diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 0e9c81dc21..d2bb95035f 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -51,6 +51,7 @@ class Detection(BaseModel, SecurityContentObject): splunk_app_enrichment: list = None file_path: str = None source: str = None + nes_fields: str = None # @validator('name') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index 7e9d478a2c..c4155ab1a3 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -64,8 +64,8 @@ schedule_window = {{ detection.deployment.scheduling.schedule_window }} {% if detection.deployment is defined %} {% if detection.deployment.notable.rule_title is defined %} action.notable = 1 -{% if detection.deployment.notable.nes_fields is defined %} -action.notable.param.nes_fields = {{ detection.deployment.notable.nes_fields }} +{% if detection.nes_fields is defined %} +action.notable.param.nes_fields = {{ detection.nes_fields }} {% endif %} action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }} action.notable.param.rule_title = {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }} diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 95465afeff..072facd9c0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -92,14 +92,11 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def addNesFields(self) -> None: if self.security_content_obj: - nes_fields_matches = [] if self.security_content_obj.deployment: if self.security_content_obj.deployment.notable: - for nes_field in self.security_content_obj.deployment.notable.nes_fields: - if (self.security_content_obj.search.find(nes_field + ' ') != -1): - nes_fields_matches.append(nes_field) - - self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches + nes_fields = ",".join(list(self.security_content_obj.deployment.notable.nes_fields)) + self.security_content_obj.nes_fields = nes_fields + def addMappings(self) -> None: @@ -237,4 +234,3 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def getObject(self) -> SecurityContentObject: return self.security_content_obj - diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf index f96947a1ae..179cb469ec 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf @@ -36,7 +36,7 @@ action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe action.notable.param.security_domain = endpoint @@ -82,7 +82,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. action.notable.param.rule_title = Detect new user AWS Console Login action.notable.param.security_domain = network diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf index f96947a1ae..179cb469ec 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf @@ -36,7 +36,7 @@ action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe action.notable.param.security_domain = endpoint @@ -82,7 +82,7 @@ action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = user,dest action.notable.param.rule_description = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. action.notable.param.rule_title = Detect new user AWS Console Login action.notable.param.security_domain = network diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml index 36531a0e7a..2dea0903bb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_correlation.yml @@ -16,7 +16,6 @@ alert_action: nes_fields: - user - dest - - src tags: type: 'Correlation' product: ESCU diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml index 94d690b648..c7608299a7 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/deployment/ESCU/00_default_ttp.yml @@ -16,7 +16,6 @@ alert_action: nes_fields: - user - dest - - src rba: enabled: 'true' tags: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py index 60a40bed79..82e22c6d78 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py @@ -164,7 +164,7 @@ def test_construct_detections(): assert detection.name == "Attempted Credential Dump From Registry via Reg exe" assert detection.author == "Patrick Bareiss, Splunk" assert detection.deployment.name == "ESCU Default Configuration TTP" - assert detection.deployment.notable.nes_fields == ['user', 'dest'] + assert detection.nes_fields == "user,dest" assert detection.annotations == valid_annotations assert detection.risk == valid_risk assert detection.playbooks[0].name == "Ransomware Investigate and Contain" diff --git a/deployments/ESCU/00_default_correlation.yml b/deployments/ESCU/00_default_correlation.yml index 36531a0e7a..b1cca041a6 100644 --- a/deployments/ESCU/00_default_correlation.yml +++ b/deployments/ESCU/00_default_correlation.yml @@ -13,10 +13,9 @@ alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: + nes_fields: - user - dest - - src tags: type: 'Correlation' product: ESCU diff --git a/deployments/ESCU/00_default_ttp.yml b/deployments/ESCU/00_default_ttp.yml index 94d690b648..513bffeba6 100644 --- a/deployments/ESCU/00_default_ttp.yml +++ b/deployments/ESCU/00_default_ttp.yml @@ -13,10 +13,9 @@ alert_action: notable: rule_description: '%description%' rule_title: '%name%' - nes_fields: - - user + nes_fields: + - user - dest - - src rba: enabled: 'true' tags: