admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updates to ymls to make sure validate passes

Browse Source
This commit is contained in:
bpatel
2020-09-04 13:31:16 -07:00
parent 7b098cf836
commit cea3735f1a
9 changed files with 15 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/previously_seen_aws_cross_account_activity_initial.yml
+4 -19
View File
@@ -2,27 +2,12 @@ name: Previously Seen AWS Cross Account Activity - Initial
id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf
version: 1
date: '2020-08-15'
description: This search looks for **AssumeRole** events where the requesting account
differs from the requested account, then writes these relationships to a lookup
file.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
and Enterprise Security 6.2, which contains the required updates to the Authentication data model
for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
a lookup file created by this support search.
description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
author: Rico Valdez, Splunk
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):'
| where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId
dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime
| outputlookup previously_seen_aws_cross_account_activity"
search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity"
tags:
analytics_story:
- Suspicious Cloud Authentication Activities
detections:
- AWS Cross Account Activity From Previously Unseen Account - DM
- AWS Cross Account Activity From Previously Unseen Account - DM
baselines/previously_seen_aws_cross_account_activity_update.yml
+3 -9
View File
@@ -6,17 +6,11 @@ description: This search looks for **AssumeRole** events where the requesting ac
differs from the requested account, then writes these relationships to a lookup
file.
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)
and Enterprise Security 6.2, which contains the required updates to the Authentication data model
for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`,
a lookup file created by this support search.
author: Rico Valdez, Splunk
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src
Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):'
| where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId
dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity
| stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId
| outputlookup previously_seen_aws_cross_account_activity'
search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | rex field=Authentication.user_role 'arn:aws:sts:*:(?<dest_account>.*):' | where Authentication.vendor_account!=dest_account | rename Authentication.vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId| outputlookup previously_seen_aws_cross_account_activity"
tags:
analytics_story:
- Suspicious Cloud Authentication Activities
baselines/previously_seen_cloud_compute_images_update.yml
+1 -1
View File
@@ -10,7 +10,7 @@ author: David Dorsey, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change
where All_Changes.action=created `previously_seen_cloud_compute_image_input_filter` by All_Changes.Instance_Changes.image_id
| `drop_dm_object_name("Change")` | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTime) as firstTime
max(lastTime) as lastTime by image_id | outputlookup previously_seen_cloud_compute_images
max(lastTime) as lastTime by image_id | outputlookup previously_seen_cloud_compute_images'
tags:
analytics_story:
- Cloud Cryptomining
baselines/previously_seen_cloud_instance_modifications_by_user_update.yml
+3 -4
View File
@@ -2,9 +2,8 @@ name: Previously Seen Cloud Instance Modifications By User - Update
id: 534b7d30-7b0c-4510-8f55-65439850d58d
version: 1
date: '2020-07-29'
###description: This search builds a table of previously seen ARNs that have launched
a EC2 instance.
###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
description: This search updates a table of previously seen Cloud Instance modifications that have been made by a user
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
author: Rico Valdez, Splunk
@@ -18,6 +17,6 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
  | outputlookup previously_seen_cloud_instance_modificationss_by_user | stats count'
tags:
analytics_story:
- Suspicious Cloud Change Activity - Mustang
- Suspicious Cloud Change Activity
detections:
- Cloud Instance Modified With Previously Unseen User
baselines/previously_seen_ec2_launches_by_user_initial___dm.yml
-20
View File
@@ -1,20 +0,0 @@
name: Previously Seen EC2 Launches By User - DM
id: 85b5f461-30e1-417b-b6d7-0c2ea5a1fb0c
version: 1
date: '2020-07-29'
description: This search builds a table of previously seen ARNs that have launched
a EC2 instance.
###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs.
author: Rico Valdez, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
  where All_Changes.action=created All_Changes.object_category=instance All_Changes.status=success
`previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user
  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user_dm
  | stats count'
tags:
analytics_story:
- Suspicious Cloud Change Activities
detections:
- EC2 Instance Started With Previously Unseen User - DM
baselines/previously_seen_ec2_launches_by_user_update___dm.yml
-51
View File
@@ -1,51 +0,0 @@
name: Previously Seen EC2 Launches By User - Update - DM
id: 7a6bf377-6c97-41f0-8ba1-fde334aee69c
version: 1
date: '2020-07-29'
description: This search builds a table of previously seen ARNs that have launched
a EC2 instance.
###how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
inputs.
author: Rico Valdez, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
  where All_Changes.action=created All_Changes.object_category=instance All_Changes.status=success
`previously_seen_cloud_compute_creations_by_user_input_filter` by All_Changes.user
  | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user_dm
  | stats count'
search: '| tstats `security_content_summariesonly` earliest(_time) as firstTime, latest(_time) as lastTime
values(All_Changes.object) as Objects from datamodel=Change.All_Changes where All_Changes.action=modified
by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t
previously_seen_cloud_compute_creations_by_user | stats min(firstTime) as firstTime max(lastTime)
as lastTime, values(Objects) as Objects by user | multireport [| table user, firstTime, lastTime
| outputlookup previously_seen_cloud_compute_creations_by_user | where fact=fiction]
[| eval new_user=if(firstTime >= relative_time(now(),
`previously_seen_cloud_compute_creations_by_user_search_window_begin_offset`), 1, 0) | where new_user=1
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`]
| table src_user, dest, firstTime, lastTime | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
###search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances
errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime
by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup
previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(),
"-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType
as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
tags:
analytics_story:
- Suspicious Cloud Change Activities
detections:
- EC2 Instance Started With Previously Unseen User - DM
detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml
+2 -2
View File
@@ -18,9 +18,9 @@ search: "| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=
requestingAccountId, requestedAccountId, OUTPUTNEW firstTime as earliest
| eval firstTime=(if (firstTime>earliest, earliest,firstTime))
| where firstTime >= relative_time(now(), '-70m@m')] | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_previously_unseen_account_filter`
| `security_content_ctime(lastTime)`
| rename Authentication.user as src_user Authentication.src as src_ip | table requestingAccountId,
requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime"
requestedAccountId, src_user, src_ip, Authentication.user_role, firstTime, lastTime | `aws_cross_account_activity_from_previously_unseen_account___dm_filter`"
known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
It's suspicious when an account requests privileges of an account it hasn't before.
You should validate with the account owner that this is a legitimate request.
detections/cloud_compute_instance_created_with_previously_unseen_image.yml
+1 -3
View File
@@ -15,9 +15,7 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values
as dest from datamodel=Change where All_Changes.action=created `cloud_compute_instance_created_with_previously_unseen_image_filter`
by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name("Change")` | inputlookup
append=t previously_seen_cloud_compute_images | stats min(firstTime) as firstTime
max(lastTime) as lastTime, values(dest) as dest by image_id, user
max(lastTime) as lastTime, values(dest) as dest by image_id, user'
known_false_positives: After a new image is created, the first systems created with
that image will cause this alert to fire. Verify that the image being used was
created by a legitimate user.
detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+1 -3
View File
@@ -10,14 +10,12 @@ how_to_implement: You must be ingesting the appropriate cloud-infrastructure log
type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest from datamodel=Change where All_Changes.action=created
`cloud_compute_instance_created_with_previously_unseen_instance_type_filter` by
All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("Change")` | inputlookup
append=t previously_seen_cloud_compute_instance_types | stats min(firstTime) as
firstTime max(lastTime) as lastTime, values(dest) as dest by instance_type, user
firstTime max(lastTime) as lastTime, values(dest) as dest by instance_type, user'
known_false_positives: It is possible that an admin will create a new system using
a new instance type that has never been used before. Verify with the creator that
they intended to create the system with the new instance type.