Branch was auto-updated.

bin/jinja2_templates/doc_detections_markdown.j2

@@ -66,7 +66,17 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 - **Product**: {{ detection.tags.product|join(', ') }}
 - **Datamodel**: {{ detection.datamodel|join(', ') }}
-- **ATT&CK**: {% for mitre_attack_id in detection.tags.mitre_attack_id %}[{{ mitre_attack_id }}](https://attack.mitre.org/techniques/{{ mitre_attack_id }}/){% if not loop.last %}, {% endif %}{% endfor %}
+- **ATT&CK**: {% for attack in detection.tags.mitre_attack_id -%}
+{%- if attack -%}
+{% set sub_technique = attack.split('.') %}
+{%- if sub_technique | length > 1 -%}
+[{{ attack}}](https://attack.mitre.org/techniques/{{sub_technique[0] }}/{{sub_technique[1]}}/)
+{%- else -%}
+[{{ attack}}](https://attack.mitre.org/techniques/{{ attack }}/)
+{%- endif -%}
+{%- endif -%}
+{% if not loop.last -%}, {% endif -%}
+{% endfor %}
 - **Last Updated**: {{ detection.date }}
 
 <details>

bin/jinja2_templates/doc_detections_wiki.j2

@@ -11,7 +11,17 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 * '''Product''': {{ detection.tags.product|join(', ') }}
 * '''Datamodel''': {{ detection.datamodel|join(', ') }}
-* '''ATT&CK''': {% for attack in detection.mitre_attacks %}[https://attack.mitre.org/techniques/{{ attack.technique_id }}/ {{ attack.technique_id }}]{% if not loop.last %}, {% endif %}{% endfor %}
+* '''ATT&CK''': {% for attack in detection.mitre_attacks -%}
+{%- if attack.technique_id -%}
+{% set sub_technique = attack.technique_id.split('.') %}
+{%- if sub_technique | length > 1 -%}
+[https://attack.mitre.org/techniques/{{sub_technique[0] }}/{{sub_technique[1]}}/ {{ attack.technique_id }}]
+{%- else -%}
+[https://attack.mitre.org/techniques/{{attack.technique_id}}/ {{ attack.technique_id }}]
+{%- endif -%}
+{%- endif -%}
+{% if not loop.last -%}, {% endif -%}
+{% endfor %}
 * '''Last Updated''': {{ detection.date }}
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -77,10 +87,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 {% endfor %}
 
-''#############''
-''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-''# On Date: {{ time }} UTC''
-''# Author: Splunk Security Research''
-''# Contact: research@splunk.com''
-''#############''
+<pre>
+#############
+# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
+# On Date: {{ time }} UTC''
+# Author: Splunk Security Research''
+# Contact: research@splunk.com''
+#############
+</pre>
 

bin/jinja2_templates/doc_stories_wiki.j2

@@ -56,12 +56,12 @@ All the Analytic Stories shipped to different Splunk products. Below is a breakd
 
 {% endfor %}
 
-''
+<pre>
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
-''
+</pre>
 

docs/stories.md

@@ -711,8 +711,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 | T1087 | Account Discovery | Discovery |
 | T1201 | Password Policy Discovery | Discovery |
 | T1552 | Unsecured Credentials | Credential Access |
-| T1003.002 | Security Account Manager | Credential Access |
 | T1003 | OS Credential Dumping | Credential Access |
+| T1003.002 | Security Account Manager | Credential Access |
 | T1003.003 | NTDS | Credential Access |
 | T1558.003 | Kerberoasting | Credential Access |
 | T1059.001 | PowerShell | Execution |

docs/stories.wiki

@@ -769,7 +769,7 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558], [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558], [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 * '''Last Updated''': 2020-02-04
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -911,14 +911,14 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 | Unsecured Credentials
 | Credential Access
 |-
-| T1003.002
-| Security Account Manager
-| Credential Access
-|-
 | T1003
 | OS Credential Dumping
 | Credential Access
 |-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|-
 | T1003.003
 | NTDS
 | Credential Access
@@ -7078,11 +7078,11 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi
 
 
 
-''
+<pre>
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-04-22 21:48:48.069505 UTC
+# On Date: 2021-04-23 12:40:54.038071 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
-''
+</pre>