admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

network: more typefixes

Browse Source
This commit is contained in:
ljstella
2024-11-15 10:37:10 -06:00
parent 4b5f5a98c3
commit f15bde0e1b
29 changed files with 30 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml
+1 -1
View File
@@ -47,7 +47,7 @@ rba:
$src$, kindly review.
risk_objects:
- field: src
type: hostname
type: system
score: 63
threat_objects:
- field: domain
detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
+1 -1
View File
@@ -51,7 +51,7 @@ rba:
message: A DNS data exfiltration request was sent by this host $src$ , kindly review.
risk_objects:
- field: src
type: hostname
type: system
score: 45
threat_objects:
- field: query
detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
+1 -1
View File
@@ -56,7 +56,7 @@ rba:
host $host$
risk_objects:
- field: host
type: hostname
type: system
score: 56
threat_objects: []
tags:
detections/network/detect_ipv6_network_infrastructure_threats.yml
+1 -1
View File
@@ -42,7 +42,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/detect_remote_access_software_usage_dns.yml
+1 -1
View File
@@ -56,7 +56,7 @@ rba:
message: A domain for a known remote access software $query$ was contacted by $src$.
risk_objects:
- field: src
type: hostname
type: system
score: 4
threat_objects:
- field: query
detections/network/detect_remote_access_software_usage_traffic.yml
+1 -1
View File
@@ -57,7 +57,7 @@ rba:
detected from $src$.
risk_objects:
- field: src
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/detect_snicat_sni_exfiltration.yml
+1 -1
View File
@@ -31,7 +31,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/detect_software_download_to_network_device.yml
+1 -1
View File
@@ -35,7 +35,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
+1 -1
View File
@@ -50,7 +50,7 @@ rba:
message: A suspicious DNS TXT response was detected on host $src$ , kindly review.
risk_objects:
- field: src
type: hostname
type: system
score: 45
threat_objects:
- field: answer
detections/network/detect_unauthorized_assets_by_mac_address.yml
+1 -1
View File
@@ -34,7 +34,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/detect_zerologon_via_zeek.yml
+1 -1
View File
@@ -33,7 +33,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/dns_query_length_outliers___mltk.yml
+1 -1
View File
@@ -46,7 +46,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/dns_query_length_with_high_standard_deviation.yml
+1 -1
View File
@@ -45,7 +45,7 @@ rba:
query in host $host$
risk_objects:
- field: host
type: hostname
type: system
score: 56
threat_objects: []
tags:
detections/network/excessive_dns_failures.yml
+1 -1
View File
@@ -33,7 +33,7 @@ rba:
message: Excessive DNS failures detected on $src$
risk_objects:
- field: src
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
+1 -1
View File
@@ -50,7 +50,7 @@ rba:
occurred.
risk_objects:
- field: dest
type: hostname
type: system
score: 70
threat_objects: []
tags:
detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
+1 -1
View File
@@ -42,7 +42,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/internal_horizontal_port_scan.yml
+1 -1
View File
@@ -50,7 +50,7 @@ rba:
IPs
risk_objects:
- field: src_ip
type: hostname
type: system
score: 64
threat_objects: []
tags:
detections/network/internal_horizontal_port_scan_nmap_top_20.yml
+1 -1
View File
@@ -51,7 +51,7 @@ rba:
IPs
risk_objects:
- field: src_ip
type: hostname
type: system
score: 72
threat_objects: []
tags:
detections/network/internal_vertical_port_scan.yml
+1 -1
View File
@@ -50,7 +50,7 @@ rba:
message: $src_ip$ has scanned $totalDestPortCount$ ports on $dest_ip$
risk_objects:
- field: src_ip
type: hostname
type: system
score: 64
threat_objects: []
tags:
detections/network/internal_vulnerability_scan.yml
+1 -1
View File
@@ -36,7 +36,7 @@ rba:
message: Large volume of IDS signatures triggered by $src$
risk_objects:
- field: src
type: hostname
type: system
score: 64
threat_objects: []
tags:
detections/network/large_volume_of_dns_any_queries.yml
+1 -1
View File
@@ -27,7 +27,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/ngrok_reverse_proxy_on_network.yml
+1 -1
View File
@@ -43,7 +43,7 @@ rba:
message: An endpoint, $src$, is beaconing out to the reverse proxy service of Ngrok.
risk_objects:
- field: src
type: hostname
type: system
score: 50
threat_objects: []
tags:
detections/network/protocol_or_port_mismatch.yml
+1 -1
View File
@@ -32,7 +32,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/protocols_passing_authentication_in_cleartext.yml
+1 -1
View File
@@ -37,7 +37,7 @@ rba:
type: user
score: 25
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/remote_desktop_network_bruteforce.yml
+2 -2
View File
@@ -30,10 +30,10 @@ rba:
message: $dest$ may be the target of an RDP Bruteforce
risk_objects:
- field: dest
type: hostname
type: system
score: 25
- field: src
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/smb_traffic_spike.yml
+1 -1
View File
@@ -31,7 +31,7 @@ rba:
message: Anomalous splike of SMB traffic sent from $src$
risk_objects:
- field: src
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/smb_traffic_spike___mltk.yml
+1 -1
View File
@@ -46,7 +46,7 @@ rba:
message: tbd
risk_objects:
- field: dest
type: hostname
type: system
score: 25
threat_objects: []
tags:
detections/network/ssl_certificates_with_punycode.yml
+1 -1
View File
@@ -36,7 +36,7 @@ rba:
email domain on $dest$.
risk_objects:
- field: dest
type: hostname
type: system
score: 15
threat_objects: []
tags:
detections/network/zeek_x509_certificate_with_punycode.yml
+1 -1
View File
@@ -36,7 +36,7 @@ rba:
alternative name on $dest$.
risk_objects:
- field: dest
type: hostname
type: system
score: 15
threat_objects: []
tags: