From 5b7c23cb5c6306d3ec5be53239bbf8dd1185db92 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2020 18:44:35 +0000 Subject: [PATCH 1/7] Bump taxii2-client from 2.0.0 to 2.1.0 Bumps [taxii2-client](https://github.com/oasis-open/cti-taxii-client) from 2.0.0 to 2.1.0. - [Release notes](https://github.com/oasis-open/cti-taxii-client/releases) - [Changelog](https://github.com/oasis-open/cti-taxii-client/blob/master/CHANGES.txt) - [Commits](https://github.com/oasis-open/cti-taxii-client/compare/v2.0.0...v2.1.0) Signed-off-by: dependabot-preview[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index c2cc9c77ba..07d91502cd 100644 --- a/requirements.txt +++ b/requirements.txt @@ -29,7 +29,7 @@ simplejson==3.17.0 six==1.15.0 stix2==1.4.0 stix2-patterns==1.3.0 -taxii2-client==2.0.0 +taxii2-client==2.1.0 toml==0.10.0 typing==3.7.4.1 urllib3==1.25.9 From e7a0e7b7746175b3db9eac7e22887c1c8559ac5e Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2020 18:52:26 +0000 Subject: [PATCH 2/7] Bump toml from 0.10.0 to 0.10.1 Bumps [toml](https://github.com/uiri/toml) from 0.10.0 to 0.10.1. - [Release notes](https://github.com/uiri/toml/releases) - [Changelog](https://github.com/uiri/toml/blob/master/RELEASE.rst) - [Commits](https://github.com/uiri/toml/compare/0.10.0...0.10.1) Signed-off-by: dependabot-preview[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 07d91502cd..d8cc7a3790 100644 --- a/requirements.txt +++ b/requirements.txt @@ -30,7 +30,7 @@ six==1.15.0 stix2==1.4.0 stix2-patterns==1.3.0 taxii2-client==2.1.0 -toml==0.10.0 +toml==0.10.1 typing==3.7.4.1 urllib3==1.25.9 virtualenv==20.0.21 From 0a4f5f27c9945ef4ca994e26909aaefd58d96ef9 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2020 21:31:50 +0000 Subject: [PATCH 3/7] Bump pre-commit from 2.5.0 to 2.5.1 Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 2.5.0 to 2.5.1. - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/master/CHANGELOG.md) - [Commits](https://github.com/pre-commit/pre-commit/compare/v2.5.0...v2.5.1) Signed-off-by: dependabot-preview[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index d8cc7a3790..4a233eaabb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -17,7 +17,7 @@ MarkupSafe==1.1.1 more-itertools==8.3.0 nodeenv==1.4.0 pathlib2==2.3.5 -pre-commit==2.5.0 +pre-commit==2.5.1 pyrsistent==0.16.0 python-dateutil==2.8.1 pytz==2020.1 From f33b65a08512e4b304879f244d62f6b0e99b5dc8 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 9 Jun 2020 14:51:13 -0700 Subject: [PATCH 4/7] remove space --- ...oss_account_activity_from_previously_unseen_account___dm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml index fa372cafce..465c8d47e1 100644 --- a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml +++ b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml @@ -27,7 +27,7 @@ known_false_positives: Using multiple AWS accounts and roles is perfectly valid You should validate with the account owner that this is a legitimate request. tags: analytics_story: - - Suspicious Cloud Authentication Activites + - Suspicious Cloud Authentication Activites kill_chain_phases: - Actions on Objectives cis20: From f7ea4f268414a21393dff0fa77372694471ef83f Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 9 Jun 2020 15:09:40 -0700 Subject: [PATCH 5/7] typo --- ...oss_account_activity_from_previously_unseen_account___dm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml index 465c8d47e1..1da59e4f2f 100644 --- a/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml +++ b/detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml @@ -27,7 +27,7 @@ known_false_positives: Using multiple AWS accounts and roles is perfectly valid You should validate with the account owner that this is a legitimate request. tags: analytics_story: - - Suspicious Cloud Authentication Activites + - Suspicious Cloud Authentication Activities kill_chain_phases: - Actions on Objectives cis20: From f8121a0be7b6ee1ee83305b648d2adb573dbbc84 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 10 Jun 2020 11:28:23 -0400 Subject: [PATCH 6/7] fixing broken links --- docs/README.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/README.md b/docs/README.md index 9ff68be2bf..601c7e22ad 100644 --- a/docs/README.md +++ b/docs/README.md @@ -32,21 +32,21 @@ If you want to help the rest of the security community by sharing your own detec ## Content Parts -* [stories/](stories/): All Analytic Stories -* [detections/](detections/): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories -* [response_tasks/](response_tasks/): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories -* [responses/](responses/): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories -* [baselines/](baselines/): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories +* [stories/](https://github.com/splunk/security-content/tree/develop/stories): All Analytic Stories +* [detections/](https://github.com/splunk/security-content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories +* [response_tasks/](https://github.com/splunk/security-content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories +* [responses/](https://github.com/splunk/security-content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories +* [baselines/](https://github.com/splunk/security-content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories #### Content Spec Files -* [stories](docs/spec/stories.spec.md) -* [detections](docs/spec/detections.spec.md) -* [deployments](docs/spec/deployments.spec.md) -* [responses](docs/spec/responses.spec.md) -* [response_tasks](docs/spec/response_tasks.spec.md) -* [baselines](docs/spec/baselines.spec.md) -* [lookups](docs/spec/lookups.spec.md) -* [macros](docs/spec/macros.spec.md) +* [stories](https://github.com/splunk/security-content/blob/develop/docs/spec/stories.spec.md) +* [detections](https://github.com/splunk/security-content/blob/develop/docs/spec/detections.spec.md) +* [deployments](https://github.com/splunk/security-content/blob/develop/docs/spec/deployments.spec.md) +* [responses](https://github.com/splunk/security-content/blob/develop/docs/spec/responses.spec.md) +* [response_tasks](https://github.com/splunk/security-content/blob/develop/docs/spec/response_tasks.spec.md) +* [baselines](https://github.com/splunk/security-content/blob/develop/docs/spec/baselines.spec.md) +* [lookups](https://github.com/splunk/security-content/blob/develop/docs/spec/lookups.spec.md) +* [macros](https://github.com/splunk/security-content/blob/develop/docs/spec/macros.spec.md) From 48dc133d41c1bebab65c7d2d959e36653b0b5086 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 10 Jun 2020 12:07:06 -0700 Subject: [PATCH 7/7] minor quotes error in spl --- detections/detect_new_user_aws_console_login___dm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/detect_new_user_aws_console_login___dm.yml b/detections/detect_new_user_aws_console_login___dm.yml index c42517d731..f47b7dc286 100644 --- a/detections/detect_new_user_aws_console_login___dm.yml +++ b/detections/detect_new_user_aws_console_login___dm.yml @@ -15,7 +15,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers often you run the detection searches) to refresh the baselines. type: ESCU author: Rico Valdez, Splunk -search: "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | rename Authentication.user as user | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(), '-70m@m'), 'First Time Logging into AWS Console','Previously Seen User')| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_new_user_aws_console_login___dm_filter`" +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | rename Authentication.user as user | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_user_aws_console_login___dm_filter`' known_false_positives: When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.