admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
P4T12ICK
2023-02-17 17:53:51 +01:00
parent 8cc5b11302
commit edb111c9b9
5 changed files with 37 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2
+2 -2
View File
@@ -10,7 +10,7 @@
"confidence_id", {{ detection.tags.confidence_id }},
"devices", [
create_map(
"uid", ucast(map_get( dest_device , "ref_uid"), "string", null), "type_id", 0)
"uid", device_uuid, "type_id", 0)
],
"duration", 0,
"time", timestamp,
@@ -40,7 +40,7 @@
"type_id", 10200101,
"users", [
create_map(
"uid", ucast(map_get(dest_user, "ref_uid"),"string", null)
"uid", inferred_caller_user_uid
)
]
)
bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py
+7 -5
View File
@@ -92,11 +92,13 @@ class SplunkBABackend(TextQueryBackend):
| eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>", null)
| eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null)
| eval disposition_id = ucast(map_get(input_event, "disposition_id"), "integer", null)
| eval origin_map=ucast(map_get(input_event, "origin"), "map<string,any>", null)
| eval device=ucast(map_get(origin_map, "device"), "map<string, any>",null)
| eval user=ucast(map_get(input_event, "user"), "map<string, any>", null)
| eval device_name=ucast(map_get(device, "name"), "string", null)
| eval user_name=ucast(map_get(user,"name"), "string", null)
| eval device = ucast(map_get(input_event, "device"), "map<string,any>", null)
| eval device_hostname = ucast(map_get(device, "hostname"), "string", null)
| eval device_uuid = ucast(map_get(device, "uuid"), "string", null)
| eval inferred = ucast(map_get(input_event, "device"), "map<string,any>", null)
| eval inferred_caller = ucast(map_get(inferred, "caller"), "map<string,any>", null)
| eval inferred_caller_user = ucast(map_get(inferred_caller, "user"), "map<string,any>", null)
| eval inferred_caller_user_uid = ucast(map_get(inferred_caller_user, "uid"), "string", null)
""".replace("\n", " ")
parsed_fields = []
dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
Vendored
+14 -12
View File
@@ -7,16 +7,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
disposition_id = ucast(map_get(input_event, "disposition_id"), "integer", null)
| eval origin_map=ucast(map_get(input_event, "origin"), "map<string,any>", null)
| eval device=ucast(map_get(origin_map, "device"), "map<string, any>",null) | eval
user=ucast(map_get(input_event, "user"), "map<string, any>", null) | eval device_name=ucast(map_get(device,
"name"), "string", null) | eval user_name=ucast(map_get(user,"name"), "string",
null) | eval process=ucast(map_get(input_event,"process"), "map<string, any>", null)
| eval process_file=ucast(map_get(process,"file"), "map<string, any>", null) | eval
process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
| eval device = ucast(map_get(input_event, "device"), "map<string,any>", null) |
eval device_hostname = ucast(map_get(device, "hostname"), "string", null) | eval
device_uuid = ucast(map_get(device, "uuid"), "string", null) | eval inferred = ucast(map_get(input_event,
"device"), "map<string,any>", null) | eval inferred_caller = ucast(map_get(inferred,
"caller"), "map<string,any>", null) | eval inferred_caller_user = ucast(map_get(inferred_caller,
"user"), "map<string,any>", null) | eval inferred_caller_user_uid = ucast(map_get(inferred_caller_user,
"uid"), "string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval
actor_process=ucast(map_get(actor,"process"), "map<string, any>", null) | eval actor_process_file=ucast(map_get(actor_process,"file"),
"map<string, any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "map<string,
any>", null) | where process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
@@ -33,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
"confidence_id", 2,
"devices", [
create_map(
"uid", ucast(map_get( dest_device , "ref_uid"), "string", null), "type_id", 0)
"uid", device_uuid, "type_id", 0)
],
"duration", 0,
"time", timestamp,
@@ -63,7 +65,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
"type_id", 10200101,
"users", [
create_map(
"uid", ucast(map_get(dest_user, "ref_uid"),"string", null)
"uid", inferred_caller_user_uid
)
]
)
dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+2 -2
View File
@@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
"confidence_id", 3,
"devices", [
create_map(
"uid", ucast(map_get( dest_device , "ref_uid"), "string", null), "type_id", 0)
"uid", device_uuid, "type_id", 0)
],
"duration", 0,
"time", timestamp,
@@ -69,7 +69,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
"type_id", 10200101,
"users", [
create_map(
"uid", ucast(map_get(dest_user, "ref_uid"),"string", null)
"uid", inferred_caller_user_uid
)
]
)
ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+12 -10
View File
@@ -13,16 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
disposition_id = ucast(map_get(input_event, "disposition_id"), "integer", null)
| eval origin_map=ucast(map_get(input_event, "origin"), "map<string,any>", null)
| eval device=ucast(map_get(origin_map, "device"), "map<string, any>",null) | eval
user=ucast(map_get(input_event, "user"), "map<string, any>", null) | eval device_name=ucast(map_get(device,
"name"), "string", null) | eval user_name=ucast(map_get(user,"name"), "string",
null) | eval process=ucast(map_get(input_event,"process"), "map<string, any>", null)
| eval process_file=ucast(map_get(process,"file"), "map<string, any>", null) | eval
process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
| eval device = ucast(map_get(input_event, "device"), "map<string,any>", null) |
eval device_hostname = ucast(map_get(device, "hostname"), "string", null) | eval
device_uuid = ucast(map_get(device, "uuid"), "string", null) | eval inferred = ucast(map_get(input_event,
"device"), "map<string,any>", null) | eval inferred_caller = ucast(map_get(inferred,
"caller"), "map<string,any>", null) | eval inferred_caller_user = ucast(map_get(inferred_caller,
"user"), "map<string,any>", null) | eval inferred_caller_user_uid = ucast(map_get(inferred_caller_user,
"uid"), "string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval
actor_process=ucast(map_get(actor,"process"), "map<string, any>", null) | eval actor_process_file=ucast(map_get(actor_process,"file"),
"map<string, any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "map<string,
any>", null) | where process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")