From 573e8e3aa0ba2860bcaecce4b018242a90faf4b7 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Wed, 4 Mar 2020 14:31:37 -0700 Subject: [PATCH 1/2] fixes for a couple broken macros --- macros/smb_traffic_spike_mltk_filter.yml | 2 +- macros/unauthorized_dns_servers_filter.yml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/macros/smb_traffic_spike_mltk_filter.yml b/macros/smb_traffic_spike_mltk_filter.yml index befb062f4a..ee09da9bcd 100644 --- a/macros/smb_traffic_spike_mltk_filter.yml +++ b/macros/smb_traffic_spike_mltk_filter.yml @@ -1,3 +1,3 @@ definition: search * description: Use this macro to add additional filters for SMB traffic spike detection using MLKT -name: smb_traffic_spike_mltkfilter +name: smb_traffic_spike_mltk_filter diff --git a/macros/unauthorized_dns_servers_filter.yml b/macros/unauthorized_dns_servers_filter.yml index 6c8c3b8dca..919e3fd05e 100644 --- a/macros/unauthorized_dns_servers_filter.yml +++ b/macros/unauthorized_dns_servers_filter.yml @@ -1,2 +1,3 @@ +definition: search * description: Use this macro to add additional filters for DNS Query Requests Resolved by Unauthorized DNS Servers detection name: unauthorized_dns_servers_filter From b4d760507cf41268f634f8654b9bd5309dcdff8b Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 4 Mar 2020 14:02:40 -0800 Subject: [PATCH 2/2] macro key --- detections/smb_traffic_spike_mltk.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detections/smb_traffic_spike_mltk.yml b/detections/smb_traffic_spike_mltk.yml index 8800247155..b5b44c2251 100644 --- a/detections/smb_traffic_spike_mltk.yml +++ b/detections/smb_traffic_spike_mltk.yml @@ -27,6 +27,8 @@ detect: risk_object_type: - system risk_score: 50 + macros: + - smb_traffic_spike_mltk_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -111,7 +113,7 @@ investigations: type: splunk known_false_positives: If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically - re-run the support search to re-build the ML model on the latest data. + re-run the support search to re-build the ML model on the latest data. Please update the `smb_traffic_spike_mltk_filter` macro to filter out false positive results maintainers: - company: Splunk email: rvaldez@splunk.com