Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2021-02-12 17:58:52 +00:00
parent 810c30d1d2 626a4fe1a8
commit c4db456aa9
739 changed files with 14295 additions and 11469 deletions
@@ -253,6 +253,12 @@ jobs:
            cd security-content
            source venv/bin/activate
            python bin/doc-gen.py --path . --output docs -v
+      - run:
+          name: make yamls pretty
+          command: |
+            cd security-content
+            source venv/bin/activate
+            python bin/pretty_yaml.py --path . -v
      - run:
          name: get cti repo for mitre-maps
          command: |
@@ -283,6 +289,7 @@ jobs:
            git config --global push.default simple
            git add package/*
            git add docs/*
+            git add detections/*
            git commit --allow-empty -m "updating docs and package bits [ci skip]"
            # Push quietly to prevent showing the token in log
            git push https://${GITHUB_TOKEN}@github.com/splunk/security-content.git ${CIRCLE_BRANCH}
@@ -13,4 +13,4 @@ validate:
  script:
    - python3 bin/ssa_validate.py --skip-error detections/*/*
    - python3 bin/ssa_test.py --skip-error tests/*/*
-    - python3 bin/testing_coverage.py --type SSA --min-coverage 1.0
+    - python3 bin/testing_coverage.py --type streaming --min-coverage 1.0
@@ -1,21 +1,25 @@
-author: David Dorsey, Splunk
+name: Baseline of API Calls per User ARN
+id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
+version: 1
 date: '2018-04-09'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
  deviation of the number of API calls made by each user. Also recorded is the number
  of data points for each user. This table is then outputted to a lookup file to allow
  the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
-name: Baseline of API Calls per User ARN
 search: '`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn
  | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
  as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
  stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
  avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  detections:
  - Detect Spike in AWS API Activity
@@ -23,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,15 +1,15 @@
-author: Bhavin Patel, Splunk
+name: Baseline of blocked outbound traffic from AWS
+id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
+version: 1
 date: '2018-05-07'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
  deviation of the number of outbound connections blocked in your VPC flow logs by
  each source IP address (IP address of your EC2 instances). Also recorded is the
  number of data points for each source IP. This table outputs to a lookup file to
  allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
-  logs.`.
-id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
-name: Baseline of blocked outbound traffic from AWS
 search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12
  OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)
  | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip
@@ -18,8 +18,12 @@ search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17
  as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints,
  avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections
  | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
+  logs.`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  - Command and Control
  - Suspicious AWS Traffic
@@ -29,5 +33,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,25 @@
-author: David Dorsey, Splunk
+name: Baseline Of Cloud Infrastructure API Calls Per User
+id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
+version: 1
 date: '2020-09-07'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  for how many API calls are performed by each user. By default, the search uses the
  last 90 days of data to build the model and the model is rebuilt weekly. The model
  created by this search is then used in the corresponding detection search, which
  identifies subsequent outliers in the number of instances created in a small time
  window.
+search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown
+  All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls)
+  as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction
+  api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm
+  show_density=true'
 how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
  installed, along with any required dependencies. Depending on the number of users
@@ -15,18 +29,9 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil
  90 days of data. You can modify the search window to build the model over a longer
  period of time, which may give you better results. You may also want to periodically
  re-run this search to rebuild the model with the latest data.
-id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
-name: Baseline Of Cloud Infrastructure API Calls Per User
-search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown
-  All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
-  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
-  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
-  <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls)
-  as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction
-  api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm
-  show_density=true'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  deployments:
  - Weekly Model Rebuild 90 Day Lookback
@@ -36,5 +41,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,25 @@
-author: David Dorsey, Splunk
+name: Baseline Of Cloud Instances Destroyed
+id: a2f701f8-5296-4d74-829c-0b7eb346d549
+version: 1
 date: '2020-08-25'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  for how many instances are destroyed in the environment. By default, the search
  uses the last 90 days of data to build the model and the model is rebuilt weekly.
  The model created by this search is then used in the corresponding detection search,
  which identifies subsequent outliers in the number of instances destroyed in a small
  time window.
+search: '| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted
+  AND All_Changes.status=success AND All_Changes.object_category=instance by _time
+  span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed,
+  (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
+  | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction
+  instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1
+  dist=expon show_density=true'
 how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
  installed, along with any required dependencies. Depending on the number of users
@@ -17,18 +31,9 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
  re-run this search to rebuild the model with the latest data.\

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-id: a2f701f8-5296-4d74-829c-0b7eb346d549
-name: Baseline Of Cloud Instances Destroyed
-search: '| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted
-  AND All_Changes.status=success AND All_Changes.object_category=instance by _time
-  span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed,
-  (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
-  | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
-  <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction
-  instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1
-  dist=expon show_density=true'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Instance Activities
  - Cloud Cryptomining
  deployments:
@@ -39,5 +44,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,25 @@
-author: David Dorsey, Splunk
+name: Baseline Of Cloud Instances Launched
+id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
+version: 1
 date: '2020-08-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  for how many instances are created in the environment. By default, the search uses
  the last 90 days of data to build the model and the model is rebuilt weekly. The
  model created by this search is then used in the corresponding detection search,
  which identifies subsequent outliers in the number of instances created in a small
  time window.
+search: '| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created)
+  AND All_Changes.status=success AND All_Changes.object_category=instance by _time
+  span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
+  (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
+  | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
+  instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
+  dist=expon show_density=true'
 how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
  installed, along with any required dependencies. Depending on the number of users
@@ -17,18 +31,9 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
  re-run this search to rebuild the model with the latest data.\

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
-name: Baseline Of Cloud Instances Launched
-search: '| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created)
-  AND All_Changes.status=success AND All_Changes.object_category=instance by _time
-  span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
-  (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
-  | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
-  <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
-  instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
-  dist=expon show_density=true'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  - Suspicious Cloud Instance Activities
  deployments:
@@ -39,5 +44,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,20 +1,15 @@
-author: David Dorsey, Splunk
+name: Baseline Of Cloud Security Group API Calls Per User
+id: 67b84d51-8329-4909-849f-8d38ce54260a
+version: 1
 date: '2020-09-07'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  for how many API calls for security groups are performed by each user. By default,
  the search uses the last 90 days of data to build the model and the model is rebuilt
  weekly.
-how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
-  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
-  installed, along with any required dependencies. Depending on the number of users
-  in your environment, you may also need to adjust the value for max_inputs in the
-  MLTK settings for the DensityFunction algorithm, then ensure that the search completes
-  in a reasonable timeframe. By default, the search builds the model using the past
-  90 days of data. You can modify the search window to build the model over a longer
-  period of time, which may give you better results. You may also want to periodically
-  re-run this search to rebuild the model with the latest data.
-id: 67b84d51-8329-4909-849f-8d38ce54260a
-name: Baseline Of Cloud Security Group API Calls Per User
 search: '| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall
  All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
@@ -24,8 +19,18 @@ search: '| tstats count as security_group_api_calls from datamodel=Change where
  isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls
  by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm
  show_density=true'
+how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
+  need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+  installed, along with any required dependencies. Depending on the number of users
+  in your environment, you may also need to adjust the value for max_inputs in the
+  MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+  in a reasonable timeframe. By default, the search builds the model using the past
+  90 days of data. You can modify the search window to build the model over a longer
+  period of time, which may give you better results. You may also want to periodically
+  re-run this search to rebuild the model with the latest data.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  deployments:
  - Weekly Model Rebuild 90 Day Lookback
@@ -35,5 +40,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,10 +1,20 @@
-author: Rico Valdez, Splunk
+name: Baseline of Command Line Length - MLTK
+id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
+version: 1
 date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  to characterize the length of the command lines observed for each user in the environment.
  By default, the search uses the last 30 days of data to build the model. The model
  created by this search is then used in the corresponding detection search, which
  identifies outliers in the length of the command line.
+search: '| tstats `security_content_summariesonly` count min(_time) as start_time
+  max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
+  Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
+  user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
+  eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
 how_to_implement: You must be ingesting endpoint data and populating the Endpoint
  data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
  >= 4.2 installed, along with any required dependencies. Depending on the number
@@ -15,15 +25,9 @@ how_to_implement: You must be ingesting endpoint data and populating the Endpoin
  a longer period of time, which may give you better results. You may also want to
  periodically re-run this search to rebuild the model with the latest data. More
  information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
-name: Baseline of Command Line Length - MLTK
-search: '| tstats `security_content_summariesonly` count min(_time) as start_time
-  max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
-  Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
-  user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
-  eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Ransomware
  - Suspicious Command-Line Executions
@@ -36,5 +40,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,10 +1,20 @@
-author: Rico Valdez, Splunk
+name: Baseline of DNS Query Length - MLTK
+id: c914844c-0ff5-4efc-8d44-c063443129ba
+version: 1
 date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Network_Resolution
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  to characterize the length of the DNS queries for each DNS record type observed
  in the environment. By default, the search uses the last 30 days of data to build
  the model. The model created by this search is then used in the corresponding detection
  search, which uses it to identify outliers in the length of the DNS query.
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
+  by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")`
+  | eval query_length = len(query) | fit DensityFunction query_length by record_type
+  into dns_query_pdfmodel'
 how_to_implement: To successfully implement this search, you will need to ensure that
  DNS data is populating the Network_Resolution data model. In addition, you must
  have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any
@@ -13,14 +23,9 @@ how_to_implement: To successfully implement this search, you will need to ensure
  period of time, which may give you better results. You may also want to periodically
  re-run this search to rebuild the model with the latest data. More information on
  the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-id: c914844c-0ff5-4efc-8d44-c063443129ba
-name: Baseline of DNS Query Length - MLTK
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
-  by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")`
-  | eval query_length = len(query) | fit DensityFunction query_length by record_type
-  into dns_query_pdfmodel'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Command and Control
  - Hidden Cobra Malware
  - Suspicious DNS Traffic
@@ -30,5 +35,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,10 +1,18 @@
-author: Jason Brewer, Splunk
+name: Baseline of Excessive AWS Instances Launched by User - MLTK
+id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
+version: 1
 date: '2019-11-14'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  for how many RunInstances users do in the environment. By default, the search uses
  the last 90 days of data to build the model. The model created by this search is
  then used in the corresponding detection search, which identifies subsequent outliers
  in the number of RunInstances performed by a user in a small time window.
+search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
+  | bucket span=10m _time | stats count as instances_launched by _time src_user |
+  fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.\
@@ -19,13 +27,9 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
  search to rebuild the model with the latest data.\

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
-name: Baseline of Excessive AWS Instances Launched by User - MLTK
-search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
-  | bucket span=10m _time | stats count as instances_launched by _time src_user |
-  fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  detections:
@@ -34,5 +38,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,19 @@
-author: Jason Brewer, Splunk
+name: Baseline of Excessive AWS Instances Terminated by User - MLTK
+id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
+version: 1
 date: '2019-11-14'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  for how many TerminateInstances users do in the environment. By default, the search
  uses the last 90 days of data to build the model. The model created by this search
  is then used in the corresponding detection search, which identifies subsequent
  outliers in the number of TerminateInstances performed by a user in a small time
  window.
+search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
+  | bucket span=10m _time | stats count as instances_terminated by _time src_user
+  | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
 how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.\
@@ -20,13 +28,9 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
  search to rebuild the model with the latest data.\

  More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
-name: Baseline of Excessive AWS Instances Terminated by User - MLTK
-search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
-  | bucket span=10m _time | stats count as instances_terminated by _time src_user
-  | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS EC2 Activities
  detections:
  - Abnormally High AWS Instances Terminated by User - MLTK
@@ -34,5 +38,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,22 +1,26 @@
-author: Bhavin Patel, Splunk
+name: Baseline of Network ACL Activity by ARN
+id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
+version: 1
 date: '2018-05-21'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
  deviation of the number of API calls that were related to network ACLs made by each
  user. Also recorded is the number of data points for each user. This table is then
  outputted to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
-id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
-name: Baseline of Network ACL Activity by ARN
 search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn
  | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
  as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
  stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
  avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
  count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  detections:
  - Detect Spike in Network ACL Activity
@@ -24,5 +28,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,21 +1,25 @@
-author: Bhavin Patel, Splunk
+name: Baseline of S3 Bucket deletion activity by ARN
+id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
+version: 1
 date: '2018-07-17'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and standard
  deviation for the number of API calls related to deleting an S3 bucket by each user.
  Also recorded is the number of data points for each user. This table is then outputted
  to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
-name: Baseline of S3 Bucket deletion activity by ARN
 search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn
  | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
  as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
  stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
  avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS S3 Activities
  detections:
  - Detect Spike in S3 Bucket deletion
@@ -23,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,22 +1,26 @@
-author: Bhavin Patel, Splunk
+name: Baseline of Security Group Activity by ARN
+id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
+version: 1
 date: '2018-04-17'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search establishes, on a per-hour basis, the average and the standard
  deviation for the number of API calls related to security groups made by each user.
  Also recorded is the number of data points for each user. This table is then outputted
  to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
-id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
-name: Baseline of Security Group Activity by ARN
 search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn
  | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
  as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
  stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
  avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats
  count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  detections:
  - Detect Spike in Security Group Activity
@@ -24,5 +28,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,22 @@
-author: Rico Valdez, Splunk
+name: Baseline of SMB Traffic - MLTK
+id: df98763b-0b08-4281-8ef9-08db7ac572a9
+version: 1
 date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: This search is used to build a Machine Learning Toolkit (MLTK) model
  to characterize the number of SMB connections observed each hour for every day of
  week. By default, the search uses the last 30 days of data to build the model. The
  model created by this search is then used in the corresponding detection search
  to identify outliers in the number of SMB connections for that hour and day of the
  week.
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
+  where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb
+  by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval
+  DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction
+  count by "HourOfDay,DayOfWeek" into smb_pdfmodel'
 how_to_implement: You must be ingesting network traffic and populating the Network_Traffic
  data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
  >= 4.2 installed, along with any required dependencies. To improve your results,
@@ -19,15 +30,9 @@ how_to_implement: You must be ingesting network traffic and populating the Netwo
  which may give you better results. You may also want to periodically re-run this
  search to rebuild the model with the latest data. More information on the algorithm
  used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-id: df98763b-0b08-4281-8ef9-08db7ac572a9
-name: Baseline of SMB Traffic - MLTK
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
-  where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb
-  by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval
-  DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction
-  count by "HourOfDay,DayOfWeek" into smb_pdfmodel'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - DHS Report TA18-074A
  - Disabling Security Tools
  - 'Emotet Malware  DHS Report TA18-201A '
@@ -41,5 +46,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,22 @@
-author: Bhavin Patel, Splunk
+name: Count of assets by category
+id: dcfd6b40-42f9-469d-a433-2e53f7489ff9
+version: 1
 date: '2017-09-13'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search shows you every asset category you have and the assets that
  belong to those categories.
+search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
+  by category | sort -count'
 how_to_implement: To successfully implement this search you must first leverage the
  Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv
  file which should then be mapped to the Identity_Management data model. The Identity_Management
  data model will contain a list of known authorized company assets. Ensure that all
  inventoried systems are constantly vetted and updated.
-id: dcfd6b40-42f9-469d-a433-2e53f7489ff9
-name: Count of assets by category
-search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
-  by category | sort -count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Asset Tracking
  detections:
  - Detect Unauthorized Assets by MAC address
@@ -20,5 +24,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,21 @@
-author: David Dorsey, Splunk
+name: Count of Unique IPs Connecting to Ports
+id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f
+version: 1
 date: '2017-09-13'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: The search counts the number of times a connection was observed to each
  destination port, and the number of unique source IPs connecting to them.
-how_to_implement: To successfully implement this search, you must be ingesting network
-  traffic, and populating the Network_Traffic data model.
-id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f
-name: Count of Unique IPs Connecting to Ports
 search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts
  from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
  | sort - count'
+how_to_implement: To successfully implement this search, you must be ingesting network
+  traffic, and populating the Network_Traffic data model.
+references: []
 tags:
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,20 +1,24 @@
-author: Bhavin Patel, Splunk
+name: Create a list of approved AWS service accounts
+id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
+version: 2
 date: '2018-12-03'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for successful API activity in CloudTrail within the
  last 30 days, filters out known users from the identity table, and outputs values
  of users into `aws_service_accounts.csv` lookup file.
+search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
+  [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
+  | table identity | outputlookup aws_service_accounts | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. Please validate the service account entires in `aws_service_accounts.csv`,
  which is a lookup file created as a result of running this support search. Please
  remove the entries of service accounts that are not legitimate.
-id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
-name: Create a list of approved AWS service accounts
-search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
-  [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
-  | table identity | outputlookup aws_service_accounts | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  detections:
  - Detect AWS API Activities From Unapproved Accounts
@@ -22,5 +26,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 2
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: Add Prohibited Processes to Enterprise Security
+id: 251930a5-1451-4428-bb13-eed5775be0ce
+version: 1
 date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search takes the existing interesting process table from ES, filters
  out any existing additions added by ESCU and then updates the table with processes
  identified by ESCU that should be prohibited on your endpoints.
-how_to_implement: This search should be run on each new install of ESCU.
-id: 251930a5-1451-4428-bb13-eed5775be0ce
-name: Add Prohibited Processes to Enterprise Security
 search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T
  prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false
  is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes
  | stats count'
+how_to_implement: This search should be run on each new install of ESCU.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - 'Emotet Malware  DHS Report TA18-201A '
  - Monitor for Unauthorized Software
  - SamSam Ransomware
@@ -21,5 +25,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,15 +1,15 @@
-author: Jose Hernandez, Splunk
+name: Discover DNS records
+id: c096f721-8842-42ce-bfc7-74bd8c72b7c3
+version: 1
 date: '2019-02-14'
+author: Jose Hernandez, Splunk
+type: batch
+datamodel:
+- Network_Resolution
 description: The search takes corporate and common cloud provider domains configured
  under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv`
  finds their responses across the last 30 days from data in the `Network_Resolution
  ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup
-how_to_implement: To successfully implement this search, you must be ingesting DNS
-  logs, and populating the Network_Resolution data model. Also make sure that the
-  cim_corporate_web_domains and cim_corporate_email_domains lookups are populated
-  with the domains owned by your corporation
-id: c096f721-8842-42ce-bfc7-74bd8c72b7c3
-name: Discover DNS records
 search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv
  | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain,
  "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type)
@@ -18,8 +18,13 @@ search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T ci
  where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"] | makemv
  delim=" " answer |  makemv delim=" " type | sort -count | table count,domain,type,query,answer
  | outputlookup createinapp=true discovered_dns_records'
+how_to_implement: To successfully implement this search, you must be ingesting DNS
+  logs, and populating the Network_Resolution data model. Also make sure that the
+  cim_corporate_web_domains and cim_corporate_email_domains lookups are populated
+  with the domains owned by your corporation
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - DNS Hijacking
  detections:
  - DNS record changed
@@ -27,5 +32,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: DNSTwist Domain Names
+id: 19f7d2ec-6028-4d01-bcdb-bda9a034c17f
+version: 2
 date: '2018-10-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search creates permutations of your existing domains, removes the
  valid domain names and stores them in a specified lookup file so they can be checked
  for in the associated detection searches.
+search: '| dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true"
+  | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count'
 how_to_implement: To successfully implement this search you need to update the file
  called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv`
  and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**.
-id: 19f7d2ec-6028-4d01-bcdb-bda9a034c17f
-name: DNSTwist Domain Names
-search: '| dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true"
-  | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Brand Monitoring
  - Suspicious Emails
  detections:
@@ -22,5 +26,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 2
@@ -1,18 +1,21 @@
-author: David Dorsey, Splunk
+name: Identify Systems Creating Remote Desktop Traffic
+id: 5cdda34f-4caf-4128-a713-0837fc48b67a
+version: 1
 date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: This search counts the numbers of times the system has generated remote
  desktop traffic.
-how_to_implement: To successfully implement this search, you must ingest network traffic
-  and populate the Network_Traffic data model.
-id: 5cdda34f-4caf-4128-a713-0837fc48b67a
-name: Identify Systems Creating Remote Desktop Traffic
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
  where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")`
  | sort - count'
+how_to_implement: To successfully implement this search, you must ingest network traffic
+  and populate the Network_Traffic data model.
+references: []
 tags:
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,19 +1,22 @@
-author: David Dorsey, Splunk
+name: Identify Systems Receiving Remote Desktop Traffic
+id: baaeea15-fe8a-4090-92c2-5b60943bb608
+version: 1
 date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
 description: This search counts the numbers of times the system has created remote
  desktop traffic
-how_to_implement: To successfully implement this search you must ingest network traffic
-  and populate the Network_Traffic data model. If a system receives a lot of remote
-  desktop traffic, you can apply the category common_rdp_destination to it.
-id: baaeea15-fe8a-4090-92c2-5b60943bb608
-name: Identify Systems Receiving Remote Desktop Traffic
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
  where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")`
  | sort - count'
+how_to_implement: To successfully implement this search you must ingest network traffic
+  and populate the Network_Traffic data model. If a system receives a lot of remote
+  desktop traffic, you can apply the category common_rdp_destination to it.
+references: []
 tags:
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,21 @@
-author: David Dorsey, Splunk
+name: Identify Systems Using Remote Desktop
+id: 063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8
+version: 1
 date: '2019-04-01'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search counts the numbers of times the remote desktop process, mstsc.exe,
  has run on each system.
-how_to_implement: To successfully implement this search you must be ingesting endpoint
-  data that records process activity.
-id: 063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8
-name: Identify Systems Using Remote Desktop
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
  where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name
  | `drop_dm_object_name(Processes)` | sort - count'
+how_to_implement: To successfully implement this search you must be ingesting endpoint
+  data that records process activity.
+references: []
 tags:
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: Monitor Successful Backups
+id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e
+version: 1
 date: '2017-09-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often successful backups
  are conducted in your environment. Fluctuations in these numbers will allow you
  to determine when you should investigate.
-how_to_implement: To successfully implement this search you must be ingesting your
-  backup logs.
-id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e
-name: Monitor Successful Backups
 search: '`netbackup` "Disk/Partition backup completed successfully." | bucket _time
  span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time,
  MESSAGE'
+how_to_implement: To successfully implement this search you must be ingesting your
+  backup logs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Monitor Backup Solution
  detections:
  - Unsuccessful Netbackup backups
@@ -19,5 +23,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,16 +1,20 @@
-author: David Dorsey, Splunk
+name: Monitor Unsuccessful Backups
+id: b2178fed-592f-492b-b851-74161678aa56
+version: 1
 date: '2017-09-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often backup failures
  happen in your environments.  Fluctuations in these numbers will allow you to determine
  when you should investigate.
-how_to_implement: To successfully implement this search you must be ingesting your
-  backup logs.
-id: b2178fed-592f-492b-b851-74161678aa56
-name: Monitor Unsuccessful Backups
 search: '`netbackup` "An error occurred, failed to backup." | bucket _time span=1d
  | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE'
+how_to_implement: To successfully implement this search you must be ingesting your
+  backup logs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Monitor Backup Solution
  detections:
  - Unsuccessful Netbackup backups
@@ -18,5 +22,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,21 +1,25 @@
-author: Bhavin Patel, Splunk
+name: Previously seen API call per user roles in CloudTrail
+id: fc0edc95-fq2c-48b0-9f6f-63da3289fd03
+version: 1
 date: '2018-04-16'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for successful API calls made by different user roles,
  then creates a baseline of the earliest and latest times we have encountered this
  user role. It also returns the name of the API call in our dataset--grouped by user
  role and name of the API call--that occurred within the last 30 days. In this support
  search, we are only looking for events where the user identity is Assumed Role.
+search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole
+  | stats earliest(_time) as earliest latest(_time) as latest by userName eventName
+  | outputlookup previously_seen_api_calls_from_user_roles | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`,
  which is a lookup file created as a result of running this support search.
-id: fc0edc95-fq2c-48b0-9f6f-63da3289fd03
-name: Previously seen API call per user roles in CloudTrail
-search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole
-  | stats earliest(_time) as earliest latest(_time) as latest by userName eventName
-  | outputlookup previously_seen_api_calls_from_user_roles | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS User Monitoring
  detections:
  - Detect new API calls from user roles
@@ -23,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,21 +1,25 @@
-author: David Dorsey, Splunk
+name: Previously Seen AWS Cross Account Activity
+id: 1cc22b09-c867-416e-a511-cb36ac44aee2
+version: 1
 date: '2018-06-04'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search looks for **AssumeRole** events where the requesting account
  differs from the requested account, then writes these relationships to a lookup
  file.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
-  a lookup file created by this support search.
-id: 1cc22b09-c867-416e-a511-cb36ac44aee2
-name: Previously Seen AWS Cross Account Activity
 search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId
  | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=*
  | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime
  latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup
  previously_seen_aws_cross_account_activity | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
+  a lookup file created by this support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cross Account Activity
  detections:
  - AWS Cross Account Activity From Previously Unseen Account
@@ -23,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,15 +1,14 @@
-author: Rico Valdez, Splunk
+name: Previously Seen AWS Cross Account Activity - Initial
+id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
+version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for **AssumeRole** events where the requesting account
  differs from the requested account, then writes these relationships to a lookup
  file.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later)and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Validate the user name entries
-  in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
-  support search.
-id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
-name: Previously Seen AWS Cross Account Activity - Initial
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
  Authentication.src Authentication.user_role |  `drop_dm_object_name(Authentication)`
@@ -17,8 +16,14 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
  != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId
  | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup
  previously_seen_aws_cross_account_activity'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later)and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  deployments:
  - 90 Day Baseline
@@ -28,5 +33,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,15 +1,14 @@
-author: Rico Valdez, Splunk
+name: Previously Seen AWS Cross Account Activity - Update
+id: dd6fb3a9-4906-48cb-8626-c88a25a056c3
+version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for **AssumeRole** events where the requesting account
  differs from the requested account, then writes these relationships to a lookup
  file.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Validate the user name entries
-  in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
-  support search.
-id: dd6fb3a9-4906-48cb-8626-c88a25a056c3
-name: Previously Seen AWS Cross Account Activity - Update
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
  Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -18,8 +17,14 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
  | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime)
  as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId
  | outputlookup previously_seen_aws_cross_account_activity'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  deployments:
  - Daily Cache Updates
@@ -29,5 +34,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,19 +1,23 @@
-author: David Dorsey, Splunk
+name: Previously Seen AWS Provisioning Activity Sources
+id: ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee
+version: 1
 date: '2018-03-16'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of the first and last times seen for every
  IP address (along with its physical location) previously associated with cloud-provisioning
  activity. This is broadly defined as any event that runs or creates something.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee
-name: Previously Seen AWS Provisioning Activity Sources
 search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress
  | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress,
  City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv
  | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Suspicious Provisioning Activities
  detections:
  - AWS Cloud Provisioning From Previously Unseen IP Address
@@ -24,5 +28,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,22 @@
-author: Bhavin Patel, Splunk
+name: Previously Seen AWS Regions
+id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63
+version: 1
 date: '2018-01-08'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for CloudTrail events where an AWS instance is started
  and creates a baseline of most recent time (latest) and the first time (earliest)
  we've seen this region in our dataset grouped by the value awsRegion for the last
  30 days
+search: '`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time)
+  as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
  inputs.
-id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63
-name: Previously Seen AWS Regions
-search: '`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time)
-  as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  detections:
@@ -21,5 +25,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,20 +1,25 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud API Calls Per User Role - Initial
+id: 69d75f4b-b794-4a66-a777-730357b886b4
+version: 1
 date: '2020-09-03'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of the first and last times seen for every
  user role and command combination. This is broadly defined as any event that runs
  or creates something. This table is then cached.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
-  provider.
-id: 69d75f4b-b794-4a66-a777-730357b886b4
-name: Previously Seen Cloud API Calls Per User Role - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success
  by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
  enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  deployments:
  - 90 Day Baseline
@@ -24,5 +29,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,13 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud API Calls Per User Role - Update
+id: c4b760a0-6a97-47e9-b089-8ae9e57f210e
+version: 1
 date: '2020-09-03'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search updates the table of the first and last times seen for every
  user role and command combination.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
-  provider.
-id: c4b760a0-6a97-47e9-b089-8ae9e57f210e
-name: Previously Seen Cloud API Calls Per User Role - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success
  by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
@@ -15,8 +17,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
  enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  deployments:
  - Daily Cache Updates
@@ -26,5 +31,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,22 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Cloud Compute Creations By User - Initial
+id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
+version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen users that have launched
  a cloud compute instance.
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the proper TAs installed.
-id: dd4ced8a-15a9-4285-94ac-7e4134673bf8
-name: Previously Seen Cloud Compute Creations By User - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance
  by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user
  | stats count'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the proper TAs installed.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - Hourly Cache Updates
@@ -21,5 +26,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,11 +1,13 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Cloud Compute Creations By User - Update
+id: 6bf75d69-7766-47bc-8097-e41696807a6f
+version: 1
 date: '2020-08-15'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen users that have launched
  a cloud compute instance.
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the proper TAs installed.
-id: 6bf75d69-7766-47bc-8097-e41696807a6f
-name: Previously Seen Cloud Compute Creations By User - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance
  by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t
@@ -13,8 +15,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(),
  "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data
  = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the proper TAs installed.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - Daily Cache Updates
@@ -24,5 +29,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,19 +1,24 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Compute Images - Initial
+id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
+version: 1
 date: '2020-10-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen images used to launch cloud
  compute instances
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the latest Change Datamodel accelerated
-id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
-name: Previously Seen Cloud Compute Images - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created  by All_Changes.Instance_Changes.image_id
  | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
  | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime
  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
  | outputlookup previously_seen_cloud_compute_images'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the latest Change Datamodel accelerated
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - 90 Day Baseline
@@ -23,5 +28,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,10 +1,13 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Compute Images - Update
+id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184
+version: 1
 date: '2020-08-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen images used to launch cloud
  compute instances
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184
-name: Previously Seen Cloud Compute Images - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id
  | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -13,8 +16,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`)
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - Daily Cache Updates
@@ -24,5 +29,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,23 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Compute Instance Types - Initial
+id: 3c78025c-1ffe-4976-a640-75ef604842be
+version: 1
 date: 2020-9-03
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen cloud compute instance
  types
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the Security Research cloud data model installed.
-id: 3c78025c-1ffe-4976-a640-75ef604842be
-name: Previously Seen Cloud Compute Instance Types - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type
  | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type !=
  "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data
  = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the Security Research cloud data model installed.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - 90 Day Baseline
@@ -22,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,10 +1,13 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Compute Instance Types - Update
+id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c
+version: 1
 date: 2020-9-03
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen cloud compute instance
  types
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c
-name: Previously Seen Cloud Compute Instance Types - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type
  | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type !=
@@ -13,8 +16,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`)
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - Daily Cache Updates
@@ -24,5 +29,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,23 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Cloud Instance Modifications By User - Initial
+id: f36dc403-739d-42f3-83a3-49237d8654c5
+version: 1
 date: '2020-07-29'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of previously seen users that have modified
  a cloud instance.
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the latest Change Datamodel accelerated.
-id: f36dc403-739d-42f3-83a3-49237d8654c5
-name: Previously Seen Cloud Instance Modifications By User - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
  All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the latest Change Datamodel accelerated.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Instance Activities
  deployments:
  - 90 Day Baseline
@@ -22,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,12 +1,13 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Cloud Instance Modifications By User - Update
+id: 534b7d30-7b0c-4510-8f55-65439850d58d
+version: 1
 date: '2020-07-29'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search updates a table of previously seen Cloud Instance modifications
  that have been made by a user
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
-id: 534b7d30-7b0c-4510-8f55-65439850d58d
-name: Previously Seen Cloud Instance Modifications By User - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
  All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
@@ -15,8 +16,12 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`)
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Instance Activities
  deployments:
  - Daily Cache Updates
@@ -26,5 +31,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,13 +1,15 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Cloud Provisioning Activity Sources - Initial
+id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7
+version: 1
 date: '2020-08-19'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search builds a table of the first and last times seen for every
  IP address (along with its physical location) previously associated with cloud-provisioning
  activity. This is broadly defined as any event that runs or creates something. This
  table is then cached.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
-  provider.
-id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7
-name: Previously Seen Cloud Provisioning Activity Sources - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created)
  All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")`
@@ -15,8 +17,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0)
  | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup
  previously_seen_cloud_provisioning_activity_sources'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Provisioning Activities
  deployments:
  - 90 Day Baseline
@@ -29,5 +34,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,15 +1,17 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Provisioning Activity Sources - Update
+id: 9830abb9-be80-4563-b232-09bf1f628cf3
+version: 1
 date: '2020-08-20'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This returns the first and last times seen for every IP address (along
  with its physical location) previously associated with cloud-provisioning activity
  within the last day. Cloud provisioning is broadly defined as any event that runs
  or creates something.  It then updates this information with historical data and
  filters out locations that have not been seen within the specified time window.
  This updated table is then cached.
-how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
-  provider.
-id: 9830abb9-be80-4563-b232-09bf1f628cf3
-name: Previously Seen Cloud Provisioning Activity Sources - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created)
  All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")`
@@ -20,8 +22,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen,
  lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources'
+how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
+  provider.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Provisioning Activities
  deployments:
  - Daily Cache Updates
@@ -34,5 +39,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,20 +1,25 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Regions - Initial
+id: b5e232db-dec6-4db8-aaa1-dd5474521e40
+version: 1
 date: '2020-09-02'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search looks for cloud compute events where a compute instance is
  started and creates a baseline of most recent time, `lastTime` and the first time
  `firstTime` we've seen this region in our dataset grouped by the region for the
  last 30 days
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the Security Research cloud data model installed.
-id: b5e232db-dec6-4db8-aaa1-dd5474521e40
-name: Previously Seen Cloud Regions - Initial
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region
  | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime
  | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0)
  | outputlookup previously_seen_cloud_regions'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the Security Research cloud data model installed.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - 90 Day Baseline
@@ -24,5 +29,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,13 +1,15 @@
-author: David Dorsey, Splunk
+name: Previously Seen Cloud Regions - Update
+id: 512f928a-a461-41b4-8984-db4dd2c472e4
+version: 1
 date: '2020-09-02'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search looks for cloud compute events where a compute instance is
  started and creates a baseline of most recent time, `lastTime` and the first time
  `firstTime` we've seen this region in our dataset grouped by the region for the
  last 30 days
-how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
-  and have the Security Research cloud data model installed.
-id: 512f928a-a461-41b4-8984-db4dd2c472e4
-name: Previously Seen Cloud Regions - Update
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region
  | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions
@@ -16,8 +18,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions
  | stats count'
+how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
+  and have the Security Research cloud data model installed.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  deployments:
  - Daily Cache Updates
@@ -27,5 +32,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,20 +1,25 @@
-author: Bhavin Patel, Splunk
+name: Previously seen command line arguments
+id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3
+version: 2
 date: '2019-03-01'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search looks for command-line arguments where `cmd.exe /c` is used
  to execute a program, then creates a baseline of the earliest and latest times we
  have encountered this command-line argument in our dataset within the last 30 days.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`'
 how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
  logs with both the process name and command line from your endpoints. The complete
  process name with command-line arguments are mapped to the "process" field in the
  Endpoint data model.
-id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3
-name: Previously seen command line arguments
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
-  AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - DHS Report TA18-074A
  - Disabling Security Tools
  - Hidden Cobra Malware
@@ -31,5 +36,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 2
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: Previously Seen EC2 AMIs
+id: bb1bd99d-1e93-45f1-9571-cfed42d372b9
+version: 1
 date: '2018-03-12'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of previously seen AMIs used to launch EC2
  instances
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: bb1bd99d-1e93-45f1-9571-cfed42d372b9
-name: Previously Seen EC2 AMIs
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId
  as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID
  | outputlookup previously_seen_ec2_amis.csv | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  detections:
  - EC2 Instance Started With Previously Unseen AMI
@@ -19,5 +23,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
-date: '2018-03-08'
-description: This search builds a table of previously seen EC2 instance types
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: b8f029f2-65a6-4d76-be98-dad1c9d59c45
 name: Previously Seen EC2 Instance Types
+id: b8f029f2-65a6-4d76-be98-dad1c9d59c45
+version: 1
+date: '2018-03-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
+description: This search builds a table of previously seen EC2 instance types
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType
  as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time)
  as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv
  | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  detections:
  - EC2 Instance Started With Previously Unseen Instance Type
@@ -19,5 +23,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: Previously Seen EC2 Launches By User
+id: 6c767ac0-0906-4355-9a83-927f5ee7bdad
+version: 1
 date: '2018-03-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of previously seen ARNs that have launched
  a EC2 instance.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: 6c767ac0-0906-4355-9a83-927f5ee7bdad
-name: Previously Seen EC2 Launches By User
 search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn
  as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup
  previously_seen_ec2_launches_by_user.csv | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
  detections:
@@ -20,5 +24,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: Previously Seen EC2 Modifications By User
+id: 4d69091b-d975-4267-85df-888bd41034eb
+version: 1
 date: '2018-04-05'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search builds a table of previously seen ARNs that have launched
  a EC2 instance.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
-id: 4d69091b-d975-4267-85df-888bd41034eb
-name: Previously Seen EC2 Modifications By User
 search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn
  userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime
  by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Unusual AWS EC2 Modifications
  detections:
  - EC2 Instance Modified With Previously Unseen User
@@ -19,5 +23,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,17 +1,21 @@
-author: David Dorsey, Splunk
+name: Previously Seen Running Windows Services - Initial
+id: 64ce0ade-cb01-4678-bddd-d31c0b175394
+version: 3
 date: '2020-06-23'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This collects the services that have been started across your entire
  enterprise.
-how_to_implement: While this search does not require you to adhere to Splunk CIM,
-  you must be ingesting your Windows security-event logs for it to execute successfully.
-  Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
-id: 64ce0ade-cb01-4678-bddd-d31c0b175394
-name: Previously Seen Running Windows Services - Initial
 search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service>[-\(\)\s\w]+)
  service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
  as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services'
+how_to_implement: While this search does not require you to adhere to Splunk CIM,
+  you must be ingesting your Windows security-event logs for it to execute successfully.
+  Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Orangeworm Attack Group
  - Windows Service Abuse
  - Sunburst Malware
@@ -23,5 +27,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 3
@@ -1,22 +1,26 @@
-author: David Dorsey, Splunk
+name: Previously Seen Running Windows Services - Update
+id: 2e3bdd68-1863-46ee-81f8-87273eee7f1c
+version: 3
 date: '2020-06-23'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search returns the first and last time a Windows service was seen
  across your enterprise within the last hour. It then updates this information with
  historical data and filters out Windows services pairs that have not been seen within
  the specified time window. This updated table is then cached.
-how_to_implement: While this search does not require you to adhere to Splunk CIM,
-  you must be ingesting your Windows security-event logs for it to execute successfully.
-  Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
-id: 2e3bdd68-1863-46ee-81f8-87273eee7f1c
-name: Previously Seen Running Windows Services - Update
 search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service>[-\(\)\s\w]+)
  service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
  as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services
  append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
  by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`")
  | outputlookup previously_seen_running_windows_services'
+how_to_implement: While this search does not require you to adhere to Splunk CIM,
+  you must be ingesting your Windows security-event logs for it to execute successfully.
+  Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Orangeworm Attack Group
  - Windows Service Abuse
  - Sunburst Malware
@@ -28,5 +32,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 3
@@ -1,20 +1,24 @@
-author: Bhavin Patel, Splunk
+name: Previously seen S3 bucket access by remote IP
+id: fc0edc15-fq2c-48b0-9f6f-63qa1281fd03
+version: 1
 date: '2018-06-28'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
 description: This search looks for successful access to S3 buckets from remote IP
  addresses, then creates a baseline of the earliest and latest times we have encountered
  this remote IP within the last 30 days. In this support search, we are only looking
  for S3 access events where the HTTP response code from AWS is "200"
+search: '`aws_s3_accesslogs` http_status=200  | stats  earliest(_time) as earliest
+  latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip
+  | stats count'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs
  inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`,
  which is a lookup file created as a result of running this support search.
-id: fc0edc15-fq2c-48b0-9f6f-63qa1281fd03
-name: Previously seen S3 bucket access by remote IP
-search: '`aws_s3_accesslogs` http_status=200  | stats  earliest(_time) as earliest
-  latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip
-  | stats count'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS S3 Activities
  detections:
  - Detect S3 access from a new IP
@@ -22,5 +26,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,22 +1,26 @@
-author: Jason Brewer, Splunk
+name: Previously seen users in CloudTrail
+id: fc0edc95-ff2b-48b0-9f6f-63da3789fd03
+version: 1
 date: '2018-04-30'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search looks for CloudTrail events where a user logs into the console,
  then creates a baseline of the latest and earliest times, City, Region, and Country
  we have encountered this user in our dataset, grouped by ARN, within the last 30
  days. NOTE - This baseline search is deprecated and has been updated to use the
  Authentication Datamodel
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
-  which is a lookup file created as a result of running this support search.
-id: fc0edc95-ff2b-48b0-9f6f-63da3789fd03
-name: Previously seen users in CloudTrail
 search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
  src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
  stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region
  Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
+  which is a lookup file created as a result of running this support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS Login Activities
  detections:
  - Detect AWS Console Login by User from New Country
@@ -27,5 +31,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,23 +1,28 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Users in CloudTrail - Initial
+id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
+version: 1
 date: '2020-05-28'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events where a user logs into the console,
  then creates a baseline of the latest and earliest times, City, Region, and Country
  we have encountered this user in our dataset, grouped by username, within the last
  30 days.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Validate the user name entries
-  in `previously_seen_users_console_logins`, which is a lookup file created by this
-  support search.
-id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
-name: Previously Seen Users in CloudTrail - Initial
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
  | iplocation Authentication.src | rename Authentication.user as user Authentication.src
  as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins
  | stats count'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_users_console_logins`, which is a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  deployments:
  - 90 Day Baseline
@@ -30,5 +35,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,23 +1,28 @@
-author: Rico Valdez, Splunk
+name: Previously Seen Users In CloudTrail - Update
+id: 66ff71c2-7e01-47dd-a041-906688c9d322
+version: 1
 date: '2020-05-28'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for CloudTrail events where a user logs into the console,
  then updates the baseline of the latest and earliest times, City, Region, and Country
  we have encountered this user in our dataset, grouped by user, within the last hour.
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Validate the user name entries
-  in `previously_seen_users_console_logins`, which is a lookup file created by this
-  support search.
-id: 66ff71c2-7e01-47dd-a041-906688c9d322
-name: Previously Seen Users In CloudTrail - Update
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
  | iplocation Authentication.src | rename Authentication.user as user Authentication.src
  as src | table user src City Region Country firstTime lastTime | inputlookup append=t
  previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime)
  as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins'
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Validate the user name entries
+  in `previously_seen_users_console_logins`, which is a lookup file created by this
+  support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  deployments:
  - Daily Cache Updates
@@ -30,5 +35,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,20 +1,25 @@
-author: David Dorsey, Splunk
+name: Previously Seen Zoom Child Processes - Initial
+id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b
+version: 1
 date: '2020-05-20'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search returns the first and last time a process was seen per endpoint
  with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then
  cached.
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node.
-id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b
-name: Previously Seen Zoom Child Processes - Initial
 search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time)
  as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe
  OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest|
  `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen
  | outputlookup zoom_first_time_child_process'
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Zoom Child Processes
  deployments:
  - 90 Day Baseline
@@ -24,5 +29,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,15 +1,16 @@
-author: David Dorsey, Splunk
+name: Previously Seen Zoom Child Processes - Update
+id: 80aea7fd-5da2-4533-b3c2-560533bfbaee
+version: 1
 date: '2020-05-20'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search returns the first and last time a process was seen per endpoint
  with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour.
  It then updates this information with historical data and filters out proces_name
  and endpoint pairs that have not been seen within the specified time window. This
  updated table is outputed to disk.
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node.
-id: 80aea7fd-5da2-4533-b3c2-560533bfbaee
-name: Previously Seen Zoom Child Processes - Update
 search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time)
  as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe
  OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest|
@@ -18,8 +19,12 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen m
  as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where
  lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`")
  | outputlookup zoom_first_time_child_process'
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Zoom Child Processes
  deployments:
  - Hourly Cache Updates
@@ -29,5 +34,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,22 +1,26 @@
-author: David Dorsey, Splunk
+name: Systems Ready for Spectre-Meltdown Windows Patch
+id: fc0edc95-ff2b-48b0-9f6f-63da3789fd61
+version: 1
 date: '2018-01-08'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: Some AV applications can cause the Spectre/Meltdown patch for Windows
  not to install successfully. This registry key is supposed to be created by the
  AV engine when it has been patched to be able to handle the Windows patch. If this
  key has been written, the system can then be patched for Spectre and Meltdown.
-how_to_implement: You need to be ingesting logs with both the process name and command-line
-  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
-id: fc0edc95-ff2b-48b0-9f6f-63da3789fd61
-name: Systems Ready for Spectre-Meltdown Windows Patch
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry
  AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*")
  by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object,
  All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
  | `drop_dm_object_name("All_Changes")`'
+how_to_implement: You need to be ingesting logs with both the process name and command-line
+  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Spectre And Meltdown Vulnerabilities
  detections:
  - Spectre and Meltdown Vulnerable Systems
@@ -24,5 +28,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,24 +1,28 @@
-author: Jason Brewer, Splunk
+name: Update previously seen users in CloudTrail
+id: 06c036e6-d6d7-4daa-bd76-411c3d356031
+version: 1
 date: '2018-04-30'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
 description: This search looks for CloudTrail events where a user logs into the console,
  then updates the baseline of the latest and earliest times, City, Region, and Country
  we have encountered this user in our dataset, grouped by ARN, within the last hour.
  NOTE - This baseline search is deprecated and has been updated to use the Authentication
  Datamodel
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
-  which is a lookup file created as a result of running this support search.
-id: 06c036e6-d6d7-4daa-bd76-411c3d356031
-name: Update previously seen users in CloudTrail
 search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
  src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
  stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region
  Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail |
  stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region
  Country | outputlookup previously_seen_users_console_logins_cloudtrail'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
+  which is a lookup file created as a result of running this support search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious AWS Login Activities
  detections:
  - Detect AWS Console Login by User from New Country
@@ -29,5 +33,3 @@ tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,20 @@
-author: David Dorsey, Splunk
+name: Windows Updates Install Failures
+id: 6a4dbd1b-4502-4a11-943a-82b5ae7a42d7
+version: 1
 date: '2017-09-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often Windows updates
  fail to install in your environment. Fluctuations in these numbers will allow you
  to determine when you should be concerned.
-how_to_implement: You must be ingesting your Windows Update Logs
-id: 6a4dbd1b-4502-4a11-943a-82b5ae7a42d7
-name: Windows Updates Install Failures
 search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM
  datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure
  by _time span=1d'
+how_to_implement: You must be ingesting your Windows Update Logs
+references: []
 tags:
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -1,18 +1,20 @@
-author: David Dorsey, Splunk
+name: Windows Updates Install Successes
+id: 6a80535c-86a6-4b54-894c-4b446d0c701d
+version: 1
 date: '2017-09-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
 description: This search is intended to give you a feel for how often successful Windows
  updates are applied in your environments. Fluctuations in these numbers will allow
  you to determine when you should be concerned.
-how_to_implement: You must be ingesting your Windows Update Logs
-id: 6a80535c-86a6-4b54-894c-4b446d0c701d
-name: Windows Updates Install Successes
 search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM
  datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed
  by _time span=1d'
+how_to_implement: You must be ingesting your Windows Update Logs
+references: []
 tags:
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-type: batch
-version: 1
@@ -37,8 +37,8 @@ def prepare_content(stories, detections):
    sto_to_nists = {}
    sto_to_det = {}
    for detection in detections:
-        if 'analytics_story' in detection['tags']:
-            for story in detection['tags']['analytics_story']:
+        if 'analytic_story' in detection['tags']:
+            for story in detection['tags']['analytic_story']:
                if story in sto_to_det.keys():
                    sto_to_det[story].add(detection['name'])
                else:
@@ -105,7 +105,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
        # we are duplicating the code block above for now and just changing variable names to make future
        # changes to this data structure separate from the mappings generation
        # @todo expose the JSON data structure for newer risk type
-        annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytics_story']
+        annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story']
        savedsearch_annotations = {}
        for key in annotation_keys:
            if key == 'mitre_attack':
@@ -154,7 +154,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
    return output_path


-def generate_analytics_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
+def generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):

    sto_det = map_detection_to_stories(detections)

@@ -334,19 +334,19 @@ def get_deployments(object, deployments):
    matched_deployments = []

    for deployment in deployments:
-        if 'analytics_story' in deployment['tags']:
-            if type(deployment['tags']['analytics_story']) is str:
-                if 'analytics_story' in object['tags']:
-                    if deployment['tags']['analytics_story'] == object['tags']['analytics_story'] or deployment['tags']['analytics_story']=='all':
+        if 'analytic_story' in deployment['tags']:
+            if type(deployment['tags']['analytic_story']) is str:
+                if 'analytic_story' in object['tags']:
+                    if deployment['tags']['analytic_story'] == object['tags']['analytic_story'] or deployment['tags']['analytic_story']=='all':
                        matched_deployments.append(deployment)

            else:
-                for story in deployment['tags']['analytics_story']:
-                    if story == object['tags']['analytics_story']:
+                for story in deployment['tags']['analytic_story']:
+                    if story == object['tags']['analytic_story']:
                        matched_deployments.append(deployment)
                        continue

-        # Remove this check since deployment files are numbered and detections for Splunk Security Analytics for AWS will only get risk configs. 
+        # Remove this check since deployment files are numbered and detections for Splunk Security Analytics for AWS will only get risk configs.

        # if 'product' in deployment['tags']:
        #     if type(deployment['tags']['product']) is str:
@@ -431,10 +431,11 @@ def get_nes_fields(search, deployment):
 def map_detection_to_stories(detections):
    sto_det = {}
    for detection in detections:
-        if 'analytics_story' in detection['tags']:
-            for story in detection['tags']['analytics_story']:
+        if 'analytic_story' in detection['tags']:
+            for story in detection['tags']['analytic_story']:
                if 'type' in detection.keys():
-                    rule_name = str(detection['type'] + ' - ' + detection['name'] + ' - Rule')
+                    if detection['type'] == 'batch':
+                        rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
                else:
                    rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
                if not (story in sto_det):
@@ -448,10 +449,11 @@ def map_response_tasks_to_stories(response_tasks):
    sto_res = {}
    for response_task in response_tasks:
        if 'tags' in response_task:
-            if 'analytics_story' in response_task['tags']:
-                for story in response_task['tags']['analytics_story']:
+            if 'analytic_story' in response_task['tags']:
+                for story in response_task['tags']['analytic_story']:
                    if 'type' in response_task.keys():
-                        task_name = str(response_task['type'] + ' - ' + response_task['name'] + ' - Response Task' )
+                        if response_task['type'] == 'response':
+                            task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
                    else:
                        task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
                    if not (story in sto_res):
@@ -465,10 +467,11 @@ def map_baselines_to_stories(baselines):
    sto_bas = {}
    for baseline in baselines:
        if 'tags' in baseline:
-            if 'analytics_story' in baseline['tags']:
-                for story in baseline['tags']['analytics_story']:
+            if 'analytic_story' in baseline['tags']:
+                for story in baseline['tags']['analytic_story']:
                    if 'type' in baseline.keys():
-                        baseline_name = str(baseline['type'] + ' - ' + baseline['name'])
+                        if baseline['type'] == 'batch':
+                            baseline_name = str('ESCU - ' + baseline['name'])
                    else:
                        baseline_name = str('ESCU - ' + baseline['name'])
                    if not (story in sto_bas):
@@ -499,10 +502,11 @@ def prepare_stories(stories, detections):
    sto_to_nists = {}
    sto_to_det = {}
    for detection in detections:
-        if 'analytics_story' in detection['tags']:
-            for story in detection['tags']['analytics_story']:
+        if 'analytic_story' in detection['tags']:
+            for story in detection['tags']['analytic_story']:
                if 'type' in detection.keys():
-                    rule_name = str(detection['type'] + ' - ' + detection['name'] + ' - Rule')
+                    if detection['type'] == 'batch':
+                        rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
                else:
                    rule_name = str('ESCU - ' + detection['name'] + ' - Rule')

@@ -640,14 +644,14 @@ def main(args):
    detections = sorted(detections, key=lambda d: d['name'])

    # only use ESCU detections to the configurations
-    detections = [object for object in detections if object["type"].lower() == "escu"]
+    detections = [object for object in detections if object["type"].lower() == "batch"]

    response_tasks = sorted(response_tasks, key=lambda i: i['name'])
    baselines = sorted(baselines, key=lambda b: b['name'])
    detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH)

    stories = sorted(stories, key=lambda s: s['name'])
-    story_path = generate_analytics_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
+    story_path = generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)

    use_case_lib_path = generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)

@@ -8,7 +8,7 @@
 ### ESCU DETECTIONS ###

 {% for detection in detections %}
-[{{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule]
+[ESCU - {{ detection.name }} - Rule]
 action.escu = 0
 action.escu.enabled = 1
 description = {{ detection.description }}
@@ -32,7 +32,7 @@ action.escu.known_false_positives = None
 action.escu.creation_date = {{ detection.date }}
 action.escu.modification_date = {{ detection.date }}
 action.escu.confidence = high
-action.escu.full_search_name = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule
+action.escu.full_search_name = ESCU - {{ detection.name }} - Rule
 action.escu.search_type = detection
 {% if detection.product is defined %}
 action.escu.product = {{ detection.product | tojson }}
@@ -42,8 +42,8 @@ action.escu.providing_technologies = {{ detection.providing_technologies | tojso
 {% else %}
 action.escu.providing_technologies = []
 {% endif %}
-{% if detection.tags.analytics_story is defined %}
-action.escu.analytic_story = {{ detection.tags.analytics_story | tojson }}
+{% if detection.tags.analytic_story is defined %}
+action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
 {% if detection.tags.risk_object is defined %}
 action.risk = 1
 action.risk.param._risk_object = {{ detection.tags.risk_object }}
@@ -58,7 +58,7 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
 dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
 dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule
+action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
 action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
 {% if detection.deployment.scheduling.schedule_window is defined %}
 schedule_window = {{ detection.deployment.scheduling.schedule_window }}
@@ -106,8 +106,8 @@ action.escu.full_search_name = {{ baseline.type | default('ESCU') }} - {{ baseli
 description = {{ baseline.description }}
 action.escu.creation_date = {{ baseline.date }}
 action.escu.modification_date = {{ baseline.date }}
-{% if baseline.tags.analytics_story is defined %}
-action.escu.analytic_story = {{ baseline.tags.analytics_story | tojson }}
+{% if baseline.tags.analytic_story is defined %}
+action.escu.analytic_story = {{ baseline.tags.analytic_story | tojson }}
 {% else %}
 action.escu.analytic_story = []
 {% endif %}
@@ -154,7 +154,7 @@ description = {{ response_task.description }}
 action.escu.creation_date = {{ response_task.date }}
 action.escu.modification_date = {{ response_task.date }}
 {% if response_task.tags is defined %}
-action.escu.analytic_story = {{ response_task.tags.analytics_story | tojson }}
+action.escu.analytic_story = {{ response_task.tags.analytic_story | tojson }}
 {% else %}
 action.escu.analytic_story = []
 {% endif %}
@@ -0,0 +1,268 @@
+#!/bin/python
+from os import path, walk
+import sys
+import argparse
+import yaml
+import re
+
+def parse_data_models_from_search(search):
+    match = re.search(r'from\sdatamodel\s?=\s?([^\s.]*)', search)
+    if match is not None:
+        return match.group(1)
+    return False
+
+def pretty_yaml_detections(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    types = ["endpoint", "application", "cloud", "deprecated", "experimental", "network", "web"]
+    for t in types:
+        for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/' + t):
+            for file in files:
+                if file.endswith(".yml"):
+                    manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['datamodel'] = object['datamodel']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['search'] = object['search']
+        if 'how_to_implement' in object:
+            pretty_yaml['how_to_implement'] = object['how_to_implement']
+        else:
+            pretty_yaml['how_to_implement'] = ''
+        pretty_yaml['known_false_positives'] = object['known_false_positives']
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_baselines(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['datamodel'] = object['datamodel']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['search'] = object['search']
+        if 'how_to_implement' in object:
+            pretty_yaml['how_to_implement'] = object['how_to_implement']
+        else:
+            pretty_yaml['how_to_implement'] = ''
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_baselines(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['datamodel'] = object['datamodel']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['search'] = object['search']
+        if 'how_to_implement' in object:
+            pretty_yaml['how_to_implement'] = object['how_to_implement']
+        else:
+            pretty_yaml['how_to_implement'] = ''
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_deployments(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['scheduling'] = object['scheduling']
+        if 'alert_action' in object:
+            pretty_yaml['alert_action'] = object['alert_action']
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml_stories(REPO_PATH, VERBOSE, content_part):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + "/" + content_part + '/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    for manifest_file in manifest_files:
+        pretty_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                error = True
+                continue
+
+        pretty_yaml['name'] = object['name']
+        pretty_yaml['id'] = object['id']
+        pretty_yaml['version'] = object['version']
+        pretty_yaml['date'] = object['date']
+        pretty_yaml['author'] = object['author']
+        pretty_yaml['type'] = object['type']
+        pretty_yaml['description'] = object['description']
+        pretty_yaml['narrative'] = object['narrative']
+        if 'references' in object:
+            pretty_yaml['references'] = object['references']
+        else:
+            pretty_yaml['references'] = []
+        pretty_yaml['tags'] = {key: value for key, value in sorted(object['tags'].items())}
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(pretty_yaml, file, sort_keys=False)
+
+    return manifest_files
+
+def pretty_yaml(REPO_PATH, VERBOSE, content_part):
+    #for root, dirs, files in walk(REPO_PATH + "/"):
+    manifest_files = []
+    if content_part == 'detections':
+        manifest_files = pretty_yaml_detections(REPO_PATH, VERBOSE, content_part)
+    elif content_part == 'baselines':
+        manifest_files = pretty_yaml_baselines(REPO_PATH, VERBOSE, content_part)
+    elif content_part == 'deployments':
+        manifest_files = pretty_yaml_deployments(REPO_PATH, VERBOSE, content_part)
+    elif content_part == 'stories':
+        manifest_files = pretty_yaml_stories(REPO_PATH, VERBOSE, content_part)
+    return len(manifest_files)
+
+def main(args):
+
+    parser = argparse.ArgumentParser(description="keeps yamls in security_content sorted and pretty printed with custom sort keys, \
+            meant to run quitely for CI, use -v flag to make it bark")
+
+    parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
+    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
+
+    # parse them
+    args = parser.parse_args()
+    REPO_PATH = args.path
+    VERBOSE = args.verbose
+    output = []
+    pretty_yaml_objects = ['macros','lookups','stories','detections','baselines','response_tasks','responses','deployments']
+    for pretty_yaml_object in pretty_yaml_objects:
+        touch_count = pretty_yaml(REPO_PATH, VERBOSE, pretty_yaml_object)
+        if VERBOSE:
+            output.append("made {0} {1} pretty".format(touch_count, pretty_yaml_object))
+
+    for o in output:
+        print(o)
+
+    print("finished successfully!")
+
+
+if __name__ == "__main__":
+    main(sys.argv[1:])
@@ -14,6 +14,6 @@
 <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
    <text x="30" y="15" fill="#010101" fill-opacity=".3">coverage</text>
    <text x="30" y="14">coverage</text>
-    <text x="80" y="14">80%%</text>
+    <text x="80" y="14">82%</text>
 </g>
 </svg>
@@ -24,7 +24,7 @@ def main(args):
                        type=float,
                        default=0.0,
                        help="Minimum coverage, script return error if target is not met")
-    parser.add_argument('--types', type=str, nargs="*", help="SSA, ESCU", default=["ESCU", "SSA"])
+    parser.add_argument('--types', type=str, nargs="*", help="batch, streaming", default=["batch", "streaming"])
    parsed = parser.parse_args(args)
    populate_coverage(parsed.types)
    print_results(parsed.types)
@@ -76,10 +76,8 @@ def validate_objects(REPO_PATH, objects, verbose):
        validation_errors, uuids = validate_standard_fields(object, uuids)
        errors = errors + validation_errors

-    if verbose:
-        print("validating object {0}".format(object['name']))
    for object in objects['detections']:
-        if object['type'] == 'ESCU':
+        if object['type'] == 'batch':
            errors = errors + validate_detection_search(object, objects['macros'])

    for object in objects['baselines']:
@@ -132,8 +130,12 @@ def validate_standard_fields(object, uuids):
    # the first two fields risk_object, and risk_object_type are an enum of fixed values
    # defined by ESCU risk scoring

-
    if 'tags' in object:
+        # check product tag is present in all objects
+        if 'product' not in object['tags']:
+            errors.append("ERROR: a `product` tag is required for object: %s" % object['name'])
+
+        # check risk score values
        for k,v in object['tags'].items():

            if k == 'risk_score':
@@ -1,10 +1,11 @@
 name: Enterprise Security deployment configuration
 id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
 date: '2020-04-27'
-description: This configuration file applies to all correlation searches that are used for detection
 author: Bhavin Patel
+description: This configuration file applies to all correlation searches that are
+  used for detection
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
@@ -13,8 +14,8 @@ alert_action:
    rule_description: '%description%'
    rule_title: '%name%'
    nes_fields:
-      - user
-      - dest
-      - src
+    - user
+    - dest
+    - src
 tags:
  analytics_story: all
@@ -1,22 +1,22 @@
 name: Detect ARP Poisoning deployment configuration
 id: e1d5b4dc-4cf3-404f-905c-b478bbb20474
 date: '2020-08-14'
-description: This configuration file applies to the Detect ARP Poisoning detection
 author: Mikael Bjerkeland
+description: This configuration file applies to the Detect ARP Poisoning detection
 scheduling:
-  cron_schedule: '59 * * * *'
+  cron_schedule: 59 * * * *
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
 alert_action:
  notable:
-    rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$.
-      This may be an indication of a MITM attack.'
-    rule_title: 'ARP Poisoning Detected on $orig_host$'
+    rule_description: ARP Poisoning has been detected on interface $src_interface$
+      on host $orig_host$. This may be an indication of a MITM attack.
+    rule_title: ARP Poisoning Detected on $orig_host$
    nes_fields:
-      - src_interface
-      - firstTime
-      - lastTime
-      - count
+    - src_interface
+    - firstTime
+    - lastTime
+    - count
 tags:
  detection_name: Detect ARP Poisoning
@@ -1,23 +1,23 @@
 name: Detect Rogue DHCP Server deployment configuration
 id: 6e4e20ac-e719-4ebe-a52d-d672cd451dbb
 date: '2020-08-14'
-description: This configuration file applies to the Detect Rogue DHCP Server detection
 author: Mikael Bjerkeland
+description: This configuration file applies to the Detect Rogue DHCP Server detection
 scheduling:
-  cron_schedule: '59 * * * *'
+  cron_schedule: 59 * * * *
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
 alert_action:
  notable:
-    rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$.
-      This may be an indication of a MITM attack.'
-    rule_title: 'Rogue DHCP Server Detected on $orig_host$'
+    rule_description: DHCP Snooping has detected a Rogue DHCP Server on $orig_host$
+      from $src_mac$. This may be an indication of a MITM attack.
+    rule_title: Rogue DHCP Server Detected on $orig_host$
    nes_fields:
-      - src_mac
-      - firstTime
-      - lastTime
-      - count
-      - message_type
+    - src_mac
+    - firstTime
+    - lastTime
+    - count
+    - message_type
 tags:
  detection_name: Detect Rogue DHCP Server
@@ -1,10 +1,10 @@
 name: Credential Dumping Story
 id: 52f52a7c-078f-4413-84da-388b61ccac26
 date: '2021-01-13'
-description: Example for a deployment for a specific Analytics Story
 author: Patrick Bareiss
+description: Example for a deployment for a specific Analytics Story
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
  earliest_time: -40m@m
  latest_time: -10m@m
  schedule_window: auto
@@ -1,10 +1,10 @@
 name: Access LSASS Memory for Dump Creation Deployment
 id: 974c422f-db3f-4538-8f2a-ee5bf8eec0fa
 date: '2021-01-13'
-description: Example for a deployment for a specific Detection
 author: Patrick Bareiss
+description: Example for a deployment for a specific Detection
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
  earliest_time: -30m@m
  latest_time: now
  schedule_window: auto
@@ -13,6 +13,6 @@ alert_action:
    rule_description: '%description%'
    rule_title: '%name% Notable'
    nes_fields:
-      - dest
+    - dest
 tags:
  detection_name: Access LSASS Memory for Dump Creation
@@ -1,10 +1,12 @@
 name: Enterprise Security config for Splunk Security Analytics for AWS customers
 id: bc91a8cd-35e7-4bb2-6140-e756cc46f211
 date: '2021-01-20'
-description: This configuration file applies to all correlation searches that are used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics for AWS searches do not need notable  configurations 
 author: Bhavin Patel
+description: This configuration file applies to all correlation searches that are
+  used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics
+  for AWS searches do not need notable  configurations
 scheduling:
-  cron_schedule: '0 * * * *'
+  cron_schedule: 0 * * * *
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
@@ -1,13 +1,14 @@
 name: Baseline Cache Hourly Updates
 id: 1030c701-2acf-4b1a-9970-46c7145caf2d
 date: '2020-06-24'
-description: This configuration file applies to all baselines with tag deployments Hourly Cache Updates
 author: Bhavin Patel
+description: This configuration file applies to all baselines with tag deployments
+  Hourly Cache Updates
 scheduling:
-  cron_schedule: '55 * * * *'
+  cron_schedule: 55 * * * *
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
 tags:
  deployments:
-    - Hourly Cache Updates
+  - Hourly Cache Updates
@@ -1,13 +1,14 @@
 name: Baseline Cache Daily Updates
 id: 9541d6f8-fa58-4d48-bb44-6720e39b7b0d
 date: '2020-08-18'
-description: This configuration file applies to all baselines with tag deployments Daily Cache Updates
 author: David Dorsey
+description: This configuration file applies to all baselines with tag deployments
+  Daily Cache Updates
 scheduling:
-  cron_schedule: '10 0 * * *'
+  cron_schedule: 10 0 * * *
  earliest_time: -1450m@m
  latest_time: -10m@m
  schedule_window: auto
 tags:
  deployments:
-    - Daily Cache Updates
+  - Daily Cache Updates
@@ -1,8 +1,9 @@
 name: 90 Day Baseline Searches
 id: 6eac9f8b-a35d-4b64-b57f-e5ecde43be6b
 date: '2020-06-24'
-description: This configuration file applies to all baselines with tag deployments Long Running Baseline
 author: Bhavin Patel
+description: This configuration file applies to all baselines with tag deployments
+  Long Running Baseline
 scheduling:
  cron_schedule: 0 1 1 1,4,7,10 *
  earliest_time: -90d@d
@@ -10,4 +11,4 @@ scheduling:
  schedule_window: auto
 tags:
  deployments:
-    - 90 Day Baseline
+  - 90 Day Baseline
@@ -1,13 +1,14 @@
 name: Weekly Model Rebuild 90 Day Lookback
 id: 4b329568-bcff-49fa-8c85-92e95f0f270d
 date: '2020-09-07'
-description: This configuration file applies to all baselines with tag deployments Weekly Model Rebuild 90 Day Lookback
 author: David Dorsey
+description: This configuration file applies to all baselines with tag deployments
+  Weekly Model Rebuild 90 Day Lookback
 scheduling:
-  cron_schedule: '0 2 * * 0'
+  cron_schedule: 0 2 * * 0
  earliest_time: -90d@d
  latest_time: -1d@d
  schedule_window: auto
 tags:
  deployments:
-    - Weekly Model Rebuild 90 Day Lookback
+  - Weekly Model Rebuild 90 Day Lookback
@@ -1,19 +1,13 @@
-author: Bhavin Patel, Splunk
+name: Email files written outside of the Outlook directory
+id: ee18ed37-0802-4268-9435-b3b91aaa18xx
+version: 3
 date: '2020-07-21'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: The search looks at the change-analysis data model and detects email
  files created outside the normal Outlook directory.
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records the file-system activity from your hosts to populate the Endpoint.Filesystem
-  data model node. This is typically populated via endpoint detection-and-response
-  products, such as Carbon Black, or by other endpoint data sources, such as Sysmon.
-  The data used for this search is typically generated via logs that report file-system
-  reads and writes.
-id: ee18ed37-0802-4268-9435-b3b91aaa18xx
-known_false_positives: Administrators and users sometimes prefer backing up their
-  email data by moving the email files into a different folder. These attempts will
-  be detected by the search.
-name: Email files written outside of the Outlook directory
-references: []
 search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path)
  as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
  where (Filesystem.file_name=*.pst OR Filesystem.file_name=*.ost) Filesystem.file_path
@@ -21,8 +15,18 @@ search: '| tstats `security_content_summariesonly` count values(Filesystem.file_
  by Filesystem.action Filesystem.process_id Filesystem.file_name Filesystem.dest
  | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `email_files_written_outside_of_the_outlook_directory_filter` '
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records the file-system activity from your hosts to populate the Endpoint.Filesystem
+  data model node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black, or by other endpoint data sources, such as Sysmon.
+  The data used for this search is typically generated via logs that report file-system
+  reads and writes.
+known_false_positives: Administrators and users sometimes prefer backing up their
+  email data by moving the email files into a different folder. These attempts will
+  be detected by the search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Collection and Staging
  asset_type: Endpoint
  cis20:
@@ -36,5 +40,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint
-type: ESCU
-version: 3
@@ -1,23 +1,27 @@
-author: Rico Valdez, Splunk
+name: Multiple Okta Users With Invalid Credentails From The Same IP
+id: 19cba45f-cad3-4032-8911-0c09e0444552
+version: 2
 date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
 description: This search detects Okta login failures due to bad credentials for multiple
  users originating from the same ip address.
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-id: 19cba45f-cad3-4032-8911-0c09e0444552
-known_false_positives: A single public IP address servicing multiple legitmate users
-  may trigger this search. In addition, the threshold of 5 distinct users may be too
-  low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise
-  the threshold or except specific IP adresses from triggering this search.
-name: Multiple Okta Users With Invalid Credentails From The Same IP
 search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
  as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users
  values(user) as users by src_ip, displayMessage, outcome.reason, country, state,
  city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  |  search distinct_users > 5| `multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
+known_false_positives: A single public IP address servicing multiple legitmate users
+  may trigger this search. In addition, the threshold of 5 distinct users may be too
+  low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise
+  the threshold or except specific IP adresses from triggering this search.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -31,5 +35,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: access
-type: ESCU
-version: 2
@@ -1,18 +1,22 @@
-author: Rico Valdez, Splunk
-date: '2020-07-21'
-description: Detect Okta user lockout events
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-id: 62b70968-a0a5-4724-8ac4-67871e6f544d
-known_false_positives: None. Account lockouts should be followed up on to determine
-  if the actual user was the one who caused the lockout, or if it was an unauthorized
-  actor.
 name: Okta Account Lockout Events
+id: 62b70968-a0a5-4724-8ac4-67871e6f544d
+version: 2
+date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
+description: Detect Okta user lockout events
 search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
  as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
+known_false_positives: None. Account lockouts should be followed up on to determine
+  if the actual user was the one who caused the lockout, or if it was an unauthorized
+  actor.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -26,5 +30,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: access
-type: ESCU
-version: 2
@@ -1,18 +1,22 @@
-author: Rico Valdez, Splunk
-date: '2020-07-21'
-description: Detect failed Okta SSO events
-how_to_implement: This search is specific to Okta and requires Okta logs are being
-  ingested in your Splunk deployment.
-id: 371a6545-2618-4032-ad84-93386b8698c5
-known_false_positives: There may be a faulty config preventing legitmate users from
-  accessing apps they should have access to.
 name: Okta Failed SSO Attempts
+id: 371a6545-2618-4032-ad84-93386b8698c5
+version: 2
+date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
+description: Detect failed Okta SSO events
 search: '`okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time)
  as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage,
  src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `okta_failed_sso_attempts_filter` '
+how_to_implement: This search is specific to Okta and requires Okta logs are being
+  ingested in your Splunk deployment.
+known_false_positives: There may be a faulty config preventing legitmate users from
+  accessing apps they should have access to.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -26,5 +30,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: access
-type: ESCU
-version: 2
@@ -1,24 +1,28 @@
-author: Rico Valdez, Splunk
+name: Okta User Logins From Multiple Cities
+id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
+version: 2
 date: '2020-07-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
 description: This search detects logins from the same user from different states in
  a 24 hour period.
+search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
+  | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)
+  as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state)
+  as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `okta_user_logins_from_multiple_cities_filter` | search locations > 1'
 how_to_implement: This search is specific to Okta and requires Okta logs are being
  ingested in your Splunk deployment.
-id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
 known_false_positives: Users in your enviornment may legitmately be travelling and
  loggin in from different locations. This search is useful for those users that should
  *not* be travelling for some reason, such as the COVID-19 pandemic. The search also
  relies on the geographical information being populated in the Okta logs. It is also
  possible that a connection from another region may be attributed to a login from
  a remote VPN endpoint.
-name: Okta User Logins From Multiple Cities
-search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
-  | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)
-  as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state)
-  as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `okta_user_logins_from_multiple_cities_filter` | search locations > 1'
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
@@ -32,5 +36,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: access
-type: ESCU
-version: 2
@@ -1,26 +1,30 @@
-author: David Dorsey, Splunk
+name: Web Servers Executing Suspicious Processes
+id: ec3b7601-689a-4463-94e0-c9f45638efb9
+version: 1
 date: '2019-04-01'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Endpoint
 description: This search looks for suspicious processes on all systems labeled as
  web servers.
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. In addition, web servers will need to be identified in the Assets and Identity
-  Framework of Enterprise Security.
-id: ec3b7601-689a-4463-94e0-c9f45638efb9
-known_false_positives: Some of these processes may be used legitimately on web servers
-  during maintenance or other administrative tasks.
-name: Web Servers Executing Suspicious Processes
-references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.dest_category="web_server"
  AND (Processes.process="*whoami*" OR Processes.process="*ping*" OR Processes.process="*iptables*"
  OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*")
  by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model. In addition, web servers will need to be identified in the Assets and Identity
+  Framework of Enterprise Security.
+known_false_positives: Some of these processes may be used legitimately on web servers
+  during maintenance or other administrative tasks.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Apache Struts Vulnerability
  asset_type: Web Server
  cis20:
@@ -36,5 +40,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint
-type: ESCU
-version: 1
@@ -1,18 +1,14 @@
-author: David Dorsey, Splunk
+name: Abnormally High Number Of Cloud Instances Destroyed
+id: ef629fc9-1583-4590-b62a-f2247fbf7bbf
+version: 1
 date: '2020-08-21'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search finds for the number successfully destroyed cloud instances
  for every 4 hour block. This is split up between weekdays and the weekend. It then
  applies the probability densitiy model previously created and alerts on any outliers.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability
-  density function.
-id: ef629fc9-1583-4590-b62a-f2247fbf7bbf
-known_false_positives: Many service accounts configured within a cloud infrastructure
-  are known to exhibit this behavior. Please adjust the threshold values and filter
-  out service accounts from the output. Always verify if this search alerted on a
-  human user.
-name: Abnormally High Number Of Cloud Instances Destroyed
-references: []
 search: '| tstats count as instances_destroyed values(All_Changes.object_id) as object_id
  from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success
  AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
@@ -25,8 +21,16 @@ search: '| tstats count as instances_destroyed values(All_Changes.object_id) as
  eval distance_from_threshold = instances_destroyed - expected_upper_threshold |
  table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold,
  object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability
+  density function.
+known_false_positives: Many service accounts configured within a cloud infrastructure
+  are known to exhibit this behavior. Please adjust the threshold values and filter
+  out service accounts from the output. Always verify if this search alerted on a
+  human user.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Instance Activities
  asset_type: Cloud Instance
  cis20:
@@ -47,5 +51,3 @@ tags:
  risk_object_type: user
  risk_score: 10
  security_domain: Cloud
-type: ESCU
-version: 1
@@ -1,18 +1,14 @@
-author: David Dorsey, Splunk
+name: Abnormally High Number Of Cloud Instances Launched
+id: f2361e9f-3928-496c-a556-120cd4223a65
+version: 2
 date: '2020-08-21'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search finds for the number successfully created cloud instances
  for every 4 hour block. This is split up between weekdays and the weekend. It then
  applies the probability densitiy model previously created and alerts on any outliers.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Instances Launched` to create the probability
-  density function.
-id: f2361e9f-3928-496c-a556-120cd4223a65
-known_false_positives: Many service accounts configured within an AWS infrastructure
-  are known to exhibit this behavior. Please adjust the threshold values and filter
-  out service accounts from the output. Always verify if this search alerted on a
-  human user.
-name: Abnormally High Number Of Cloud Instances Launched
-references: []
 search: '| tstats count as instances_launched values(All_Changes.object_id) as object_id
  from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success
  AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
@@ -25,8 +21,16 @@ search: '| tstats count as instances_launched values(All_Changes.object_id) as o
  eval distance_from_threshold = instances_launched - expected_upper_threshold | table
  _time, user, instances_launched, expected_upper_threshold, distance_from_threshold,
  object_id | `abnormally_high_number_of_cloud_instances_launched_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Instances Launched` to create the probability
+  density function.
+known_false_positives: Many service accounts configured within an AWS infrastructure
+  are known to exhibit this behavior. Please adjust the threshold values and filter
+  out service accounts from the output. Always verify if this search alerted on a
+  human user.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  - Suspicious Cloud Instance Activities
  asset_type: Cloud Instance
@@ -48,5 +52,3 @@ tags:
  risk_object_type: user
  risk_score: 40
  security_domain: Cloud
-type: ESCU
-version: 2
@@ -1,14 +1,13 @@
-author: David Dorsey, Splunk
+name: Abnormally High Number Of Cloud Infrastructure API Calls
+id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
+version: 1
 date: '2020-09-07'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search will detect a spike in the number of API calls made to your
  cloud infrastructure environment by a user.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
-  create the probability density function.
-id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
-known_false_positives: ''
-name: Abnormally High Number Of Cloud Infrastructure API Calls
-references: []
 search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change
  where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time
  span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time,
@@ -20,8 +19,13 @@ search: '| tstats count as api_calls values(All_Changes.command) as command from
  -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold
  = api_calls - expected_upper_threshold | table _time, user, command, api_calls,
  expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
+  create the probability density function.
+known_false_positives: ''
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -46,5 +50,3 @@ tags:
  risk_object_type: user
  risk_score: 25
  security_domain: network
-type: ESCU
-version: 1
@@ -1,14 +1,13 @@
-author: David Dorsey, Splunk
+name: Abnormally High Number Of Cloud Security Group API Calls
+id: d4dfb7f3-7a37-498a-b5df-f19334e871af
+version: 1
 date: '2020-09-07'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
 description: This search will detect a spike in the number of API calls made to your
  cloud infrastructure environment about security groups by a user.
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
-  create the probability density function model.
-id: d4dfb7f3-7a37-498a-b5df-f19334e871af
-known_false_positives: ''
-name: Abnormally High Number Of Cloud Security Group API Calls
-references: []
 search: '| tstats count as security_group_api_calls values(All_Changes.command) as
  command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success
  by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval
@@ -21,8 +20,13 @@ search: '| tstats count as security_group_api_calls values(All_Changes.command)
  > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls
  - expected_upper_threshold | table _time, user, command, security_group_api_calls,
  expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
+  create the probability density function model.
+known_false_positives: ''
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -47,5 +51,3 @@ tags:
  risk_object_type: user
  risk_score: 25
  security_domain: network
-type: ESCU
-version: 1
@@ -1,21 +1,14 @@
-author: Rico Valdez, Splunk
+name: AWS Cross Account Activity From Previously Unseen Account
+id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
+version: 1
 date: '2020-05-28'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Authentication
 description: This search looks for AssumeRole events where an IAM role in a different
  account is requested for the first time.  This search is deprecated and have been
  translated to use the latest Authentication Datamodel.
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider. You should run the baseline search `Previously Seen AWS Cross Account
-  Activity - Initial` to build the initial table of source IP address, geographic
-  locations, and times. You must also enable the second baseline search `Previously
-  Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
-  out old data. You can also provide additional filtering for this search by customizing
-  the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
-id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
-known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
-  It's suspicious when an account requests privileges of an account it hasn't before.
-  You should validate with the account owner that this is a legitimate request.
-name: AWS Cross Account Activity From Previously Unseen Account
-references: []
 search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication
  where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
  Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -26,8 +19,19 @@ search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=
  Cross Account Activity","Previously Seen") |  where status = "New Cross Account
  Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `aws_cross_account_activity_from_previously_unseen_account_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider. You should run the baseline search `Previously Seen AWS Cross Account
+  Activity - Initial` to build the initial table of source IP address, geographic
+  locations, and times. You must also enable the second baseline search `Previously
+  Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
+  out old data. You can also provide additional filtering for this search by customizing
+  the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
+known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
+  It's suspicious when an account requests privileges of an account it hasn't before.
+  You should validate with the account owner that this is a legitimate request.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud Authentication Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -50,5 +54,3 @@ tags:
  risk_object_type: user
  risk_score: 15
  security_domain: network
-type: ESCU
-version: 1
@@ -1,18 +1,14 @@
-author: Rod Soto, Patrick Bareiss Splunk
+name: AWS Detect Users creating keys with encrypt policy without MFA
+id: c79c164f-4b21-4847-98f9-cf6a9f49179e
+version: 1
 date: '2021-01-11'
+author: Rod Soto, Patrick Bareiss Splunk
+type: batch
+datamodel: []
 description: This search provides detection of KMS keys which action kms:Encrypt is
  accessible for everyone (also outside of your organization). This is an identicator
  that your account is compromised and the attacker uses the encryption key to compromise
  another company.
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
-id: c79c164f-4b21-4847-98f9-cf6a9f49179e
-known_false_positives: unknown
-name: AWS Detect Users creating keys with encrypt policy without MFA
-references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
- https://github.com/d1vious/git-wild-hunt
- https://www.youtube.com/watch?v=PgzNib37g0M
 search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy
  output=key_policy_statements path=Statement{} | mvexpand key_policy_statements |
  spath input=key_policy_statements output=key_policy_action_1 path=Action | spath
@@ -22,8 +18,15 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
  | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource
  eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+known_false_positives: unknown
+references:
+- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
+- https://github.com/d1vious/git-wild-hunt
+- https://www.youtube.com/watch?v=PgzNib37g0M
 tags:
-  analytics_story:
+  analytic_story:
  - Ransomware Cloud
  asset_type: AWS Account
  automated_detection_testing: passed
@@ -36,5 +39,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: threat
-type: ESCU
-version: 1
@@ -1,24 +1,27 @@
-author: Rod Soto, Patrick Bareiss Splunk
+name: AWS Detect Users with KMS keys performing encryption S3
+id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
+version: 1
 date: '2021-01-11'
+author: Rod Soto, Patrick Bareiss Splunk
+type: batch
+datamodel: []
 description: This search provides detection of users with KMS keys performing encryption
  specifically against S3 buckets.
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs
-id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
-known_false_positives: bucket with S3 encryption
-name: AWS Detect Users with KMS keys performing encryption S3
-references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
- https://github.com/d1vious/git-wild-hunt
- https://www.youtube.com/watch?v=PgzNib37g0M
 search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
  | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source
  AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime
  max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file
  values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+known_false_positives: bucket with S3 encryption
+references:
+- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
+- https://github.com/d1vious/git-wild-hunt
+- https://www.youtube.com/watch?v=PgzNib37g0M
 tags:
-  analytics_story:
+  analytic_story:
  - Ransomware Cloud
  asset_type: S3 Bucket
  automated_detection_testing: passed
@@ -31,5 +34,3 @@ tags:
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: threat
-type: ESCU
-version: 1
@@ -1,16 +1,12 @@
-author: Bhavin Patel, Patrick Bareiss, Splunk
+name: AWS Network Access Control List Created with All Open Ports
+id: ada0f478-84a8-4641-a3f1-d82362d6bd75
+version: 2
 date: '2021-01-11'
+author: Bhavin Patel, Patrick Bareiss, Splunk
+type: batch
+datamodel: []
 description: The search looks for CloudTrail events to detect if any network ACLs
  were created with all the ports open to a specified CIDR.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
-  inputs.
-id: ada0f478-84a8-4641-a3f1-d82362d6bd75
-known_false_positives: It's possible that an admin has created this ACL with all ports
-  open for some legitimate purpose however, this should be scoped and not allowed
-  in production environment.
-name: AWS Network Access Control List Created with All Open Ports
-references: []
 search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
  requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
  | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
@@ -21,8 +17,15 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
  requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
  requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
+  inputs.
+known_false_positives: It's possible that an admin has created this ACL with all ports
+  open for some legitimate purpose however, this should be scoped and not allowed
+  in production environment.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -45,5 +48,3 @@ tags:
  risk_object_type: user
  risk_score: 10
  security_domain: network
-type: ESCU
-version: 2
@@ -1,24 +1,27 @@
-author: Bhavin Patel, Patrick Bareiss, Splunk
+name: AWS Network Access Control List Deleted
+id: ada0f478-84a8-4641-a3f1-d82362d6fd75
+version: 2
 date: '2021-01-12'
+author: Bhavin Patel, Patrick Bareiss, Splunk
+type: batch
+datamodel: []
 description: Enforcing network-access controls is one of the defensive mechanisms
  used by cloud administrators to restrict access to a cloud instance. After the attacker
  has gained control of the AWS console by compromising an admin account, they can
  delete a network ACL and gain access to the instance from anywhere. This search
  will query the CloudTrail logs to detect users deleting network ACLs.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: ada0f478-84a8-4641-a3f1-d82362d6fd75
-known_false_positives: It's possible that a user has legitimately deleted a network
-  ACL.
-name: AWS Network Access Control List Deleted
-references: []
 search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
  | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
  userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs.
+known_false_positives: It's possible that a user has legitimately deleted a network
+  ACL.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -41,5 +44,3 @@ tags:
  risk_object_type: user
  risk_score: 5
  security_domain: network
-type: ESCU
-version: 2
@@ -1,38 +1,43 @@
-author: Rod Soto, Splunk
+name: AWS SAML Access by Provider User and Principal
+id: bbe23980-6019-11eb-ae93-0242ac130002
+version: 1
 date: '2021-01-26'
+author: Rod Soto, Splunk
+type: batch
+datamodel: []
 description: This search provides specific SAML access from specific Service Provider,
  user and targeted principal at AWS. This search provides specific information to
  detect abnormal access or potential credential hijack or forgery, specially in federated
  environments using SAML protocol inside the perimeter or cloud provider.
+search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
+  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
+  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
+  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_access_by_provider_user_and_principal_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with cloudtrail logs
-id: bbe23980-6019-11eb-ae93-0242ac130002
 known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
  are very difficult to detect as accessing cloud providers with these assertions
  looks exactly like normal access, however things such as source IP sourceIPAddress
  user, and principal targeted at receiving cloud provider along with endpoint credential
  access and abuse detection searches can provide the necessary context to detect
  these attacks.
-name: AWS SAML Access by Provider User and Principal
 references:
 - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
 - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
 - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
 - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
-search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
-  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
-  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
-  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`aws_saml_access_by_provider_user_and_principal_filter`'
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Federated Credential Abuse
  asset_type: AWS Federated Account
-  mitre_attack_id:
-  - T1078
-  security_domain: threat
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json
-type: ESCU
-version: 1
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
@@ -1,34 +1,39 @@
-author: Rod Soto, Splunk
+name: AWS SAML Update identity provider
+id: 2f0604c6-6030-11eb-ae93-0242ac130002
+version: 1
 date: '2021-01-26'
+author: Rod Soto, Splunk
+type: batch
+datamodel: []
 description: This search provides detection of updates to SAML provider in AWS. Updates
  to SAML provider need to be monitored closely as they may indicate possible perimeter
  compromise of federated credentials, or backdoor access from another cloud provider
  set by attacker.
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with cloudtrail logs.
-id: 2f0604c6-6030-11eb-ae93-0242ac130002
-known_false_positives: Updating a SAML provider or creating a new one may not necessarily
-  be malicious however it needs to be closely monitored.
-name: AWS SAML Update identity provider
-references:
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
 search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
  max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
  userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
  userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  |`aws_saml_update_identity_provider_filter`'
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs.
+known_false_positives: Updating a SAML provider or creating a new one may not necessarily
+  be malicious however it needs to be closely monitored.
+references:
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Federated Credential Abuse
  asset_type: AWS Federated Account
-  mitre_attack_id:
-  - T1078
-  security_domain: threat
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json
-type: ESCU
-version: 1
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
@@ -1,18 +1,12 @@
-author: David Dorsey, Splunk
-date: '2020-09-04'
-description: This search looks for new commands from each user role.
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider.  You should run the baseline search `Previously Seen Cloud API Calls Per
-  User Role - Initial` to build the initial table of user roles, commands, and times.
-  You must also enable the second baseline search `Previously Seen Cloud API Calls
-  Per User Role - Update` to keep this table up to date and to age out old data. You
-  can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
-  macro. You can also provide additional filtering for this search by customizing
-  the `cloud_api_calls_from_previously_unseen_user_roles_filter`
-id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
-known_false_positives: .
 name: Cloud API Calls From Previously Unseen User Roles
-references: []
+id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
+version: 1
+date: '2020-09-04'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
+description: This search looks for new commands from each user role.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
  where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
  All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` |
@@ -22,8 +16,18 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
  OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user,
  object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `cloud_api_calls_from_previously_unseen_user_roles_filter`'
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider.  You should run the baseline search `Previously Seen Cloud API Calls Per
+  User Role - Initial` to build the initial table of user roles, commands, and times.
+  You must also enable the second baseline search `Previously Seen Cloud API Calls
+  Per User Role - Update` to keep this table up to date and to age out old data. You
+  can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
+  macro. You can also provide additional filtering for this search by customizing
+  the `cloud_api_calls_from_previously_unseen_user_roles_filter`
+known_false_positives: .
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Instance
  automated_detection_testing: passed
@@ -44,5 +48,3 @@ tags:
  risk_object_type: user
  risk_score: 25
  security_domain: endpoint
-type: ESCU
-version: 1
@@ -1,16 +1,13 @@
-author: Rico Valdez, Splunk
+name: Cloud Compute Instance Created By Previously Unseen User
+id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
+version: 1
 date: '2020-08-21'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Change
 description: This search looks for cloud compute instances created by users who have
  not created them before.
-how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
-  Run the "Previously Seen Cloud Compute Creations By User" support search to create
-  of baseline of previously seen users.
-id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
-known_false_positives: It's possible that a user will start to create compute instances
-  for the first time, for any number of reasons. Verify with the user launching instances
-  that this is the intended behavior.
-name: Cloud Compute Instance Created By Previously Unseen User
-references: []
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
  latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change
  where All_Changes.action=created by All_Changes.user All_Changes.vendor_region |
@@ -20,8 +17,15 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
  | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
  | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)`
  | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
+how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
+  Run the "Previously Seen Cloud Compute Creations By User" support search to create
+  of baseline of previously seen users.
+known_false_positives: It's possible that a user will start to create compute instances
+  for the first time, for any number of reasons. Verify with the user launching instances
+  that this is the intended behavior.
+references: []
 tags:
-  analytics_story:
+  analytic_story:
  - Cloud Cryptomining
  asset_type: Cloud Compute Instance
  automated_detection_testing: passed
@@ -42,5 +46,3 @@ tags:
  risk_object_type: user
  risk_score: 20
  security_domain: endpoint
-type: ESCU
-version: 1
--- a/Show More
+++ b/Show More