adding splunk docs wiki

bin/doc_gen.py

@@ -153,6 +153,15 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
         f.write(output)
     messages.append("doc_gen.py wrote {0} stories documentation in markdown to: {1}".format(len(stories),output_path))
 
+    # write wikimarkup
+    template = j2_env.get_template('doc_stories_wiki.j2')
+    output_path = path.join(OUTPUT_DIR + '/stories.wiki')
+    output = template.render(categories=categories)
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote {0} stories documentation in mediawiki to: {1}".format(len(stories),output_path))
+    return sorted_stories, messages
+
 
 def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE):
     types = ["endpoint", "application", "cloud", "network", "web", "experimental", "deprecated"]
@@ -260,19 +269,10 @@ if __name__ == "__main__":
     messages = []
     if type == 'all':
         sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE)
-        generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_detections, messages, VERBOSE)
+        sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_detections, messages, VERBOSE)
 
 
     # print all the messages from generation
     for m in messages:
         print(m)
     print("finished successfully!")
-
-#    stories = load_objects("stories/*.yml")
-#    detections = []
-#    detections = load_objects("detections/*/*.yml")
-#    detections.extend(load_objects("detections/*/*/*.yml"))
-
-
-    #story_count, path = write_splunk_docs(stories, detections, OUTPUT_DIR)
-    #print("{0} story documents have been successfully written to {1}".format(story_count, path))

bin/jinja2_templates/doc_stories_wiki.j2

@@ -0,0 +1,57 @@
+=Splunk Security Content Analytic Story =
+
+----
+All the Analytic Stories shipped to different Splunk products. Below is a breakdown by Category.
+{% for category in categories %}
+=={{ category.name }}==
+
+{% for story in category.stories %}
+==={{ story.name}}===
+{{ story.description }}
+
+* '''Product''': {{ story.tags.product|join(', ') }}
+* '''Datamodel''': {{ story.data_models|join(', ') }}
+* '''ATT&CK''': {% for mitre_attack_id in story.mitre_attack_ids %}[https://attack.mitre.org/techniques/{{ mitre_attack_id }}/ {{ mitre_attack_id }}]{% if not loop.last %}, {% endif %}{% endfor %}
+* '''Last Updated''': {{ story.date }}
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Detection Profile====
+{% for detection in story.detections %}
+* [[Documentation:ESSOC:detections:Detections#{{ detection|replace(" ", "_") }}|{{ detection }}]]
+{% endfor %}
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+{%-for attack in story.mitre_attacks %}
+|-
+| {{ attack.technique_id }}
+| {{ attack.technique }}
+| {{ attack.tactic|join(', ') }}
+{%- endfor %}
+|}
+
+====Kill Chain Phase====
+{% for phase in story.kill_chain_phases %}
+* {{ phase }}
+{% endfor %}
+
+====Reference====
+{% for reference in story.references %}
+* {{ reference }}
+{% endfor %}
+
+''version'': {{story.version}}
+</div>
+</div>
+
+----
+{% endfor %}
+
+{% endfor %}
+
+[[Category:V:ESSOC:drafts]]

docs/detections.md

@@ -6179,6 +6179,64 @@ _version_: 3
 ### Attempted Credential Dump From Registry via Reg exe
 Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
 
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/)
+- **Last Updated**: 2019-12-02
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)` 
+| `attempted_credential_dump_from_registry_via_reg_exe_filter`
+```
+#### Associated Analytic Story
+
+* Credential Dumping
+
+
+#### How To Implement
+You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
+
+#### Required field
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1003.002 | Security Account Manager | Credential Access |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+
+#### Known False Positives
+None identified.
+
+#### Reference
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
+
+
+_version_: 4
+</details>
+
+---
+
+### Attempted Credential Dump From Registry via Reg exe
+Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
+
 - **Product**: UEBA for Security Cloud
 - **Datamodel**: 
 - **ATT&CK**: [T1003](https://attack.mitre.org/techniques/T1003/)
@@ -6246,64 +6304,6 @@ _version_: 1
 
 ---
 
-### Attempted Credential Dump From Registry via Reg exe
-Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
-
-- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
-- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/)
-- **Last Updated**: 2019-12-02
-
-<details>
-  <summary>details</summary>
-
-#### Search
-```
-
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest 
-| `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)` 
-| `attempted_credential_dump_from_registry_via_reg_exe_filter`
-```
-#### Associated Analytic Story
-
-* Credential Dumping
-
-
-#### How To Implement
-You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
-
-#### Required field
-
-
-#### ATT&CK
-
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
-| T1003.002 | Security Account Manager | Credential Access |
-
-#### Kill Chain Phase
-
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-#### Reference
-
-
-#### Test Dataset
-
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
-
-
-_version_: 4
-</details>
-
----
-
 ### BCDEdit Failure Recovery Modification
 This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
 

docs/detections.wiki

@@ -10256,6 +10256,69 @@ None identified. Attempts to disable security-related services should be identif
 ===Attempted Credential Dump From Registry via Reg exe===
 Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
 
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+* '''Last Updated''': 2019-12-02
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)` 
+| `attempted_credential_dump_from_registry_via_reg_exe_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]]
+
+
+====How To Implement====
+You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
+
+====Required field====
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|}
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+
+====Known False Positives====
+None identified.
+
+====Reference====
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
+
+
+''version'': 4
+</div>
+</div>
+
+----
+
+===Attempted Credential Dump From Registry via Reg exe===
+Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
+
 * '''Product''': UEBA for Security Cloud
 * '''Datamodel''': 
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003]
@@ -10328,69 +10391,6 @@ None identified.
 
 ----
 
-===Attempted Credential Dump From Registry via Reg exe===
-Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
-
-* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002]
-* '''Last Updated''': 2019-12-02
-
-<div class="toccolours mw-collapsible mw-collapsed">
-<div class="mw-collapsible-content">
-
-====Search====
-<search>
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest 
-| `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)` 
-| `attempted_credential_dump_from_registry_via_reg_exe_filter`</search>
-
-====Associated Analytic Story====
-
-* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]]
-
-
-====How To Implement====
-You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
-
-====Required field====
-
-
-====ATT&CK====
-{|
-! style="text-align:left;"| ID
-! Technique
-! Tactic
-|-
-| T1003.002
-| Security Account Manager
-| Credential Access
-|}
-
-====Kill Chain Phase====
-
-* Actions on Objectives
-
-
-====Known False Positives====
-None identified.
-
-====Reference====
-
-
-====Test Dataset====
-
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
-
-
-''version'': 4
-</div>
-</div>
-
-----
-
 ===BCDEdit Failure Recovery Modification===
 This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
 

docs/stories.md

@@ -590,8 +590,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 | ----------- | ----------- |--------------|
 | T1003.001 | LSASS Memory | Credential Access |
 | T1059.001 | PowerShell | Execution |
-| T1003 | OS Credential Dumping | Credential Access |
 | T1003.002 | Security Account Manager | Credential Access |
+| T1003 | OS Credential Dumping | Credential Access |
 | T1003.003 | NTDS | Credential Access |
 
 #### Kill Chain Phase