Branch was auto-updated.

bin/content_changer.py

@@ -0,0 +1,75 @@
+import glob
+import yaml
+import sys
+import re
+import argparse
+
+from os import path
+
+
+def load_objects(file_path, REPO_PATH):
+    files = []
+    manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
+    for file in sorted(glob.glob(manifest_files)):
+        files.append(load_file(file))
+    return files
+
+
+def load_file(file_path):
+    with open(file_path, 'r', encoding="utf-8") as stream:
+        try:
+            file = list(yaml.safe_load_all(stream))[0]
+        except yaml.YAMLError as exc:
+            print(exc)
+            sys.exit("ERROR: reading {0}".format(file_path))
+    return file
+
+
+def load_content(old_project):
+    stories = load_objects("stories/*.yml", old_project)
+    macros = load_objects("macros/*.yml", old_project)
+    lookups = load_objects("lookups/*.yml", old_project)
+    baselines = load_objects("baselines/*.yml", old_project)
+    responses = load_objects("responses/*.yml", old_project)
+    response_tasks = load_objects("response_tasks/*.yml", old_project)
+    deployments = load_objects("deployments/*.yml", old_project)
+
+    # process all detections
+    detections = []
+    detections = load_objects("detections/*/*.yml", old_project)
+    detections.extend(load_objects("detections/*/*/*.yml", old_project))
+
+    #print(len(detections))
+
+    return detections, stories, macros, lookups, baselines, responses, response_tasks, deployments
+
+
+def add_required_field(detections, new_project):
+    #for detection in detections:
+    matches = re.findall(r'(?<key>[^\s]*)=', detections[0])
+    for match in matches:
+        print(match)
+
+
+def main(new_project, old_project, change):
+
+    detections, stories, macros, lookups, baselines, responses, response_tasks, deployments = load_content(old_project)
+
+    if change == "add_required_field":
+        add_required_field(detections, new_project)
+
+
+if __name__ == "__main__":
+
+    parser = argparse.ArgumentParser(description="applies security content changes to the whole project")
+    parser.add_argument("-np", "--new_project", required=True, help="the security content project to write the new configs in to")
+    parser.add_argument("-op", "--old_project", required=True, help="the security content project to read the files from")
+    parser.add_argument("-c", "--change", required=True, help="the name of your change")
+
+   # parse them
+    args = parser.parse_args()
+    new_project = args.new_project
+    old_project = args.old_project
+    change = args.change
+
+    main(new_project, old_project, change)

bin/jinja2_templates/detection.j2

@@ -31,3 +31,5 @@ tags:
   {% for product in products -%}
   - {{product}}
   {% endfor -%}
+  required_fields:
+  - _time

bin/validate.py

@@ -79,6 +79,7 @@ def validate_objects(REPO_PATH, objects, verbose):
     for object in objects['detections']:
         if object['type'] == 'batch':
             errors = errors + validate_detection_search(object, objects['macros'])
+            errors = errors + validate_fields(object)
 
     for object in objects['baselines']:
         errors = errors + validate_baseline_search(object, objects['macros'])
@@ -88,6 +89,21 @@ def validate_objects(REPO_PATH, objects, verbose):
     return errors
 
 
+def validate_fields(object):
+    errors = []
+
+    if 'tags' in object:
+
+        # check if required_fields is present
+        if 'required_fields' not in object['tags']:
+            errors.append("ERROR: a `required_fields` tag is required for object: %s" % object['name'])
+
+        if 'security_domain' not in object['tags']:
+            errors.append("ERROR: a `security_domain` tag is required for object: %s" % object['name'])
+
+    return errors
+
+
 def validate_standard_fields(object, uuids):
 
     errors = []

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -46,6 +46,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.command
+  - All_Changes.user
+  - All_Changes.status
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -47,6 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.command
+  - All_Changes.object_category
+  - All_Changes.status
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -50,6 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.vendor_account
+  - Authentication.user
+  - Authentication.user_role
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 15

detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

@@ -38,4 +38,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - eventSource
+  - eventID
+  - awsRegion
+  - requestParameters.policy
+  - userIdentity.principalId
   security_domain: threat

detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml

@@ -33,4 +33,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.x-amz-server-side-encryption
+  - requestParameters.bucketName
+  - requestParameters.x-amz-copy-source
+  - requestParameters.key
+  - userAgent
+  - region
   security_domain: threat

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -44,6 +44,18 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.ruleAction
+  - requestParameters.egress
+  - requestParameters.aclProtocol
+  - requestParameters.portRange.to
+  - requestParameters.portRange.from
+  - requestParameters.cidrBlock
+  - userName
+  - userIdentity.principalId
+  - userAgent
   risk_object: userName
   risk_object_type: user
   risk_score: 10

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -40,6 +40,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.egress
+  - userName
+  - userIdentity.principalId
+  - src
+  - userAgent
   risk_object: userName
   risk_object_type: user
   risk_score: 5

detections/cloud/aws_saml_access_by_provider_user_and_principal.yml

@@ -40,4 +40,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.principalArn
+  - requestParameters.roleArn
+  - requestParameters.roleSessionName
+  - recipientAccountId
+  - responseElements.issuer
+  - sourceIPAddress
+  - userAgent
   security_domain: threat

detections/cloud/aws_saml_update_identity_provider.yml

@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - eventType
+  - requestParameters.sAMLProviderArn
+  - userIdentity.sessionContext.sessionIssuer.arn
+  - sourceIPAddress
+  - userIdentity.accessKeyId
+  - userIdentity.principalId
   security_domain: threat

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -44,6 +44,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - All_Changes.user_type
+  - All_Changes.status
+  - All_Changes.command
+  - All_Changes.object
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -42,6 +42,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object
+  - All_Changes.action
+  - All_Changes.user
+  - All_Changes.vendor_region
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -48,6 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.vendor_region
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -43,6 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.image_id
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -43,6 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.instance_type
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -43,6 +43,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.command
+  - All_Changes.action
+  - All_Changes.change_type
+  - All_Changes.status
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -57,6 +57,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -48,6 +48,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
   risk_object: user
   risk_object_type: user
   risk_score: 30

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/cloud/detect_new_open_s3_buckets.yml

@@ -43,6 +43,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventSource
+  - eventName
+  - requestParameters.bucketName
+  - userName
+  - userIdentity.principalId
+  - userAgent
+  - uri
+  - permission
   risk_object: src
   risk_object_type: system
   risk_score: 20

detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml

@@ -44,6 +44,19 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventSource
+  - eventName
+  - requestParameters.accessControlList.x-amz-grant-read-acp
+  - requestParameters.accessControlList.x-amz-grant-write
+  - requestParameters.accessControlList.x-amz-grant-write-acp
+  - requestParameters.accessControlList.x-amz-grant-full-control
+  - requestParameters.bucketName
+  - userName
+  - userIdentity.principalId
+  - userAgent
+  - bucketName
   risk_object: src
   risk_object_type: system
   risk_score: 20

detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Resources{}.Type
+  - Title
+  - Types{}
+  - vendor_account
+  - vendor_region
+  - severity
+  - dest
   security_domain: network

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - Operation
+  - Actor{}.ID
+  - Actor{}.Type
+  - ActorIpAddress
+  - dest
+  - ResultStatus
   security_domain: threat

detections/cloud/o365_added_service_principal.yml

@@ -39,4 +39,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - signature
+  - Actor{}.ID
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - Target{}.ID
+  - ActorIpAddress
   security_domain: threat

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -39,4 +39,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - signature
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - ModifiedProperties{}.OldValue
+  - user
+  - vendor_product
+  - vendor_account
+  - status
+  - user_id
+  - action
   security_domain: threat

detections/cloud/o365_disable_mfa.yml

@@ -32,4 +32,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - UserType
+  - user
+  - status
+  - signature
+  - dest
+  - ResultStatus
   security_domain: threat

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -33,4 +33,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - UserAuthenticationMethod
+  - status
+  - UserAgent
+  - src_ip
+  - user
   security_domain: threat

detections/cloud/o365_excessive_sso_logon_errors.yml

@@ -34,4 +34,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - LogonError
+  - ActorIpAddress
+  - UserAgent
+  - UserId
   security_domain: threat

detections/cloud/o365_new_federated_domain_added.yml

@@ -38,4 +38,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - Operation
+  - Parameters{}.Value
+  - ObjectId
+  - OrganizationName
+  - OriginatingServer
+  - UserId
+  - UserKey
   security_domain: threat

detections/cloud/o365_pst_export_alert.yml

@@ -33,4 +33,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Category
+  - Name
+  - Source
+  - Severity
+  - AlertEntityId
+  - Operation
   security_domain: threat

detections/cloud/o365_suspicious_admin_email_forwarding.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat

detections/cloud/o365_suspicious_rights_delegation.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat

detections/cloud/o365_suspicious_user_email_forwarding.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat

detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml

@@ -42,6 +42,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - userName
   risk_object: userName
   risk_object_type: user
   risk_score: 40

detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml

@@ -38,6 +38,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - src_user
   risk_object: src_usr
   risk_object_type: user
   risk_score: 10

detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml

@@ -42,4 +42,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - userName
   security_domain: network

detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml

@@ -37,4 +37,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - src_user
   security_domain: network

detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml

@@ -50,6 +50,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - sourceIPAddress
   risk_object: user
   risk_object_type: user
   risk_score: 25

detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml

@@ -51,4 +51,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - sourceIPAddress
   security_domain: endpoint

detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -48,4 +48,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - sourceIPAddress
   security_domain: endpoint

detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml

@@ -50,4 +50,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - sourceIPAddress
   security_domain: endpoint

detections/deprecated/clients_connecting_to_multiple_dns_servers.yml

@@ -51,4 +51,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.dest
+  - DNS.message_type
+  - DNS.src
   security_domain: network

detections/deprecated/cloud_network_access_control_list_deleted.yml

@@ -36,4 +36,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userIdentity.arn
+  - errorMessage
+  - errorCode
+  - userAgent
+  - src
+  - userName
+  - arn
   security_domain: network

detections/deprecated/detect_api_activity_from_users_without_mfa.yml

@@ -58,6 +58,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userIdentity.sessionContext.attributes.mfaAuthenticated
+  - eventName
+  - userIdentity.arn
+  - userIdentity.type
+  - user
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml

@@ -65,6 +65,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - errorCode
+  - userName
+  - eventName
+  - user
   risk_object: user
   risk_object_type: user
   risk_score: 15

detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml

@@ -58,4 +58,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.answer
+  - DNS.dest
+  - DNS.src
+  - DNS.query
+  - host
   security_domain: network

detections/deprecated/detect_long_dns_txt_record_response.yml

@@ -51,4 +51,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.message_type
+  - DNS.record_type
+  - DNS.src
+  - DNS.dest
+  - DNS.answer
   security_domain: network

detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml

@@ -45,4 +45,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - signature_id
+  - Process_Name
+  - Message
+  - dest
+  - Process_ID
   security_domain: access

detections/deprecated/detect_new_api_calls_from_user_roles.yml

@@ -40,6 +40,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType
+  - errorCode
+  - userIdentity.type
+  - userName
+  - eventName
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/deprecated/detect_new_user_aws_console_login.yml

@@ -43,4 +43,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userIdentity.arn
   security_domain: network

detections/deprecated/detect_spike_in_aws_api_activity.yml

@@ -69,6 +69,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType
+  - userIdentity.arn
   risk_object: user
   risk_object_type: user
   risk_score: 10

detections/deprecated/detect_spike_in_network_acl_activity.yml

@@ -54,6 +54,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userIdentity.arn
   risk_object: user
   risk_object_type: user
   risk_score: 20

detections/deprecated/detect_spike_in_security_group_activity.yml

@@ -54,6 +54,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - serIdentity.arn
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/deprecated/detect_usb_device_insertion.yml

@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.result
+  - All_Changes.result_id
+  - All_Changes.src_priority
+  - All_Changes.dest
   security_domain: endpoint

detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml

@@ -51,4 +51,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.url
+  - Web.status
+  - Web.src
+  - Web.dest
   security_domain: network

detections/deprecated/detection_of_dns_tunnels.yml

@@ -59,4 +59,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.query
+  - DNS.message_type
+  - DNS.src_category
+  - DNS.src
   security_domain: network

detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml

@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.dest_category
+  - DNS.src_category
+  - DNS.src
+  - DNS.dest
   security_domain: network

detections/deprecated/dns_record_changed.yml

@@ -57,4 +57,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.record_type
+  - DNS.answer
+  - DNS.src
+  - DNS.message_type
+  - DNS.query
   security_domain: network

detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml

@@ -39,6 +39,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - errorCode
+  - userIdentity.arn
   risk_object: user
   risk_object_type: user
   risk_score: 5

detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml

@@ -41,6 +41,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - awsRegion
   risk_object: src
   risk_object_type: system
   risk_score: 10

detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml

@@ -39,4 +39,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - requestParameters.instancesSet.items{}.imageId
   security_domain: endpoint

detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml

@@ -39,4 +39,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - requestParameters.instanceType
   security_domain: endpoint

detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml

@@ -40,4 +40,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - errorCode
+  - userIdentity.arn
   security_domain: endpoint

detections/deprecated/execution_of_file_with_spaces_before_extension.yml

@@ -39,4 +39,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_path
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
   security_domain: endpoint

detections/deprecated/extended_period_without_successful_netbackup_backups.yml

@@ -31,4 +31,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - MESSAGE
+  - COMPUTERNAME
   security_domain: endpoint

detections/deprecated/first_time_seen_command_line_argument.yml

@@ -59,4 +59,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint

detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml

@@ -36,4 +36,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - data.protoPayload.request.policy.bindings{}.role
+  - data.resource.type data.protoPayload.authenticationInfo.principalEmail
+  - data.protoPayload.authorizationInfo{}.permission
+  - data.protoPayload.authorizationInfo{}.resource
+  - data.protoPayload.response.bindings{}.role
+  - data.protoPayload.response.bindings{}.members{}
   security_domain: threat

detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml

@@ -35,4 +35,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - data.protoPayload.authorizationInfo{}.permission
+  - data.protoPayload.requestMetadata.callerIp
+  - data.protoPayload.authenticationInfo.principalEmail
+  - data.protoPayload.authorizationInfo{}.permission
+  - data.protoPayload.response.bindings{}.members{}
+  - data.resource.labels.project_id
   security_domain: threat

detections/deprecated/gcp_detect_oauth_token_abuse.yml

@@ -31,4 +31,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/gcp_gcr_container_uploaded.yml

@@ -31,4 +31,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml

@@ -35,4 +35,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/identify_new_user_accounts.yml

@@ -33,4 +33,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: access

detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml

@@ -25,4 +25,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml

@@ -26,4 +26,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml

@@ -26,4 +26,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml

@@ -26,4 +26,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml

@@ -26,4 +26,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

@@ -26,4 +26,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml

@@ -29,4 +29,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml

@@ -26,4 +26,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_azure_scan_fingerprint.yml

@@ -28,4 +28,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml

@@ -27,4 +27,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml

@@ -29,4 +29,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml

@@ -28,4 +28,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat

detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml

@@ -48,4 +48,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: endpoint

detections/deprecated/monitor_dns_for_brand_abuse.yml

@@ -31,4 +31,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: network