From 3fce3dff3c347889e6668cebc833ea21e236762f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 Oct 2023 16:24:38 -0700 Subject: [PATCH 1/3] contentctl validate throws errors on the following playbooks. the first had an invalid uuid (improper number of characters). The second had unallowed characters in the name (underscores). I will reach out to the devs for this content to understand what implications these changes may have. --- ...G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml | 2 +- playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml b/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml index 4c7c0f0004..1cb92b64dd 100644 --- a/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml +++ b/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml @@ -1,5 +1,5 @@ name: G Suite for GMail Message Identifier Activity Analysis -id: 5299d6dd-e9c4-4afa-b051-928ace0ff816d +id: 5299d6dd-e9c4-4afa-b051-928ace0ff816 version: 1 date: '2023-05-12' author: Lou Stella, Splunk diff --git a/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml b/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml index 3a32316c0d..0db56f477e 100644 --- a/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml +++ b/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml @@ -1,4 +1,4 @@ -name: Splunk_Attack_Analyzer_Dynamic_Analysis +name: Splunk Attack Analyzer Dynamic Analysis id: c77faffe-1339-43b0-b870-86582da9063e version: 1 date: '2023-03-24' @@ -26,4 +26,4 @@ tags: - Enrichment - Phishing - Endpoint - defend_technique_id: D3-DA \ No newline at end of file + defend_technique_id: D3-DA From 7ff09049e3b377bab67e9de8eb1b075030153d80 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 Oct 2023 16:48:52 -0700 Subject: [PATCH 2/3] Fix the ids associated with a number of playbooks and fix incorrectly named referenced detections. Check with Playbook SME to understand the full implications of these changes. --- playbooks/log4j_investigate.yml | 2 +- playbooks/log4j_respond.yml | 2 +- playbooks/risk_notable_block_indicators.yml | 2 +- playbooks/risk_notable_enrich.yml | 2 +- playbooks/risk_notable_import_data.yml | 2 +- playbooks/risk_notable_investigate.yml | 2 +- playbooks/risk_notable_merge_events.yml | 2 +- playbooks/risk_notable_mitigate.yml | 2 +- playbooks/risk_notable_preprocess.yml | 2 +- playbooks/risk_notable_protect_assets_and_users.yml | 2 +- playbooks/risk_notable_review_indicators.yml | 2 +- playbooks/risk_notable_verdict.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/playbooks/log4j_investigate.yml b/playbooks/log4j_investigate.yml index 25097050bf..ef1fe43747 100644 --- a/playbooks/log4j_investigate.yml +++ b/playbooks/log4j_investigate.yml @@ -22,7 +22,7 @@ tags: - Curl Download and Bash Execution - Wget Download and Bash Execution - Linux Java Spawning Shell - - Windows Java Spawning Shell + - Windows Java Spawning Shells - Java Class File download by Java User Agent - Outbound Network Connection from Java Using Default Ports - Log4Shell JNDI Payload Injection Attempt diff --git a/playbooks/log4j_respond.yml b/playbooks/log4j_respond.yml index 01bf65e624..abf4e879f3 100644 --- a/playbooks/log4j_respond.yml +++ b/playbooks/log4j_respond.yml @@ -22,7 +22,7 @@ tags: - Curl Download and Bash Execution - Wget Download and Bash Execution - Linux Java Spawning Shell - - Windows Java Spawning Shell + - Windows Java Spawning Shells - Java Class File download by Java User Agent - Outbound Network Connection from Java Using Default Ports - Log4Shell JNDI Payload Injection Attempt diff --git a/playbooks/risk_notable_block_indicators.yml b/playbooks/risk_notable_block_indicators.yml index fef4d2fbb9..adad175212 100644 --- a/playbooks/risk_notable_block_indicators.yml +++ b/playbooks/risk_notable_block_indicators.yml @@ -1,5 +1,5 @@ name: Risk Notable Block Indicators -id: rn0edc96-ff2b-48b0-9f6f-83da3783fd63 +id: 000edc96-ff2b-48b0-9f6f-83da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_enrich.yml b/playbooks/risk_notable_enrich.yml index 12299a549d..445fc87919 100644 --- a/playbooks/risk_notable_enrich.yml +++ b/playbooks/risk_notable_enrich.yml @@ -1,5 +1,5 @@ name: Risk Notable Enrich -id: rn0edc96-ff2b-48b0-9f6f-43da3783fd63 +id: 010edc96-ff2b-48b0-9f6f-43da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_import_data.yml b/playbooks/risk_notable_import_data.yml index 65c3f0742b..d9707adb32 100644 --- a/playbooks/risk_notable_import_data.yml +++ b/playbooks/risk_notable_import_data.yml @@ -1,5 +1,5 @@ name: Risk Notable Import Data -id: rn0edc96-ff2b-48b0-9f6f-23da3783fd63 +id: 020edc96-ff2b-48b0-9f6f-23da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_investigate.yml b/playbooks/risk_notable_investigate.yml index ebbf5249a5..5c67101e47 100644 --- a/playbooks/risk_notable_investigate.yml +++ b/playbooks/risk_notable_investigate.yml @@ -1,5 +1,5 @@ name: Risk Notable Investigate -id: rn0edc96-ff2b-48b0-9f6f-03da3783fd63 +id: 030edc96-ff2b-48b0-9f6f-03da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_merge_events.yml b/playbooks/risk_notable_merge_events.yml index 05f6f92824..f294e78cd7 100644 --- a/playbooks/risk_notable_merge_events.yml +++ b/playbooks/risk_notable_merge_events.yml @@ -1,5 +1,5 @@ name: Risk Notable Merge Events -id: rn0edc96-ff2b-48b0-9f6f-53da3783fd63 +id: 040edc96-ff2b-48b0-9f6f-53da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_mitigate.yml b/playbooks/risk_notable_mitigate.yml index 6a57ba6f14..c3a547cf0a 100644 --- a/playbooks/risk_notable_mitigate.yml +++ b/playbooks/risk_notable_mitigate.yml @@ -1,5 +1,5 @@ name: Risk Notable Mitigate -id: rn0edc96-ff2b-48b0-9f6f-63da3783fd63 +id: 050edc96-ff2b-48b0-9f6f-63da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_preprocess.yml b/playbooks/risk_notable_preprocess.yml index d3d0c9b9cf..d48961a068 100644 --- a/playbooks/risk_notable_preprocess.yml +++ b/playbooks/risk_notable_preprocess.yml @@ -1,5 +1,5 @@ name: Risk Notable Preprocess -id: rn0edc96-ff2b-48b0-9f6f-13da3783fd63 +id: 060edc96-ff2b-48b0-9f6f-13da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_protect_assets_and_users.yml b/playbooks/risk_notable_protect_assets_and_users.yml index 4429c9bf1b..276fa1389e 100644 --- a/playbooks/risk_notable_protect_assets_and_users.yml +++ b/playbooks/risk_notable_protect_assets_and_users.yml @@ -1,5 +1,5 @@ name: Risk Notable Protect Assets and Users -id: rn0edc96-ff2b-48b0-9f6f-93da3783fd63 +id: 070edc96-ff2b-48b0-9f6f-93da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_review_indicators.yml b/playbooks/risk_notable_review_indicators.yml index 446aa2a2c6..e0319e9607 100644 --- a/playbooks/risk_notable_review_indicators.yml +++ b/playbooks/risk_notable_review_indicators.yml @@ -1,5 +1,5 @@ name: Risk Notable Review Indicators -id: rn0edc96-ff2b-48b0-9f6f-73da3783fd63 +id: 080edc96-ff2b-48b0-9f6f-73da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_verdict.yml b/playbooks/risk_notable_verdict.yml index a8b06dd070..4f394d6f71 100644 --- a/playbooks/risk_notable_verdict.yml +++ b/playbooks/risk_notable_verdict.yml @@ -1,5 +1,5 @@ name: Risk Notable Verdict -id: rn0edc96-ff2b-48b0-9f6f-33da3783fd63 +id: 090edc96-ff2b-48b0-9f6f-33da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk From 6ba29754a6e7e6cb35386da4142c3d679d69182c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 Oct 2023 17:03:13 -0700 Subject: [PATCH 3/3] Meaningless commit to the release branch so that we can open a PR --- contentctl.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.py b/contentctl.py index ccee1712d6..8229a6e7c7 100644 --- a/contentctl.py +++ b/contentctl.py @@ -1,6 +1,6 @@ import sys import argparse -import os +import os from bin.contentctl_project.contentctl_core.domain.entities.link_validator import LinkValidator