Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-02-18 07:41:50 -08:00
parent 6e24d0c2aa ac1662310c
commit aa6ec9315b
288 changed files with 3372 additions and 1 deletions
@@ -455,6 +455,14 @@ jobs:
          source venv/bin/activate
          python3 bin/doc_gen.py --path . --output docs -v

+      - name: Enrich detections with TAs
+        env:
+          GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }}
+        run: |
+          source venv/bin/activate
+          python3 -m pip install security_content_automation/requirements.txt
+          python3 security_content_automation/enrich_detections.py
+
      - name: Make YAMLs Pretty
        run: |
          source venv/bin/activate
@@ -75,7 +75,7 @@ publish_build_to_pre_qa:
  script:
    - mkdir -p artifacts
    - pip install requests
-    - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $CI_COMMIT_REF_NAME --builds DA-ESS_AmazonWebServices_Content DA-ESS-ContentUpdate
+    - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $CI_COMMIT_REF_NAME --builds DA-ESS-ContentUpdate
  after_script:
    - cp publish_build_to_pre_qa.log artifacts/publish_build_to_pre_qa.log
  rules:
@@ -97,6 +97,9 @@ A complete use case, specifically built to detect, investigate, and respond to a
 * [dashboards/](dashboards/): JSON definitions of Mission Control dashboards, to be used as a response task. Currently not used.
 * [macros/](macros/): Implements Splunk’s search macros, shortcuts to commonly used search patterns like sysmon source type. More on how macros are used to customize content below.
 * [lookups/](lookups/): Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions.
+* [security_content_automation/](security_content_automation/): It contains script for enriching detection with relevant supported TAs and also contains script for publishing release build to [Pre-QA artifactory](https://repo.splunk.com/artifactory/Solutions/DA/Pre-QA/) on every tag release.
+
+

 # Contribution 🥰
 We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved.
@@ -66,3 +66,5 @@ tags:
  - All_Changes.status
  risk_score: 15
  security_domain: network
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -72,3 +72,5 @@ tags:
  - All_Changes.user
  risk_score: 15
  security_domain: network
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -68,3 +68,5 @@ tags:
  - All_Changes.object
  risk_score: 36
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -69,3 +69,5 @@ tags:
  - All_Changes.vendor_region
  risk_score: 18
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -74,3 +74,5 @@ tags:
  - All_Changes.user
  risk_score: 42
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -69,3 +69,5 @@ tags:
  - All_Changes.user
  risk_score: 36
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -69,3 +69,5 @@ tags:
  - All_Changes.user
  risk_score: 30
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -71,3 +71,5 @@ tags:
  - All_Changes.user
  risk_score: 42
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -90,3 +90,5 @@ tags:
  - All_Changes.command
  risk_score: 18
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -90,3 +90,5 @@ tags:
  - All_Changes.command
  risk_score: 42
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -89,3 +89,5 @@ tags:
  - All_Changes.command
  risk_score: 42
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -90,3 +90,5 @@ tags:
  - All_Changes.command
  risk_score: 42
  security_domain: threat
+  supported_tas:
+  - Splunk_TA_aws-kinesis-firehose
@@ -80,3 +80,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 5
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -76,3 +76,5 @@ tags:
  - Registry.registry_value_name
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -69,3 +69,5 @@ tags:
  - Registry.dest
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -76,3 +76,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -55,3 +55,5 @@ tags:
  - Processes.process_path
  - Processes.parent_process_id
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -74,3 +74,5 @@ tags:
  - Registry.user
  risk_score: 3
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -57,3 +57,5 @@ tags:
  - Processes.process_path
  - Processes.parent_process_id
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -74,3 +74,5 @@ tags:
  - Registry.dest
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -82,3 +82,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -88,3 +88,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -82,3 +82,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 35
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -92,3 +92,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 20
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -69,3 +69,5 @@ tags:
  - Registry.dest
  risk_score: 63
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -83,3 +83,5 @@ tags:
  - Processes.dest
  risk_score: 63
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -65,3 +65,5 @@ tags:
  - Processes.user
  risk_score: 35
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -75,3 +75,5 @@ tags:
  - Processes.user
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -92,3 +92,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -85,3 +85,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -74,3 +74,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 63
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -85,3 +85,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 40
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -66,3 +66,5 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -64,3 +64,5 @@ tags:
  - Processes.user
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -65,3 +65,5 @@ tags:
  - Processes.user
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -77,3 +77,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -81,3 +81,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 100
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -87,3 +87,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -78,3 +78,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 30
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -83,3 +83,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -82,3 +82,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -82,3 +82,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -81,3 +81,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -88,3 +88,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -94,3 +94,5 @@ tags:
  - Filesystem.user
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -94,3 +94,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -98,3 +98,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -95,3 +95,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 72
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -90,3 +90,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -91,3 +91,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -85,3 +85,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -88,3 +88,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 32
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -94,3 +94,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 35
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -84,3 +84,5 @@ tags:
  - Processes.original_file_name
  risk_score: 35
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -87,3 +87,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -89,3 +89,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 64
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -89,3 +89,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -96,3 +96,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -95,3 +95,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -93,3 +93,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -95,3 +95,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -81,3 +81,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -71,3 +71,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 24
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -80,3 +80,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 24
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -67,3 +67,5 @@ tags:
  - Processes.dest
  risk_score: 35
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -55,3 +55,5 @@ tags:
  - Registry.dest
  - Registry.registry_value_name
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -71,3 +71,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -70,3 +70,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -70,3 +70,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -71,3 +71,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -69,3 +69,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -69,3 +69,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -54,3 +54,5 @@ tags:
  - Registry.dest
  - Registry.registry_value_name
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -61,3 +61,5 @@ tags:
  - Processes.process_guid
  risk_score: 24
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -68,3 +68,5 @@ tags:
  - Registry.registry_value_name
  risk_score: 40
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -60,3 +60,5 @@ tags:
  - Processes.dest
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -70,3 +70,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -74,3 +74,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -69,3 +69,5 @@ tags:
  - Registry.dest Registry.user
  risk_score: 40
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -75,3 +75,5 @@ tags:
  - Registry.registry_value_name
  risk_score: 40
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -72,3 +72,5 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -71,3 +71,5 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -72,3 +72,5 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -71,3 +71,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 25
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -78,3 +78,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 42
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
--- a/Show More
+++ b/Show More