From 86430c55cc1a8f846e012b7d93207e1bd5742a07 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Thu, 24 Mar 2022 16:13:36 -0500
Subject: [PATCH 01/16] Created Application Dirs

---
 .../splunk_dos_via_malformed_s2s_request.yml  | 47 +++++++++++++++++++
 .../splunk_dos_via_malformed_s2s_request.yml  | 12 +++++
 2 files changed, 59 insertions(+)
 create mode 100644 detections/application/splunk_dos_via_malformed_s2s_request.yml
 create mode 100644 tests/application/splunk_dos_via_malformed_s2s_request.yml

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
new file mode 100644
index 0000000000..b81451bc59
--- /dev/null
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -0,0 +1,47 @@
+name: Splunk DoS via Malformed S2S Request
+id: fc246e56-953b-40c1-8634-868f9e474cbd
+version: 1
+date: '2022-03-24'
+author: Lou Stella, Splunk
+type: TTP
+datamodel: []
+description: UPDATE_DESCRIPTION
+search: '| UPDATE_SPL | `splunk_dos_via_malformed_s2s_request_filter`'
+how_to_implement: UPDATE_HOW_TO_IMPLEMENT
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: UPDATE asset_type
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: UPDATE value between 1-100
+  context:
+  - Update context
+  dataset:
+  - UPDATE_DATASET_URL
+  impact: UPDATE value between 1-100
+  kill_chain_phases:
+  - Denial of Service
+  message: UPDATE message
+  mitre_attack_id:
+  - T1498
+  nist:
+  - DE.CM
+  observable:
+  - name: UPDATE
+    type: UPDATE
+    role:
+    - UPDATE
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - UPDATE
+  risk_score: UPDATE (impact * confidence)/100
+  security_domain: threat
diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.yml b/tests/application/splunk_dos_via_malformed_s2s_request.yml
new file mode 100644
index 0000000000..59664af2a6
--- /dev/null
+++ b/tests/application/splunk_dos_via_malformed_s2s_request.yml
@@ -0,0 +1,12 @@
+name: Splunk DoS via Malformed S2S Request Unit Test
+tests:
+- name: Splunk DoS via Malformed S2S Request
+  file: application/splunk_dos_via_malformed_s2s_request.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE

From fb3d9bd32be4b922ddc5f3a976418326b8f6b816 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Thu, 24 Mar 2022 16:17:46 -0500
Subject: [PATCH 02/16] Updated test name

---
 ..._request.yml => splunk_dos_via_malformed_s2s_request.test.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/application/{splunk_dos_via_malformed_s2s_request.yml => splunk_dos_via_malformed_s2s_request.test.yml} (100%)

diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
similarity index 100%
rename from tests/application/splunk_dos_via_malformed_s2s_request.yml
rename to tests/application/splunk_dos_via_malformed_s2s_request.test.yml

From c758275a399756369d345c8c51582c824db2ef9e Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Mar 2022 13:35:13 -0500
Subject: [PATCH 03/16] Updates

---
 .../splunk_dos_via_malformed_s2s_request.yml        | 13 +++++++------
 .../splunk_dos_via_malformed_s2s_request.test.yml   |  4 ++--
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index b81451bc59..0734b2d3b6 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -6,11 +6,11 @@ author: Lou Stella, Splunk
 type: TTP
 datamodel: []
 description: UPDATE_DESCRIPTION
-search: '| UPDATE_SPL | `splunk_dos_via_malformed_s2s_request_filter`'
+search: 'index=_internal sourcetype=splunkd log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | `splunk_dos_via_malformed_s2s_request_filter`'
 how_to_implement: UPDATE_HOW_TO_IMPLEMENT
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:
-- REFERENCE
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
 tags:
   analytic_story:
   - UPDATE_STORY_NAME
@@ -19,15 +19,16 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: UPDATE value between 1-100
+  confidence: 100
   context:
   - Update context
+  cve: CVE-2021-3422
   dataset:
   - UPDATE_DATASET_URL
-  impact: UPDATE value between 1-100
+  impact: 50
   kill_chain_phases:
   - Denial of Service
-  message: UPDATE message
+  message: An attempt to exploit CVE-2021-3422 was detected from $src$
   mitre_attack_id:
   - T1498
   nist:
@@ -43,5 +44,5 @@ tags:
   - Splunk Cloud
   required_fields:
   - UPDATE
-  risk_score: UPDATE (impact * confidence)/100
+  risk_score: 50
   security_domain: threat
diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
index 59664af2a6..920d0c8fea 100644
--- a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
+++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: UPDATE
     data: UPDATE
-    source: UPDATE
-    sourcetype: UPDATE
+    source: /opt/splunk/var/log/splunk/splunkd.log
+    sourcetype: splunkd

From 0bae6cd8e56ea837e937de96d916a70d7418045a Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 09:18:04 -0500
Subject: [PATCH 04/16] Updated detection

---
 .../splunk_dos_via_malformed_s2s_request.yml           | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index 0734b2d3b6..cbb39c35e9 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -5,10 +5,10 @@ date: '2022-03-24'
 author: Lou Stella, Splunk
 type: TTP
 datamodel: []
-description: UPDATE_DESCRIPTION
-search: 'index=_internal sourcetype=splunkd log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | `splunk_dos_via_malformed_s2s_request_filter`'
-how_to_implement: UPDATE_HOW_TO_IMPLEMENT
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+description: On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. 
+search: '`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+known_false_positives: None.
 references:
 - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
 tags:
@@ -28,7 +28,7 @@ tags:
   impact: 50
   kill_chain_phases:
   - Denial of Service
-  message: An attempt to exploit CVE-2021-3422 was detected from $src$
+  message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$
   mitre_attack_id:
   - T1498
   nist:

From b1cabaecb2135f504b802c9ee3a9b44b89548101 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 09:18:19 -0500
Subject: [PATCH 05/16] Added macro

---
 macros/splunkd.yml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 macros/splunkd.yml

diff --git a/macros/splunkd.yml b/macros/splunkd.yml
new file mode 100644
index 0000000000..4967864d23
--- /dev/null
+++ b/macros/splunkd.yml
@@ -0,0 +1,4 @@
+definition: index=_internal sourcetype=splunkd
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: splunkd
\ No newline at end of file

From cf688974eeafeb9263f6218bb0ea365ef1e7e090 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 09:55:06 -0500
Subject: [PATCH 06/16] Updated story

---
 stories/splunk_vulnerabilities.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 stories/splunk_vulnerabilities.yml

diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml
new file mode 100644
index 0000000000..9e3d64107f
--- /dev/null
+++ b/stories/splunk_vulnerabilities.yml
@@ -0,0 +1,19 @@
+name: Splunk Vulnerabilities
+id: 5354df00-dce2-48ac-9a64-8adb48006828
+version: 1
+date: '2022-03-28'
+author: Lou Stella, Splunk
+description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. 
+narrative:  This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. 
+references: 
+- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
+- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422
+tags:
+  analytic_story: Splunk Vulnerabilities
+  category:
+  - Best Practices
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Application Security

From 9fae9fc95ffca992008907919a29336834ad312c Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 09:55:37 -0500
Subject: [PATCH 07/16] Capitalization is important

---
 stories/living_off_the_land.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/living_off_the_land.yml b/stories/living_off_the_land.yml
index 1e7dc547b2..741299fa9c 100644
--- a/stories/living_off_the_land.yml
+++ b/stories/living_off_the_land.yml
@@ -4,7 +4,7 @@ version: 2
 date: '2022-03-16'
 author: Lou Stella, Splunk
 description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. 
-narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
+narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
 references:
 - https://lolbas-project.github.io/
 tags:

From 86f2dddba473c312ea733fa597be7e4786932b3a Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 09:56:00 -0500
Subject: [PATCH 08/16] Updated test

---
 .../splunk_dos_via_malformed_s2s_request.test.yml            | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
index 920d0c8fea..d2780a45e8 100644
--- a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
+++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml
@@ -6,7 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: UPDATE
-    data: UPDATE
+  - file_name: splunkd.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
     source: /opt/splunk/var/log/splunk/splunkd.log
     sourcetype: splunkd
+    update_timestamp: true

From 7188d0089f8be73951048a3da92dce62d607aa6d Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 10:00:59 -0500
Subject: [PATCH 09/16] Updated detection

---
 .../splunk_dos_via_malformed_s2s_request.yml  | 26 ++++++++++++-------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index cbb39c35e9..37b6c5eee3 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -7,24 +7,24 @@ type: TTP
 datamodel: []
 description: On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. 
 search: '`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
-how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
+how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422.
 known_false_positives: None.
 references:
 - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
-  asset_type: UPDATE asset_type
+  - Splunk Vulnerabilities
+  asset_type: Endpoint
   cis20:
   - CIS 3
   - CIS 5
   - CIS 16
   confidence: 100
   context:
-  - Update context
+  - Source:Endpoint
   cve: CVE-2021-3422
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
   impact: 50
   kill_chain_phases:
   - Denial of Service
@@ -34,15 +34,23 @@ tags:
   nist:
   - DE.CM
   observable:
-  - name: UPDATE
-    type: UPDATE
+  - name: host
+    type: Hostname
     role:
-    - UPDATE
+    - Victim
+  - name: src 
+    type: IP Address
+    role:
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - UPDATE
+  - host
+  - src
+  - log_level
+  - component
+  - thread_name
   risk_score: 50
   security_domain: threat

From 0e73fe3d73138527b6a36af4226dd516ae8f6d1f Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 10:31:21 -0500
Subject: [PATCH 10/16] Changed CVE to list format

---
 .../application/splunk_dos_via_malformed_s2s_request.yml       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index 37b6c5eee3..27abb8318c 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -22,7 +22,8 @@ tags:
   confidence: 100
   context:
   - Source:Endpoint
-  cve: CVE-2021-3422
+  cve: 
+  - CVE-2021-3422
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
   impact: 50

From 92e9c8206565620223e79f80b8d79954333b9c29 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 10:32:16 -0500
Subject: [PATCH 11/16] Updated killchain

---
 detections/application/splunk_dos_via_malformed_s2s_request.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index 27abb8318c..02ad08ca81 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -28,7 +28,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
   impact: 50
   kill_chain_phases:
-  - Denial of Service
+  - Exploitation
   message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$
   mitre_attack_id:
   - T1498

From 21f1ad793cbca19e4b44b7b6e9682f46d6db3769 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 12:57:36 -0500
Subject: [PATCH 12/16] Testing without CVE

---
 detections/application/splunk_dos_via_malformed_s2s_request.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index 02ad08ca81..c88d351eaa 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -22,8 +22,6 @@ tags:
   confidence: 100
   context:
   - Source:Endpoint
-  cve: 
-  - CVE-2021-3422
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
   impact: 50

From 41b3c7478539f42eeacf8d171a0b7aa5098f6249 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 13:23:02 -0500
Subject: [PATCH 13/16] Migrated old detections to new story

---
 .../open_redirect_in_splunk_web.yml           |  2 +-
 ...lunk_enterprise_information_disclosure.yml |  2 +-
 .../splunk_enterprise_vulnerability.yml       | 47 -------------------
 ...nterprise_vulnerability_cve_2018_11409.yml | 42 -----------------
 4 files changed, 2 insertions(+), 91 deletions(-)
 delete mode 100644 stories/deprecated/splunk_enterprise_vulnerability.yml
 delete mode 100644 stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml

diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml
index cb5861e8e5..87c328c19b 100644
--- a/detections/deprecated/open_redirect_in_splunk_web.yml
+++ b/detections/deprecated/open_redirect_in_splunk_web.yml
@@ -13,7 +13,7 @@ known_false_positives: None identified
 references: []
 tags:
   analytic_story:
-  - Splunk Enterprise Vulnerability
+  - Splunk Vulnerabilities
   asset_type: Splunk Server
   cis20:
   - CIS 3
diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml
index b5dc3677c0..8e97f6508f 100644
--- a/detections/deprecated/splunk_enterprise_information_disclosure.yml
+++ b/detections/deprecated/splunk_enterprise_information_disclosure.yml
@@ -20,7 +20,7 @@ known_false_positives: Retrieving server information may be a legitimate API req
 references: []
 tags:
   analytic_story:
-  - Splunk Enterprise Vulnerability CVE-2018-11409
+  - Splunk Vulnerabilities
   asset_type: Splunk Server
   cis20:
   - CIS 3
diff --git a/stories/deprecated/splunk_enterprise_vulnerability.yml b/stories/deprecated/splunk_enterprise_vulnerability.yml
deleted file mode 100644
index 0ff703097d..0000000000
--- a/stories/deprecated/splunk_enterprise_vulnerability.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Splunk Enterprise Vulnerability
-id: 4e692b96-de2d-4bd1-9105-37e2368a8db1
-version: 1
-date: '2017-09-19'
-author: Bhavin Patel, Splunk
-type: batch
-description: Keeping your Splunk deployment up to date is critical and may help you
-  reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some
-  older versions of Splunk Enterprise. The detection search will help ensure that
-  users are being properly authenticated and not being redirected to malicious domains.
-narrative: 'This Analytic Story is associated with CVE-2016-4859, an open-redirect
-  vulnerability in the following versions of Splunk Enterprise:\
-
-  \
-
-  1. Splunk Enterprise 6.4.x, prior to 6.4.3\
-
-  1. Splunk Enterprise 6.3.x, prior to 6.3.6\
-
-  1. Splunk Enterprise 6.2.x, prior to 6.2.10\
-
-  1. Splunk Enterprise 6.1.x, prior to 6.1.11\
-
-  1. Splunk Enterprise 6.0.x, prior to 6.0.12\
-
-  1. Splunk Enterprise 5.0.x, prior to 5.0.16\
-
-  1. Splunk Light, prior to 6.4.3CVE-2016-4859 allows attackers to redirect users
-  to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit:
-  Noriaki Iwasaki, Cyber Defense Institute, Inc.).\
-
-  It is important to ensure that your Splunk deployment is being kept up to date and
-  is properly configured. This detection search allows analysts to monitor internal
-  logs to ensure users are properly authenticated and cannot be redirected to any
-  malicious third-party websites.'
-references:
-- http://www.splunk.com/view/SP-CAAAPQ6#announce
-- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859
-tags:
-  analytic_story: Splunk Enterprise Vulnerability
-  category:
-  - Vulnerability
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Security Monitoring
diff --git a/stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml b/stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml
deleted file mode 100644
index 29aa754be9..0000000000
--- a/stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Splunk Enterprise Vulnerability CVE-2018-11409
-id: 1fc34cbc-34e9-43ba-87ab-6811c9e95400
-version: 1
-date: '2018-06-14'
-author: David Dorsey, Splunk
-type: batch
-description: Reduce the risk of CVE-2018-11409, an information disclosure vulnerability
-  within some older versions of Splunk Enterprise, with searches designed to help
-  ensure that your Splunk system does not leak information to authenticated users.
-narrative: 'Although there have been no reports of it being exploited, Splunk Enterprise
-  versions through 7.0.1 reportedly have a vulnerability that may expose information
-  through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings).
-  NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409).
-  The REST endpoint that exposes system information is also necessary for the proper
-  operation of Splunk clustering and instrumentation. Customers should upgrade to
-  the latest version to reduce the risk of this vulnerability.\
-
-  Splunk Enterprise exposes partial information about the host operating system, hardware,
-  and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without
-  authentication. Splunk Enterprise 6.6.0 and later exposes this information only
-  to authenticated Splunk users. Based on the information exposure, Splunk characterizes
-  this issue as a low severity impact.\
-
-  Read more in Splunk''s official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\
-
-  A detection search within this Analytic Story looks for vulnerabilities described
-  in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409).
-  If it turns up activities that may be specific, you can use the included investigative
-  searches to return information regarding web activity and network traffic by src_ip.'
-references:
-- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
-- https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings
-- https://www.exploit-db.com/exploits/44865/
-tags:
-  analytic_story: Splunk Enterprise Vulnerability CVE-2018-11409
-  category:
-  - Vulnerability
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Security Monitoring

From f33641d00be7a0f537c6017e7133e681b3d57a1f Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 17:33:57 -0500
Subject: [PATCH 14/16] Adding CVE tag back

---
 detections/application/splunk_dos_via_malformed_s2s_request.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index c88d351eaa..bad1050a39 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -14,6 +14,7 @@ references:
 tags:
   analytic_story:
   - Splunk Vulnerabilities
+  cve: CVE-2021-3422
   asset_type: Endpoint
   cis20:
   - CIS 3

From c207cf0112ba2f9019d39416086bc33fe0ac2b78 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Mar 2022 17:36:53 -0500
Subject: [PATCH 15/16] Modified CVE

---
 .../application/splunk_dos_via_malformed_s2s_request.yml       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml
index bad1050a39..d2d9bbcb34 100644
--- a/detections/application/splunk_dos_via_malformed_s2s_request.yml
+++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml
@@ -14,7 +14,8 @@ references:
 tags:
   analytic_story:
   - Splunk Vulnerabilities
-  cve: CVE-2021-3422
+  cve: 
+  - CVE-2021-3422
   asset_type: Endpoint
   cis20:
   - CIS 3

From 952e07a05c1f6d4db26566988cd6337e9f95da62 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 28 Mar 2022 18:49:50 -0400
Subject: [PATCH 16/16] added try catch handler for cirl cve enrichment

---
 .../builder/cve_enrichment.py                    | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py b/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py
index 579ab37d72..a6e2ae5cf7 100644
--- a/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py
+++ b/bin/contentctl_project/contentctl_infrastructure/builder/cve_enrichment.py
@@ -8,10 +8,16 @@ class CveEnrichment():
 
     @classmethod
     def enrich_cve(self, cve_id: str) -> dict:
-        cve = CVESearch(CVESSEARCH_API_URL)
-        result = cve.id(cve_id)
         cve_enriched = dict()
-        cve_enriched['id'] = cve_id
-        cve_enriched['cvss'] = result['cvss']
-        cve_enriched['summary'] = result['summary']
+        try:
+            cve = CVESearch(CVESSEARCH_API_URL)
+            result = cve.id(cve_id)
+            cve_enriched['id'] = cve_id
+            cve_enriched['cvss'] = result['cvss']
+            cve_enriched['summary'] = result['summary']
+        except TypeError as TypeErr:
+            # there was a error calling the circl api lets just empty the object
+            print("WARNING, issue enriching {0}, with error: {1}".format(cve_id, str(TypeErr)))
+            cve_enriched = dict()
+    
         return cve_enriched
\ No newline at end of file