diff --git a/bin/generate.py b/bin/generate.py index 6fe8389067..ca15b35b0a 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -122,6 +122,8 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_object_type'] = detection['tags']['risk_object_type'] if 'risk_score' in detection['tags']: detection['risk_score'] = detection['tags']['risk_score'] + if 'product' in detection['tags']: + detection['product'] = detection['tags']['product'] for baseline in baselines: data_model = parse_data_models_from_search(baseline['search']) @@ -340,6 +342,18 @@ def get_deployments(object, deployments): matched_deployments.append(deployment) continue + if 'product' in deployment['tags']: + if type(deployment['tags']['product']) is str: + if 'product' in object['tags']: + if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Splunk Security Analytics for AWS': + matched_deployments.append(deployment) + else: + for story in deployment['tags']['product']: + if story == object['tags']['product']: + matched_deployments.append(deployment) + continue + + if 'detection_name' in deployment['tags']: if type(deployment['tags']['detection_name']) is str: if deployment['tags']['detection_name'] == object['name']: diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 4371a004d5..0ee7df2866 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -34,6 +34,9 @@ action.escu.modification_date = {{ detection.date }} action.escu.confidence = high action.escu.full_search_name = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule action.escu.search_type = detection +{% if detection.product is defined %} +action.escu.product = {{ detection.product | tojson }} +{% endif %} {% if detection.providing_technologies is defined %} action.escu.providing_technologies = {{ detection.providing_technologies | tojson }} {% else %} diff --git a/deployments/16_splunk_security_analytics_for_aws.yml b/deployments/16_splunk_security_analytics_for_aws.yml new file mode 100644 index 0000000000..12f5d6b71f --- /dev/null +++ b/deployments/16_splunk_security_analytics_for_aws.yml @@ -0,0 +1,12 @@ +name: Enterprise Security config for Splunk Security Analytics for AWS customers +id: bc91a8cd-35e7-4bb2-6140-e756cc46f211 +date: '2021-01-20' +description: This configuration file applies to all correlation searches that are used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics for AWS searches do not need notable configurations +author: Bhavin Patel +scheduling: + cron_schedule: '0 * * * *' + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +tags: + product: Splunk Security Analytics for AWS diff --git a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml index 89298eaaae..1f3fe92088 100644 --- a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml @@ -40,6 +40,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: Cloud asset_type: Cloud Instance risk_score: 10 diff --git a/detections/cloud/abnormally_high_cloud_instances_launched.yml b/detections/cloud/abnormally_high_cloud_instances_launched.yml index e325bcb4b7..5c2f23adaa 100644 --- a/detections/cloud/abnormally_high_cloud_instances_launched.yml +++ b/detections/cloud/abnormally_high_cloud_instances_launched.yml @@ -41,6 +41,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: Cloud asset_type: Cloud Instance risk_score: 40 diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index b61b044ea2..fb209ffccc 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -37,6 +37,8 @@ tags: - PR.AC security_domain: network asset_type: AWS Instance + product: + - Splunk Security Analytics for AWS risk_score: 25 risk_object_type: user risk_object: user diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index bb27706fff..95e5e21722 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -36,6 +36,8 @@ tags: - DE.DP - DE.CM - PR.AC + product: + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 25 diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index eefc75b06b..7efc31a0ca 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -43,6 +43,8 @@ tags: risk_score: 15 risk_object_type: user risk_object: user + product: + - Splunk Security Analytics for AWS automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 0ee71e4acb..baeec7bf0e 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -33,6 +33,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 25 diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index d2184163b2..629c0c6d36 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -31,6 +31,8 @@ tags: - T1078.004 nist: - ID.AM + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index cb4a5739fb..a25498761a 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -37,6 +37,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: network asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 79df427ff6..46f32353e5 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -32,6 +32,8 @@ tags: - CIS 1 nist: - ID.AM + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 387876b9ae..64bedd2548 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -32,6 +32,8 @@ tags: - CIS 1 nist: - ID.AM + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index ff9f038c8e..c310f1290d 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -32,6 +32,8 @@ tags: - CIS 1 nist: - ID.AM + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 3ddcb7e320..b255668a85 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -47,6 +47,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index 2180a7e17c..37808e4598 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -47,6 +47,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index 00910b6a39..4f2875fc30 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -46,6 +46,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 7fd0943492..55f8dca6b2 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -47,6 +47,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index b14d09fe5f..854bbf4d48 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -35,6 +35,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 30 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 38f3b42f23..d00f89e65c 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -41,6 +41,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 00e2819d0e..a431b99676 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -43,6 +43,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 10b5d3d619..afde87e13f 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -43,6 +43,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/requirements.txt b/requirements.txt index 26907b67a4..228cce7e25 100644 --- a/requirements.txt +++ b/requirements.txt @@ -16,7 +16,7 @@ humanfriendly==9.1 identify==1.5.13 idna==2.10 importlib-metadata==3.4.0 -importlib-resources==4.1.1 +importlib-resources==5.0.0 Jinja2==2.11.2 jsonschema==3.2.0 MarkupSafe==1.1.1