fix baselines and investigations

baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml

@@ -20,7 +20,6 @@ tags:
   - Emotet Malware DHS Report TA18-201A
   - Monitor for Unauthorized Software
   - SamSam Ransomware
-  asset_type: Endpoint
   detections:
   - Prohibited Software On Endpoint
   product:
@@ -29,17 +28,4 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  security_domain: endpoint
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: endpoint

baselines/deprecated/baseline_of_api_calls_per_user_arn.yml

@@ -32,17 +32,4 @@ tags:
   - _time
   - eventType
   - userIdentity.arn
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml

@@ -44,17 +44,4 @@ tags:
   - eventName
   - errorCode
   - src_user
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml

@@ -44,17 +44,4 @@ tags:
   - eventName
   - errorCode
   - src_user
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml

@@ -35,17 +35,4 @@ tags:
   - userIdentity.type
   - userName
   - eventName
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml

@@ -33,17 +33,4 @@ tags:
   - _time
   - eventName
   - sourceIPAddress
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/previously_seen_ec2_amis.yml

@@ -29,17 +29,4 @@ tags:
   - eventName
   - errorCode
   - requestParameters.instancesSet.items{}.imageId
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/previously_seen_ec2_instance_types.yml

@@ -29,17 +29,4 @@ tags:
   - eventName
   - errorCode
   - requestParameters.instanceType
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/previously_seen_ec2_launches_by_user.yml

@@ -31,16 +31,3 @@ tags:
   - errorCode
   - requestParameters.instanceType
   security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown

baselines/deprecated/previously_seen_users_in_cloudtrail.yml

@@ -37,17 +37,4 @@ tags:
   - eventName
   - userIdentity.arn
   - src
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml

@@ -39,17 +39,4 @@ tags:
   - eventName
   - userIdentity.arn
   - src
-  security_domain: network
-  kill_chain_phases:
-  - Exploitation
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: field
-    type: Unknown
-    role:
-    - Unknown
+  security_domain: network

baselines/dnstwist_domain_names.yml

@@ -19,7 +19,6 @@ tags:
   analytic_story:
   - Brand Monitoring
   - Suspicious Emails
-  asset_type: Endpoint
   detections:
   - Monitor Email For Brand Abuse
   - Monitor DNS For Brand Abuse
@@ -28,19 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  kill_chain_phases:
-  - Exploitation
   required_fields:
   - _time
-  security_domain: network
-  confidence: 50
-  impact: 50
-  risk_score: 25
-  context:
-  - Unknown
-  message: tbd
-  observable:
-  - name: dest
-    type: Other
-    role:
-    - Other
+  security_domain: network

investigations/investigate_network_traffic_from_src_ip.yml

@@ -16,8 +16,6 @@ references: []
 tags:
   analytic_story:
   - ColdRoot MacOS RAT
-  cve:
-  - CVE-2018-11409
   product:
   - Splunk Phantom
   required_fields: