Find and replace

orginal_detection_search
with
original_detection_search

detections/application/crushftp_server_side_template_injection.yml

@@ -36,7 +36,7 @@ references:
 - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
 drilldown_searches:
 - name: View the detection results for $dest$
-  search: '%orginal_detection_search% | search  dest = $dest$'
+  search: '%original_detection_search% | search  dest = $dest$'
 tags:
   analytic_story:
   - CrushFTP Vulnerabilities

detections/application/detect_new_login_attempts_to_routers.yml

@@ -26,7 +26,7 @@ known_false_positives: Legitimate router connections may appear as new connectio
 references: []
 drilldown_searches:
 - name: View the detection results for $user$ and $dest$
-  search: '%orginal_detection_search% | search  user = $user$ dest = $dest$'
+  search: '%original_detection_search% | search  user = $user$ dest = $dest$'
 tags:
   analytic_story:
   - Router and Infrastructure Security

detections/application/detect_password_spray_attempts.yml

@@ -37,7 +37,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/003/
 drilldown_searches:
 - name: View the detection results for $unique_accounts$
-  search: '%orginal_detection_search% | search unique_accounts = $unique_accounts$'
+  search: '%original_detection_search% | search unique_accounts = $unique_accounts$'
 tags:
   analytic_story:
   - Compromised User Account

detections/application/email_attachments_with_lots_of_spaces.yml

@@ -40,7 +40,7 @@ known_false_positives: None at this time
 references: []
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Data Destruction

detections/application/email_files_written_outside_of_the_outlook_directory.yml

@@ -34,7 +34,7 @@ known_false_positives: Administrators and users sometimes prefer backing up thei
 references: []
 drilldown_searches:
 - name: View the detection results for $dest$
-  search: '%orginal_detection_search% | search  dest = $dest$'
+  search: '%original_detection_search% | search  dest = $dest$'
 tags:
   analytic_story:
   - Collection and Staging

detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml

@@ -40,7 +40,7 @@ known_false_positives: The false-positive rate will vary based on how you set th
 references: []
 drilldown_searches:
 - name: View the detection results for $dest$
-  search: '%orginal_detection_search% | search  dest = $dest$'
+  search: '%original_detection_search% | search  dest = $dest$'
 tags:
   analytic_story:
   - Collection and Staging

detections/application/ivanti_vtm_new_account_creation.yml

@@ -30,7 +30,7 @@ references:
 - https://nvd.nist.gov/vuln/detail/CVE-2024-7593
 drilldown_searches:
 - name: View the detection results for $MODUSER$
-  search: '%orginal_detection_search% | search  MODUSER = $MODUSER$'
+  search: '%original_detection_search% | search  MODUSER = $MODUSER$'
 tags:
   analytic_story:
   - Ivanti Virtual Traffic Manager CVE-2024-7593

detections/application/monitor_email_for_brand_abuse.yml

@@ -28,7 +28,7 @@ known_false_positives: None at this time
 references: []
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Brand Monitoring

detections/application/okta_authentication_failed_during_mfa_challenge.yml

@@ -33,7 +33,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_idp_lifecycle_modifications.yml

@@ -32,7 +32,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Suspicious Okta Activity

detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml

@@ -44,7 +44,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $actor.alternateId$
-  search: '%orginal_detection_search% | search  actor.alternateId = $actor.alternateId$'
+  search: '%original_detection_search% | search  actor.alternateId = $actor.alternateId$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_multi_factor_authentication_disabled.yml

@@ -30,7 +30,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_multiple_accounts_locked_out.yml

@@ -29,7 +29,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_multiple_failed_mfa_requests_for_user.yml

@@ -28,7 +28,7 @@ references:
 - https://attack.mitre.org/techniques/T1621/
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml

@@ -31,7 +31,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_new_api_token_created.yml

@@ -30,7 +30,7 @@ references:
 - https://splunkbase.splunk.com/app/6553
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_new_device_enrolled_on_account.yml

@@ -29,7 +29,7 @@ references:
 - https://developer.okta.com/docs/reference/api/event-types/?q=device.enrollment.create
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_phishing_detection_with_fastpass_origin_check.yml

@@ -28,7 +28,7 @@ references:
 - https://sec.okta.com/fastpassphishingdetection
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_risk_threshold_exceeded.yml

@@ -39,7 +39,7 @@ references:
 - https://sec.okta.com/everythingisyes
 drilldown_searches:
 - name: View the detection results for $risk_object$
-  search: '%orginal_detection_search% | search  risk_object = $risk_object$'
+  search: '%original_detection_search% | search  risk_object = $risk_object$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_successful_single_factor_authentication.yml

@@ -30,7 +30,7 @@ references:
 - https://attack.mitre.org/techniques/T1078/004/
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_suspicious_activity_reported.yml

@@ -30,7 +30,7 @@ references:
 - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_suspicious_use_of_a_session_cookie.yml

@@ -32,7 +32,7 @@ references:
 - https://attack.mitre.org/techniques/T1539/
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Suspicious Okta Activity

detections/application/okta_threatinsight_threat_detected.yml

@@ -29,7 +29,7 @@ references:
 - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
 drilldown_searches:
 - name: View the detection results for $app$
-  search: '%orginal_detection_search% | search  app = $app$'
+  search: '%original_detection_search% | search  app = $app$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_unauthorized_access_to_application.yml

@@ -30,7 +30,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/003/
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/okta_user_logins_from_multiple_cities.yml

@@ -34,7 +34,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/003/
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Okta Account Takeover

detections/application/pingid_mismatch_auth_source_and_verification_response.yml

@@ -43,7 +43,7 @@ references:
 - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
 drilldown_searches:
 - name: View the detection results for $user$ and $src$
-  search: '%orginal_detection_search% | search  user = $user$ src = $src$'
+  search: '%original_detection_search% | search  user = $user$ src = $src$'
 tags:
   analytic_story:
   - Compromised User Account

detections/application/pingid_multiple_failed_mfa_requests_for_user.yml

@@ -33,7 +33,7 @@ references:
 - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Compromised User Account

detections/application/pingid_new_mfa_method_after_credential_reset.yml

@@ -41,7 +41,7 @@ references:
 - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Compromised User Account

detections/application/pingid_new_mfa_method_registered_for_user.yml

@@ -33,7 +33,7 @@ references:
 - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
 drilldown_searches:
 - name: View the detection results for $user$ and $src$
-  search: '%orginal_detection_search% | search  user = $user$ src = $src$'
+  search: '%original_detection_search% | search  user = $user$ src = $src$'
 tags:
   analytic_story:
   - Compromised User Account

detections/application/suspicious_email_attachment_extensions.yml

@@ -37,7 +37,7 @@ known_false_positives: None identified
 references: []
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Data Destruction

detections/application/suspicious_java_classes.yml

@@ -27,7 +27,7 @@ known_false_positives: There are no known false positives.
 references: []
 drilldown_searches:
 - name: View the detection results for $user$ and $dest$
-  search: '%orginal_detection_search% | search  user = $user$ dest = $dest$'
+  search: '%original_detection_search% | search  user = $user$ dest = $dest$'
 tags:
   analytic_story:
   - Apache Struts Vulnerability

detections/application/web_servers_executing_suspicious_processes.yml

@@ -35,7 +35,7 @@ known_false_positives: Some of these processes may be used legitimately on web s
 references: []
 drilldown_searches:
 - name: View the detection results for $user$ and $dest$
-  search: '%orginal_detection_search% | search  user = $user$ dest = $dest$'
+  search: '%original_detection_search% | search  user = $user$ dest = $dest$'
 tags:
   analytic_story:
   - Apache Struts Vulnerability

detections/application/windows_ad_add_self_to_group.yml

@@ -22,7 +22,7 @@ known_false_positives: Unknown
 references: []
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Active Directory Privilege Escalation

detections/application/windows_ad_dangerous_deny_acl_modification.yml

@@ -47,7 +47,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_dangerous_group_acl_modification.yml

@@ -56,7 +56,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_dangerous_user_acl_modification.yml

@@ -54,7 +54,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_dcshadow_privileges_acl_addition.yml

@@ -50,7 +50,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_domain_root_acl_deletion.yml

@@ -47,7 +47,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_domain_root_acl_modification.yml

@@ -46,7 +46,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_gpo_deleted.yml

@@ -30,7 +30,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_gpo_disabled.yml

@@ -28,7 +28,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_gpo_new_cse_addition.yml

@@ -39,7 +39,7 @@ references:
 - https://github.com/FSecureLABS/SharpGPOAbuse
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_hidden_ou_creation.yml

@@ -47,7 +47,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_object_owner_updated.yml

@@ -39,7 +39,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_privileged_group_modification.yml

@@ -22,7 +22,7 @@ references:
 - https://splunkbase.splunk.com/app/6853
 drilldown_searches:
 - name: View the detection results for $user$
-  search: '%orginal_detection_search% | search  user = $user$'
+  search: '%original_detection_search% | search  user = $user$'
 tags:
   analytic_story:
   - Active Directory Privilege Escalation

detections/application/windows_ad_self_dacl_assignment.yml

@@ -44,7 +44,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_suspicious_attribute_modification.yml

@@ -34,7 +34,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $src_user$ and $dest$
-  search: '%orginal_detection_search% | search  src_user = $src_user$ dest = $dest$'
+  search: '%original_detection_search% | search  src_user = $src_user$ dest = $dest$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_ad_suspicious_gpo_modification.yml

@@ -56,7 +56,7 @@ references:
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 drilldown_searches:
 - name: View the detection results for $user$ and $src_user$
-  search: '%orginal_detection_search% | search  user = $user$ src_user = $src_user$'
+  search: '%original_detection_search% | search  user = $user$ src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_increase_in_group_or_object_modification_activity.yml

@@ -24,7 +24,7 @@ known_false_positives: Unknown
 references: []
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks

detections/application/windows_increase_in_user_modification_activity.yml

@@ -28,7 +28,7 @@ known_false_positives: Genuine activity
 references: []
 drilldown_searches:
 - name: View the detection results for $src_user$
-  search: '%orginal_detection_search% | search  src_user = $src_user$'
+  search: '%original_detection_search% | search  src_user = $src_user$'
 tags:
   analytic_story:
   - Sneaky Active Directory Persistence Tricks