adding json file

detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

@@ -1,113 +1,111 @@
+---
 name: Detect DNS Data Exfiltration using pretrained model in DSDL
 id: 92f65c3a-968c-11ed-a1eb-0242ac120002
 version: 1
-date: "2023-04-27"
+date: 2023-04-27
 status: experimental
 author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
 type: Anomaly
 datamodel:
-- Network_Resolution
+  - Network_Resolution
 description: The following analytic uses a pre trained deep learning model to
-  detect DNS data exfiltration. The model is trained on the data we collected and is
-  inferred on live data. This detection detects low throughput DNS Tunneling (data exfiltration) using features computed from past events between
-  the same src and domain. The search uses macros from URL ToolBox app to generate features used by the model.
-  The model is a deep learning model that accepts DNS request as input along with a few custom features to generate a
-  pred_is_exfiltration_proba score. The higher the pred_is_exfiltration_proba, the more likely the DNS request is data exfiltration. 
-  The threshold for flagging a request as DNS exfiltration is set at 0.5. 
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.src _time DNS.query 
-| `drop_dm_object_name("DNS")` 
-| sort - _time,src, query 
-| streamstats count as count by src query 
-| where count < 10 
-| table src,query,count,_time 
-| apply dns_exfil11 
-| table src,_time, query,count,pred_is_dns_data_exfiltration_proba,pred_is_dns_data_exfiltration 
-| where count == 1
-| rename pred_is_dns_data_exfiltration_proba as is_exfiltration_score
-| rename pred_is_dns_data_exfiltration as is_exfiltration
-| where is_exfiltration_score > 0.5 
-| `security_content_ctime(_time)` 
-| rename src as "Source IP" _time as "time"
-| table "Source IP","time","query","is_exfiltration_score","is_exfiltration"
-| `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter`'
+  detect DNS data exfiltration. The model is trained on the data we collected
+  and is inferred on live data. This detection detects low throughput DNS
+  Tunneling (data exfiltration) using features computed from past events between
+  the same src and domain. The search uses macros from URL ToolBox app to
+  generate features used by the model. The model is a deep learning model that
+  accepts DNS request as input along with a few custom features to generate a
+  pred_is_exfiltration_proba score. The higher the pred_is_exfiltration_proba,
+  the more likely the DNS request is data exfiltration. The threshold for
+  flagging a request as DNS exfiltration is set at 0.5.
+search: '| tstats `security_content_summariesonly` count from
+  datamodel=Network_Resolution by DNS.src _time DNS.query |
+  `drop_dm_object_name("DNS")` | sort - _time,src, query | streamstats count as
+  count by src query | where count < 10 | table src,query,count,_time | apply
+  detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter | table
+  src,_time,
+  query,count,pred_is_dns_data_exfiltration_proba,pred_is_dns_data_exfiltration
+  | where count == 1 | rename pred_is_dns_data_exfiltration_proba as
+  is_exfiltration_score | rename pred_is_dns_data_exfiltration as
+  is_exfiltration | where is_exfiltration_score > 0.5 |
+  `security_content_ctime(_time)`| rename src as "Source IP" _time as "time" |
+  table "Source IP","time","query","is_exfiltration_score","is_exfiltration" |
+  `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter`'
+how_to_implement: >-
+  Steps to deploy detect DNS data exfiltration model into Splunk
+  App DSDL. This detection depends on the Splunk app for Data Science and Deep
+  Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and
+  the Network Resolution datamodel which can be found here -
+  https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep
+  learning model that needs to be deployed in DSDL app. Follow the steps for
+  deployment here -
+  `https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU`.\
 
-how_to_implement: 'Steps to deploy detect DNS data exfiltration model into Splunk App
-    DSDL. This detection depends on the Splunk app for Data Science and Deep
-    Learning which can be found here - https://splunkbase.splunk.com/app/4607/
-    and the Network Resolution datamodel which can be found here -
-    https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained
-    deep learning model that needs to be deployed in DSDL app. Follow the steps
-    for deployment here - `https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU`.\
+  * Download the `artifacts .tar.gz` file from the link - https://seal.splunkresearch.com/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz Download the `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.ipynb` Jupyter notebook from https://github.com/splunk/security_content/notebooks\
 
-  * Download the `artifacts .tar.gz` file from the link - https://seal.splunkresearch.com/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz
-    Download the `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.ipynb`
-    Jupyter notebook from https://github.com/splunk/security_content/notebooks\
-
-  * Login to the Jupyter Lab assigned for
-    detect_dns_data_exfiltration_using_pretrained_model_in_dsdl container.
-    This container should be listed on Containers page for DSDL app.\
+  * Login to the Jupyter Lab assigned for detect_dns_data_exfiltration_using_pretrained_model_in_dsdl container. This container should be listed on Containers page for DSDL app.\
 
   * Below steps need to be followed inside Jupyter lab \
 
-      * Upload the detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz file
-        into `app/model/data` path using the upload option in the jupyter notebook.\
+  * Upload the detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz file into `app/model/data` path using the upload option in the jupyter notebook.\
 
-      * Untar the artifact detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz using `tar -xf app/model/data/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz -C app/model/data`\
+  * Untar the artifact detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz using `tar -xf app/model/data/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz -C app/model/data`\
 
-      * Upload detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab \
+  * Upload detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab \
 
-      * Save the notebook using the save option in jupyter notebook. \
+  * Save the notebook using the save option in jupyter notebook. \
 
-      * Upload `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json` into `notebooks/data` folder.'
-known_false_positives: False positives may be present if DNS data exfiltration request look very similar to benign DNS requests.
+  * Upload `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json` into `notebooks/data` folder.
+known_false_positives: False positives may be present if DNS data exfiltration
+  request look very similar to benign DNS requests.
 references:
-- https://attack.mitre.org/techniques/T1048/003/
-- https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
-- https://en.wikipedia.org/wiki/Data_exfiltration
+  - https://attack.mitre.org/techniques/T1048/003/
+  - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
+  - https://en.wikipedia.org/wiki/Data_exfiltration
 tags:
   analytic_story:
-  - DNS Hijacking
-  - Suspicious DNS Traffic
-  - Command and Control
+    - DNS Hijacking
+    - Suspicious DNS Traffic
+    - Command and Control
   asset_type: Endpoint
   cis20:
-  - CIS 8
-  - CIS 12
-  - CIS 13
+    - CIS 8
+    - CIS 12
+    - CIS 13
   confidence: 90
   context:
     - Source:Endpoint
     - Stage:Command And Control
   impact: 50
   kill_chain_phases:
-  - Command & Control
+    - Command & Control
   message: A DNS data exfiltration request was sent by this host $src$ , kindly review.
   mitre_attack_id:
-  - T1048.003
+    - T1048.003
   nist:
-  - PR.DS
-  - PR.PT
-  - DE.AE
-  - DE.CM
+    - PR.DS
+    - PR.PT
+    - DE.AE
+    - DE.CM
   observable:
-  - name: query
-    type: Other
-    role:
-      - Attacker
-  - name: src
-    type: Hostname
-    role:
-      - Victim
+    - name: query
+      type: Other
+      role:
+        - Attacker
+    - name: src
+      type: Hostname
+      role:
+        - Victim
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
   required_fields:
-  - _time
-  - DNS.message_type
-  - DNS.record_type
-  - DNS.src
-  - DNS.dest
-  - DNS.answer
+    - _time
+    - DNS.message_type
+    - DNS.record_type
+    - DNS.src
+    - DNS.dest
+    - DNS.answer
   risk_score: 45
-  security_domain: network
+  security_domain: network

notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json

@@ -0,0 +1 @@
+{"options": {"params": {"mode": "stage", "algo": "detect_dns_data_exfiltration_using_pretrained_model_in_dsdl"}, "args": ["is_exfiltration", "src", "query", "rank"], "target_variable": ["is_exfiltration"], "feature_variables": ["src", "query", "rank"], "model_name": "detect_dns_data_exfiltration_using_pretrained_model_in_dsdl", "algo_name": "MLTKContainer", "mlspl_limits": {"handle_new_cat": "default", "max_distinct_cat_values": "100", "max_distinct_cat_values_for_classifiers": "100", "max_distinct_cat_values_for_scoring": "100", "max_fit_time": "600", "max_inputs": "100000", "max_memory_usage_mb": "4000", "max_model_size_mb": "30", "max_score_time": "600", "use_sampling": "true"}, "kfold_cv": null}, "feature_variables": ["src", "query", "rank"], "target_variables": ["is_exfiltration"]}