admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removed src field from table, as it is not available and results in a blank column. Also incremented the version as a significant change was made to the search

Browse Source
This commit is contained in:
Rico Valdez
2019-08-13 15:46:49 -06:00
parent 5168a396ef
commit dacd5b1d55
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/dns_query_length_with_high_standard_deviation.json
+2 -2
View File
@@ -75,12 +75,12 @@
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | table src query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev",
"search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev",
"search_description": "This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.",
"search_id": "1a67f15a-f4ff-4170-84e9-08cf6f75d6f5",
"search_name": "DNS Query Length With High Standard Deviation",
"search_type": "detection",
"security_domain": "network",
"spec_version": 1,
"version": "1.0"
"version": "2.0"
}