added datamodels as an array

2026-06-08 17:32:49 +00:00 · 2021-02-10 22:35:58 -05:00
parent e87fe6564e
commit b58843ca9f
337 changed files with 473 additions and 337 deletions
@@ -4,7 +4,8 @@ version: 3
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: The search looks at the change-analysis data model and detects email
  files created outside the normal Outlook directory.
 search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path)
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects Okta login failures due to bad credentials for multiple
  users originating from the same ip address.
 search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: Detect Okta user lockout events
 search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: Detect failed Okta SSO events
 search: '`okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time)
  as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage,
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects logins from the same user from different states in
  a 24 hour period.
 search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
@@ -4,7 +4,8 @@ version: 1
 date: '2019-04-01'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for suspicious processes on all systems labeled as
  web servers.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -4,7 +4,8 @@ version: 1
 date: '2020-08-21'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search finds for the number successfully destroyed cloud instances
  for every 4 hour block. This is split up between weekdays and the weekend. It then
  applies the probability densitiy model previously created and alerts on any outliers.
@@ -4,7 +4,8 @@ version: 2
 date: '2020-08-21'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search finds for the number successfully created cloud instances
  for every 4 hour block. This is split up between weekdays and the weekend. It then
  applies the probability densitiy model previously created and alerts on any outliers.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search will detect a spike in the number of API calls made to your
  cloud infrastructure environment by a user.
 search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change
@@ -4,7 +4,8 @@ version: 1
 date: '2020-09-07'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search will detect a spike in the number of API calls made to your
  cloud infrastructure environment about security groups by a user.
 search: '| tstats count as security_group_api_calls values(All_Changes.command) as
@@ -4,7 +4,8 @@ version: 1
 date: '2020-05-28'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Authentication
+datamodel:
+- Authentication
 description: This search looks for AssumeRole events where an IAM role in a different
  account is requested for the first time.  This search is deprecated and have been
  translated to use the latest Authentication Datamodel.
@@ -4,7 +4,7 @@ version: 1
 date: '2021-01-11'
 author: Rod Soto, Patrick Bareiss Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search provides detection of KMS keys which action kms:Encrypt is
  accessible for everyone (also outside of your organization). This is an identicator
  that your account is compromised and the attacker uses the encryption key to compromise
@@ -4,7 +4,7 @@ version: 1
 date: '2021-01-11'
 author: Rod Soto, Patrick Bareiss Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search provides detection of users with KMS keys performing encryption
  specifically against S3 buckets.
 search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
@@ -4,7 +4,7 @@ version: 2
 date: '2021-01-11'
 author: Bhavin Patel, Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: The search looks for CloudTrail events to detect if any network ACLs
  were created with all the ports open to a specified CIDR.
 search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
@@ -4,7 +4,7 @@ version: 2
 date: '2021-01-12'
 author: Bhavin Patel, Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: Enforcing network-access controls is one of the defensive mechanisms
  used by cloud administrators to restrict access to a cloud instance. After the attacker
  has gained control of the AWS console by compromising an admin account, they can
@@ -4,7 +4,8 @@ version: 1
 date: '2020-09-04'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for new commands from each user role.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
  where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
@@ -4,7 +4,8 @@ version: 1
 date: '2020-08-21'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud compute instances created by users who have
  not created them before.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
@@ -4,7 +4,8 @@ version: 1
 date: '2020-09-02'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks at cloud-infrastructure events where an instance is
  created in any region within the last hour and then compares it to a lookup file
  of previously seen regions where instances have been created.
@@ -4,7 +4,8 @@ version: 1
 date: '2018-10-12'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud compute instances being created with previously
  unseen image IDs.
 search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
@@ -4,7 +4,8 @@ version: 1
 date: '2020-09-12'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: Find EC2 instances being created with previously unseen instance types.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
  as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
@@ -4,7 +4,8 @@ version: 1
 date: '2020-07-29'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud instances being modified by users who have
  not previously modified them.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
  cities. Provisioning activities are defined broadly as any event that runs or creates
  something.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
  countries. Provisioning activities are defined broadly as any event that runs or
  creates something.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-08-16'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
  IP addresses. Provisioning activities are defined broadly as any event that runs
  or creates something.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-08-16'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: batch
-datamodel: Change
+datamodel:
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
  regions. Provisioning activities are defined broadly as any event that runs or creates
  something.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-05-28'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Authentication
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Authentication
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Authentication
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Authentication
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
@@ -4,7 +4,7 @@ version: 1
 date: '2020-08-10'
 author: Shannon Davis, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks at GCP Storage bucket-access logs and detects new or
  previously unseen remote IP addresses that have successfully accessed a GCP Storage
  bucket.
@@ -4,7 +4,7 @@ version: 1
 date: '2020-08-05'
 author: Shannon Davis, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for GCP PubSub events where a user has created an open/public
  GCP Storage bucket.
 search: '`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions
@@ -4,7 +4,7 @@ version: 2
 date: '2021-01-12'
 author: Bhavin Patel, Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where a user has created an open/public
  S3 bucket.
 search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
@@ -4,7 +4,7 @@ version: 1
 date: '2021-01-12'
 author: Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where a user has created an open/public
  S3 bucket over the aws cli.
 search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
@@ -4,7 +4,7 @@ version: 1
 date: '2018-06-28'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks at S3 bucket-access logs and detects new or previously
  unseen remote IP addresses that have successfully accessed an S3 bucket.
 search: '`aws_s3_accesslogs` http_status=200  [search `aws_s3_accesslogs` http_status=200
@@ -4,7 +4,7 @@ version: 3
 date: '2021-01-26'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for a spike in number of of AWS security Hub alerts
  for an EC2 instance in 4 hours intervals
 search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
@@ -4,7 +4,7 @@ version: 3
 date: '2021-01-26'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for a spike in number of of AWS security Hub alerts
  for an AWS IAM User in 4 hours intervals.
 search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename
@@ -4,7 +4,7 @@ version: 1
 date: '2018-05-07'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search will detect spike in blocked outbound network connections
  originating from within your AWS environment.  It will also update the cache file
  that factors in the latest data.
@@ -4,7 +4,7 @@ version: 1
 date: '2018-11-27'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects users creating spikes in API activity related to
  deletion of S3 buckets in your AWS environment. It will also update the cache file
  that factors in the latest data.
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-16'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search will detect more than 5 login failures in Office365 Azure
  Active Directory from a single source IP address. Please adjust the threshold value
  of 5 as suited for your environment.
@@ -4,7 +4,7 @@ version: 1
 date: '2020-02-20'
 author: Rod Soto, Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This searches show information on uploaded containers including source
  user, image id, source IP user type, http user agent, region, first time, last time
  of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
@@ -4,7 +4,7 @@ version: 1
 date: '2021-01-12'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects newly added IP addresses/CIDR blocks to the list
  of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
  to use this technique so that they can bypass the MFA system.
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-16'
 author: Rod Soto, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects when multi factor authentication has been disabled,
  what entitiy performed the action and against what user
 search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-16'
 author: Rod Soto, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects when an excessive number of authentication failures
  occur this search also includes attempts against MFA prompt codes
 search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=*
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-16'
 author: Rod Soto, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects when a user has performed an Ediscovery search or
  exported a PST file from the search. This PST file usually has sensitive information
  including email body content
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-16'
 author: Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects when an admin configured a forwarding rule for multiple
  mailboxes to the same destination.
 search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-15'
 author: Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects the assignment of rights to accesss content from
  another mailbox. This is usually only assigned to a service account.
 search: '`o365_management_activity` Operation=Add-MailboxPermission | spath input=Parameters
@@ -4,7 +4,7 @@ version: 1
 date: '2020-12-16'
 author: Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects when multiple user configured a forwarding rule to
  the same destination.
 search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where a user successfully launches
  an abnormally high number of instances. This search is deprecated and have been
  translated to use the latest Change Datamodel
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Jason Brewer, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where a user successfully launches
  an abnormally high number of instances. This search is deprecated and have been
  translated to use the latest Change Datamodel.
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where an abnormally high number
  of instances were successfully terminated by a user in a 10-minute window. This
  search is deprecated and have been translated to use the latest Change Datamodel.
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Jason Brewer, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where a user successfully terminates
  an abnormally high number of instances. This search is deprecated and have been
  translated to use the latest Change Datamodel.
@@ -4,7 +4,7 @@ version: 1
 date: '2018-03-16'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: 'This search looks for AWS provisioning activities from previously unseen
  cities.  Provisioning activities are defined broadly as any event that begins with
  "Run" or "Create." This search is deprecated and have been translated to use the
@@ -4,7 +4,7 @@ version: 1
 date: '2018-03-16'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: 'This search looks for AWS provisioning activities from previously unseen
  countries. Provisioning activities are defined broadly as any event that begins
  with "Run" or "Create." This search is deprecated and have been translated to use
@@ -4,7 +4,7 @@ version: 1
 date: '2018-03-16'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: 'This search looks for AWS provisioning activities from previously unseen
  IP addresses. Provisioning activities are defined broadly as any event that begins
  with "Run" or "Create." This search is deprecated and have been translated to use
@@ -4,7 +4,7 @@ version: 1
 date: '2018-03-16'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for AWS provisioning activities from previously unseen
  regions. Region in this context is similar to a state in the United States. Provisioning
  activities are defined broadly as any event that begins with "Run" or "Create."
@@ -4,7 +4,8 @@ version: 3
 date: '2020-07-21'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Network_Resolution
+datamodel:
+- Network_Resolution
 description: This search allows you to identify the endpoints that have connected
  to more than five DNS servers and made DNS Queries over the time frame of the search.
 search: '| tstats `security_content_summariesonly` count, values(DNS.dest) AS dest
@@ -4,7 +4,7 @@ version: 1
 date: '2020-09-08'
 author: Peter Gael, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: Enforcing network-access controls is one of the defensive mechanisms
  used by cloud administrators to restrict access to a cloud instance. After the attacker
  has gained control of the console by compromising an admin account, they can delete
@@ -4,7 +4,7 @@ version: 1
 date: '2018-05-17'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where a user logged into the
  AWS account, is making API calls and has not enabled Multi Factor authentication.
  Multi factor authentication adds a layer of security by forcing the users to type
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for successful CloudTrail activity by user accounts
  that are not listed in the identity table or `aws_service_accounts.csv`. It returns
  event names and count, as well as the first and last time a specific user or service
@@ -4,7 +4,8 @@ version: 2
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Network_Resolution
+datamodel:
+- Network_Resolution
 description: This search looks for DNS requests for phishing domains that are leveraging
  EvilGinx tools to mimic websites.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -4,7 +4,8 @@ version: 2
 date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Network_Resolution
+datamodel:
+- Network_Resolution
 description: This search is used to detect attempts to use DNS tunneling, by calculating
  the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission
  for data exfiltration, command and control, or evasion of security controls can
@@ -4,7 +4,7 @@ version: 1
 date: '2019-12-03'
 author: Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for reading loaded Images unique to credential dumping
  with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon
  Event Code.
@@ -4,7 +4,7 @@ version: 2
 date: '2019-02-27'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for PowerShell requesting privileges consistent with
  credential dumping. Deprecated, looks like things changed from a logging perspective.
 search: '`wineventlog_security` signature_id=4703 Process_Name=*powershell.exe | rex
@@ -4,7 +4,7 @@ version: 1
 date: '2018-04-16'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects new API calls that have either never been seen before
  or that have not been seen in the previous hour, where the identity type is `AssumedRole`.
 search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events wherein a console login event
  by a user was recorded within the last hour, then compares the event to a lookup
  file of previously seen users (by ARN values) who have logged into the console.
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search will detect users creating spikes of API activity in your
  AWS environment.  It will also update the cache file that factors in the latest
  data. This search is deprecated and have been translated to use the latest Change
@@ -4,7 +4,7 @@ version: 1
 date: '2018-05-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search will detect users creating spikes in API activity related
  to network access-control lists (ACLs)in your AWS environment. This search is deprecated
  and have been translated to use the latest Change Datamodel.
@@ -4,7 +4,7 @@ version: 1
 date: '2018-04-18'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search will detect users creating spikes in API activity related
  to security groups in your AWS environment.  It will also update the cache file
  that factors in the latest data.  This search is deprecated and have been translated
@@ -4,7 +4,8 @@ version: 1
 date: '2017-11-27'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Change_Analysis
+datamodel:
+- Change_Analysis
 description: The search is used to detect hosts that generate Windows Event ID 4663
  for successful attempts to write to or read from a removable storage and Event ID
  4656 for failures, which occurs when a USB drive is plugged in. In this scenario
@@ -4,7 +4,8 @@ version: 2
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Web
+datamodel:
+- Web
 description: This search looks for web connections to dynamic DNS providers.
 search: '| tstats `security_content_summariesonly` count values(Web.url) as url min(_time)
  as firstTime from datamodel=Web where Web.status=200 by Web.src Web.dest Web.status
@@ -4,7 +4,8 @@ version: 2
 date: '2017-09-18'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Network_Resolution
+datamodel:
+- Network_Resolution
 description: This search is used to detect DNS tunneling, by calculating the sum of
  the length of DNS queries and DNS answers. The search also filters out potential
  false positives by filtering out queries made to internal systems and the queries
@@ -4,7 +4,8 @@ version: 3
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Network_Resolution
+datamodel:
+- Network_Resolution
 description: This search will detect DNS requests resolved by unauthorized DNS servers.
  Legitimate DNS servers should be identified in the Enterprise Security Assets and
  Identity Framework.
@@ -4,7 +4,7 @@ version: 3
 date: '2020-07-21'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for EC2 instances being modified by users who have
  not previously modified them. This search is deprecated and have been translated
  to use the latest Change Datamodel.
@@ -4,7 +4,7 @@ version: 1
 date: '2018-02-23'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for CloudTrail events where an instance is started
  in a particular region in the last one hour and then compares it to a lookup file
  of previously seen regions where an instance was started
@@ -4,7 +4,7 @@ version: 1
 date: '2018-03-12'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for EC2 instances being created with previously unseen
  AMIs.  This search is deprecated and have been translated to use the latest Change
  Datamodel.
@@ -4,7 +4,7 @@ version: 2
 date: '2020-02-07'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for EC2 instances being created with previously unseen
  instance types.  This search is deprecated and have been translated to use the latest
  Change Datamodel.
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-21'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for EC2 instances being created by users who have not
  created them before. This search is deprecated and have been translated to use the
  latest Change Datamodel.
@@ -4,7 +4,8 @@ version: 3
 date: '2020-11-19'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for processes launched from files with at least five
  spaces in the name before the extension. This is typically done to obfuscate the
  file extension by pushing it outside of the default view.
@@ -4,7 +4,7 @@ version: 1
 date: '2017-09-12'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search returns a list of hosts that have not successfully completed
  a backup in over a week. Deprecated because it's a infrastructure monitoring.
 search: '`netbackup` MESSAGE="Disk/Partition backup completed successfully." | stats
@@ -4,7 +4,8 @@ version: 5
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for command-line arguments that use a `/c` parameter
  to execute a command that has not previously been seen.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
@@ -4,7 +4,7 @@ version: 1
 date: '2020-02-20'
 author: Rod Soto, Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search show information on uploaded containers including source
  user, account, action, bucket name event name, http user agent, message and destination
  path.
@@ -4,7 +4,7 @@ version: 1
 date: '2017-09-12'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This detection search will help profile user accounts in your environment
  by identifying newly created accounts that have been added to your network in the
  past week.
@@ -4,7 +4,8 @@ version: 6
 date: '2021-01-19'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for PowerShell processes started with a base64 encoded
  command-line passed to it, with parameters to modify the execution policy for the
  process, and those that prevent the display of an interactive prompt to the user.
@@ -4,7 +4,8 @@ version: 1
 date: '2017-09-23'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Network_Resolution
+datamodel:
+- Network_Resolution
 description: This search looks for DNS requests for faux domains similar to the domains
  that you want to have monitored for abuse.
 search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time)
@@ -4,7 +4,7 @@ version: 1
 date: '2017-09-19'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search allows you to look for evidence of exploitation for CVE-2016-4859,
  the Splunk Open Redirect Vulnerability.
 search: index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter`
@@ -4,7 +4,7 @@ version: 1
 date: '2019-01-29'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for ColdRoot events from the osx-attacks osquery pack.
 search: '| from datamodel Alerts.Alerts | search app=osquery:results (name=pack_osx-attacks_OSX_ColdRoot_RAT_Launchd
  OR name=pack_osx-attacks_OSX_ColdRoot_RAT_Files) | rename columns.path as path |
@@ -4,7 +4,8 @@ version: 5
 date: '2020-11-23'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for processes launching netsh.exe to execute various
  commands via the netsh command-line utility. Netsh.exe is a command-line scripting
  utility that allows you to, either locally or remotely, display or modify the network
@@ -4,7 +4,8 @@ version: 2
 date: '2019-10-11'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for applications on the endpoint that you have marked
  as prohibited.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -4,7 +4,8 @@ version: 2
 date: '2019-02-27'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: The search looks for command-line arguments used to hide a file or directory
  using the reg add command.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -4,7 +4,7 @@ version: 3
 date: '2020-03-02'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search monitors for remote modifications to registry keys.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
@@ -4,7 +4,8 @@ version: 2
 date: '2018-12-03'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for wmic.exe being launched with parameters to operate
  on remote systems.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -4,7 +4,8 @@ version: 3
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for flags passed to schtasks.exe on the command-line
  that indicate that task names related to the execution of Bad Rabbit ransomware
  were created or deleted. Deprecated because we already have a similar detection
@@ -4,7 +4,7 @@ version: 1
 date: '2018-06-14'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search allows you to look for evidence of exploitation for CVE-2018-11409,
  a Splunk Enterprise Information Disclosure Bug.
 search: index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1
@@ -4,7 +4,7 @@ version: 4
 date: '2020-07-22'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search looks for changes to registry values that control Windows
  file associations, executed by a process that is not typical for legitimate, routine
  changes to this area.
@@ -4,7 +4,7 @@ version: 3
 date: '2019-04-25'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: The search looks for files created with names that have been linked to
  malicious activity.
 search: '| tstats `security_content_summariesonly` count values(Filesystem.action)
@@ -4,7 +4,7 @@ version: 2
 date: '2020-07-22'
 author: Rico Valdez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects writes to the 'System Volume Information' folder
  by something other than the System process.
 search: (`sysmon` OR tag=process) EventCode=11 process_id!=4 file_path=*System\ Volume\
@@ -4,7 +4,8 @@ version: 4
 date: '2020-07-22'
 author: David Dorsey, Splunk
 type: batch
-datamodel: Endpoint
+datamodel:
+- Endpoint
 description: This search looks for applications on the endpoint that you have marked
  as uncommon.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -4,7 +4,7 @@ version: 1
 date: '2019-12-06'
 author: Patrick Bareiss, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search detects loading of unsigned images by LSASS. Deprecated because
  too noisy.
 search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time)
@@ -4,7 +4,7 @@ version: 1
 date: '2017-09-12'
 author: David Dorsey, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: This search gives you the hosts where a backup was attempted and then
  failed.
 search: '`netbackup` | stats latest(_time) as latestTime by COMPUTERNAME, MESSAGE
@@ -4,7 +4,7 @@ version: 1
 date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
 type: batch
-datamodel: ''
+datamodel: []
 description: 'The search looks for the Console Window Host process (connhost.exe)
  executed using the force flag -ForceV1. This is not regular behavior in the Windows
  OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually
--- a/Show More
+++ b/Show More