diff --git a/bin/generate.py b/bin/generate.py
index 3c2763e8e1..a4eecd7da6 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -124,11 +124,17 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
detection['risk_score'] = detection['tags']['risk_score']
if 'product' in detection['tags']:
detection['product'] = detection['tags']['product']
+ if (OUTPUT_PATH) == 'dist/mustang':
+ detection['disabled'] = 'false'
+
+
for baseline in baselines:
data_model = parse_data_models_from_search(baseline['search'])
if data_model:
baseline['data_model'] = data_model
+ if (OUTPUT_PATH) == 'dist/mustang':
+ baseline['disabled'] = 'false'
matched_deployment = get_deployments(baseline, deployments)
baseline['deployment'] = matched_deployment
diff --git a/bin/jinja2_templates/analytic_stories.j2 b/bin/jinja2_templates/analytic_stories.j2
index eac6ee050f..ba45f92e02 100644
--- a/bin/jinja2_templates/analytic_stories.j2
+++ b/bin/jinja2_templates/analytic_stories.j2
@@ -39,6 +39,7 @@ description = {{ story.description }}
{% if story.narrative is defined %}
narrative = {{ story.narrative }}
{% endif %}
+product = {{ story.tags.product}}
{% endfor %}
#### END STORIES ####
diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2
index 351c73851d..55bfce0eb6 100644
--- a/bin/jinja2_templates/savedsearches.j2
+++ b/bin/jinja2_templates/savedsearches.j2
@@ -82,7 +82,11 @@ action.email.useNSSubject = 1
{% endif %}
{% endif %}
alert.digest_mode = 1
+{% if detection.disabled is defined %}
+disabled = false
+{% else %}
disabled = true
+{% endif %}
enableSched = 1
counttype = number of events
relation = greater than
@@ -134,7 +138,11 @@ action.escu.how_to_implement = {{ baseline.how_to_implement }}
{% else %}
action.escu.how_to_implement = none
{% endif %}
+{% if baseline.disabled is defined %}
+disabled = false
+{% else %}
disabled = true
+{% endif %}
is_visible = false
search = {{ baseline.search }}
diff --git a/dist/escu/appserver/static/alert_escu_contextualize.png b/dist/escu/appserver/static/alert_escu_contextualize.png
new file mode 100644
index 0000000000..23c161b5c2
Binary files /dev/null and b/dist/escu/appserver/static/alert_escu_contextualize.png differ
diff --git a/dist/escu/appserver/static/alert_escu_investigate.png b/dist/escu/appserver/static/alert_escu_investigate.png
new file mode 100644
index 0000000000..23c161b5c2
Binary files /dev/null and b/dist/escu/appserver/static/alert_escu_investigate.png differ
diff --git a/dist/escu/appserver/static/alerticon.png b/dist/escu/appserver/static/alerticon.png
new file mode 100644
index 0000000000..c7f9d26890
Binary files /dev/null and b/dist/escu/appserver/static/alerticon.png differ
diff --git a/dist/escu/appserver/static/analytic_story_details.css b/dist/escu/appserver/static/analytic_story_details.css
new file mode 100644
index 0000000000..ce54b7882b
--- /dev/null
+++ b/dist/escu/appserver/static/analytic_story_details.css
@@ -0,0 +1,187 @@
+/* .rTable {
+ display: table;
+ width: 100%;
+}
+
+.rTableRow {
+ display: table-row;
+}
+
+.rTableHeading {
+ display: table-header-group;
+ background-color: #ddd;
+}
+
+.rTableCell, .rTableHead {
+ display: table-cell;
+ padding: 3px 10px;
+ //border: 1px solid #999999;
+}
+
+.rTableLeftCell {
+ display: table-cell;
+ padding: 3px 10px;
+ //border: 1px solid #999999;
+ width: 200px;
+}
+
+.rTableHeading {
+ display: table-header-group;
+ background-color: #ddd;
+ font-weight: bold;
+}
+
+.rTableFoot {
+ display: table-footer-group;
+ font-weight: bold;
+ background-color: #ddd;
+}
+
+.rTableBody {
+ display: table-row-group;
+} */
+
+h1 {
+ font-size: 24px;
+ font-weight: 200;
+ margin: 0;
+}
+
+h3 {
+ padding-left: 10px;
+}
+
+.as_title_attr_bar {
+ padding-left: 15%;
+ background-color: #eee;
+ height: 40px;
+ line-height: 40px;
+ margin-bottom: 7px;
+}
+
+.as_title_attr {
+ float: left;
+ margin-right: 5%;
+ padding-right: 20px;
+ font-size: 14px;
+}
+
+.as_search_accordion {
+ width: 100%;
+ margin-top: 10px;
+}
+
+.as_story_details {
+ display: flex;
+ max-height: 500px;
+ clear: both;
+}
+
+.as_story_details_left_col {
+ float: right;
+ width: 34%;
+ display: block;
+ overflow: scroll;
+ padding: 10px;
+ margin: 10px;
+ border: 1px solid #ddd;
+}
+
+.as_story_details_right_col {
+ float: left;
+ width: 60%;
+ overflow: scroll;
+ padding: 10px;
+ margin: 10px;
+ border: 1px solid #ddd;
+}
+
+.as_left_attr{
+ display: inline-block;
+ width: 100%;
+}
+
+.as_story_detail_left_attr_label {
+ float: left;
+ width: 30%;
+ padding-top: 2%;
+}
+
+.as_story_detail_left_attr {
+ margin-top: 5px;
+ float: left;
+ width: 70%;
+}
+
+.value_label {
+ float: left;
+ margin-right: 5px;
+ background-color: #eee;
+ padding: 4px;
+ border-radius: 6px;
+ margin-bottom: 5px;
+}
+
+.as_story_detail_right_attr_label {
+ margin-bottom: 7px;
+}
+
+.search_content {
+ display: flex;
+ clear: both;
+}
+
+.search_left_panel {
+ float: left;
+ width: 70%;
+ margin: 10px;
+ padding: 10px;
+ border: 1px solid #ddd;
+}
+
+.search_right_panel {
+ float: left;
+ width: 25%;
+ margin: 10px;
+ padding: 10px;
+ border: 1px solid #ddd;
+}
+
+.search_left_attr {
+ margin: 10px;
+}
+
+.search_right_attr {
+ margin: 10px;
+ display: table;
+}
+
+.search_string{
+ padding: 10px;
+ background-color: #ddd;
+ border: 1px solid #aaa;
+ border-radius: 2px;
+}
+
+.data_model_tag {
+ background-color: #11a88b;
+}
+
+.kill_chain_tag {
+ background-color: #ed8440;
+ color: #303841;
+}
+
+.attack_tag {
+ background-color: #3863a0;
+ color: #eee;
+}
+
+.heading-story {
+ width: 80%;
+ float: left;
+}
+
+.run_story_btn {
+ float: right;
+}
\ No newline at end of file
diff --git a/dist/escu/appserver/static/analytic_story_details.js b/dist/escu/appserver/static/analytic_story_details.js
new file mode 100644
index 0000000000..932b4426f0
--- /dev/null
+++ b/dist/escu/appserver/static/analytic_story_details.js
@@ -0,0 +1,575 @@
+require([
+ 'underscore',
+ 'jquery',
+ 'splunkjs/mvc',
+ 'splunkjs/mvc/searchmanager',
+ 'splunkjs/mvc/searchbarview',
+ 'splunkjs/mvc/tableview',
+ 'splunk.util',
+ '../app/DA-ESS-ContentUpdate/js/lib/showdown.min',
+ '../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui',
+ 'css!../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui.css',
+ 'css!../app/DA-ESS-ContentUpdate/analytic_story_details.css',
+ 'splunkjs/mvc/simplexml/ready!'
+], function(_, $, mvc, SearchManager, SearchBarView, TableView, splunkUtil, showdown) {
+
+ let tokenModel = mvc.Components.get("default");
+ let renderedComponents = [];
+
+ let templ = `
+
+
+ Category:
+
+
+ Version:
+
+
+ Created:
+
+
+ Modified:
+
+
+
+
+
+
+
+ Run Analytics
+
+
+
+
+
+ Description:
+
+
+
+
+
+ Narrative:
+
+
+
+
+
+
+
+
+
+ Kill Chain Phases:
+
+
+
+
+
+
+ CIS Controls:
+
+
+
+
+
+
+
+
+
+
+ Analytic Story Searches
+
+
+
Detection
+
+
Investigative
+
+
Support
+
+
+
+ `;
+
+ $('#analytic_story_details').html(_.template(templ));
+
+ if (tokenModel.get('analytic_story_name')) {
+ fetchAnalyticStoryDetails(tokenModel.get('analytic_story_name'));
+ }
+
+ tokenModel.on("change:analytic_story_name", function(model, value, options) {
+ fetchAnalyticStoryDetails(value);
+ });
+
+ function fetchAnalyticStoryDetails(asName) {
+ let epoch = (new Date).getTime();
+ let searchGetAnalyticStoryData = new SearchManager({
+ id: epoch,
+ earliest_time: "-1h@h",
+ latest_time: "now",
+ cache: false,
+ search: "| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | search title=\"" + asName + "\" | spath input=reference path={} output=ref | spath input=data_models path={} output=dm | table title, category, description, version, mappings, creation_date, modification_date, dm, narrative, ref"
+ });
+
+ $('.run-story').unbind('click');
+
+ $('.run-story').on('click', function(evt) {
+ window.open('/en-US/app/Splunk_ASX/execute?form.mode=now&form.cron=*%2F15%20*%20*%20*%20*&form.earliest_time=-15m&form.latest_time=now&form.time.earliest=-24h%40h&form.time.latest=now&form.story=' + asName);
+ });
+
+ let asSearch = splunkjs.mvc.Components.getInstance(epoch);
+ let asResults = asSearch.data("results", {
+ count: 0
+ });
+ asResults.on("data", function() {
+ let as_attributes = {};
+ let fields = asResults.data().fields;
+ let rows = asResults.data().rows;
+
+ for (let i = 0; i < fields.length; i++) {
+ as_attributes[fields[i]] = rows[0][i];
+ }
+ renderStoryAttributes(as_attributes);
+ });
+
+ var searchGetSearchesData = new SearchManager({
+ id: "s" + epoch,
+ earliest_time: "-1h@h",
+ latest_time: "now",
+ cache: false,
+ search: "| rest /services/saved/searches splunk_server=local count=0 | spath input=action.escu.analytic_story path={} output=uc | search uc = \"" + asName + "\" | spath input=action.escu.data_models path={} output=dm | table action.escu.full_search_name, search, description, action.escu.search_type, action.escu.how_to_implement, action.escu.eli5, action.escu.version, action.escu.mappings, dm, tex, action.escu.asset_at_risk, action.escu.confidence, action.escu.known_false_positives, updated, action.escu.modification_date, action.escu.creation_date "
+
+ });
+ var searchesSearch = splunkjs.mvc.Components.getInstance("s" + epoch);
+ var searchesResults = searchesSearch.data("results", {
+ count: 0
+ });
+
+
+ searchesResults.on("data", function() {
+ let asSearchAttr = [];
+ var fields = searchesResults.data().fields;
+ var rows = searchesResults.data().rows;
+
+ for (let i = 0; i < rows.length; i++) {
+ let searchObj = {};
+ for (let j = 0; j < fields.length; j++) {
+ searchObj[fields[j]] = rows[i][j];
+ }
+ asSearchAttr.push(searchObj);
+ }
+ renderSearches(asSearchAttr);
+ });
+ }
+
+ function renderStoryAttributes(asAttributes) {
+ let converter = new showdown.Converter();
+ let mappings = JSON.parse(asAttributes.mappings);
+ $('#as_label_category').html(asAttributes.category);
+ $('#as_label_version').html(asAttributes.version);
+ $('#as_label_created').html(asAttributes.creation_date);
+ $('#as_label_modified').html(asAttributes.modification_date);
+ $('#story_heading').html(asAttributes.title);
+ $('#attack').html(mappings.mitre_attack);
+ $('#narrative').html(converter.makeHtml(asAttributes.narrative));
+ $('#description').html(converter.makeHtml(asAttributes.description));
+ $('#mitre_attack').html(getValueLabels(mappings.mitre_attack, 'attack_tag'));
+ $('#data_model').html(getValueLabels(asAttributes.dm, 'data_model_tag'));
+ $('#kill_chain_phases').html(getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag'));
+ $('#cis_20').html(getValueLabels(mappings.cis20));
+ $('#references').html(getReferenceURLS(asAttributes.ref));
+ }
+
+ function getReferenceURLS(refs) {
+ if (refs === null) {
+ return " ";
+ } else {
+ let refsResult = ``;
+ if (Array.isArray(refs)) {
+ refs.map(ref => {
+ refsResult = refsResult + `${ ref } `;
+ });
+ } else {
+ refsResult = refsResult + `${ refs } `
+ }
+
+ return refsResult;
+ }
+ }
+
+ function renderSearches(asSearches) {
+ clearSearchView();
+ let i = 0;
+ let converter = new showdown.Converter();
+ asSearches.forEach(search => {
+ i++;
+ let epoch = (new Date).getTime();
+ let searchID = `#search${ i }`;
+ let resultID = `#result${ i }`;
+ let searchSelector = `search${ i }`;
+ let controlID = `as_search${ i }`
+ let resultsControlID = `as_results_search${ i }`;
+ let btnID = `btn_es_${i}`;
+
+ let searchPanel = `
+ ${ search['action.escu.full_search_name'] }
+
+
+
Configure
+
+
+ Description
+
+
+ ${ converter.makeHtml(search['description']) }
+
+
+
+
+
+
+
+ How to Implement
+
+
+ ${ converter.makeHtml(search['action.escu.how_to_implement']) }
+
+
+
+
+ Known False Positives
+
+
+ ${ converter.makeHtml(search['action.escu.known_false_positives']) }
+
+
+
+
+
+
+ Data Models
+
+
+ ${ getValueLabels(search['dm'], 'data_model_tag') }
+
+
+
+
`;
+
+ if (search['action.escu.search_type'] === "support") {
+ //Process Support Search Accordion
+
+ let mappings = JSON.parse(search['action.escu.mappings']);
+ $('#search_support').append(searchPanel);
+
+ // Adding extra params to support search
+ let supportLeftAttr = `
+
+ Explain It Like I'm 5
+
+
+ ${ converter.makeHtml(search['action.escu.eli5']) }
+
+
`;
+
+
+ $(`#${searchSelector}-eli5`).append(supportLeftAttr);
+
+ } else if (search['action.escu.search_type'] === "detection") {
+ let mappings = JSON.parse(search['action.escu.mappings']);
+ $('#search_detection').append(searchPanel);
+ // Adding extra params to detection search
+ let detectionAttrTop = `
+
+
+ ATT&CK
+
+
+ ${ getValueLabels(mappings.mitre_attack, 'attack_tag') }
+
+
+
+
+ Kill Chain Phases
+
+
+ ${ getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag') }
+
+
+
+
+ CIS Controls
+
+
+ ${ getValueLabels(mappings.cis20) }
+
+
+ `;
+
+ let detectionAttrBottom = `
+
+
+ Asset at Risk
+
+
+ ${ search['action.escu.asset_at_risk'] }
+
+
+
+
+ Confidence
+
+
+ ${ search['action.escu.confidence'] }
+
+
+
+
+ Creation Date
+
+
+ ${ search['action.escu.creation_date'] }
+
+
+
+
+ Modification Date
+
+
+ ${ search['action.escu.modification_date'] }
+
+
`;
+
+ let detectionLeftAttr = `
+
+ Explain It Like I'm 5
+
+
+ ${ converter.makeHtml(search['action.escu.eli5']) }
+
+
`;
+ $(detectionAttrTop).insertBefore($(`#${searchSelector}-content`).find('.data_model_srch_attr'));
+ $(`#${searchSelector}-content`).find('.search_right_panel').append(detectionAttrBottom);
+ $(`#${searchSelector}-eli5`).append(detectionLeftAttr);
+ } else if (search['action.escu.search_type'] === "contextual") {
+ //Process contextual Search Accordion
+
+ let mappings = JSON.parse(search['action.escu.mappings']);
+ $('#search_contextual').append(searchPanel);
+
+
+ // Adding extra params to contextual search
+ let contextualLeftAttr = `
+
+ Explain It Like I'm 5
+
+
+ ${ converter.makeHtml(search['action.escu.eli5']) }
+
+
`;
+ $(`#${searchSelector}-eli5`).append(contextualLeftAttr);
+
+ } else if (search['action.escu.search_type'] === "investigative") {
+ //Process Investigative Search Accordion
+ let mappings = JSON.parse(search['action.escu.mappings']);
+ $('#search_investigative').append(searchPanel);
+
+ // Adding extra params to investigative search
+ let investigativeLeftAttr = `
+
+ Explain It Like I'm 5
+
+
+ ${ converter.makeHtml(search['action.escu.eli5']) }
+
+
`;
+
+
+ $(`#${searchSelector}-eli5`).append(investigativeLeftAttr);
+ }
+
+ /*
+ let updatedAttr = `
+
+
+ Last Updated
+
+
+ ${ search['updated'] }
+
+
+ `;
+ $(`#${searchSelector}-content`).find('.search_right_panel').append(updatedAttr);
+ */
+
+ $(`#${ btnID }`).on('click', (evt) => {
+ console.log($(evt.target).data("searchType"));
+ if ($(evt.target).data("searchType") === "detection") {
+ splunkUtil.redirect_to('app/SplunkEnterpriseSecuritySuite/correlation_search_edit', {
+ search: `${$(evt.target).data("searchName")}`
+ }, window.open(), true);
+ } else {
+ splunkUtil.redirect_to(`manager/DA-ESS-ContentUpdate/saved/searches`, {
+ search: `${$(evt.target).data("searchName")}`
+ }, window.open(), true);
+ }
+ })
+
+ let searchManagerID = search['action.escu.full_search_name'].split(' ').join('');
+
+ let searchManager = new SearchManager({
+ id: searchManagerID,
+ earliest_time: "-24h@h",
+ latest_time: "now",
+ status_buckets: 300,
+ required_field_list: "*",
+ preview: true,
+ cache: true,
+ autostart: false, // Prevent the search from running automatically
+ search: search['search'],
+ });
+
+ let searchBar = new SearchBarView({
+ id: searchID,
+ managerId: searchManagerID,
+ timerange: true,
+ el: $('.' + controlID),
+ value: search['search'],
+ timerange_preset: "Last 24 hours"
+ }).render();
+
+ let tableviewer = new TableView({
+ id: resultsControlID,
+ managerid: searchManagerID,
+ pageSize: 5,
+ el: $("." + resultsControlID)
+ }).render();
+
+ searchBar.on("change", function() {
+ searchManager.settings.unset("search");
+
+ // Update the search query
+ searchManager.settings.set("search", searchBar.val());
+
+ // Run the search (because autostart=false)
+ searchManager.startSearch();
+ });
+
+ searchBar.timerange.on("change", function() {
+ // Update the time range of the search
+ searchManager.search.set(searchBar.timerange.val());
+
+ // Run the search (because autostart=false)
+ searchManager.startSearch();
+ })
+
+
+ renderedComponents.push(searchID, searchManagerID, resultsControlID);
+
+ });
+
+ $('#accordion').accordion({
+ heightStyle: "content"
+ });
+ $('#search_support').accordion({
+ heightStyle: "content"
+ });
+ $('#search_detection').accordion({
+ heightStyle: "content"
+ });
+ $('#search_contextual').accordion({
+ heightStyle: "content"
+ });
+ $('#search_investigative').accordion({
+ heightStyle: "content"
+ });
+ }
+
+ function clearSearchView() {
+ if ($('#accordion').hasClass('ui-accordion')) {
+ $('#accordion').accordion('destroy');
+ }
+
+ if ($('#search_support').hasClass('ui-accordion')) {
+ $('#search_support').accordion('destroy');
+ $('#search_support').empty();
+ }
+
+ if ($('#search_detection').hasClass('ui-accordion')) {
+ $('#search_detection').accordion('destroy');
+ $('#search_detection').empty();
+ }
+
+ if ($('#search_contextual').hasClass('ui-accordion')) {
+ $('#search_contextual').accordion('destroy');
+ $('#search_contextual').empty();
+ }
+
+ if ($('#search_investigative').hasClass('ui-accordion')) {
+ $('#search_investigative').accordion('destroy');
+ $('#search_investigative').empty();
+ }
+
+ $('.configure_in_es').unbind("click");
+
+ let len = renderedComponents.length;
+ while (len--) {
+ let id = renderedComponents.pop();
+ mvc.Components.getInstance(id).dispose();
+ }
+ }
+
+ function getValueLabels(values, className) {
+ let cls = "";
+ if (className !== undefined || className) {
+ cls = className;
+ }
+ let valueArray = [];
+ if (values) {
+ if (typeof values === "string") {
+ valueArray.push(values)
+ } else {
+ valueArray = values;
+ }
+ }
+ let htmlTmpl = "";
+ valueArray.forEach(val => {
+ htmlTmpl += `${ val }
`
+ });
+
+ return htmlTmpl;
+ }
+});
diff --git a/dist/escu/appserver/static/escu_summary.css b/dist/escu/appserver/static/escu_summary.css
new file mode 100644
index 0000000000..48fe5b72c3
--- /dev/null
+++ b/dist/escu/appserver/static/escu_summary.css
@@ -0,0 +1,66 @@
+.btn-pill {
+ display: inline;
+}
+
+.killchain-phases {
+ width: 100%;
+ margin-left: 6%;
+}
+
+.killchain_card {
+ width: 14%;
+ float:left;
+}
+
+.killchain {
+ height: 55px;
+ line-height: 55px;
+ -webkit-clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%);
+ clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%);
+}
+
+.killchain-text {
+ font-size: 300%;
+ font-weight: 600;
+ color: #fff;
+ text-align: center;
+ white-space: wrap;
+}
+
+
+.killchain-label {
+ margin-top: 7px;
+ text-align: center;
+ color: #666;
+ font-size: 14px;
+ font-weight: 700;
+ margin-left: 10%;
+ width: 60%;
+}
+
+.killchain-text-one-line {
+ font-size: 16px;
+ color: #fff;
+ font-family: system-ui;
+ white-space: wrap;
+ width: 100%;
+ padding-top: 7%;
+ padding-left: 26%;
+}
+
+.killchain-text-second {
+ font-size: 16px;
+ color: #fff;
+ font-family: system-ui;
+ margin-top: -10px;
+ padding-left: 26%;
+}
+
+.killchain-phases {
+ display: inline-block;
+ width: 100%;
+}
+
+.notfirst {
+ margin-left: -2%;
+}
diff --git a/dist/escu/appserver/static/escu_summary.js b/dist/escu/appserver/static/escu_summary.js
new file mode 100644
index 0000000000..572eef9abb
--- /dev/null
+++ b/dist/escu/appserver/static/escu_summary.js
@@ -0,0 +1,76 @@
+require([
+ 'underscore',
+ 'jquery',
+ 'splunkjs/mvc',
+ 'splunkjs/mvc/searchmanager',
+ '../app/DA-ESS-ContentUpdate/js/lib/tabs',
+ 'css!../app/DA-ESS-ContentUpdate/js/lib/tabs.css',
+ 'css!../app/DA-ESS-ContentUpdate/escu_summary.css',
+ 'splunkjs/mvc/simplexml/ready!'
+ ], function(_, $, mvc, SearchManager) {
+ $('.es-soc-analytic-story-stats').html(_.template('<%- _("Analytic Story Summary").t() %>'));
+ $('.es-soc-search-stats').html(_.template('<%- _("Search Summary").t() %>'));
+
+ const tokenModel = mvc.Components.get('default');
+ const submittedTokens = mvc.Components.get('submitted');
+
+ $.ajax({
+ url: Splunk.util.make_url('/splunkd/__raw/servicesNS/nobody/DA-ESS-ContentUpdate/apps/local'),
+ type: 'GET',
+ async: true,
+ data: {
+ output_mode: 'json',
+ count: -1,
+ },
+ }).done(result => {
+ if (result.entry) {
+ const foundEss = result.entry.find(app => app.name === 'SplunkEnterpriseSecuritySuite');
+ if (foundEss.content.version === "5.2.0") {
+ submittedTokens.set('explore-use-case-es-show', 'true');
+ const use_case_library_link = Splunk.util.make_url('app/SplunkEnterpriseSecuritySuite/ess_use_case_library');
+ const template = `
+ ${ _('Εxplore ESCU content updates directly from the Use Case Library within ES. To explore it, click').t() }
+
${ _('here').t() } .
+
`;
+ $('#explore-use-case-es-info').html(_.template(template, { use_case_library_link: use_case_library_link }));
+ }
+ }
+ }).fail(err => {
+ });
+
+
+
+ // searchQuery -
+ let kcpSearch = new SearchManager({
+ id: "kcpSearch",
+ preview: true,
+ cache: true,
+ status_buckets: 300,
+ earliest_time: '-24h@h',
+ latest_time: 'now',
+ search: '| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | spath input=mappings path=kill_chain_phases{} output=kcp | stats count by kcp',
+ });
+
+ let results = kcpSearch.data("preview");
+
+ results.on("data", function() {
+ results.data().rows.forEach(row => {
+ let killchainID = '#' + row[0].toLowerCase().replace(/ /g,'');
+ $(killchainID).html(row[1]);
+ });
+ });
+
+ $('#analytic_filter_clear').on('click', function() {
+ tokenModel.set('form.as_cis', '*');
+ tokenModel.set('form.as_category', '*');
+ tokenModel.set('form.as_kill_chain_phase', '*');
+ tokenModel.set('form.as_data_models', '*');
+ });
+
+ $('#search_filter_clear').on('click', function() {
+ tokenModel.set('form.cis', '*');
+ tokenModel.set('form.searchtype', '*');
+ tokenModel.set('form.kill_chain_phase', '*');
+ tokenModel.set('form.data_models', '*');
+ });
+ });
diff --git a/dist/escu/appserver/static/feedback.js b/dist/escu/appserver/static/feedback.js
new file mode 100644
index 0000000000..48c3f4cb74
--- /dev/null
+++ b/dist/escu/appserver/static/feedback.js
@@ -0,0 +1,19 @@
+
+ require([
+ 'underscore',
+ 'jquery',
+ 'splunkjs/mvc',
+ 'splunkjs/mvc/simplexml/ready!'
+ ], function(_, $, mvc, TableView) {
+
+ var defaultTokenSpace = mvc.Components.getInstance('default');
+
+ // This will take every textarea that has a data-token attribute and will make the given token with the value of the textarea
+ $('textarea[data-token]').each(function (textarea) {
+ $(this).on('input', function(input) {
+ var token_to_set = $(this).data('token');
+ defaultTokenSpace.set(token_to_set, $(this).val());
+ })
+ })
+ });
+
diff --git a/dist/escu/appserver/static/img/escu/Slide1.PNG b/dist/escu/appserver/static/img/escu/Slide1.PNG
new file mode 100644
index 0000000000..4e5f7311ac
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide1.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide2.PNG b/dist/escu/appserver/static/img/escu/Slide2.PNG
new file mode 100644
index 0000000000..7f33c545ca
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide2.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide3.PNG b/dist/escu/appserver/static/img/escu/Slide3.PNG
new file mode 100644
index 0000000000..efc6a8de98
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide3.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide4.PNG b/dist/escu/appserver/static/img/escu/Slide4.PNG
new file mode 100644
index 0000000000..5780daa26e
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide4.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide5.PNG b/dist/escu/appserver/static/img/escu/Slide5.PNG
new file mode 100644
index 0000000000..fc21341750
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide5.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide6.PNG b/dist/escu/appserver/static/img/escu/Slide6.PNG
new file mode 100644
index 0000000000..bb0cfaefdd
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide6.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide7.PNG b/dist/escu/appserver/static/img/escu/Slide7.PNG
new file mode 100644
index 0000000000..6f98b937c6
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide7.PNG differ
diff --git a/dist/escu/appserver/static/img/escu/Slide8.PNG b/dist/escu/appserver/static/img/escu/Slide8.PNG
new file mode 100644
index 0000000000..328fccfbf7
Binary files /dev/null and b/dist/escu/appserver/static/img/escu/Slide8.PNG differ
diff --git a/dist/escu/appserver/static/js/lib/jquery-ui/AUTHORS.txt b/dist/escu/appserver/static/js/lib/jquery-ui/AUTHORS.txt
new file mode 100644
index 0000000000..a75056b941
--- /dev/null
+++ b/dist/escu/appserver/static/js/lib/jquery-ui/AUTHORS.txt
@@ -0,0 +1,333 @@
+Authors ordered by first contribution
+A list of current team members is available at http://jqueryui.com/about
+
+Paul Bakaus
+Richard Worth
+Yehuda Katz
+Sean Catchpole
+John Resig
+Tane Piper
+Dmitri Gaskin
+Klaus Hartl
+Stefan Petre
+Gilles van den Hoven
+Micheil Bryan Smith
+Jörn Zaefferer
+Marc Grabanski
+Keith Wood
+Brandon Aaron
+Scott González
+Eduardo Lundgren
+Aaron Eisenberger
+Joan Piedra
+Bruno Basto
+Remy Sharp
+Bohdan Ganicky
+David Bolter
+Chi Cheng
+Ca-Phun Ung
+Ariel Flesler
+Maggie Wachs
+Scott Jehl
+Todd Parker
+Andrew Powell
+Brant Burnett
+Douglas Neiner
+Paul Irish
+Ralph Whitbeck
+Thibault Duplessis
+Dominique Vincent
+Jack Hsu
+Adam Sontag
+Carl Fürstenberg
+Kevin Dalman
+Alberto Fernández Capel
+Jacek Jędrzejewski (http://jacek.jedrzejewski.name)
+Ting Kuei
+Samuel Cormier-Iijima
+Jon Palmer
+Ben Hollis
+Justin MacCarthy
+Eyal Kobrigo
+Tiago Freire
+Diego Tres
+Holger Rüprich
+Ziling Zhao
+Mike Alsup
+Robson Braga Araujo
+Pierre-Henri Ausseil
+Christopher McCulloh
+Andrew Newcomb
+Lim Chee Aun
+Jorge Barreiro
+Daniel Steigerwald
+John Firebaugh
+John Enters
+Andrey Kapitcyn
+Dmitry Petrov
+Eric Hynds
+Chairat Sunthornwiphat
+Josh Varner
+Stéphane Raimbault
+Jay Merrifield
+J. Ryan Stinnett
+Peter Heiberg
+Alex Dovenmuehle
+Jamie Gegerson
+Raymond Schwartz
+Phillip Barnes
+Kyle Wilkinson
+Khaled AlHourani
+Marian Rudzynski
+Jean-Francois Remy
+Doug Blood
+Filippo Cavallarin
+Heiko Henning
+Aliaksandr Rahalevich
+Mario Visic
+Xavi Ramirez
+Max Schnur
+Saji Nediyanchath
+Corey Frang
+Aaron Peterson
+Ivan Peters
+Mohamed Cherif Bouchelaghem
+Marcos Sousa
+Michael DellaNoce
+George Marshall
+Tobias Brunner
+Martin Solli
+David Petersen
+Dan Heberden
+William Kevin Manire
+Gilmore Davidson
+Michael Wu
+Adam Parod
+Guillaume Gautreau
+Marcel Toele
+Dan Streetman
+Matt Hoskins
+Giovanni Giacobbi
+Kyle Florence
+Pavol Hluchý
+Hans Hillen
+Mark Johnson
+Trey Hunner
+Shane Whittet
+Edward A Faulkner
+Adam Baratz
+Kato Kazuyoshi
+Eike Send
+Kris Borchers
+Eddie Monge
+Israel Tsadok
+Carson McDonald
+Jason Davies
+Garrison Locke
+David Murdoch
+Benjamin Scott Boyle
+Jesse Baird
+Jonathan Vingiano
+Dylan Just
+Hiroshi Tomita
+Glenn Goodrich
+Tarafder Ashek-E-Elahi
+Ryan Neufeld
+Marc Neuwirth
+Philip Graham
+Benjamin Sterling
+Wesley Walser
+Kouhei Sutou
+Karl Kirch
+Chris Kelly
+Jason Oster
+Felix Nagel
+Alexander Polomoshnov
+David Leal
+Igor Milla
+Dave Methvin
+Florian Gutmann
+Marwan Al Jubeh
+Milan Broum
+Sebastian Sauer
+Gaëtan Muller
+Michel Weimerskirch
+William Griffiths
+Stojce Slavkovski
+David Soms
+David De Sloovere
+Michael P. Jung
+Shannon Pekary
+Dan Wellman
+Matthew Edward Hutton
+James Khoury
+Rob Loach
+Alberto Monteiro
+Alex Rhea
+Krzysztof Rosiński
+Ryan Olton
+Genie <386@mail.com>
+Rick Waldron
+Ian Simpson
+Lev Kitsis
+TJ VanToll
+Justin Domnitz
+Douglas Cerna
+Bert ter Heide
+Jasvir Nagra
+Yuriy Khabarov <13real008@gmail.com>
+Harri Kilpiö
+Lado Lomidze
+Amir E. Aharoni
+Simon Sattes
+Jo Liss
+Guntupalli Karunakar
+Shahyar Ghobadpour
+Lukasz Lipinski
+Timo Tijhof
+Jason Moon
+Martin Frost
+Eneko Illarramendi
+EungJun Yi
+Courtland Allen
+Viktar Varvanovich
+Danny Trunk
+Pavel Stetina
+Michael Stay
+Steven Roussey
+Michael Hollis
+Lee Rowlands
+Timmy Willison
+Karl Swedberg
+Baoju Yuan
+Maciej Mroziński
+Luis Dalmolin
+Mark Aaron Shirley
+Martin Hoch
+Jiayi Yang
+Philipp Benjamin Köppchen
+Sindre Sorhus
+Bernhard Sirlinger
+Jared A. Scheel
+Rafael Xavier de Souza
+John Chen
+Robert Beuligmann
+Dale Kocian
+Mike Sherov
+Andrew Couch
+Marc-Andre Lafortune
+Nate Eagle
+David Souther
+Mathias Stenbom
+Sergey Kartashov
+Avinash R
+Ethan Romba
+Cory Gackenheimer
+Juan Pablo Kaniefsky
+Roman Salnikov
+Anika Henke
+Samuel Bovée
+Fabrício Matté
+Viktor Kojouharov
+Pawel Maruszczyk (http://hrabstwo.net)
+Pavel Selitskas
+Bjørn Johansen
+Matthieu Penant
+Dominic Barnes
+David Sullivan
+Thomas Jaggi
+Vahid Sohrabloo
+Travis Carden
+Bruno M. Custódio
+Nathanael Silverman
+Christian Wenz
+Steve Urmston
+Zaven Muradyan
+Woody Gilk
+Zbigniew Motyka
+Suhail Alkowaileet
+Toshi MARUYAMA
+David Hansen
+Brian Grinstead
+Christian Klammer
+Steven Luscher
+Gan Eng Chin
+Gabriel Schulhof
+Alexander Schmitz
+Vilhjálmur Skúlason
+Siebrand Mazeland
+Mohsen Ekhtiari
+Pere Orga
+Jasper de Groot