admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into tool-get-execution-logic-fix

Browse Source
This commit is contained in:
Bhavin Patel
2024-11-07 11:24:24 -08:00
committed by GitHub
parent 2c7979b8eb 5dc96dcc8b
commit e8861ff2d4
1964 changed files with 32123 additions and 1878666 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/appinspect.yml
+7 -7
View File
@@ -1,16 +1,15 @@
name: appinspect
on:
pull_request_target:
push:
branches:
- develop
types: [opened, reopened, synchronize]
jobs:
appinspect:
runs-on: ubuntu-latest
steps:
- name: Check out the repository code
uses: actions/checkout@v4
with:
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: actions/setup-python@v5
with:
@@ -20,7 +19,8 @@ jobs:
- name: Install Python Dependencies and ContentCTL and Atomic Red Team
run: |
pip install contentctl>=4.0.0
git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git
git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
- name: Running appinspect with enrichments
env:
@@ -28,7 +28,7 @@ jobs:
APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}"
run: |
echo $APPINSPECTUSERNAME
contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments
contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments --enable-metadata-validation --suppress-missing-content-exceptions
echo "done appinspect"
mkdir -p artifacts/app_inspect_report
cp -r dist/*.html artifacts/app_inspect_report
@@ -40,4 +40,4 @@ jobs:
name: content-latest
path: |
artifacts/DA-ESS-ContentUpdate-latest.tar.gz
artifacts/app_inspect_report
artifacts/app_inspect_report
.github/workflows/build.yml
+2 -1
View File
@@ -20,7 +20,8 @@ jobs:
- name: Install Python Dependencies and ContentCTL and Atomic Red Team
run: |
pip install contentctl>=4.0.0
git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git
git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
- name: Running build with enrichments
run: |
.github/workflows/datasource-dependabot.yml
+56
View File
@@ -0,0 +1,56 @@
name: Splunk TA Update
on:
workflow_dispatch: # Manually trigger the workflow
schedule:
- cron: '55 06 * * *' # Runs daily at midnight
jobs:
data-source-validation-and-update:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: 'develop'
token: ${{ secrets.DATA_SOURCES_DEPENDABOT }}
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
architecture: 'x64' # or the version your script requires
- name: Install Python Dependencies and ContentCTL and Atomic Red Team
run: |
pip install "contentctl>=4.0.0"
- name: Run ContentCTL Data source TA validation
id: validate
run: |
pwd
contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log
continue-on-error: true
- name: Print Validation Log
run: |
cat data_source_validation.log
rm -f =4.0.0
- name: Update Data Sources if Validation Fails
run: |
python .github/workflows/update_data_sources_ta.py
git status
- name: Create Pull Request
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.DATA_SOURCES_DEPENDABOT }}
commit-message: Updated TAs
branch: auto-ta-update-${{ github.run_number }}
base: develop
title: Automated Splunk TA Update ${{ github.run_number }}
body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow."
paths: |
security_content/data_sources/**
.github/workflows/datasource-ta-check.yml
-27
View File
@@ -1,27 +0,0 @@
name: datasource-ta-check
on:
pull_request_target:
push:
branches:
- develop
jobs:
datasource-ta-check:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- name: Check out the repository code
uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: '3.11'
architecture: 'x64'
- name: Install Python Dependencies and contentctl
run: |
pip install contentctl>=4.0.0
- name: Run datasource TA check
run: |
contentctl validate --data-source-TA-validation
.github/workflows/unit-testing.yml
+1 -1
View File
@@ -39,7 +39,7 @@ jobs:
git fetch origin pull/${{ github.event.pull_request.number }}/head:new_branch_for_testing
#We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo
git switch new_branch_for_testing
contentctl test --disable-tqdm --no-enable-integration-testing --post-test-behavior never_pause mode:changes --mode.target-branch ${{ github.base_ref }}
contentctl test --disable-tqdm --no-enable-integration-testing --container-settings.num-containers 2 --post-test-behavior never_pause mode:changes --mode.target-branch ${{ github.base_ref }}
echo "contentctl test - COMPLETED"
continue-on-error: true
.github/workflows/update_data_sources_ta.py
+98
View File
@@ -0,0 +1,98 @@
import os
import yaml
from collections import OrderedDict
# Custom YAML loader to preserve the order of keys
class OrderedLoader(yaml.SafeLoader):
pass
def construct_mapping(loader, node):
loader.flatten_mapping(node)
return OrderedDict(loader.construct_pairs(node))
OrderedLoader.add_constructor(
yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG,
construct_mapping
)
# Custom YAML dumper to preserve the order of keys
class OrderedDumper(yaml.SafeDumper):
pass
def dict_representer(dumper, data):
return dumper.represent_dict(data.items())
OrderedDumper.add_representer(OrderedDict, dict_representer)
# Define the paths
log_file_path = 'data_source_validation.log'
data_sources_dir = 'data_sources'
contentctl_file_path = 'contentctl.yml'
def update_data_sources(ta_name, latest_version):
# Update the YAML files in the data sources directory
for filename in os.listdir(data_sources_dir):
if filename.endswith('.yml'):
file_path = os.path.join(data_sources_dir, filename)
with open(file_path, 'r') as yml_file:
data = yaml.load(yml_file, Loader=OrderedLoader)
# Check if the TA name matches and update the version
updated = False
for ta in data.get('supported_TA', []):
if ta['name'] == ta_name:
if ta['version'] != latest_version:
ta['version'] = latest_version
updated = True
# Write the updated data back to the YAML file
if updated:
with open(file_path, 'w') as yml_file:
yaml.dump(data, yml_file, Dumper=OrderedDumper)
def update_contentctl_yml(title, new_version):
# Load the existing YAML file
with open(contentctl_file_path, 'r') as file:
content = yaml.load(file, Loader=OrderedLoader)
# Iterate over the apps to find the title and update the version and hardcoded_path
updated = False
for app in content.get('apps', []):
if app.get('title') == title:
if app.get('version') != new_version:
app['version'] = new_version
updated = True
print(f"Updated {title} in contentctl.yml to version {new_version}")
# Update the hardcoded_path if it exists
if 'hardcoded_path' in app:
base_url, current_version = app['hardcoded_path'].rsplit('_', 1)
new_hardcoded_path = f"{base_url}_{new_version.replace('.', '')}.tgz"
app['hardcoded_path'] = new_hardcoded_path
print(f"Updated hardcoded_path for {title} to {new_hardcoded_path}")
# Write the updated content back to the YAML file if changes were made
if updated:
with open(contentctl_file_path, 'w') as file:
yaml.dump(content, file, Dumper=OrderedDumper, default_flow_style=False)
def main():
# Read the log file to find version mismatches
with open(log_file_path, 'r') as log_file:
log_lines = log_file.readlines()
# Parse the log file to find the TA name and the latest version
for i, line in enumerate(log_lines):
if 'Version mismatch' in line:
ta_name = log_lines[i].split("'")[3].strip()
latest_version = log_lines[i + 1].split(':')[1].strip()
print(f"Found version mismatch for TA: {ta_name}, updating to version: {latest_version}")
# Update data sources and contentctl.yml
update_data_sources(ta_name, latest_version)
update_contentctl_yml(ta_name, latest_version)
print("Version updates completed.")
if __name__ == "__main__":
main()
.gitignore
+2 -1
View File
@@ -6,12 +6,13 @@ detections/*/.yml.example
stories/*.yml.example
tests/*/*.yml.example
artifacts/
contentctl/*
contentctl/
dist/DA-ESS-ContentUpdate-*.tar.gz
dist/DA-ESS-ContentUpdate.tar.gz
dist/ContentPack-*.appinspect_api_results.html
dist/ContentPack-*.appinspect_api_results.json
atomic-red-team/
external_repos/
# IDE
.vscode/
README.md
+70 -16
View File
@@ -18,7 +18,7 @@
# Splunk Security Content
![security_content](docs/static/logo.png)
![security_content](docs/static/escu_sb.png)
=====
Welcome to the Splunk Security Content
@@ -27,39 +27,88 @@ This project gives you access to our repository of Analytic Stories, security gu
**Note:** We have sister projects that enable us to build the industry's best security content. These projects are the Splunk Attack Range, an attack simulation lab built around Splunk, and Contentctl, the tool that enables us to build, test, and package our content for distribution.
- [Splunk Attack Range](https://github.com/splunk/attack_range): An attack simulation lab built around Splunk.
# Tools 🧰
- [Splunk Attack Range](https://github.com/splunk/attack_range): The Splunk Attack Range is an open-source project maintained by the Splunk Threat Research Team. It builds instrumented cloud (AWS, Azure) and local environments (Virtualbox), simulates attacks, and forwards the data into a Splunk instance. This environment can then be used to develop and test the effectiveness of detections.
- [Contentctl](https://github.com/splunk/contentctl): The tool that enables us to build, test, and package our content for distribution.
- [Attack data](https://github.com/splunk/attack_data): The is a collection of attack data that is used to test our content.
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team): Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments.
# Get Content🛡
The latest Splunk Security Content can be obtained via:
### 🌐 [Website](https://research.splunk.com/)
#### 🌐 [Website](https://research.splunk.com/)
Best way to discover and access our content is by using the [research.splunk.com](https://research.splunk.com/) website.
### 🖥️ [Splunk Enterprise Security (ES) Content Update](https://docs.splunk.com/Documentation/ES/latest/Admin/Usecasecontentlibrary?#Update_the_Analytic_Stories)
#### 🖥️ [Splunk Enterprise Security (ES) Content Update](https://docs.splunk.com/Documentation/ES/latest/Admin/Usecasecontentlibrary?#Update_the_Analytic_Stories)
Splunk security content ships as part of ESCU directly into, if you are an ES user, good news, you already have it!
### 📦 [ESCU App](https://github.com/splunk/security_content/releases)
#### 📦 [ESCU App](https://github.com/splunk/security_content/releases)
To manually download the latest release of Splunk Security Content (named DA-ESS-ContentUpdate.spl), you can visit the [splunkbase](https://splunkbase.splunk.com/app/3449/) page or the [release page](https://github.com/splunk/security_content/releases) on GitHub.
# Tools 🧰
The key tool that drives our content development is [contentctl](https://github.com/splunk/contentctl). Contentctl offers the following features:
# Getting Started 🛠️
- Creating new detections
- Validating the correctness of all necessary components for detections
- Testing detections
- Generating deployable apps from detections
Follow these steps to get started with Splunk Security Content.
To learn more about contentctl and its capabilities, please visit the [contentctl repository](https://github.com/splunk/contentctl).
1. Clone this repository using `git clone https://github.com/splunk/security_content.git`
2. Navigate to the repository directory using `cd security_content`
3. Install contentctl using `pip install contentctl` to install the latest version of contentctl, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team
# MITRE ATT&CK ⚔️
### Detection Coverage
To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for.
# Quick Start 🚀
![](docs/mitre-map/coverage.png)
1. Setup the environment
```
git clone https://github.com/splunk/security_content.git
cd security_content
python3.11 -m venv .venv
source .venv/bin/activate
pip install contentctl
```
2. Create a new **detection.yml** and answer the questions
```
contentctl new
```
**NOTE** - Make sure you update the detection.yml with the required fields and values. If you need help, please refer to the [yaml-spec](docs/yaml-spec) to check out the list of allowed values
4. Validate your content
```
contentctl validate
```
**NOTE** - The contentctl validate command ensures that all YAML files adhere to the defined specifications and are up-to-date. It checks for required fields, correct data types, and overall consistency, helping maintain the integrity and quality of the content.
5. Build an ESCU app with enrichments from Atomic Red Team and Mitre CTI repositories
```
contentctl build --enrichments
```
6. Test the content - Our testing framework is based on [contentctl](https://github.com/splunk/contentctl) and is extensive and flexible. Refer to the [contentctl test documentation](https://github.com/splunk/contentctl?tab=readme-ov-file#contentctl-test) to learn more about the testing framework.
# Recommendations 💡
- 🚨 NOTE: If you are just getting started with managing your Splunk detection as code, we recommend that you keep the YAML structure of the detections as close as possible to the original structure of the detections. This will make it easier to manage your detections and will also make it easier to contribute back to the community by creating a pull request to the Splunk Security Content project.
- In order to build an content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other yamls that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection ymls.
- If your detections are using macros and lookups, please make sure that you have the same macros and lookups in those directories.. This will ensure that the content app is self-contained and does not rely on external files.
- We recommend that you follow the errors produced by the `contentctl` tool while developing this content. The errors are descriptive enough to guide you in getting the right values. If you need help, please open a GitHub issue in the `contentctl` repository or refer to the [yaml-spec](docs/yaml-spec) to check out the list of allowed values
# YAML Specs 📄
YAML specs define the structure and required fields for various YAML configuration files used in the project. These specifications ensure consistency and validation across different types of YAML files, such as macros, lookups, and analytic stories. Each spec outlines the expected data types, descriptions, and whether the fields are mandatory, providing a clear schema for developers to follow.
- [detection](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/detection_spec.yml)
- [stories](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/stories_spec.yml)
- [macros](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/macros_spec.yml)
- [lookups](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/lookups_spec.yml)
# Content Parts 🧩
@@ -73,6 +122,11 @@ To view an up-to-date detection coverage map for all the content tagged with MIT
* [lookups/](lookups/): Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions.
* [data_sources/](data_sources/): Defines the data sources, the necessary TA or App to collect them and the fields provided that can be used by the detections.
# MITRE ATT&CK ⚔️
### Detection Coverage
To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for.
# Contribution 🥰
We welcome feedback and contributions from the community! Please see our [contributing to the project](./.github/CONTRIBUTING.md) for more information on how to get involved.
app_template/README/essoc_usage_dashboard.txt
-51
View File
@@ -1,51 +0,0 @@
######################
ESSOC Usage Dashboard#
######################
The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table.
IMPORTANT: The user loading this dashboard must have permission to search the _audit index
##################
#Dashboard panels#
##################
Searches Ran
The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax
Unique Searches
The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app.
Most Run
The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Ad hoc Searches
The total number of searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Scheduled
The total number of ESSOC searches run that were scheduled.
Most Active User
The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Search Run Time (seconds)
Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Average Run Time (seconds)
Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Max Run Time (seconds)
The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Search summary
This table provides details on each search that was executed in the ESSOC app.
app_template/default/analytic_stories.conf
-2
View File
@@ -1,2 +0,0 @@
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### Using one single file analyticstories.conf that will be used both by ES and ESCU
app_template/default/app.conf
-30
View File
@@ -1,30 +0,0 @@
## Splunk app configuration file
[install]
is_configured = false
state = enabled
state_change_requires_restart = false
build = 16367
[triggers]
reload.analytic_stories = simple
reload.use_case_library = simple
reload.correlationsearches = simple
reload.analyticstories = simple
reload.governance = simple
reload.managed_configurations = simple
reload.postprocess = simple
reload.content-version = simple
reload.es_investigations = simple
[launcher]
author = Splunk
version = 4.9.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
is_visible = true
label = ES Content Updates
[package]
id = DA-ESS-ContentUpdate
app_template/default/commands.conf
-11
View File
@@ -1,11 +0,0 @@
# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1
#[dnstwist]
#filename = dnstwist.py
#chunked = true
# run story functionality has been moved to: https://github.com/splunk/analytic_story_execution'
# [runstory]
# filename = runstory.py
# chunked = true
# is_risky = true
app_template/default/content-version.conf
-2
View File
@@ -1,2 +0,0 @@
[content-version]
version = 4.9.0
app_template/default/data/ui/views/feedback.xml
+5 -5
View File
@@ -1,13 +1,13 @@
<form isVisible="true" version="1.1">
<label>Feedback Center</label>
<description>Welcome to Splunk Enterprise Security Content Updates Feedback Center.</description>
<description>Welcome to the Splunk Enterprise Security Content Updates feedback center.</description>
<row>
<panel>
<html>
<p5>Contact us at <a href = "mailto:research@splunk.com">research@splunk.com</a> to send us support requests, bug reports, or questions directly to the Splunk Security Research Team.
<br>Please specify your request type and/or the title of any related Analytic Stories.</br>
You can also find us in the <b>#security-research</b> room in the <a href = "http://splunk-usergroups.slack.com/">Splunk Slack channel</a></p5>
<p5>You can contact the Splunk Threat Research team at<a href = "mailto:research@splunk.com">research@splunk.com</a> to send us support requests, bug reports, and questions.
<br>Specify the request type and the title of any related analytic stories, detections analytics where applicable.</br>
You can also find us on the <b>#es-content-updates</b><a href = "http://splunk-usergroups.slack.com/"> Splunk Usergroups Slack channel.</a></p5>
</html>
</panel>
</row>
</form>
</form>
app_template/default/use_case_library.conf
-2
View File
@@ -1,2 +0,0 @@
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### Using one single file analyticstories.conf that will be used both by ES and ESCU
app_template/lookups/mitre_enrichment.csv
+649 -630
View File
File diff suppressed because it is too large Load Diff
app_template/metadata/default.meta
+1 -1
View File
@@ -1,6 +1,6 @@
## shared Application-level permissions
[]
access = read : [ * ], write : [ admin ]
access = read : [ * ], write : [ admin, sc_admin ]
export = system
[savedsearches]
baselines/baseline_of_kubernetes_container_network_io.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Baseline Of Kubernetes Container Network IO
id: 6edaca1d-d436-42d0-8df0-6895d3bf5b70
version: 1
date: '2023-12-19'
version: 4
date: '2024-09-24'
author: Matthew Moore, Splunk
type: Baseline
datamodel: []
@@ -15,7 +15,7 @@ search: '| mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8
| stats avg(eval(if(direction="transmit", io,null()))) as avg_outbound_network_io avg(eval(if(direction="receive", io,null()))) as avg_inbound_network_io
stdev(eval(if(direction="transmit", io,null()))) as stdev_outbound_network_io stdev(eval(if(direction="receive", io,null()))) as stdev_inbound_network_io
count latest(_time) as last_seen by key
| outputlookup k8s_container_network_io_baseline '
| outputlookup k8s_container_network_io_baseline'
how_to_implement: 'To implement this detection, follow these steps:
1. Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.
2. Enable the hostmetrics/process receiver in the OTEL configuration.
baselines/baseline_of_kubernetes_container_network_io_ratio.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Baseline Of Kubernetes Container Network IO Ratio
id: f395003b-6389-4e14-89bf-ac4dbea215bd
version: 1
date: '2023-12-19'
version: 2
date: '2024-09-24'
author: Matthew Moore, Splunk
type: Baseline
datamodel: []
@@ -18,7 +18,7 @@ search: '| mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8
| eval outbound:inbound = outbound_network_io/inbound_network_io
| stats avg(*:*) as avg_*:* stdev(*:*) as stdev_*:*
count latest(_time) as last_seen by key
| outputlookup k8s_container_network_io_ratio_baseline '
| outputlookup k8s_container_network_io_ratio_baseline'
how_to_implement: 'To implement this detection, follow these steps:
1. Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.
2. Enable the hostmetrics/process receiver in the OTEL configuration.
baselines/baseline_of_kubernetes_process_resource_ratio.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Baseline Of Kubernetes Process Resource Ratio
id: 427f81cf-ce6a-4a24-a73d-70c50171ea66
version: 1
date: '2023-12-18'
version: 2
date: '2024-09-24'
author: Matthew Moore, Splunk
type: Baseline
datamodel: []
@@ -20,7 +20,7 @@ search: '| mstats avg(process.*) as process.* where `kubernetes_metrics` by host
| stats avg(cpu:mem) as avg_cpu:mem stdev(cpu:mem) as stdev_cpu:mem avg(cpu:disk) as avg_cpu:disk stdev(cpu:disk) as stdev_cpu:disk
avg(mem:disk) as avg_mem:disk stdev(mem:disk) as stdev_mem:disk avg(cpu:threads) as avg_cpu:threads stdev(cpu:threads) as stdev_cpu:threads
avg(disk:threads) as avg_disk:threads stdev(disk:threads) as stdev_disk:threads count latest(_time) as last_seen by key
| outputlookup k8s_process_resource_ratio_baseline '
| outputlookup k8s_process_resource_ratio_baseline'
how_to_implement: 'To implement this detection, follow these steps:
1. Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.
2. Enable the hostmetrics/process receiver in the OTEL configuration.
contentctl.yml
+57 -45
View File
@@ -3,7 +3,7 @@ app:
uid: 3449
title: ES Content Updates
appid: DA-ESS-ContentUpdate
version: 4.39.0
version: 4.43.0
description: Explore the Analytic Stories included with ES Content Updates.
prefix: ESCU
label: ESCU
@@ -40,13 +40,13 @@ apps:
appid: Splunk_SA_CIM
version: 5.3.2
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_532.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-cim_532.tgz
- uid: 6553
title: Splunk Add-on for Okta Identity Cloud
appid: Splunk_TA_okta_identity_cloud
version: 2.2.0
version: 2.2.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-okta-identity-cloud_220.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_221.tgz
- uid: 6652
title: Add-on for Linux Sysmon
appid: Splunk_TA_linux_sysmon
@@ -65,134 +65,146 @@ apps:
- uid: 742
title: Splunk Add-on for Microsoft Windows
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS
version: 8.8.0
version: 9.0.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_880.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-windows_900.tgz
- uid: 5709
title: Splunk Add-on for Sysmon
appid: Splunk_TA_microsoft_sysmon
version: 4.0.1
version: 4.0.2
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_401.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-sysmon_402.tgz
- uid: 833
title: Splunk Add-on for Unix and Linux
appid: Splunk_TA_nix
version: 9.0.0
version: 9.2.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_900.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_920.tgz
- uid: 5579
title: Splunk Add-on for CrowdStrike FDR
appid: Splunk_TA_CrowdStrike_FDR
version: 1.5.0
version: 2.0.2
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_150.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_202.tgz
- uid: 3185
title: Splunk Add-on for Microsoft IIS
appid: SPLUNK_TA_FOR_IIS
version: 1.3.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_130.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_130.tgz
- uid: 4242
title: TA for Suricata
appid: SPLUNK_TA_FOR_SURICATA
version: 2.3.4
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/ta-for-suricata_234.tgz
- uid: 5466
title: TA for Zeek
appid: SPLUNK_TA_FOR_ZEEK
version: 1.0.8
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_108.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/ta-for-zeek_108.tgz
- uid: 3258
title: Splunk Add-on for NGINX
appid: SPLUNK_ADD_ON_FOR_NGINX
version: 3.2.2
version: 3.3.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_322.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-nginx_330.tgz
- uid: 5238
title: Splunk Add-on for Stream Forwarders
appid: SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS
version: 8.1.1
version: 8.1.3
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_811.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-stream-forwarders_813.tgz
- uid: 5234
title: Splunk Add-on for Stream Wire Data
appid: SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA
version: 8.1.1
version: 8.1.3
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_811.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-stream-wire-data_813.tgz
- uid: 2757
title: Palo Alto Networks Add-on for Splunk
appid: PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK
version: 8.1.1
version: 8.1.3
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_811.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_813.tgz
- uid: 3865
title: Zscaler Technical Add-On for Splunk
appid: Zscaler_CIM
version: 4.0.3
version: 4.0.16
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/zscaler-technical-add-on-for-splunk_403.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/zscaler-technical-add-on-for-splunk_4016.tgz
- uid: 3719
title: Splunk Add-on for Amazon Kinesis Firehose
appid: SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE
version: 1.3.2
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-kinesis-firehose_132.tgz
- uid: 1876
title: Splunk Add-on for AWS
appid: Splunk_TA_aws
version: 7.5.0
appid: Splunk_TA_aws
version: 7.7.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-web-services-aws_750.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services-aws_771.tgz
- uid: 3088
title: Splunk Add-on for Google Cloud Platform
appid: SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM
version: 4.5.0
version: 4.7.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_450.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_470.tgz
- uid: 5556
title: Splunk Add-on for Google Workspace
appid: SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE
version: 2.7.0
version: 3.0.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_270.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_300.tgz
- uid: 3110
title: Splunk Add-on for Microsoft Cloud Services
appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
version: 5.2.2
version: 5.4.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_522.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz
- uid: 4055
title: Splunk Add-on for Microsoft Office 365
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
version: 4.5.1
version: 4.6.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_451.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_460.tgz
- uid: 2890
title: Splunk Machine Learning Toolkit
appid: SPLUNK_MACHINE_LEARNING_TOOLKIT
version: 5.4.1
version: 5.5.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_541.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-machine-learning-toolkit_550.tgz
- uid: 5518
title: Splunk add on for Microsoft Defender Advanced Hunting
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_DEFENDER_ADVANCED_HUNTING
version: 1.4.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/microsoft-defender-advanced-hunting-add-on-for-splunk_141.tgz
- uid: 6207
title: Splunk Add-on for Microsoft Security
appid: Splunk_TA_MS_Security
version: 2.3.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_230.tgz
- uid: 2734
title: URL Toolbox
appid: URL_TOOLBOX
version: 1.9.2
version: 1.9.4
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/url-toolbox_194.tgz
- uid: 6853
title: Splunk Add-on for Admon Enrichment
appid: SA-admon
version: 1.1.0
version: 1.1.2
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_112.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-admon-enrichment_112.tgz
- uid: 5082
title: CrowdStrike Falcon Event Streams Technical Add-On
appid: TA-crowdstrike-falcon-event-streams
version: 3.2.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/crowdstrike-falcon-event-streams-technical-add-on_321.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/crowdstrike-falcon-event-streams-technical-add-on_321.tgz
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
data_sources/aws_cloudfront.yml
+1 -1
View File
@@ -9,7 +9,7 @@ sourcetype: aws:cloudfront:accesslogs
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail.yml
+1 -2
View File
@@ -10,5 +10,4 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
data_sources/aws_cloudtrail_assumerolewithsaml.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_consolelogin.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_copyobject.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- additionalEventData.AuthenticationMethod
data_sources/aws_cloudtrail_createaccesskey.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_createkey.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_createloginprofile.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_createnetworkaclentry.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_createpolicyversion.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_createsnapshot.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_createtask.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_createvirtualmfadevice.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deactivatemfadevice.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deletealarms.yml
+141
View File
@@ -0,0 +1,141 @@
name: AWS CloudTrail DeleteAlarms
id: b0730ac8-0992-4de8-b000-2c7d0fc7a61f
version: 1
date: '2024-07-18'
author: Bhavin Patel, Splunk
description: Data source object for AWS CloudTrail DeleteAlarms
source: aws_cloudtrail
sourcetype: aws:cloudtrail
separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.7.1
fields:
- _time
- action
- app
- authentication_method
- awsRegion
- aws_account_id
- change_type
- command
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- desc
- dest
- dest_ip_range
- dest_port_range
- direction
- dvc
- errorCode
- errorMessage
- eventCategory
- eventID
- eventName
- eventSource
- eventTime
- eventType
- eventVersion
- eventtype
- host
- image_id
- index
- instance_type
- linecount
- managementEvent
- msg
- object
- object_attrs
- object_category
- object_id
- product
- protocol
- protocol_code
- punct
- readOnly
- reason
- recipientAccountId
- region
- requestID
- requestParameters.alarmNames{}
- responseElements
- result
- result_id
- rule_action
- sessionCredentialFromConsole
- signature
- source
- sourceIPAddress
- splunk_server
- splunk_server_group
- src
- src_ip
- src_ip_range
- src_port_range
- src_user
- src_user_id
- src_user_name
- src_user_role
- src_user_type
- start_time
- status
- tag
- tag::action
- tag::eventtype
- tag::object_category
- temp_access_key
- timeendpos
- timestartpos
- user
- userAgent
- userIdentity.accessKeyId
- userIdentity.accountId
- userIdentity.arn
- userIdentity.invokedBy
- userIdentity.principalId
- userIdentity.sessionContext.attributes.creationDate
- userIdentity.sessionContext.attributes.mfaAuthenticated
- userIdentity.sessionContext.sessionIssuer.accountId
- userIdentity.sessionContext.sessionIssuer.arn
- userIdentity.sessionContext.sessionIssuer.principalId
- userIdentity.sessionContext.sessionIssuer.type
- userIdentity.sessionContext.sessionIssuer.userName
- userIdentity.type
- userName
- user_access_key
- user_agent
- user_arn
- user_group_id
- user_id
- user_name
- user_role
- user_type
- vendor
- vendor_account
- vendor_product
- vendor_region
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId":
"AROAYTOGP2RLKZK7JIDWN:AutoScaling-ManageAlarms", "arn": "arn:aws:sts::111111111111:assumed-role/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable/AutoScaling-ManageAlarms",
"accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLJ7ZZZZZZZ", "sessionContext":
{"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLKZK7JIDWN", "arn":
"arn:aws:iam::111111111111:role/aws-service-role/test.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable",
"accountId": "111111111111", "userName": "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable"},
"webIdFederationData": {}, "attributes": {"creationDate": "2023-07-11T11:11:59Z",
"mfaAuthenticated": "false"}}, "invokedBy": "test.amazonaws.com"}, "eventTime":
"2023-07-11T11:12:00Z", "eventSource": "monitoring.amazonaws.com", "eventName":
"DeleteAlarms", "awsRegion": "us-west-1", "sourceIPAddress": "test.amazonaws.com",
"userAgent": "test.amazonaws.com", "requestParameters": {"alarmNames": ["TargetTracking-table/attack-range-orchestrator-backend-AlarmHigh-bbc5c675-6ddb-40d5-9f16-a59147a61c2a",
"TargetTracking-table/attack-range-orchestrator-backend-AlarmLow-1669f952-dd7b-4835-b3d5-8df86d264db2",
"TargetTracking-table/attack-range-orchestrator-backend-ProvisionedCapacityHigh-eac39cba-2339-4c5c-9a13-c527ede7abfd",
"TargetTracking-table/attack-range-orchestrator-backend-ProvisionedCapacityLow-62c8a6e3-edb4-42d1-b26d-e30f33a57a0e"]},
"responseElements": null, "requestID": "af48ccab-e844-4229-883e-5c813e2c2f31", "eventID":
"bcfccd92-5bf1-4de1-9cfd-87fdeb70e452", "readOnly": false, "eventType": "AwsApiCall",
"managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":
"Management"}'
data_sources/aws_cloudtrail_deletedetector.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_deletegroup.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deleteipset.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_deleteloggroup.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- apiVersion
data_sources/aws_cloudtrail_deletelogstream.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- apiVersion
data_sources/aws_cloudtrail_deletenetworkaclentry.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deletepolicy.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deleterule.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- apiVersion
data_sources/aws_cloudtrail_deletesnapshot.yml
+145
View File
@@ -0,0 +1,145 @@
name: AWS CloudTrail DeleteSnapshot
id: b0731ac8-0992-4de8-b000-2c7d0fc2a61f
version: 1
date: '2024-07-18'
author: Bhavin Patel, Splunk
description: Data source object for AWS CloudTrail DeleteSnapshot
source: aws_cloudtrail
sourcetype: aws:cloudtrail
separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.7.1
fields:
- _time
- action
- app
- authentication_method
- awsRegion
- aws_account_id
- change_type
- command
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- desc
- dest
- dest_ip_range
- dest_port_range
- direction
- dvc
- errorCode
- errorMessage
- eventCategory
- eventID
- eventName
- eventSource
- eventTime
- eventType
- eventVersion
- eventtype
- host
- image_id
- index
- instance_type
- linecount
- managementEvent
- msg
- object
- object_attrs
- object_category
- object_id
- product
- protocol
- protocol_code
- punct
- readOnly
- reason
- recipientAccountId
- region
- requestID
- requestParameters.force
- requestParameters.snapshotId
- responseElements
- responseElements._return
- responseElements.requestId
- result
- result_id
- rule_action
- sessionCredentialFromConsole
- signature
- source
- sourceIPAddress
- sourcetype
- splunk_server
- splunk_server_group
- src
- src_ip
- src_ip_range
- src_port_range
- src_user
- src_user_id
- src_user_name
- src_user_role
- src_user_type
- start_time
- status
- tag
- tag::action
- tag::eventtype
- tag::object_category
- temp_access_key
- timeendpos
- timestartpos
- tlsDetails.cipherSuite
- tlsDetails.clientProvidedHostHeader
- tlsDetails.tlsVersion
- user
- userAgent
- userIdentity.accessKeyId
- userIdentity.accountId
- userIdentity.arn
- userIdentity.principalId
- userIdentity.sessionContext.attributes.creationDate
- userIdentity.sessionContext.attributes.mfaAuthenticated
- userIdentity.sessionContext.sessionIssuer.accountId
- userIdentity.sessionContext.sessionIssuer.arn
- userIdentity.sessionContext.sessionIssuer.principalId
- userIdentity.sessionContext.sessionIssuer.type
- userIdentity.sessionContext.sessionIssuer.userName
- userIdentity.type
- userIdentity.userName
- userName
- user_access_key
- user_agent
- user_arn
- user_group_id
- user_id
- user_name
- user_role
- user_type
- vendor
- vendor_account
- vendor_product
- vendor_region
example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "AssumedRole", "principalId":
"AROAYTOGP2RLDF6WPXXXX:daftpunk@splunk.com", "arn": "arn:aws:sts::11111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/daftpunk@splunk.com",
"accountId": "11111111111111", "accessKeyId": "AAAAAAAAAAAAAAAAAA", "sessionContext":
{"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WPXXXX", "arn":
"arn:aws:iam::11111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f",
"accountId": "11111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_11"},
"attributes": {"creationDate": "2024-01-18T09:55:32Z", "mfaAuthenticated": "false"}}},
"eventTime": "2024-01-18T10:02:08Z", "eventSource": "ec2.amazonaws.com", "eventName":
"DeleteSnapshot", "awsRegion": "eu-central-1", "sourceIPAddress": "80.187.64.117",
"userAgent": "AWS Internal", "requestParameters": {"snapshotId": "snap-0b5d5eaad2e6efa11",
"force": false}, "responseElements": {"requestId": "86e4bb11-2a21-4a16-8c40-4c1bc08a9a03",
"_return": true}, "requestID": "86e4bb11-2a21-4a16-8c40-4c1bc08a9a03", "eventID":
"56f61d71-6620-4958-8dbf-03410913f1cc", "readOnly": false, "eventType": "AwsApiCall",
"managementEvent": true, "recipientAccountId": "11111111111111", "eventCategory":
"Management", "sessionCredentialFromConsole": "true"}'
data_sources/aws_cloudtrail_deletetrail.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_deletevirtualmfadevice.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_deletewebacl.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- apiVersion
data_sources/aws_cloudtrail_describeeventaggregates.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_describeimagescanfindings.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_getobject.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- additionalEventData.AuthenticationMethod
data_sources/aws_cloudtrail_getpassworddata.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_jobcreated.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_modifydbinstance.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_modifyimageattribute.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_modifysnapshotattribute.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_putbucketacl.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_putbucketlifecycle.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- additionalEventData.AuthenticationMethod
data_sources/aws_cloudtrail_putbucketreplication.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- additionalEventData.AuthenticationMethod
data_sources/aws_cloudtrail_putbucketversioning.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- additionalEventData.AuthenticationMethod
data_sources/aws_cloudtrail_putimage.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_putkeypolicy.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_replacenetworkaclentry.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_setdefaultpolicyversion.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_stoplogging.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_updateloginprofile.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_updatesamlprovider.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- action
data_sources/aws_cloudtrail_updatetrail.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- app
data_sources/aws_cloudwatchlogs_vpcflow.yml
+5 -4
View File
@@ -8,9 +8,9 @@ source: aws_cloudwatchlogs_vpcflow
sourcetype: aws:cloudwatchlogs:vpcflow
separator: eventName
supported_TA:
- name: Splunk Add-on for AWS
version: 7.6.0
url: https://splunkbase.splunk.com/app/1876
- name: Splunk Add-on for AWS
version: 7.7.1
url: https://splunkbase.splunk.com/app/1876
fields:
- _raw
- _time
@@ -65,4 +65,5 @@ fields:
- vendor_product
- version
- vpcflow_action
example_log: '2 123397614277 eni-0b0f9f261f45e6489 10.0.1.30 10.0.1.1 47254 22 17 2 98 1697608042 1697608070 ACCEPT OK'
example_log: 2 123397614277 eni-0b0f9f261f45e6489 10.0.1.30 10.0.1.1 47254 22 17 2
98 1697608042 1697608070 ACCEPT OK
data_sources/aws_security_hub.yml
+1 -1
View File
@@ -9,7 +9,7 @@ sourcetype: aws:securityhub:finding
supported_TA:
- name: Splunk Add-on for AWS
url: https://splunkbase.splunk.com/app/1876
version: 7.6.0
version: 7.7.1
fields:
- _time
- AwsAccountId
data_sources/azure_active_directory.yml
+2 -2
View File
@@ -3,11 +3,11 @@ id: 51ca21e5-bda2-4652-bb29-27c7bc18a81c
version: 1
date: '2024-07-18'
author: Patrick Bareiss, Splunk
description: Data source object for Azure Active Directory
description: Data source object for Azure Active Directory
source: Azure AD
sourcetype: azure:monitor:aad
separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml
+1 -1
View File
@@ -11,7 +11,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_add_member_to_role.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_add_owner_to_application.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_add_service_principal.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_add_unverified_domain.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_consent_to_application.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_disable_strong_authentication.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_enable_account.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_invite_external_user.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_reset_password_(by_admin).yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_set_domain_authentication.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_sign_in_activity.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_update_application.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_update_authorization_policy.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_update_user.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_active_directory_user_registered_security_info.yml
+1 -1
View File
@@ -11,7 +11,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- Level
data_sources/azure_audit_create_or_update_an_azure_automation_account.yml
+1 -1
View File
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- authorization.action
data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml
+1 -1
View File
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- authorization.action
data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml
+1 -1
View File
@@ -11,7 +11,7 @@ separator: operationName.localizedValue
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 5.3.2
version: 5.4.1
fields:
- _time
- authorization.action
data_sources/crowdstrike_processrollup2.yml
+11 -11
View File
@@ -10,7 +10,7 @@ separator: event_simpleName
supported_TA:
- name: Splunk Add-on for CrowdStrike FDR
url: https://splunkbase.splunk.com/app/5579
version: 2.0.0
version: 2.0.2
fields:
- AuthenticationId
- AuthenticationId_meaning
@@ -91,16 +91,16 @@ fields:
- user_id
- vendor_product
field_mappings:
- data_model: cim
data_set: Endpoint.Processes
mapping:
CommandLine: Processes.process
ImageFileName: Processes.process_path
ParentBaseFileName: Processes.parent_process_name
ParentProcessId: Processes.parent_process_id
RawProcessId: Processes.process_id
SHA256HashData: Processes.process_hash
UserSid: Processes.user
- data_model: cim
data_set: Endpoint.Processes
mapping:
CommandLine: Processes.process
ImageFileName: Processes.process_path
ParentBaseFileName: Processes.parent_process_name
ParentProcessId: Processes.parent_process_id
RawProcessId: Processes.process_id
SHA256HashData: Processes.process_hash
UserSid: Processes.user
example_log: '{"LinkName":"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start
Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk","ProcessCreateFlags":"67634196","IntegrityLevel":"12288","ParentProcessId":"5459598860","SourceProcessId":"5459598860","aip":"3.126.231.40","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-586445407-708991241-1829972403-500","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"3b98faafc17b47beb9027c437fceeafdf0624a1c","ParentBaseFileName":"explorer.exe","EventOrigin":"1","ImageSubsystem":"3","id":"e2210781-0e8f-47d2-bf6a-56d2c59f38ee","EffectiveTransmissionClass":"3","SessionId":"2","ShowWindowFlags":"1","Tags":"27,
40, 151, 874, 924, 12094627905582, 12094627906234, 211106232533012, 212205744161605,
data_sources/g_suite_drive.yml
+1 -1
View File
@@ -9,7 +9,7 @@ sourcetype: gsuite:drive:json
supported_TA:
- name: Splunk Add-on for Google Workspace
url: https://splunkbase.splunk.com/app/5556
version: 2.8.1
version: 3.0.0
fields:
- _time
- email
data_sources/g_suite_gmail.yml
+1 -1
View File
@@ -9,7 +9,7 @@ sourcetype: gsuite:gmail:bigquery
supported_TA:
- name: Splunk Add-on for Google Workspace
url: https://splunkbase.splunk.com/app/5556
version: 2.8.1
version: 3.0.0
fields:
- _time
- action_type
data_sources/github.yml
+1 -1
View File
@@ -9,7 +9,7 @@ sourcetype: aws:firehose:json
supported_TA:
- name: Splunk Add-on for Github
url: https://splunkbase.splunk.com/app/6254
version: 3.0.0
version: 3.1.0
fields:
- _time
- action
data_sources/google_workspace_login_failure.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: event.name
supported_TA:
- name: Splunk Add-on for Google Workspace
url: https://splunkbase.splunk.com/app/5556
version: 2.8.1
version: 3.0.0
fields:
- _time
- actor.email
data_sources/google_workspace_login_success.yml
+1 -1
View File
@@ -10,7 +10,7 @@ separator: event.name
supported_TA:
- name: Splunk Add-on for Google Workspace
url: https://splunkbase.splunk.com/app/5556
version: 2.8.1
version: 3.0.0
fields:
- _time
- actor.email
data_sources/ivanti_vtm_audit.yml
+19
View File
@@ -0,0 +1,19 @@
name: Ivanti VTM Audit
id: b04be6e5-2002-4a49-8722-52285635b8f5
version: 1
date: '2024-08-19'
author: Michael Haag, Splunk
description: Data source object for Ivanti Virtual Traffic Manager (vTM)
source: ivanti_vtm
sourcetype: ivanti_vtm_audit
supported_TA: []
fields:
- _time
- IP
- MODUSER
- OPERATION
- MODGROUP
- AUTH
- USER
- GROUP
example_log: '[19/Aug/2024:19:41:22 +0000] USER=!!ABSENT!! GROUP=!!ABSENT!! AUTH=!!ABSENT!! IP=!!ABSENT!! OPERATION=adduser MODUSER=newadmin MODGROUP=admin'

Some files were not shown because too many files have changed in this diff Show More