From 3dfb0c502a54d6f697d5f6160acd4fc93673e85c Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 8 Apr 2021 13:58:41 -0400 Subject: [PATCH] removed mustang and replaced with saaws --- .circleci/config.yml | 40 +++++++++--------- bin/generate.py | 8 ++-- contentctl.py | 2 +- dist/{mustang => saaws}/README.md | 0 .../README/essoc_story_detail.txt | 0 .../README/essoc_summary.txt | 0 .../README/essoc_usage_dashboard.txt | 0 dist/{mustang => saaws}/app.manifest | 2 +- .../default/analytic_stories.conf | 0 .../default/analyticstories.conf | 0 dist/{mustang => saaws}/default/app.conf | 2 +- .../default/collections.conf | 0 dist/{mustang => saaws}/default/commands.conf | 0 .../default/content-version.conf | 0 .../default/data/ui/nav/default.xml | 0 ...l_backup_logs_for_host___response_task.xml | 0 ...tes_activity_by_src_ip___response_task.xml | 0 ...ity_hub_alerts_by_dest___response_task.xml | 0 ...ivities_by_accesskeyid___response_task.xml | 0 ...user_activities_by_arn___response_task.xml | 0 ...rk_acl_details_from_id___response_task.xml | 0 ...details_via_resourceid___response_task.xml | 0 ...details_via_bucketname___response_task.xml | 0 ...tes_activity_by_src_ip___response_task.xml | 0 ...aws_activity_from_city___response_task.xml | 0 ..._activity_from_country___response_task.xml | 0 ...tivity_from_ip_address___response_task.xml | 0 ...s_activity_from_region___response_task.xml | 0 ...ckup_logs_for_endpoint___response_task.xml | 0 ...cate_logs_for_a_domain___response_task.xml | 0 ...ver_history_for_a_host___response_task.xml | 0 ..._get_dns_traffic_ratio___response_task.xml | 0 ..._details_by_instanceid___response_task.xml | 0 ...get_ec2_launch_details___response_task.xml | 0 ...h_panel_get_email_info___response_task.xml | 0 ...s_from_specific_sender___response_task.xml | 0 ...rence_of_a_mac_address___response_task.xml | 0 ...story_of_email_sources___response_task.xml | 0 ...fications_for_endpoint___response_task.xml | 0 ...modifications_for_user___response_task.xml | 0 ...el_get_notable_history___response_task.xml | 0 ...en_cobra_threat_actors___response_task.xml | 0 ...et_parent_process_info___response_task.xml | 0 ..._process_file_activity___response_task.xml | 0 ...panel_get_process_info___response_task.xml | 0 ...tion_for_port_activity___response_task.xml | 0 ...le_for_the_dns_traffic___response_task.xml | 0 ..._wmi_activity_for_host___response_task.xml | 0 ...rmation_via_session_id___response_task.xml | 0 ...vities_via_region_name___response_task.xml | 0 ...tivities_by_user_field___response_task.xml | 0 ..._multiple_destinations___response_task.xml | 0 ...rk_traffic_from_src_ip___response_task.xml | 0 ...e_okta_activity_by_app___response_task.xml | 0 ...activity_by_ip_address___response_task.xml | 0 ...pass_the_hash_attempts___response_task.xml | 0 ...ss_the_ticket_attempts___response_task.xml | 0 ...e_previous_unseen_user___response_task.xml | 0 ...esktop_authentications___response_task.xml | 0 ...strings_in_http_header___response_task.xml | 0 ...ser_activities_in_okta___response_task.xml | 0 ...ate_web_posts_from_src___response_task.xml | 0 .../default/data/ui/views/escu_summary.xml | 0 .../default/data/ui/views/feedback.xml | 0 .../default/distsearch.conf | 0 .../default/es_investigations.conf | 0 dist/{mustang => saaws}/default/macros.conf | 0 dist/{mustang => saaws}/default/restmap.conf | 0 .../default/savedsearches.conf | 0 .../{mustang => saaws}/default/searchbnf.conf | 0 .../default/transforms.conf | 0 .../default/usage_searches.conf | 0 .../default/use_case_library.conf | 0 .../default/workflow_actions.conf | 0 .../lookups/aws_service_accounts.csv | 0 .../baseline_blocked_outbound_connections.csv | 0 .../lookups/brand_monitoring.csv | 0 .../{mustang => saaws}/lookups/csc_lookup.csv | 0 .../lookups/discovered_dns_records.csv | 0 dist/{mustang => saaws}/lookups/domains.csv | 0 .../lookups/dynamic_dns_providers_default.csv | 0 .../lookups/dynamic_dns_providers_local.csv | 0 .../lookups/escu_search_id.csv | 0 .../is_suspicious_file_extension_lookup.csv | 0 .../lookups/is_windows_system_file.csv | 0 .../lookups/legit_domains.csv | 0 .../lookups/mitre_enrichment.csv | 0 .../lookups/network_acl_activity_baseline.csv | 0 ...eviously_seen_S3_access_from_remote_ip.csv | 0 ...viously_seen_api_calls_from_user_roles.csv | 0 ...iously_seen_aws_cross_account_activity.csv | 0 .../lookups/previously_seen_aws_regions.csv | 0 .../previously_seen_cmd_line_arguments.csv | 0 ...viously_seen_ec2_modifications_by_user.csv | 0 .../lookups/prohibited_apps_launching_cmd.csv | 0 .../lookups/prohibited_processes.csv | 0 .../lookups/prohibited_softwares.csv | 0 .../lookups/ransomware_extensions.csv | 0 .../lookups/ransomware_notes.csv | 0 .../rare_process_allow_list_default.csv | 0 .../lookups/rare_process_allow_list_local.csv | 0 .../lookups/s3_deletion_baseline.csv | 0 .../security_group_activity_baseline.csv | 0 .../lookups/security_services.csv | 0 .../lookups/suspicious_files.csv | 0 .../lookups/uncommon_processes_default.csv | 0 .../lookups/uncommon_processes_local.csv | 0 dist/{mustang => saaws}/metadata/default.meta | 0 dist/{mustang => saaws}/static/appIcon.png | Bin dist/{mustang => saaws}/static/appIconAlt.png | Bin .../static/appIconAlt_2x.png | Bin dist/{mustang => saaws}/static/appIcon_2x.png | Bin 112 files changed, 27 insertions(+), 27 deletions(-) rename dist/{mustang => saaws}/README.md (100%) rename dist/{mustang => saaws}/README/essoc_story_detail.txt (100%) rename dist/{mustang => saaws}/README/essoc_summary.txt (100%) rename dist/{mustang => saaws}/README/essoc_usage_dashboard.txt (100%) rename dist/{mustang => saaws}/app.manifest (94%) rename dist/{mustang => saaws}/default/analytic_stories.conf (100%) rename dist/{mustang => saaws}/default/analyticstories.conf (100%) rename dist/{mustang => saaws}/default/app.conf (93%) rename dist/{mustang => saaws}/default/collections.conf (100%) rename dist/{mustang => saaws}/default/commands.conf (100%) rename dist/{mustang => saaws}/default/content-version.conf (100%) rename dist/{mustang => saaws}/default/data/ui/nav/default.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml (100%) rename dist/{mustang => saaws}/default/data/ui/views/escu_summary.xml (100%) rename dist/{mustang => saaws}/default/data/ui/views/feedback.xml (100%) rename dist/{mustang => saaws}/default/distsearch.conf (100%) rename dist/{mustang => saaws}/default/es_investigations.conf (100%) rename dist/{mustang => saaws}/default/macros.conf (100%) rename dist/{mustang => saaws}/default/restmap.conf (100%) rename dist/{mustang => saaws}/default/savedsearches.conf (100%) rename dist/{mustang => saaws}/default/searchbnf.conf (100%) rename dist/{mustang => saaws}/default/transforms.conf (100%) rename dist/{mustang => saaws}/default/usage_searches.conf (100%) rename dist/{mustang => saaws}/default/use_case_library.conf (100%) rename dist/{mustang => saaws}/default/workflow_actions.conf (100%) rename dist/{mustang => saaws}/lookups/aws_service_accounts.csv (100%) rename dist/{mustang => saaws}/lookups/baseline_blocked_outbound_connections.csv (100%) rename dist/{mustang => saaws}/lookups/brand_monitoring.csv (100%) rename dist/{mustang => saaws}/lookups/csc_lookup.csv (100%) rename dist/{mustang => saaws}/lookups/discovered_dns_records.csv (100%) rename dist/{mustang => saaws}/lookups/domains.csv (100%) rename dist/{mustang => saaws}/lookups/dynamic_dns_providers_default.csv (100%) rename dist/{mustang => saaws}/lookups/dynamic_dns_providers_local.csv (100%) rename dist/{mustang => saaws}/lookups/escu_search_id.csv (100%) rename dist/{mustang => saaws}/lookups/is_suspicious_file_extension_lookup.csv (100%) rename dist/{mustang => saaws}/lookups/is_windows_system_file.csv (100%) rename dist/{mustang => saaws}/lookups/legit_domains.csv (100%) rename dist/{mustang => saaws}/lookups/mitre_enrichment.csv (100%) rename dist/{mustang => saaws}/lookups/network_acl_activity_baseline.csv (100%) rename dist/{mustang => saaws}/lookups/previously_seen_S3_access_from_remote_ip.csv (100%) rename dist/{mustang => saaws}/lookups/previously_seen_api_calls_from_user_roles.csv (100%) rename dist/{mustang => saaws}/lookups/previously_seen_aws_cross_account_activity.csv (100%) rename dist/{mustang => saaws}/lookups/previously_seen_aws_regions.csv (100%) rename dist/{mustang => saaws}/lookups/previously_seen_cmd_line_arguments.csv (100%) rename dist/{mustang => saaws}/lookups/previously_seen_ec2_modifications_by_user.csv (100%) rename dist/{mustang => saaws}/lookups/prohibited_apps_launching_cmd.csv (100%) rename dist/{mustang => saaws}/lookups/prohibited_processes.csv (100%) rename dist/{mustang => saaws}/lookups/prohibited_softwares.csv (100%) rename dist/{mustang => saaws}/lookups/ransomware_extensions.csv (100%) rename dist/{mustang => saaws}/lookups/ransomware_notes.csv (100%) rename dist/{mustang => saaws}/lookups/rare_process_allow_list_default.csv (100%) rename dist/{mustang => saaws}/lookups/rare_process_allow_list_local.csv (100%) rename dist/{mustang => saaws}/lookups/s3_deletion_baseline.csv (100%) rename dist/{mustang => saaws}/lookups/security_group_activity_baseline.csv (100%) rename dist/{mustang => saaws}/lookups/security_services.csv (100%) rename dist/{mustang => saaws}/lookups/suspicious_files.csv (100%) rename dist/{mustang => saaws}/lookups/uncommon_processes_default.csv (100%) rename dist/{mustang => saaws}/lookups/uncommon_processes_local.csv (100%) rename dist/{mustang => saaws}/metadata/default.meta (100%) rename dist/{mustang => saaws}/static/appIcon.png (100%) rename dist/{mustang => saaws}/static/appIconAlt.png (100%) rename dist/{mustang => saaws}/static/appIconAlt_2x.png (100%) rename dist/{mustang => saaws}/static/appIcon_2x.png (100%) diff --git a/.circleci/config.yml b/.circleci/config.yml index c081f5c9c4..9c30ed1292 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -125,23 +125,23 @@ jobs: cd security-content source venv/bin/activate python contentctl.py --path . --verbose generate --product ESCU --output dist/escu - python contentctl.py --path . --verbose generate --product MUSTANG --output dist/mustang + python contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws # make a copy of use_case_lib in order to have ES work :-( cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf - cp dist/mustang/default/use_case_library.conf dist/mustang/default/analyticstories.conf + cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf - run: name: copy lookups .csv files command: | cd security-content # clean up current lookups rm -rf dist/escu/lookups - rm -rf dist/mustang/lookups + rm -rf dist/saaws/lookups mkdir dist/escu/lookups - mkdir dist/mustang/lookups + mkdir dist/saaws/lookups # copy over lookups cd lookups cp -rv *.csv ../dist/escu/lookups - cp -rv *.csv ../dist/mustang/lookups + cp -rv *.csv ../dist/saaws/lookups - run: name: update version and build number command: | @@ -160,18 +160,18 @@ jobs: sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf tar -czf content-pack-build-escu.tar.gz dist/escu/* - # update build number and version for MUSTANG - sed -i "s/build = .*$/build = $CIRCLE_BUILD_NUM/g" dist/mustang/default/app.conf - sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/mustang/default/app.conf - sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/mustang/app.manifest - sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/mustang/default/content-version.conf - tar -czf content-pack-build-mustang.tar.gz dist/mustang/* + # update build number and version for saaws + sed -i "s/build = .*$/build = $CIRCLE_BUILD_NUM/g" dist/saaws/default/app.conf + sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf + sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/saaws/app.manifest + sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/content-version.conf + tar -czf content-pack-build-saaws.tar.gz dist/saaws/* - persist_to_workspace: root: security-content/ paths: - content-pack-build-escu.tar.gz - - content-pack-build-mustang.tar.gz + - content-pack-build-saaws.tar.gz build-package: executor: content-executor @@ -200,13 +200,13 @@ jobs: source ~/slim-latest/venv/bin/activate cd ~/build tar -zxf content-pack-build-escu.tar.gz - tar -zxf content-pack-build-mustang.tar.gz + tar -zxf content-pack-build-saaws.tar.gz mv dist/escu DA-ESS-ContentUpdate - mv dist/mustang DA-ESS-ContentUpdateMustang + mv dist/saaws Splunk_DA-ESS_AmazonWebServices_Content slim package -o upload DA-ESS-ContentUpdate - slim package -o upload DA-ESS-ContentUpdateMustang + slim package -o upload Splunk_DA-ESS_AmazonWebServices_Content cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz - cp upload/DA-ESS-ContentUpdateMustang-*tar.gz DA-ESS-ContentUpdateMustang-latest.tar.gz + cp upload/Splunk_DA-ESS_AmazonWebServices_Content-*tar.gz Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz - store_artifacts: path: ~/build/upload destination: package/ @@ -214,7 +214,7 @@ jobs: root: ~/build paths: - DA-ESS-ContentUpdate-latest.tar.gz - - DA-ESS-ContentUpdateMustang-latest.tar.gz + - Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz run-appinspect: executor: content-executor @@ -241,10 +241,10 @@ jobs: cd security-content/bin ./appinspect.sh ~/ DA-ESS-ContentUpdate-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD - run: - name: submit MUSTANG package to appinspect API + name: submit saaws package to appinspect API command: | cd security-content/bin - ./appinspect.sh ~/ DA-ESS-ContentUpdateMustang-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD + ./appinspect.sh ~/ Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD - store_artifacts: path: ~/report destination: report/ @@ -252,7 +252,7 @@ jobs: root: ~/ paths: - DA-ESS-ContentUpdate-latest.tar.gz - - DA-ESS-ContentUpdateMustang-latest.tar.gz + - Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz update-sources-github: executor: content-executor steps: diff --git a/bin/generate.py b/bin/generate.py index a4eecd7da6..06f56e3867 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -124,7 +124,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_score'] = detection['tags']['risk_score'] if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] - if (OUTPUT_PATH) == 'dist/mustang': + if (OUTPUT_PATH) == 'dist/saaws': detection['disabled'] = 'false' @@ -133,7 +133,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen data_model = parse_data_models_from_search(baseline['search']) if data_model: baseline['data_model'] = data_model - if (OUTPUT_PATH) == 'dist/mustang': + if (OUTPUT_PATH) == 'dist/saaws': baseline['disabled'] = 'false' matched_deployment = get_deployments(baseline, deployments) @@ -625,7 +625,7 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): detections = load_objects("detections/*/*.yml", VERBOSE, REPO_PATH) detections.extend(load_objects("detections/*/*/*.yml", VERBOSE, REPO_PATH)) - if PRODUCT == "MUSTANG": + if PRODUCT == "SAAWS": detections = [object for object in detections if 'Splunk Security Analytics for AWS' in object['tags']['product']] stories = [object for object in stories if 'Splunk Security Analytics for AWS' in object['tags']['product']] baselines = [object for object in baselines if 'Splunk Security Analytics for AWS' in object['tags']['product']] @@ -693,4 +693,4 @@ if __name__ == "__main__": VERBOSE = args.verbose PRODUCT = args.product - main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE) \ No newline at end of file + main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE) diff --git a/contentctl.py b/contentctl.py index 117e17c329..69f27ccb2e 100644 --- a/contentctl.py +++ b/contentctl.py @@ -112,7 +112,7 @@ def main(args): generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu", help="Path where to store the deployment package, defaults to `dist/escu`") generate_parser.add_argument("--product", required=False, type=str, default="ESCU", - help="Type of package to create, choose between `ESCU`, or `MUSTANG`. Defaults to `ESCU`") + help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`") generate_parser.set_defaults(func=generate) # # parse them diff --git a/dist/mustang/README.md b/dist/saaws/README.md similarity index 100% rename from dist/mustang/README.md rename to dist/saaws/README.md diff --git a/dist/mustang/README/essoc_story_detail.txt b/dist/saaws/README/essoc_story_detail.txt similarity index 100% rename from dist/mustang/README/essoc_story_detail.txt rename to dist/saaws/README/essoc_story_detail.txt diff --git a/dist/mustang/README/essoc_summary.txt b/dist/saaws/README/essoc_summary.txt similarity index 100% rename from dist/mustang/README/essoc_summary.txt rename to dist/saaws/README/essoc_summary.txt diff --git a/dist/mustang/README/essoc_usage_dashboard.txt b/dist/saaws/README/essoc_usage_dashboard.txt similarity index 100% rename from dist/mustang/README/essoc_usage_dashboard.txt rename to dist/saaws/README/essoc_usage_dashboard.txt diff --git a/dist/mustang/app.manifest b/dist/saaws/app.manifest similarity index 94% rename from dist/mustang/app.manifest rename to dist/saaws/app.manifest index c8c6014311..d857b6ebf1 100644 --- a/dist/mustang/app.manifest +++ b/dist/saaws/app.manifest @@ -4,7 +4,7 @@ "title": "Splunk Security Analytics for AWS Content", "id": { "group": null, - "name": "DA-ESS-ContentUpdateMustang", + "name": "Splunk_DA-ESS_AmazonWebServices_Content", "version": "3.18.0" }, "author": [ diff --git a/dist/mustang/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf similarity index 100% rename from dist/mustang/default/analytic_stories.conf rename to dist/saaws/default/analytic_stories.conf diff --git a/dist/mustang/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf similarity index 100% rename from dist/mustang/default/analyticstories.conf rename to dist/saaws/default/analyticstories.conf diff --git a/dist/mustang/default/app.conf b/dist/saaws/default/app.conf similarity index 93% rename from dist/mustang/default/app.conf rename to dist/saaws/default/app.conf index 0a3461f490..b6185cf528 100644 --- a/dist/mustang/default/app.conf +++ b/dist/saaws/default/app.conf @@ -27,4 +27,4 @@ is_visible = true label = Splunk Security Analytics for AWS Content [package] -id = DA-ESS-ContentUpdateMustang +id = Splunk_DA-ESS_AmazonWebServices_Content diff --git a/dist/mustang/default/collections.conf b/dist/saaws/default/collections.conf similarity index 100% rename from dist/mustang/default/collections.conf rename to dist/saaws/default/collections.conf diff --git a/dist/mustang/default/commands.conf b/dist/saaws/default/commands.conf similarity index 100% rename from dist/mustang/default/commands.conf rename to dist/saaws/default/commands.conf diff --git a/dist/mustang/default/content-version.conf b/dist/saaws/default/content-version.conf similarity index 100% rename from dist/mustang/default/content-version.conf rename to dist/saaws/default/content-version.conf diff --git a/dist/mustang/default/data/ui/nav/default.xml b/dist/saaws/default/data/ui/nav/default.xml similarity index 100% rename from dist/mustang/default/data/ui/nav/default.xml rename to dist/saaws/default/data/ui/nav/default.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml diff --git a/dist/mustang/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml similarity index 100% rename from dist/mustang/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml rename to dist/saaws/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml diff --git a/dist/mustang/default/data/ui/views/escu_summary.xml b/dist/saaws/default/data/ui/views/escu_summary.xml similarity index 100% rename from dist/mustang/default/data/ui/views/escu_summary.xml rename to dist/saaws/default/data/ui/views/escu_summary.xml diff --git a/dist/mustang/default/data/ui/views/feedback.xml b/dist/saaws/default/data/ui/views/feedback.xml similarity index 100% rename from dist/mustang/default/data/ui/views/feedback.xml rename to dist/saaws/default/data/ui/views/feedback.xml diff --git a/dist/mustang/default/distsearch.conf b/dist/saaws/default/distsearch.conf similarity index 100% rename from dist/mustang/default/distsearch.conf rename to dist/saaws/default/distsearch.conf diff --git a/dist/mustang/default/es_investigations.conf b/dist/saaws/default/es_investigations.conf similarity index 100% rename from dist/mustang/default/es_investigations.conf rename to dist/saaws/default/es_investigations.conf diff --git a/dist/mustang/default/macros.conf b/dist/saaws/default/macros.conf similarity index 100% rename from dist/mustang/default/macros.conf rename to dist/saaws/default/macros.conf diff --git a/dist/mustang/default/restmap.conf b/dist/saaws/default/restmap.conf similarity index 100% rename from dist/mustang/default/restmap.conf rename to dist/saaws/default/restmap.conf diff --git a/dist/mustang/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf similarity index 100% rename from dist/mustang/default/savedsearches.conf rename to dist/saaws/default/savedsearches.conf diff --git a/dist/mustang/default/searchbnf.conf b/dist/saaws/default/searchbnf.conf similarity index 100% rename from dist/mustang/default/searchbnf.conf rename to dist/saaws/default/searchbnf.conf diff --git a/dist/mustang/default/transforms.conf b/dist/saaws/default/transforms.conf similarity index 100% rename from dist/mustang/default/transforms.conf rename to dist/saaws/default/transforms.conf diff --git a/dist/mustang/default/usage_searches.conf b/dist/saaws/default/usage_searches.conf similarity index 100% rename from dist/mustang/default/usage_searches.conf rename to dist/saaws/default/usage_searches.conf diff --git a/dist/mustang/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf similarity index 100% rename from dist/mustang/default/use_case_library.conf rename to dist/saaws/default/use_case_library.conf diff --git a/dist/mustang/default/workflow_actions.conf b/dist/saaws/default/workflow_actions.conf similarity index 100% rename from dist/mustang/default/workflow_actions.conf rename to dist/saaws/default/workflow_actions.conf diff --git a/dist/mustang/lookups/aws_service_accounts.csv b/dist/saaws/lookups/aws_service_accounts.csv similarity index 100% rename from dist/mustang/lookups/aws_service_accounts.csv rename to dist/saaws/lookups/aws_service_accounts.csv diff --git a/dist/mustang/lookups/baseline_blocked_outbound_connections.csv b/dist/saaws/lookups/baseline_blocked_outbound_connections.csv similarity index 100% rename from dist/mustang/lookups/baseline_blocked_outbound_connections.csv rename to dist/saaws/lookups/baseline_blocked_outbound_connections.csv diff --git a/dist/mustang/lookups/brand_monitoring.csv b/dist/saaws/lookups/brand_monitoring.csv similarity index 100% rename from dist/mustang/lookups/brand_monitoring.csv rename to dist/saaws/lookups/brand_monitoring.csv diff --git a/dist/mustang/lookups/csc_lookup.csv b/dist/saaws/lookups/csc_lookup.csv similarity index 100% rename from dist/mustang/lookups/csc_lookup.csv rename to dist/saaws/lookups/csc_lookup.csv diff --git a/dist/mustang/lookups/discovered_dns_records.csv b/dist/saaws/lookups/discovered_dns_records.csv similarity index 100% rename from dist/mustang/lookups/discovered_dns_records.csv rename to dist/saaws/lookups/discovered_dns_records.csv diff --git a/dist/mustang/lookups/domains.csv b/dist/saaws/lookups/domains.csv similarity index 100% rename from dist/mustang/lookups/domains.csv rename to dist/saaws/lookups/domains.csv diff --git a/dist/mustang/lookups/dynamic_dns_providers_default.csv b/dist/saaws/lookups/dynamic_dns_providers_default.csv similarity index 100% rename from dist/mustang/lookups/dynamic_dns_providers_default.csv rename to dist/saaws/lookups/dynamic_dns_providers_default.csv diff --git a/dist/mustang/lookups/dynamic_dns_providers_local.csv b/dist/saaws/lookups/dynamic_dns_providers_local.csv similarity index 100% rename from dist/mustang/lookups/dynamic_dns_providers_local.csv rename to dist/saaws/lookups/dynamic_dns_providers_local.csv diff --git a/dist/mustang/lookups/escu_search_id.csv b/dist/saaws/lookups/escu_search_id.csv similarity index 100% rename from dist/mustang/lookups/escu_search_id.csv rename to dist/saaws/lookups/escu_search_id.csv diff --git a/dist/mustang/lookups/is_suspicious_file_extension_lookup.csv b/dist/saaws/lookups/is_suspicious_file_extension_lookup.csv similarity index 100% rename from dist/mustang/lookups/is_suspicious_file_extension_lookup.csv rename to dist/saaws/lookups/is_suspicious_file_extension_lookup.csv diff --git a/dist/mustang/lookups/is_windows_system_file.csv b/dist/saaws/lookups/is_windows_system_file.csv similarity index 100% rename from dist/mustang/lookups/is_windows_system_file.csv rename to dist/saaws/lookups/is_windows_system_file.csv diff --git a/dist/mustang/lookups/legit_domains.csv b/dist/saaws/lookups/legit_domains.csv similarity index 100% rename from dist/mustang/lookups/legit_domains.csv rename to dist/saaws/lookups/legit_domains.csv diff --git a/dist/mustang/lookups/mitre_enrichment.csv b/dist/saaws/lookups/mitre_enrichment.csv similarity index 100% rename from dist/mustang/lookups/mitre_enrichment.csv rename to dist/saaws/lookups/mitre_enrichment.csv diff --git a/dist/mustang/lookups/network_acl_activity_baseline.csv b/dist/saaws/lookups/network_acl_activity_baseline.csv similarity index 100% rename from dist/mustang/lookups/network_acl_activity_baseline.csv rename to dist/saaws/lookups/network_acl_activity_baseline.csv diff --git a/dist/mustang/lookups/previously_seen_S3_access_from_remote_ip.csv b/dist/saaws/lookups/previously_seen_S3_access_from_remote_ip.csv similarity index 100% rename from dist/mustang/lookups/previously_seen_S3_access_from_remote_ip.csv rename to dist/saaws/lookups/previously_seen_S3_access_from_remote_ip.csv diff --git a/dist/mustang/lookups/previously_seen_api_calls_from_user_roles.csv b/dist/saaws/lookups/previously_seen_api_calls_from_user_roles.csv similarity index 100% rename from dist/mustang/lookups/previously_seen_api_calls_from_user_roles.csv rename to dist/saaws/lookups/previously_seen_api_calls_from_user_roles.csv diff --git a/dist/mustang/lookups/previously_seen_aws_cross_account_activity.csv b/dist/saaws/lookups/previously_seen_aws_cross_account_activity.csv similarity index 100% rename from dist/mustang/lookups/previously_seen_aws_cross_account_activity.csv rename to dist/saaws/lookups/previously_seen_aws_cross_account_activity.csv diff --git a/dist/mustang/lookups/previously_seen_aws_regions.csv b/dist/saaws/lookups/previously_seen_aws_regions.csv similarity index 100% rename from dist/mustang/lookups/previously_seen_aws_regions.csv rename to dist/saaws/lookups/previously_seen_aws_regions.csv diff --git a/dist/mustang/lookups/previously_seen_cmd_line_arguments.csv b/dist/saaws/lookups/previously_seen_cmd_line_arguments.csv similarity index 100% rename from dist/mustang/lookups/previously_seen_cmd_line_arguments.csv rename to dist/saaws/lookups/previously_seen_cmd_line_arguments.csv diff --git a/dist/mustang/lookups/previously_seen_ec2_modifications_by_user.csv b/dist/saaws/lookups/previously_seen_ec2_modifications_by_user.csv similarity index 100% rename from dist/mustang/lookups/previously_seen_ec2_modifications_by_user.csv rename to dist/saaws/lookups/previously_seen_ec2_modifications_by_user.csv diff --git a/dist/mustang/lookups/prohibited_apps_launching_cmd.csv b/dist/saaws/lookups/prohibited_apps_launching_cmd.csv similarity index 100% rename from dist/mustang/lookups/prohibited_apps_launching_cmd.csv rename to dist/saaws/lookups/prohibited_apps_launching_cmd.csv diff --git a/dist/mustang/lookups/prohibited_processes.csv b/dist/saaws/lookups/prohibited_processes.csv similarity index 100% rename from dist/mustang/lookups/prohibited_processes.csv rename to dist/saaws/lookups/prohibited_processes.csv diff --git a/dist/mustang/lookups/prohibited_softwares.csv b/dist/saaws/lookups/prohibited_softwares.csv similarity index 100% rename from dist/mustang/lookups/prohibited_softwares.csv rename to dist/saaws/lookups/prohibited_softwares.csv diff --git a/dist/mustang/lookups/ransomware_extensions.csv b/dist/saaws/lookups/ransomware_extensions.csv similarity index 100% rename from dist/mustang/lookups/ransomware_extensions.csv rename to dist/saaws/lookups/ransomware_extensions.csv diff --git a/dist/mustang/lookups/ransomware_notes.csv b/dist/saaws/lookups/ransomware_notes.csv similarity index 100% rename from dist/mustang/lookups/ransomware_notes.csv rename to dist/saaws/lookups/ransomware_notes.csv diff --git a/dist/mustang/lookups/rare_process_allow_list_default.csv b/dist/saaws/lookups/rare_process_allow_list_default.csv similarity index 100% rename from dist/mustang/lookups/rare_process_allow_list_default.csv rename to dist/saaws/lookups/rare_process_allow_list_default.csv diff --git a/dist/mustang/lookups/rare_process_allow_list_local.csv b/dist/saaws/lookups/rare_process_allow_list_local.csv similarity index 100% rename from dist/mustang/lookups/rare_process_allow_list_local.csv rename to dist/saaws/lookups/rare_process_allow_list_local.csv diff --git a/dist/mustang/lookups/s3_deletion_baseline.csv b/dist/saaws/lookups/s3_deletion_baseline.csv similarity index 100% rename from dist/mustang/lookups/s3_deletion_baseline.csv rename to dist/saaws/lookups/s3_deletion_baseline.csv diff --git a/dist/mustang/lookups/security_group_activity_baseline.csv b/dist/saaws/lookups/security_group_activity_baseline.csv similarity index 100% rename from dist/mustang/lookups/security_group_activity_baseline.csv rename to dist/saaws/lookups/security_group_activity_baseline.csv diff --git a/dist/mustang/lookups/security_services.csv b/dist/saaws/lookups/security_services.csv similarity index 100% rename from dist/mustang/lookups/security_services.csv rename to dist/saaws/lookups/security_services.csv diff --git a/dist/mustang/lookups/suspicious_files.csv b/dist/saaws/lookups/suspicious_files.csv similarity index 100% rename from dist/mustang/lookups/suspicious_files.csv rename to dist/saaws/lookups/suspicious_files.csv diff --git a/dist/mustang/lookups/uncommon_processes_default.csv b/dist/saaws/lookups/uncommon_processes_default.csv similarity index 100% rename from dist/mustang/lookups/uncommon_processes_default.csv rename to dist/saaws/lookups/uncommon_processes_default.csv diff --git a/dist/mustang/lookups/uncommon_processes_local.csv b/dist/saaws/lookups/uncommon_processes_local.csv similarity index 100% rename from dist/mustang/lookups/uncommon_processes_local.csv rename to dist/saaws/lookups/uncommon_processes_local.csv diff --git a/dist/mustang/metadata/default.meta b/dist/saaws/metadata/default.meta similarity index 100% rename from dist/mustang/metadata/default.meta rename to dist/saaws/metadata/default.meta diff --git a/dist/mustang/static/appIcon.png b/dist/saaws/static/appIcon.png similarity index 100% rename from dist/mustang/static/appIcon.png rename to dist/saaws/static/appIcon.png diff --git a/dist/mustang/static/appIconAlt.png b/dist/saaws/static/appIconAlt.png similarity index 100% rename from dist/mustang/static/appIconAlt.png rename to dist/saaws/static/appIconAlt.png diff --git a/dist/mustang/static/appIconAlt_2x.png b/dist/saaws/static/appIconAlt_2x.png similarity index 100% rename from dist/mustang/static/appIconAlt_2x.png rename to dist/saaws/static/appIconAlt_2x.png diff --git a/dist/mustang/static/appIcon_2x.png b/dist/saaws/static/appIcon_2x.png similarity index 100% rename from dist/mustang/static/appIcon_2x.png rename to dist/saaws/static/appIcon_2x.png