Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2021-01-27 01:51:16 +00:00
parent c67d577df2 c66ba21904
commit aafb5088b4
23 changed files with 175123 additions and 175122 deletions
@@ -1,23 +1,23 @@
 </p>
 <p align="center">
-    <a href="https://github.com/splunk/security-content/releases">
-        <img src="https://img.shields.io/github/v/release/splunk/security-content" /></a>
-    <a href="https://circleci.com/gh/splunk/security-content/tree/develop">
-        <img src="https://img.shields.io/circleci/build/github/splunk/security-content?token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269" /></a>
-    <a href="https://github.com/search?q=repo%3Asplunk%2Fsecurity-content+extension%3Ayml+path%3Adetections&type=Code&ref=advsearch&l=&l=">
-        <img src="https://img.shields.io/github/directory-file-count/splunk/security-content/detections?extension=.yml&label=detections" /></a>
-    <a href="https://github.com/splunk/security-content">
-        <img src="https://security-content.s3-us-west-2.amazonaws.com/reporting/detection_coverage.svg" /></a>
-    <a href="https://github.com/splunk/security-content">
-        <img src="https://img.shields.io/github/downloads/splunk/security-content/total" /></a>
-    <a href="https://github.com/splunk/security-content/graphs/contributors" alt="Contributors">
-        <img src="https://img.shields.io/github/contributors/splunk/security-content" /></a>
-    <a href="https://github.com/splunk/security-content/stargazers">
-        <img src="https://img.shields.io/github/stars/splunk/security-content?style=social" /></a>
+    <a href="https://github.com/splunk/security_content/releases">
+        <img src="https://img.shields.io/github/v/release/splunk/security_content" /></a>
+    <a href="https://circleci.com/gh/splunk/security_content/tree/develop">
+        <img src="https://img.shields.io/circleci/build/github/splunk/security_content?token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269" /></a>
+    <a href="https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+extension%3Ayml+path%3Adetections&type=Code&ref=advsearch&l=&l=">
+        <img src="https://img.shields.io/github/directory-file-count/splunk/security_content/detections?extension=.yml&label=detections" /></a>
+    <a href="https://github.com/splunk/security_content">
+        <img src="https://security_content.s3-us-west-2.amazonaws.com/reporting/detection_coverage.svg" /></a>
+    <a href="https://github.com/splunk/security_content">
+        <img src="https://img.shields.io/github/downloads/splunk/security_content/total" /></a>
+    <a href="https://github.com/splunk/security_content/graphs/contributors" alt="Contributors">
+        <img src="https://img.shields.io/github/contributors/splunk/security_content" /></a>
+    <a href="https://github.com/splunk/security_content/stargazers">
+        <img src="https://img.shields.io/github/stars/splunk/security_content?style=social" /></a>
 </p>

 # Splunk Security Content
-![security-content](docs/static/logo.png)
+![security_content](docs/static/logo.png)
 =====

 Welcome to the Splunk Security Content
@@ -27,7 +27,7 @@ This project gives you access to our repository of Analytic Stories that are sec
 # Usage🛡
 The Splunk Security Content can be used via:

-#### [Splunk App](https://github.com/splunk/security-content/releases)
+#### [Splunk App](https://github.com/splunk/security_content/releases)
 Grab the latest release of DA-ESS-ContentUpdate and install it on a Splunk Enterprise instance. Alternatively, you can download it from [splunkbase](https://splunkbase.splunk.com/app/3449/), it is currently a Splunk Supported App.

 #### [API](https://docs.splunkresearch.com/?version=latest)
@@ -38,35 +38,35 @@ curl -s https://content.splunkresearch.com | jq
 }
 ```

-#### [GitHub Workflow](https://github.com/splunk/security-content/wiki/Installation-and-Usage)
-Create your customized version of Security Content by forking this project and following this [guide](https://github.com/splunk/security-content/wiki/Installation-and-Usage#github-workflow).
+#### [GitHub Workflow](https://github.com/splunk/security_content/wiki/Installation-and-Usage)
+Create your customized version of Security Content by forking this project and following this [guide](https://github.com/splunk/security_content/wiki/Installation-and-Usage#github-workflow).

 # MITRE ATT&CK
 ### Detection Coverage
-To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/develop/bin/generate-coverage-map.py).
+To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).

 ![](docs/mitre-map/coverage.png)

 ### Detection Priority by Threat Actors
-If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer. Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security-content/blob/develop/bin/generate-actors-map.py) script.
+If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer. Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.

 ![](docs/mitre-map/priority.png)

 # Customize to your Environment 🏗
-Customize your content to change how [often detections run](https://github.com/splunk/security-content/wiki/Customize-to-Your-Environment#customizing-scheduling-and-alert-actions-with-deployments), or what the right source type for [sysmon](https://github.com/splunk/security-content/wiki/Customize-to-Your-Environment#customizing-source-types-with-macros) in your environment is please follow this [guide](https://github.com/splunk/security-content/wiki/Customize-to-Your-Environment).  
+Customize your content to change how [often detections run](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-scheduling-and-alert-actions-with-deployments), or what the right source type for [sysmon](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-source-types-with-macros) in your environment is please follow this [guide](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment).  

 # Writing Content 📓
-Please see the Developing Content [guide](https://github.com/splunk/security-content/wiki/Developing-Content) for instructions.
+Please see the Developing Content [guide](https://github.com/splunk/security_content/wiki/Developing-Content) for instructions.

 # What's in an Analytic Story?
-A complete use case, specifically built to detect, investigate, and respond to a specific threat like [Credential Dumping](https://github.com/splunk/security-content/blob/develop/stories/credential_dumping.yml) or [Ransomware](https://github.com/splunk/security-content/blob/develop/stories/ransomware.yml). A group of detections and a response make up an analytic story, they are associated with the tag `analytics_story: <name>`.  
+A complete use case, specifically built to detect, investigate, and respond to a specific threat like [Credential Dumping](https://github.com/splunk/security_content/blob/develop/stories/credential_dumping.yml) or [Ransomware](https://github.com/splunk/security_content/blob/develop/stories/ransomware.yml). A group of detections and a response make up an analytic story, they are associated with the tag `analytics_story: <name>`.  

 # Execute an Analytic Story 🏃‍♀️
 Download and install the latest version of [Splunk Analytic Story Execution](https://github.com/splunk/analytic_story_execution/releases). This Splunk application will help the user do the following:

 1. Execute an analytic story in an ad-hoc mode and view the results.
 2. Schedule all the detection searches in an analytic story.
-3. Update security-content via an API
+3. Update security_content via an API

 # Content Parts 🧩

@@ -85,10 +85,10 @@ Download and install the latest version of [Splunk Analytic Story Execution](htt
 * [bin/](bin/): All binaries required to produce and test content

 # Contribution 🥰
-We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security-content/wiki/Contributing-to-the-Project) for more information on how to get involved.
+We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved.

 ## Support 💪
-Please use the [GitHub Issue Tracker](https://github.com/splunk/security-content/issues) to submit bugs or request features.
+Please use the [GitHub Issue Tracker](https://github.com/splunk/security_content/issues) to submit bugs or request features.

 If you have questions or need support, you can:

@@ -29,7 +29,7 @@ def main(args):
                        help="specify the url of the atack range repository")
    parser.add_argument("-arb", "--attack_range_branch", required=False, default="develop",
                        help="specify the atack range branch")
-    parser.add_argument("-scr", "--security_content_repo", required=False, default="splunk/security-content",
+    parser.add_argument("-scr", "--security_content_repo", required=False, default="splunk/security_content",
                        help="specify the url of the security content repository")
    parser.add_argument("-scb", "--security_content_branch", required=False, default="develop",
                        help="specify the security content branch")
@@ -66,7 +66,7 @@ def main(args):

    # clone repositories
    git.Repo.clone_from('https://github.com/' + attack_range_repo, "attack_range", branch=attack_range_branch)
-    security_content_repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/' + security_content_repo, "security-content", branch=security_content_branch)
+    security_content_repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/' + security_content_repo, "security_content", branch=security_content_branch)

    sys.path.append(os.path.join(os.getcwd(),'attack_range'))
    copyfile('attack_range/attack_range.conf.template', 'attack_range/attack_range.conf')
@@ -81,10 +81,10 @@ def main(args):
    os.chmod(ssh_key_name, 0o600)

    # build new version of ESCU
-    sys.path.append(os.path.join(os.getcwd(),'security-content/bin'))
+    sys.path.append(os.path.join(os.getcwd(),'security_content/bin'))
    try:
        module = __import__('generate')
-        module.sys.argv = ['generate', '-p', 'security-content', '-o' 'security-content/package']
+        module.sys.argv = ['generate', '-p', 'security_content', '-o' 'security_content/package']
        results = module.main(module.sys.argv)
    except Exception as e:
        print('Error: ' + str(e))
@@ -111,7 +111,7 @@ def main(args):
        os.system('cd attack_range/terraform/aws && terraform init && cd ../../..')

    module = __import__('attack_range')
-    module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security-content/tests/' + test_file_name]
+    module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security_content/tests/' + test_file_name]

    execution_error = False

@@ -127,7 +127,7 @@ def main(args):
    response = ec2.delete_key_pair(KeyName=ssh_key_name)

    # read_test_file
-    test_file = load_file('security-content/tests/' + test_file_name)
+    test_file = load_file('security_content/tests/' + test_file_name)

    # check if was succesful
    if not execution_error:
@@ -143,7 +143,7 @@ def main(args):
        counter = 0
        for test in results:
            if not test['detection_result']['error']:
-                file_path = 'security-content/detections/' + test['detection_result']['detection_file']
+                file_path = 'security_content/detections/' + test['detection_result']['detection_file']
                detection_obj = load_file(file_path)
                detection_obj['tags']['automated_detection_testing'] = 'passed'
                if 'attack_data' in test_file['tests'][counter]:
@@ -171,7 +171,7 @@ def main(args):
            security_content_repo_obj.remotes.origin.pull()
        security_content_repo_obj.git.push('--set-upstream', 'origin', branch_name)
        g = Github(O_AUTH_TOKEN_GITHUB)
-        repo = g.get_repo("splunk/security-content")
+        repo = g.get_repo("splunk/security_content")
        pull_requests = repo.get_pulls(state='open', sort='created', head=branch_name)
        for pr in pull_requests:
            if pr.head.label == str('splunk:' + branch_name):
@@ -50,10 +50,11 @@ pluggy==0.13.1
 pre-commit==2.9.3
 protobuf==3.14.0
 psutil==5.8.0
-py==1.10.0
 ptyprocess==0.7.0
+py==1.10.0
 pycparser==2.20
 PyGithub==1.54.1
+PyInquirer==1.0.3
 PyJWT==2.0.1
 PyNaCl==1.4.0
 pyparsing==2.4.7
@@ -663,7 +663,7 @@ if __name__ == "__main__":
    # grab arguments
    parser = argparse.ArgumentParser(description="generates documentation from our content", epilog="""
    This tool converts manifests information to documents in variious format like markdown and wiki markup used by Splunk docs.""")
-    parser.add_argument("-p", "--path", required=True, help="path to security-content repo")
+    parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
    parser.add_argument("-o", "--output", required=True, help="path to the output directory for the docs")
    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
    parser.add_argument("-gsd", "--gen_splunk_docs", required=False, default=True, action='store_true',
@@ -13,7 +13,7 @@ from stix2 import Filter

 VERSION = "4.1"
 NAME = "Detection Priority by Threat Actors"
-DESCRIPTION = "security-content detection priorty by common techniques used from threat actors"
+DESCRIPTION = "security_content detection priorty by common techniques used from threat actors"
 DOMAIN = "mitre-enterprise"

 def main(argv):
@@ -111,7 +111,7 @@ def get_matched_techniques(counted_techniques, detections):
        matched_splunk_detections = []

        # find detections from Splunks security content
-        # https://github.com/splunk/security-content
+        # https://github.com/splunk/security_content
        for detection in detections:
            if 'mitre_attack_id' in detection['object']['tags']:
                for mitreid in detection['object']['tags']['mitre_attack_id']:
@@ -150,7 +150,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):

        if len(technique["splunk_rules"]) > 0:
            for splunk_rule in technique["splunk_rules"]:
-                comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
+                comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])

        if len(comments) > 0:
            layer_technique["comment"] = "\n\n".join(comments)
@@ -209,7 +209,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):

 def generate_csv_file(matched_techniques, output):

-    security_content_url = 'https://github.com/splunk/security-content/blob/develop/detections/'
+    security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'

    with open(output + '/detections.csv', 'w') as f:
        writer = csv.writer(f)
@@ -13,7 +13,7 @@ from stix2 import Filter

 VERSION = "4.1"
 NAME = "Detection Coverage"
-DESCRIPTION = "security-content detection coverage"
+DESCRIPTION = "security_content detection coverage"
 DOMAIN = "mitre-enterprise"

 def main(argv):
@@ -86,7 +86,7 @@ def get_matched_techniques(counted_techniques, detections):
        matched_splunk_detections = []

        # find detections from Splunks security content
-        # https://github.com/splunk/security-content
+        # https://github.com/splunk/security_content
        for detection in detections:
            if 'mitre_attack_id' in detection['object']['tags']:
                for mitreid in detection['object']['tags']['mitre_attack_id']:
@@ -115,7 +115,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
        comments = []
        if len(technique["splunk_rules"]) > 0:
            for splunk_rule in technique["splunk_rules"]:
-                comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
+                comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])
                layer_technique = {
                "techniqueID": technique["ID"],
                "score" : technique["score"]
@@ -177,7 +177,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):

 def generate_csv_file(matched_techniques, output):

-    security_content_url = 'https://github.com/splunk/security-content/blob/develop/detections/'
+    security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'

    with open(output + '/coverage.csv', 'w') as f:
        writer = csv.writer(f)
@@ -1,7 +1,7 @@
 #!/usr/bin/python

 '''
-Generates splunk configurations from manifest files under the security-content repo.
+Generates splunk configurations from manifest files under the security_content repo.
 '''

 import glob
@@ -583,10 +583,10 @@ def generate_mitre_lookup(OUTPUT_PATH):

 def main(args):

-    parser = argparse.ArgumentParser(description="generates splunk conf files out of security-content manifests", epilog="""
+    parser = argparse.ArgumentParser(description="generates splunk conf files out of security_content manifests", epilog="""
    This tool converts manifests to the source files to be used by products like Splunk Enterprise.
    It generates the savesearches.conf, analytics_stories.conf files for ES.""")
-    parser.add_argument("-p", "--path", required=True, help="path to security-content repo")
+    parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
    parser.add_argument("-o", "--output", required=True, help="path to the output directory")
    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")

@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,7 +1,7 @@
 #!/usr/bin/python

 '''
-Validates Manifest file under the security-content repo for correctness.
+Validates Manifest file under the security_content repo for correctness.
 '''

 import glob
@@ -7,7 +7,7 @@ description: Monitor for execution of reg.exe with parameters specifying an expo
 how_to_implement: You must be ingesting windows endpoint data that tracks process activity,
  including parent-child relationships from your endpoints.
 type: SSA
-references: ['https://github.com/splunk/security-content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml']
+references: ['https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml']
 author: Jose Hernandez, Splunk
 search: '
 | from read_ssa_enriched_events()
@@ -5,8 +5,8 @@ date: '2020-08-25'
 description: An attacker tries might try to use different version of a system command without overriding original,
  or they might try to avoid some detection running the process from a different folder.
  This detection checks that a list of system processes run inside C:\\Windows\System32 or C:\\Windows\SysWOW64
-  The list of system processes has been extracted from https://github.com/splunk/security-content/blob/develop/lookups/is_windows_system_file.csv
-  and the original detection https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
+  The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
+  and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 references: []
 type: SSA
@@ -6,7 +6,7 @@ Welcome to the Splunk Security Content
 This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.

 ## View Our Content
-You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security-content/releases). 
+You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security_content/releases). 

 If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):

@@ -19,34 +19,34 @@ curl -s https://content.splunkresearch.com | jq

 ## Getting Started

-Once you've installed our [app](https://github.com/splunk/security-content/releases), we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute and schedule all of the detections a story automatically.   
+Once you've installed our [app](https://github.com/splunk/security_content/releases), we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute and schedule all of the detections a story automatically.   

 ## Test Out The Detections
 The [attack_range](https://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it to test the detections. 

 ## Questions?
-If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security-content#support). 
+If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security_content#support). 

 ## Contribute Content
-If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!
+If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!


 ## Content Parts
-* [stories/](https://github.com/splunk/security-content/tree/develop/stories): All Analytic Stories
-* [detections/](https://github.com/splunk/security-content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
-* [response_tasks/](https://github.com/splunk/security-content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
-* [responses/](https://github.com/splunk/security-content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
-* [baselines/](https://github.com/splunk/security-content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+* [stories/](https://github.com/splunk/security_content/tree/develop/stories): All Analytic Stories
+* [detections/](https://github.com/splunk/security_content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
+* [response_tasks/](https://github.com/splunk/security_content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
+* [responses/](https://github.com/splunk/security_content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
+* [baselines/](https://github.com/splunk/security_content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories

 #### Content Spec Files
-* [stories](https://github.com/splunk/security-content/blob/develop/docs/spec/stories.spec.md) 
-* [detections](https://github.com/splunk/security-content/blob/develop/docs/spec/detections.spec.md)
-* [deployments](https://github.com/splunk/security-content/blob/develop/docs/spec/deployments.spec.md)
-* [responses](https://github.com/splunk/security-content/blob/develop/docs/spec/responses.spec.md)
-* [response_tasks](https://github.com/splunk/security-content/blob/develop/docs/spec/response_tasks.spec.md)
-* [baselines](https://github.com/splunk/security-content/blob/develop/docs/spec/baselines.spec.md)
-* [lookups](https://github.com/splunk/security-content/blob/develop/docs/spec/lookups.spec.md)
-* [macros](https://github.com/splunk/security-content/blob/develop/docs/spec/macros.spec.md)
+* [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.spec.md) 
+* [detections](https://github.com/splunk/security_content/blob/develop/docs/spec/detections.spec.md)
+* [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.spec.md)
+* [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.spec.md)
+* [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.spec.md)
+* [baselines](https://github.com/splunk/security_content/blob/develop/docs/spec/baselines.spec.md)
+* [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.spec.md)
+* [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.spec.md)



@@ -1,5 +1,5 @@
 {
-  "$id": "https://raw.githubusercontent.com/splunk/security-content/develop/docs/spec/response_tasks.spec.json",
+  "$id": "https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response_tasks.spec.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
@@ -1,5 +1,5 @@
 {
-  "$id": "https://raw.githubusercontent.com/splunk/security-content/develop/docs/spec/response.spec.json",
+  "$id": "https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response.spec.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},