admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-01-27 10:34:51 +00:00
committed by GitHub
parent 6fcbe9eb84 da718acaad
commit e3f3fa6e8e
23 changed files with 68 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/generate.py
+14
View File
@@ -122,6 +122,8 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
detection['risk_object_type'] = detection['tags']['risk_object_type']
if 'risk_score' in detection['tags']:
detection['risk_score'] = detection['tags']['risk_score']
if 'product' in detection['tags']:
detection['product'] = detection['tags']['product']
for baseline in baselines:
data_model = parse_data_models_from_search(baseline['search'])
@@ -340,6 +342,18 @@ def get_deployments(object, deployments):
matched_deployments.append(deployment)
continue
if 'product' in deployment['tags']:
if type(deployment['tags']['product']) is str:
if 'product' in object['tags']:
if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Splunk Security Analytics for AWS':
matched_deployments.append(deployment)
else:
for story in deployment['tags']['product']:
if story == object['tags']['product']:
matched_deployments.append(deployment)
continue
if 'detection_name' in deployment['tags']:
if type(deployment['tags']['detection_name']) is str:
if deployment['tags']['detection_name'] == object['name']:
bin/jinja2_templates/savedsearches.j2
+3
View File
@@ -34,6 +34,9 @@ action.escu.modification_date = {{ detection.date }}
action.escu.confidence = high
action.escu.full_search_name = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule
action.escu.search_type = detection
{% if detection.product is defined %}
action.escu.product = {{ detection.product | tojson }}
{% endif %}
{% if detection.providing_technologies is defined %}
action.escu.providing_technologies = {{ detection.providing_technologies | tojson }}
{% else %}
deployments/16_splunk_security_analytics_for_aws.yml
+12
View File
@@ -0,0 +1,12 @@
name: Enterprise Security config for Splunk Security Analytics for AWS customers
id: bc91a8cd-35e7-4bb2-6140-e756cc46f211
date: '2021-01-20'
description: This configuration file applies to all correlation searches that are used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics for AWS searches do not need notable configurations
author: Bhavin Patel
scheduling:
cron_schedule: '0 * * * *'
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
product: Splunk Security Analytics for AWS
detections/cloud/abnormally_high_cloud_instances_destroyed.yml
+2
View File
@@ -40,6 +40,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: Cloud
asset_type: Cloud Instance
risk_score: 10
detections/cloud/abnormally_high_cloud_instances_launched.yml
+2
View File
@@ -41,6 +41,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: Cloud
asset_type: Cloud Instance
risk_score: 40
detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
- PR.AC
security_domain: network
asset_type: AWS Instance
product:
- Splunk Security Analytics for AWS
risk_score: 25
risk_object_type: user
risk_object: user
detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+2
View File
@@ -36,6 +36,8 @@ tags:
- DE.DP
- DE.CM
- PR.AC
product:
- Splunk Security Analytics for AWS
security_domain: network
asset_type: AWS Instance
risk_score: 25
detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
+2
View File
@@ -43,6 +43,8 @@ tags:
risk_score: 15
risk_object_type: user
risk_object: user
product:
- Splunk Security Analytics for AWS
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
- ID.AM
mitre_attack_id:
- T1078
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: AWS Instance
risk_score: 25
detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+2
View File
@@ -31,6 +31,8 @@ tags:
- T1078.004
nist:
- ID.AM
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: Cloud Compute Instance
risk_score: 20
detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+2
View File
@@ -37,6 +37,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: network
asset_type: Cloud Compute Instance
risk_score: 20
detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+2
View File
@@ -32,6 +32,8 @@ tags:
- CIS 1
nist:
- ID.AM
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: Cloud Compute Instance
risk_score: 20
detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+2
View File
@@ -32,6 +32,8 @@ tags:
- CIS 1
nist:
- ID.AM
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: Cloud Compute Instance
risk_score: 20
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+2
View File
@@ -32,6 +32,8 @@ tags:
- CIS 1
nist:
- ID.AM
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: AWS Instance
risk_score: 10
detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
+2
View File
@@ -47,6 +47,8 @@ tags:
- ID.AM
mitre_attack_id:
- T1078
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: AWS Instance
risk_score: 10
detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+2
View File
@@ -47,6 +47,8 @@ tags:
- ID.AM
mitre_attack_id:
- T1078
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: AWS Instance
risk_score: 5
detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
+2
View File
@@ -46,6 +46,8 @@ tags:
- ID.AM
mitre_attack_id:
- T1078
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: AWS Instance
risk_score: 5
detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
+2
View File
@@ -47,6 +47,8 @@ tags:
- ID.AM
mitre_attack_id:
- T1078
product:
- Splunk Security Analytics for AWS
security_domain: endpoint
asset_type: AWS Instance
risk_score: 5
detections/cloud/detect_aws_console_login_by_new_user.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: network
asset_type: AWS Instance
risk_score: 30
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+2
View File
@@ -41,6 +41,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: network
asset_type: AWS Instance
risk_score: 5
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+2
View File
@@ -43,6 +43,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: network
asset_type: AWS Instance
risk_score: 5
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+2
View File
@@ -43,6 +43,8 @@ tags:
nist:
- DE.DP
- DE.AE
product:
- Splunk Security Analytics for AWS
security_domain: network
asset_type: AWS Instance
risk_score: 5
requirements.txt
+1 -1
View File
@@ -16,7 +16,7 @@ humanfriendly==9.1
identify==1.5.13
idna==2.10
importlib-metadata==3.4.0
importlib-resources==4.1.1
importlib-resources==5.0.0
Jinja2==2.11.2
jsonschema==3.2.0
MarkupSafe==1.1.1