From a917acaf4cf286d98b4e4e671bc4e00b4357c618 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Mon, 6 Sep 2021 14:49:19 +0200
Subject: [PATCH] updated detections

---
 .../cloud/correlation_by_user_and_risk.yml    | 47 +++++++++++++++++++
 macros/signals.yml                            |  4 ++
 2 files changed, 51 insertions(+)
 create mode 100644 detections/cloud/correlation_by_user_and_risk.yml
 create mode 100644 macros/signals.yml

diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml
new file mode 100644
index 0000000000..7638dcfe1b
--- /dev/null
+++ b/detections/cloud/correlation_by_user_and_risk.yml
@@ -0,0 +1,47 @@
+name: Correlation by User and Risk
+id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
+version: 1
+date: '2021-09-06'
+author: Patrick Bareiss, Splunk
+type: Correlation
+datamodel: []
+description: This search correlations detections by user and risk_score
+search: '`signals` | fillnull 
+  | stats sum(risk_score) as total_risk_score values(source) as signals by user 
+  | sort - total_risk_score 
+  | where total_risk_score > 100
+  | correlation_by_user_and_risk_filter'
+how_to_implement: For Dev Sec Ops POC
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 100
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Correlation triggered for user $user$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Dev Sec Ops Analytics
+  required_fields:
+  - _time
+  risk_score: 70
+  security_domain: network
diff --git a/macros/signals.yml b/macros/signals.yml
new file mode 100644
index 0000000000..4f7ce112ee
--- /dev/null
+++ b/macros/signals.yml
@@ -0,0 +1,4 @@
+definition: index=signals
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: signals