From cf688974eeafeb9263f6218bb0ea365ef1e7e090 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 28 Mar 2022 09:55:06 -0500 Subject: [PATCH] Updated story --- stories/splunk_vulnerabilities.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 stories/splunk_vulnerabilities.yml diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml new file mode 100644 index 0000000000..9e3d64107f --- /dev/null +++ b/stories/splunk_vulnerabilities.yml @@ -0,0 +1,19 @@ +name: Splunk Vulnerabilities +id: 5354df00-dce2-48ac-9a64-8adb48006828 +version: 1 +date: '2022-03-28' +author: Lou Stella, Splunk +description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. +narrative: This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html +- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3422 +tags: + analytic_story: Splunk Vulnerabilities + category: + - Best Practices + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Application Security