delete depreacated lookup configs

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-09T18:00:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -11,6 +11,21 @@ replicate = false
 [cloud_instances_enough_data]
 enforceTypes = false
 replicate = false
+[network_acl_activity_baseline]
+enforceTypes = false
+replicate = false
+[previously_seen_S3_access_from_remote_ip]
+enforceTypes = false
+replicate = false
+[previously_seen_api_calls_from_user_roles]
+enforceTypes = false
+replicate = false
+[previously_seen_aws_cross_account_activity]
+enforceTypes = false
+replicate = false
+[previously_seen_aws_regions]
+enforceTypes = false
+replicate = false
 [previously_seen_cloud_api_calls_per_user_role]
 enforceTypes = false
 replicate = false
@@ -32,12 +47,21 @@ replicate = false
 [previously_seen_cloud_regions]
 enforceTypes = false
 replicate = false
+[previously_seen_gcp_storage_access_from_remote_ip]
+enforceTypes = false
+replicate = false
 [previously_seen_running_windows_services]
 enforceTypes = false
 replicate = false
 [previously_seen_users_console_logins]
 enforceTypes = false
 replicate = false
+[s3_deletion_baseline]
+enforceTypes = false
+replicate = false
+[security_group_activity_baseline]
+enforceTypes = false
+replicate = false
 [zoom_first_time_child_process]
 enforceTypes = false
 replicate = false

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-09T18:00:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-09T18:00:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -861,6 +861,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_activity_related_to_pass_the_hash_attacks_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_api_activity_from_users_without_mfa_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1397,10 +1401,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[detect_activity_related_to_pass_the_hash_attacks_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [detect_azurehound_command_line_arguments_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5247,8 +5247,8 @@ definition = index=netops sourcetype="f5:bigip:rogue"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [filter_rare_process_allow_list]
-definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
-description = This macro is intended to allow_list processes that have been definied as rare
+definition = (process_name=*)
+description = Add rare process names to this macro that are allowed in your organization
 
 [github]
 definition = sourcetype=aws:firehose:json
@@ -5618,10 +5618,6 @@ description = Matches the process with its original file name, data for this mac
 definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
 description = This macro outputs a list of process that should not be the parent process of cmd.exe
 
-[prohibited_softwares]
-definition = lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True
-description = This macro limits the output to process_names that have been marked as prohibited
-
 [ransomware_extensions]
 definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
 description = This macro limits the output to files that have extensions associated with ransomware
@@ -5715,10 +5711,6 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
 description = This macro is a list of process that can be used to discover the network configuration
 
-[uncommon_processes]
-definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true  lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
-description = This macro limits the output to processes that have been marked as uncommon
-
 [windows_shells]
 definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe OR Processes.process_name=bash.exe OR Processes.process_name=wscript.exe OR Processes.process_name=cscript.exe)
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-09T18:00:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -64,10 +64,6 @@ case_sensitive_match = false
 match_type = WILDCARD(attacker_tool_names)
 min_matches = 1
 
-[aws_service_accounts]
-filename = aws_service_accounts.csv
-# description = A lookup file that will contain AWS Service accounts
-
 [baseline_blocked_outbound_connections]
 filename = baseline_blocked_outbound_connections.csv
 # description = A lookup file that will contain the baseline information for number of blocked outbound connections
@@ -87,11 +83,6 @@ default_match = false
 match_type = WILDCARD(filter)
 fields_list = _key, filter, enough_data
 
-[csc_lookup]
-filename = csc_lookup.csv
-# description = The CSC control numbers and names
-min_matches = 1
-
 [discovered_dns_records]
 filename = discovered_dns_records.csv
 default_match = false
@@ -114,10 +105,6 @@ case_sensitive_match = false
 # description = A list of dynammic dns providers that can be modified
 match_type = WILDCARD(dynamic_dns_domains)
 
-[escu_search_id_lookup]
-filename = escu_search_id.csv
-# description = A placeholder lookup file to hold information for ESCU Usage dashboard
-
 [hijacklibs]
 filename = hijacklibs.csv
 default_match = false
@@ -192,34 +179,6 @@ case_sensitive_match = false
 match_type = WILDCARD(driver_name)
 min_matches = 1
 
-[lookup_rare_process_allow_list_default]
-filename = rare_process_allow_list_default.csv
-default_match = false
-case_sensitive_match = false
-# description = A list of rare processes that are legitimate that is provided by Splunk
-match_type = WILDCARD(process)
-min_matches = 1
-
-[lookup_rare_process_allow_list_local]
-filename = rare_process_allow_list_local.csv
-default_match = false
-case_sensitive_match = false
-# description = A list of rare processes that are legitimate provided by the end user
-match_type = WILDCARD(process)
-min_matches = 1
-
-[lookup_uncommon_processes_default]
-filename = uncommon_processes_default.csv
-case_sensitive_match = false
-# description = A list of processes that are not common
-match_type = WILDCARD(process)
-
-[lookup_uncommon_processes_local]
-filename = uncommon_processes_local.csv
-case_sensitive_match = false
-# description = A list of processes that are not common
-match_type = WILDCARD(process)
-
 [mandatory_job_for_workflow]
 filename = mandatory_job_for_workflow.csv
 # description = A lookup file that will be used to define the mandatory job for workflow
@@ -229,26 +188,33 @@ filename = mandatory_step_for_job.csv
 # description = A lookup file that will be used to define the mandatory step for job
 
 [network_acl_activity_baseline]
-filename = network_acl_activity_baseline.csv
+collection = network_acl_activity_baseline
+external_type = kvstore
 # description = A lookup file that will contain the baseline information for number of AWS Network ACL Activity
 
 [previously_seen_S3_access_from_remote_ip]
-filename = previously_seen_S3_access_from_remote_ip.csv
+collection = previously_seen_S3_access_from_remote_ip
+external_type = kvstore
 # description = A placeholder for a list of IPs that have access S3
+fields_list = _key, bucket_name,remote_ip,earliest,latest
 
 [previously_seen_api_calls_from_user_roles]
-filename = previously_seen_api_calls_from_user_roles.csv
+collection = previously_seen_api_calls_from_user_roles
+external_type = kvstore
 # description = A placeholder for a list of AWS API calls for each user role
+fields_list = _key,earliest,latest,userName,eventName
 
 [previously_seen_aws_cross_account_activity]
-filename = previously_seen_aws_cross_account_activity.csv
+collection = previously_seen_aws_cross_account_activity
+external_type = kvstore
 # description = A placeholder for a list of AWS accounts and assumed roles
+fields_list = _key,firstTime,lastTime,requestingAccountId,requestedAccountId
 
 [previously_seen_aws_regions]
-filename = previously_seen_aws_regions.csv
-default_match = false
+collection = previously_seen_aws_regions
+external_type = kvstore
 # description = A place holder for a list of used AWS regions
-min_matches = 1
+fields_list = _key,earliest,latest,awsRegion
 
 [previously_seen_cloud_api_calls_per_user_role]
 collection = previously_seen_cloud_api_calls_per_user_role
@@ -292,19 +258,11 @@ external_type = kvstore
 # description = A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
 fields_list = _key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data
 
-[previously_seen_cmd_line_arguments]
-filename = previously_seen_cmd_line_arguments.csv
-# description = A placeholder for a list of cmd line arugments that been seen before
-
-[previously_seen_ec2_modifications_by_user]
-filename = previously_seen_ec2_modifications_by_user.csv
-# description = A place holder for a list of AWS EC2 modifications done by each user
-
 [previously_seen_gcp_storage_access_from_remote_ip]
-filename = previously_seen_gcp_storage_access_from_remote_ip.csv
-default_match = false
+collection = previously_seen_gcp_storage_access_from_remote_ip
+external_type = kvstore
 # description = A place holder for a list of GCP storage access from remote IPs
-min_matches = 1
+fields_list = _key, firstTime, lastTime, bucket_name, remote_ip, operation, request_uri
 
 [previously_seen_running_windows_services]
 collection = previously_seen_running_windows_services
@@ -360,12 +318,16 @@ match_type = WILDCARD(remote_software)
 min_matches = 1
 
 [s3_deletion_baseline]
-filename = s3_deletion_baseline.csv
+collection = s3_deletion_baseline
+external_type = kvstore
 # description = A placeholder for the baseline information for AWS S3 deletions
+fields_list = _key, arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
 
 [security_group_activity_baseline]
-filename = security_group_activity_baseline.csv
+collection = security_group_activity_baseline
+external_type = kvstore
 # description = A placeholder for the baseline information for AWS security groups
+fields_list = _key, arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls
 
 [security_services_lookup]
 filename = security_services.csv

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-09T18:00:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/lookups/baseline_blocked_outbound_connections.csv

@@ -1 +0,0 @@
-src_ip,numDataPoints,latestCount,avgBlockedConnections,stdevBlockedConnections

dist/escu/lookups/csc_lookup.csv

@@ -1,21 +0,0 @@
-number, name
-1, Inventory of Authorized and Unauthorized Devices
-2, Inventory of Authorized and Unauthorized Software
-3, Secure Configuration of End-User Devices
-4, Continuous Vulnerability Assessment & Remediation
-5, Controlled Use of Administrative Privileges
-6, Maintenance Monitoring and Analysis of Audit Logs
-7, Email & Web Browser Protections
-8, Malware Defense
-9, Limitation & Control of Network Ports-Protocols & Services
-10, Data Recovery Capability
-11, Secure Configuration of Network Devices
-12, Boundary Defense
-13, Data Protection
-14, Controlled Access Based on Need to Know
-15, Wireless Access Control
-16, Account Monitoring and Control
-17, Security Skills Assessment and Appropriate Training
-18, Application Software Security
-19, Incident Response and Management
-20, Penetration Tests and Red Team Exercises

dist/escu/lookups/dynamic_dns_providers_local.csv

@@ -1 +0,0 @@
-dynamic_dns_domains, isDynDNS_local

dist/escu/lookups/escu_search_id.csv

@@ -1 +0,0 @@
-savedsearch_name, search_id, user, _time, usage

lookups/dynamic_dns_providers_local.csv

@@ -1 +0,0 @@
-dynamic_dns_domains, isDynDNS_local

lookups/dynamic_dns_providers_local.yml

@@ -1,5 +0,0 @@
-case_sensitive_match: 'false'
-description: A list of dynammic dns providers that can be modified
-filename: dynamic_dns_providers_local.csv
-match_type: WILDCARD(dynamic_dns_domains)
-name: dynamic_dns_providers_local

lookups/legit_domains.csv

@@ -1,20 +0,0 @@
-domain, isLegit
-amazon.com, True
-ssl-images-amazon.com, True
-facebook.com, True
-xx.fbcdn.net, True
-github.com, True
-githubassets.com, True
-instagram.com, True
-linkedin.com, True
-microsoftonline.com, True
-office.com, True
-okta.com, True
-live.com, True
-protonmail.com, True
-reddit.com, True
-redditstatic.com, True
-twitter.com, True
-twimg.com, True
-google.com, True
-

lookups/legit_domains.yml

@@ -1,3 +0,0 @@
-description: A list of legit domains to be used as an ignore list for possible phishing sites
-filename: legit_domains.csv
-name: legit_domains

macros/dynamic_dns_providers.yml

@@ -1,8 +1,3 @@
-definition: lookup update=true dynamic_dns_providers_default dynamic_dns_domains as
-  query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local
-  dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default,
-  isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
+definition: search query = *
 description: This macro limits the output of the query field to dynamic dns domains.
-  It looks up the domains in a file provided by Splunk and one intended to be updated
-  by the end user.
 name: dynamic_dns_providers