updated detections

detections/cloud/correlation_by_user_and_risk.yml

@@ -0,0 +1,47 @@
+name: Correlation by User and Risk
+id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
+version: 1
+date: '2021-09-06'
+author: Patrick Bareiss, Splunk
+type: Correlation
+datamodel: []
+description: This search correlations detections by user and risk_score
+search: '`signals` | fillnull 
+  | stats sum(risk_score) as total_risk_score values(source) as signals by user 
+  | sort - total_risk_score 
+  | where total_risk_score > 100
+  | correlation_by_user_and_risk_filter'
+how_to_implement: For Dev Sec Ops POC
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 100
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Correlation triggered for user $user$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Dev Sec Ops Analytics
+  required_fields:
+  - _time
+  risk_score: 70
+  security_domain: network

macros/signals.yml

@@ -0,0 +1,4 @@
+definition: index=signals
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: signals