  - Change.All_Changes.user
+  - Change.All_Changes.result
+  - Change.All_Changes.dest
   risk_score: 36
   security_domain: access

detections/endpoint/java_class_file_download_by_java_user_agent.yml

@@ -10,7 +10,7 @@ description: The following analytic identifies a Java user agent performing a GE
   request for a .class file from the remote site. This is potentially indicative of
   exploitation of the Java application and may be related to current event CVE-2021-44228
   (Log4Shell).
-search: '| tstats count from datamodel=Web where Web.http_user_agent="*Java*" Web.http_method="GET"
+search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET"
   Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length
   Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`'

detections/endpoint/potentially_malicious_code_on_commandline.yml

@@ -17,7 +17,7 @@ description: The following analytic uses a pretrained machine learning text clas
   found in normal usage of the commandline.  The model will output a score where all
   values above zero are suspicious, anything greater than one particularly so.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name
   Processes.process_name Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  |
   where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score`
   | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',

detections/endpoint/short_lived_windows_accounts.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search detects accounts that were created and deleted in a short
   time period.
 search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
-  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change
+  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h
   All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726

detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml

@@ -13,7 +13,7 @@ description: Malicious actors often abuse legitimate Dynamic DNS services to hos
   analytic and investigative processes. This search will look for DNS queries made
   from within your infrastructure to suspicious dynamic domains.
 search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer
-  min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")`
+  min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host | `drop_dm_object_name("DNS")`
   | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
 how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This
   can be done by ingesting logs from your server or data, collected passively by Splunk

detections/network/dns_query_length_with_high_standard_deviation.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search allows you to identify DNS requests and compute the standard
   deviation on the length of the names being resolved, then filter on two times the
   standard deviation to show you those queries that are unusually large for your environment.
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution.DNS
   where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
   | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld)
   | search tld_len<=24 | eval query_length = len(query) | table query query_length