admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2154 from splunk/TR-1735

Browse Source 
Tr 1735:nes fields
This commit is contained in:
Bhavin Patel
2022-04-18 14:42:05 -07:00
committed by GitHub
parent 1df940a5e9 a99614452e
commit 9eb9e7a88b
10 changed files with 14 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/domain/entities/detection.py
+1
View File
@@ -51,6 +51,7 @@ class Detection(BaseModel, SecurityContentObject):
splunk_app_enrichment: list = None
file_path: str = None
source: str = None
nes_fields: str = None
# @validator('name')
bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2
+2 -2
View File
@@ -64,8 +64,8 @@ schedule_window = {{ detection.deployment.scheduling.schedule_window }}
{% if detection.deployment is defined %}
{% if detection.deployment.notable.rule_title is defined %}
action.notable = 1
{% if detection.deployment.notable.nes_fields is defined %}
action.notable.param.nes_fields = {{ detection.deployment.notable.nes_fields }}
{% if detection.nes_fields is defined %}
action.notable.param.nes_fields = {{ detection.nes_fields }}
{% endif %}
action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }}
action.notable.param.rule_title = {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}
bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
+3 -7
View File
@@ -92,14 +92,11 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
def addNesFields(self) -> None:
if self.security_content_obj:
nes_fields_matches = []
if self.security_content_obj.deployment:
if self.security_content_obj.deployment.notable:
for nes_field in self.security_content_obj.deployment.notable.nes_fields:
if (self.security_content_obj.search.find(nes_field + ' ') != -1):
nes_fields_matches.append(nes_field)
self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches
nes_fields = ",".join(list(self.security_content_obj.deployment.notable.nes_fields))
self.security_content_obj.nes_fields = nes_fields
def addMappings(self) -> None:
@@ -237,4 +234,3 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
def getObject(self) -> SecurityContentObject:
return self.security_content_obj
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf
+2 -2
View File
@@ -36,7 +36,7 @@ action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.nes_fields = user,dest
action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe
action.notable.param.security_domain = endpoint
@@ -82,7 +82,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.nes_fields = user,dest
action.notable.param.rule_description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
action.notable.param.rule_title = Detect new user AWS Console Login
action.notable.param.security_domain = network
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf
+2 -2
View File
@@ -36,7 +36,7 @@ action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.nes_fields = user,dest
action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe
action.notable.param.security_domain = endpoint
@@ -82,7 +82,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
action.notable.param.nes_fields = user,dest
action.notable.param.rule_description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
action.notable.param.rule_title = Detect new user AWS Console Login
action.notable.param.security_domain = network
bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml
-1
View File
@@ -16,7 +16,6 @@ alert_action:
nes_fields:
- user
- dest
- src
tags:
type: 'Correlation'
product: ESCU
bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml
-1
View File
@@ -16,7 +16,6 @@ alert_action:
nes_fields:
- user
- dest
- src
rba:
enabled: 'true'
tags:
bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py
+1 -1
View File
@@ -164,7 +164,7 @@ def test_construct_detections():
assert detection.name == "Attempted Credential Dump From Registry via Reg exe"
assert detection.author == "Patrick Bareiss, Splunk"
assert detection.deployment.name == "ESCU Default Configuration TTP"
assert detection.deployment.notable.nes_fields == ['user', 'dest']
assert detection.nes_fields == "user,dest"
assert detection.annotations == valid_annotations
assert detection.risk == valid_risk
assert detection.playbooks[0].name == "Ransomware Investigate and Contain"
deployments/ESCU/00_default_correlation.yml
+1 -2
View File
@@ -13,10 +13,9 @@ alert_action:
notable:
rule_description: '%description%'
rule_title: '%name%'
nes_fields:
nes_fields:
- user
- dest
- src
tags:
type: 'Correlation'
product: ESCU
deployments/ESCU/00_default_ttp.yml
+2 -3
View File
@@ -13,10 +13,9 @@ alert_action:
notable:
rule_description: '%description%'
rule_title: '%name%'
nes_fields:
- user
nes_fields:
- user
- dest
- src
rba:
enabled: 'true'
tags: