From b19c8f4107fae02ce13b8f62e61941b97cb4bd91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 8 Jan 2021 14:02:53 +0000 Subject: [PATCH 1/7] Bump dnspython from 2.0.0 to 2.1.0 Bumps [dnspython](https://github.com/rthalley/dnspython) from 2.0.0 to 2.1.0. - [Release notes](https://github.com/rthalley/dnspython/releases) - [Changelog](https://github.com/rthalley/dnspython/blob/master/doc/whatsnew.rst) - [Commits](https://github.com/rthalley/dnspython/compare/v2.0.0...v2.1.0) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index de8aa04513..b646b11a0f 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -23,7 +23,7 @@ configparser==4.0.2 contextlib2==0.6.0.post1 cryptography==3.3.1 Deprecated==1.2.10 -dnspython==2.0.0 +dnspython==2.1.0 docutils==0.16 execnet==1.7.1 gitdb==4.0.5 From dc9efbf09d194949fabb60aa2b6098995cd64093 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 11 Jan 2021 14:03:32 +0000 Subject: [PATCH 2/7] Bump importlib-resources from 4.1.1 to 5.0.0 Bumps [importlib-resources](https://github.com/python/importlib_resources) from 4.1.1 to 5.0.0. - [Release notes](https://github.com/python/importlib_resources/releases) - [Changelog](https://github.com/python/importlib_resources/blob/main/CHANGES.rst) - [Commits](https://github.com/python/importlib_resources/compare/v4.1.1...v5.0.0) Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 7009f6946c..711369e786 100644 --- a/requirements.txt +++ b/requirements.txt @@ -16,7 +16,7 @@ humanfriendly==9.1 identify==1.5.11 idna==2.10 importlib-metadata==3.3.0 -importlib-resources==4.1.1 +importlib-resources==5.0.0 Jinja2==2.11.2 jsonschema==3.2.0 MarkupSafe==1.1.1 From b99d01458e50475cccd66bcfa021450b49db0140 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 14 Jan 2021 17:09:00 -0800 Subject: [PATCH 3/7] first commit with product tag --- detections/cloud/abnormally_high_cloud_instances_destroyed.yml | 2 ++ detections/cloud/abnormally_high_cloud_instances_launched.yml | 2 ++ ...abnormally_high_number_of_cloud_infrastructure_api_calls.yml | 2 ++ ...abnormally_high_number_of_cloud_security_group_api_calls.yml | 2 ++ ...ws_cross_account_activity_from_previously_unseen_account.yml | 2 ++ .../cloud/cloud_api_calls_from_previously_unseen_user_roles.yml | 2 ++ ...cloud_compute_instance_created_by_previously_unseen_user.yml | 2 ++ ...oud_compute_instance_created_in_previously_unused_region.yml | 2 ++ ...ud_compute_instance_created_with_previously_unseen_image.yml | 2 ++ ...te_instance_created_with_previously_unseen_instance_type.yml | 2 ++ .../cloud_instance_modified_with_previously_unseen_user.yml | 2 ++ .../cloud/cloud_provisioning_from_previously_unseen_city.yml | 2 ++ .../cloud/cloud_provisioning_from_previously_unseen_country.yml | 2 ++ .../cloud_provisioning_from_previously_unseen_ip_address.yml | 2 ++ .../cloud/cloud_provisioning_from_previously_unseen_region.yml | 2 ++ detections/cloud/detect_aws_console_login_by_new_user.yml | 2 ++ .../cloud/detect_aws_console_login_by_user_from_new_city.yml | 2 ++ .../cloud/detect_aws_console_login_by_user_from_new_country.yml | 2 ++ .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 2 ++ 19 files changed, 38 insertions(+) diff --git a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml index bc66d71600..78c0b4fab4 100644 --- a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml @@ -41,6 +41,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: Cloud asset_type: Cloud Instance risk_score: 10 diff --git a/detections/cloud/abnormally_high_cloud_instances_launched.yml b/detections/cloud/abnormally_high_cloud_instances_launched.yml index e325bcb4b7..eaedc7d5a0 100644 --- a/detections/cloud/abnormally_high_cloud_instances_launched.yml +++ b/detections/cloud/abnormally_high_cloud_instances_launched.yml @@ -41,6 +41,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: Cloud asset_type: Cloud Instance risk_score: 40 diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index b61b044ea2..e095121ceb 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -37,6 +37,8 @@ tags: - PR.AC security_domain: network asset_type: AWS Instance + product: + - Mustang risk_score: 25 risk_object_type: user risk_object: user diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index bb27706fff..8a942ebaf2 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -36,6 +36,8 @@ tags: - DE.DP - DE.CM - PR.AC + product: + - Mustang security_domain: network asset_type: AWS Instance risk_score: 25 diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index eefc75b06b..d47bc9f9a2 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -43,6 +43,8 @@ tags: risk_score: 15 risk_object_type: user risk_object: user + product: + - Mustang automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 0ee71e4acb..c3a4d6bd55 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -33,6 +33,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Mustang security_domain: endpoint asset_type: AWS Instance risk_score: 25 diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index d2184163b2..d6118cb06f 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -31,6 +31,8 @@ tags: - T1078.004 nist: - ID.AM + product: + - Mustang security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index cb4a5739fb..879815da9b 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -37,6 +37,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: network asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 79df427ff6..7e68eb8422 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -32,6 +32,8 @@ tags: - CIS 1 nist: - ID.AM + product: + - Mustang security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 387876b9ae..a6389ac188 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -32,6 +32,8 @@ tags: - CIS 1 nist: - ID.AM + product: + - Mustang security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index ff9f038c8e..47b4147f87 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -32,6 +32,8 @@ tags: - CIS 1 nist: - ID.AM + product: + - Mustang security_domain: endpoint asset_type: AWS Instance risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 3ddcb7e320..f7bd034f24 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -47,6 +47,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Mustang security_domain: endpoint asset_type: AWS Instance risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index 2180a7e17c..6e08c4438a 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -47,6 +47,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Mustang security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index 00910b6a39..04934da268 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -46,6 +46,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Mustang security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 7fd0943492..c342c07624 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -47,6 +47,8 @@ tags: - ID.AM mitre_attack_id: - T1078 + product: + - Mustang security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 4f972ea968..58a170898f 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -36,6 +36,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: network asset_type: AWS Instance risk_score: 30 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 2d9ff5c6de..97938be853 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -42,6 +42,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 1b021ac98b..b242ed52ff 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -42,6 +42,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 713a9b95c6..03dcc284cc 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -42,6 +42,8 @@ tags: nist: - DE.DP - DE.AE + product: + - Mustang security_domain: network asset_type: AWS Instance risk_score: 5 From f7ae31682a4b25d838393d80809b6053760f8be3 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 20 Jan 2021 15:39:29 -0800 Subject: [PATCH 4/7] adding product field in tags for mustang --- bin/generate.py | 3 +++ bin/jinja2_templates/savedsearches.j2 | 3 +++ 2 files changed, 6 insertions(+) diff --git a/bin/generate.py b/bin/generate.py index 04c08af580..4fd576ee4a 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -122,6 +122,9 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_object_type'] = detection['tags']['risk_object_type'] if 'risk_score' in detection['tags']: detection['risk_score'] = detection['tags']['risk_score'] + if 'product' in detection['tags']: + detection['product'] = detection['tags']['product'] + print (detection['product']) for baseline in baselines: data_model = parse_data_models_from_search(baseline['search']) diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 565b751d1a..afa6ffa71f 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -34,6 +34,9 @@ action.escu.modification_date = {{ detection.date }} action.escu.confidence = high action.escu.full_search_name = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule action.escu.search_type = detection +{% if detection.product is defined %} +action.escu.product = {{ detection.product | tojson }} +{% endif %} {% if detection.providing_technologies is defined %} action.escu.providing_technologies = {{ detection.providing_technologies | tojson }} {% else %} From 0b7f46489afc70121cc63bcac00db7d5b01aa278 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 20 Jan 2021 16:40:33 -0800 Subject: [PATCH 5/7] adding deployment file for Mustang --- bin/generate.py | 18 ++++++++++++++++-- deployments/16_mustang.yml | 12 ++++++++++++ 2 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 deployments/16_mustang.yml diff --git a/bin/generate.py b/bin/generate.py index 4fd576ee4a..a3e0c549c4 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -83,6 +83,9 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen if data_model: detection['data_model'] = data_model + if 'product' in detection['tags']: + detection['product'] = detection['tags']['product'] + matched_deployment = get_deployments(detection, deployments) detection['deployment'] = matched_deployment nes_fields = get_nes_fields(detection['search'], detection['deployment']) @@ -124,8 +127,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_score'] = detection['tags']['risk_score'] if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] - print (detection['product']) - + for baseline in baselines: data_model = parse_data_models_from_search(baseline['search']) if data_model: @@ -343,6 +345,18 @@ def get_deployments(object, deployments): matched_deployments.append(deployment) continue + if 'product' in deployment['tags']: + if type(deployment['tags']['product']) is str: + if 'product' in object['tags']: + if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Mustang': + matched_deployments.append(deployment) + else: + for story in deployment['tags']['product']: + if story == object['tags']['product']: + matched_deployments.append(deployment) + continue + + if 'detection_name' in deployment['tags']: if type(deployment['tags']['detection_name']) is str: if deployment['tags']['detection_name'] == object['name']: diff --git a/deployments/16_mustang.yml b/deployments/16_mustang.yml new file mode 100644 index 0000000000..583ae74969 --- /dev/null +++ b/deployments/16_mustang.yml @@ -0,0 +1,12 @@ +name: Enterprise Security config for Mustang customers +id: bc91a8cd-35e7-4bb2-6140-e756cc46f211 +date: '2021-01-20' +description: This configuration file applies to all correlation searches that are used in the Mustang product +author: Bhavin Patel +scheduling: + cron_schedule: '0 * * * *' + earliest_time: -90m@m + latest_time: -10m@m + schedule_window: auto +tags: + product: Mustang From 369dab34886d466be5090d03137ba63c50272ff7 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 20 Jan 2021 17:32:03 -0800 Subject: [PATCH 6/7] minor --- bin/generate.py | 5 +---- deployments/16_mustang.yml | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index a3e0c549c4..9d2a57260e 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -83,9 +83,6 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen if data_model: detection['data_model'] = data_model - if 'product' in detection['tags']: - detection['product'] = detection['tags']['product'] - matched_deployment = get_deployments(detection, deployments) detection['deployment'] = matched_deployment nes_fields = get_nes_fields(detection['search'], detection['deployment']) @@ -127,7 +124,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_score'] = detection['tags']['risk_score'] if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] - + for baseline in baselines: data_model = parse_data_models_from_search(baseline['search']) if data_model: diff --git a/deployments/16_mustang.yml b/deployments/16_mustang.yml index 583ae74969..3d8b8357d7 100644 --- a/deployments/16_mustang.yml +++ b/deployments/16_mustang.yml @@ -1,11 +1,11 @@ name: Enterprise Security config for Mustang customers id: bc91a8cd-35e7-4bb2-6140-e756cc46f211 date: '2021-01-20' -description: This configuration file applies to all correlation searches that are used in the Mustang product +description: This configuration file applies to all correlation searches that are used in the Mustang product. NOTE - Mustang searches do not need notable configurations author: Bhavin Patel scheduling: cron_schedule: '0 * * * *' - earliest_time: -90m@m + earliest_time: -70m@m latest_time: -10m@m schedule_window: auto tags: From c8fc855ccd2b3ac3df6bd143418158dc7f8463d5 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 21 Jan 2021 14:31:23 -0800 Subject: [PATCH 7/7] rename mustang to ssa4aws --- bin/generate.py | 2 +- deployments/16_mustang.yml | 12 ------------ deployments/16_splunk_security_analytics_for_aws.yml | 12 ++++++++++++ .../abnormally_high_cloud_instances_destroyed.yml | 2 +- .../abnormally_high_cloud_instances_launched.yml | 2 +- ...high_number_of_cloud_infrastructure_api_calls.yml | 2 +- ...high_number_of_cloud_security_group_api_calls.yml | 2 +- ...count_activity_from_previously_unseen_account.yml | 2 +- ...d_api_calls_from_previously_unseen_user_roles.yml | 2 +- ...te_instance_created_by_previously_unseen_user.yml | 2 +- ..._instance_created_in_previously_unused_region.yml | 2 +- ...instance_created_with_previously_unseen_image.yml | 2 +- ..._created_with_previously_unseen_instance_type.yml | 2 +- ...instance_modified_with_previously_unseen_user.yml | 2 +- ...loud_provisioning_from_previously_unseen_city.yml | 2 +- ...d_provisioning_from_previously_unseen_country.yml | 2 +- ...rovisioning_from_previously_unseen_ip_address.yml | 2 +- ...ud_provisioning_from_previously_unseen_region.yml | 2 +- .../cloud/detect_aws_console_login_by_new_user.yml | 2 +- ...etect_aws_console_login_by_user_from_new_city.yml | 2 +- ...ct_aws_console_login_by_user_from_new_country.yml | 2 +- ...ect_aws_console_login_by_user_from_new_region.yml | 2 +- 22 files changed, 32 insertions(+), 32 deletions(-) delete mode 100644 deployments/16_mustang.yml create mode 100644 deployments/16_splunk_security_analytics_for_aws.yml diff --git a/bin/generate.py b/bin/generate.py index 9d2a57260e..7d714aa556 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -345,7 +345,7 @@ def get_deployments(object, deployments): if 'product' in deployment['tags']: if type(deployment['tags']['product']) is str: if 'product' in object['tags']: - if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Mustang': + if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Splunk Security Analytics for AWS': matched_deployments.append(deployment) else: for story in deployment['tags']['product']: diff --git a/deployments/16_mustang.yml b/deployments/16_mustang.yml deleted file mode 100644 index 3d8b8357d7..0000000000 --- a/deployments/16_mustang.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Enterprise Security config for Mustang customers -id: bc91a8cd-35e7-4bb2-6140-e756cc46f211 -date: '2021-01-20' -description: This configuration file applies to all correlation searches that are used in the Mustang product. NOTE - Mustang searches do not need notable configurations -author: Bhavin Patel -scheduling: - cron_schedule: '0 * * * *' - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto -tags: - product: Mustang diff --git a/deployments/16_splunk_security_analytics_for_aws.yml b/deployments/16_splunk_security_analytics_for_aws.yml new file mode 100644 index 0000000000..12f5d6b71f --- /dev/null +++ b/deployments/16_splunk_security_analytics_for_aws.yml @@ -0,0 +1,12 @@ +name: Enterprise Security config for Splunk Security Analytics for AWS customers +id: bc91a8cd-35e7-4bb2-6140-e756cc46f211 +date: '2021-01-20' +description: This configuration file applies to all correlation searches that are used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics for AWS searches do not need notable configurations +author: Bhavin Patel +scheduling: + cron_schedule: '0 * * * *' + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +tags: + product: Splunk Security Analytics for AWS diff --git a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml index 78c0b4fab4..e32429a389 100644 --- a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml @@ -42,7 +42,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: Cloud asset_type: Cloud Instance risk_score: 10 diff --git a/detections/cloud/abnormally_high_cloud_instances_launched.yml b/detections/cloud/abnormally_high_cloud_instances_launched.yml index eaedc7d5a0..5c2f23adaa 100644 --- a/detections/cloud/abnormally_high_cloud_instances_launched.yml +++ b/detections/cloud/abnormally_high_cloud_instances_launched.yml @@ -42,7 +42,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: Cloud asset_type: Cloud Instance risk_score: 40 diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index e095121ceb..fb209ffccc 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -38,7 +38,7 @@ tags: security_domain: network asset_type: AWS Instance product: - - Mustang + - Splunk Security Analytics for AWS risk_score: 25 risk_object_type: user risk_object: user diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 8a942ebaf2..95e5e21722 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -37,7 +37,7 @@ tags: - DE.CM - PR.AC product: - - Mustang + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 25 diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index d47bc9f9a2..7efc31a0ca 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -44,7 +44,7 @@ tags: risk_object_type: user risk_object: user product: - - Mustang + - Splunk Security Analytics for AWS automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index c3a4d6bd55..baeec7bf0e 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -34,7 +34,7 @@ tags: mitre_attack_id: - T1078 product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 25 diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index d6118cb06f..629c0c6d36 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -32,7 +32,7 @@ tags: nist: - ID.AM product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 879815da9b..a25498761a 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -38,7 +38,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: network asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 7e68eb8422..46f32353e5 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -33,7 +33,7 @@ tags: nist: - ID.AM product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index a6389ac188..64bedd2548 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -33,7 +33,7 @@ tags: nist: - ID.AM product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: Cloud Compute Instance risk_score: 20 diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 47b4147f87..c310f1290d 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -33,7 +33,7 @@ tags: nist: - ID.AM product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index f7bd034f24..b255668a85 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -48,7 +48,7 @@ tags: mitre_attack_id: - T1078 product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 10 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index 6e08c4438a..37808e4598 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -48,7 +48,7 @@ tags: mitre_attack_id: - T1078 product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index 04934da268..4f2875fc30 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -47,7 +47,7 @@ tags: mitre_attack_id: - T1078 product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index c342c07624..55f8dca6b2 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -48,7 +48,7 @@ tags: mitre_attack_id: - T1078 product: - - Mustang + - Splunk Security Analytics for AWS security_domain: endpoint asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 0eaa453d45..854bbf4d48 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -36,7 +36,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 30 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 7d65cf817c..d00f89e65c 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -42,7 +42,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index ac5874dde2..a431b99676 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -44,7 +44,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 5 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 85a64064f8..afde87e13f 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -44,7 +44,7 @@ tags: - DE.DP - DE.AE product: - - Mustang + - Splunk Security Analytics for AWS security_domain: network asset_type: AWS Instance risk_score: 5