stock values for deprecation

2026-06-08 17:32:49 +00:00 · 2025-01-17 15:31:56 -08:00
parent 863eb07dc9
commit f5cc9deade
189 changed files with 1436 additions and 621 deletions
@@ -51,3 +51,10 @@ tags:
  - userName
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -47,3 +47,10 @@ tags:
  - src_user
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -51,3 +51,10 @@ tags:
  - userName
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -46,3 +46,10 @@ tags:
  - src_user
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,97 @@
+name: ASL AWS CreateAccessKey
+id: ccb3e4af-23d6-407f-9842-a26212816c9e
+version: 2
+date: '2024-10-17'
+author: Patrick Bareiss, Splunk
+status: deprecated
+type: Hunting
+description: This detection rule monitors for the creation of AWS Identity and Access
+  Management (IAM) access keys. An IAM access key consists of an access key ID and
+  secret access key, which are used to sign programmatic requests to AWS services.
+  While IAM access keys can be legitimately used by developers and administrators
+  for API access, their creation can also be indicative of malicious activity. Attackers
+  who have gained unauthorized access to an AWS environment might create access keys
+  as a means to establish persistence or to exfiltrate data through the APIs. Moreover,
+  because access keys can be used to authenticate with AWS services without the need
+  for further interaction, they can be particularly appealing for bad actors looking
+  to operate under the radar. Consequently, it's important to vigilantly monitor and
+  scrutinize access key creation events, especially if they are associated with unusual
+  activity or are created by users who don't typically perform these actions. This
+  hunting query identifies when a potentially compromised user creates a IAM access
+  key for another user who may have higher privilleges, which can be a sign for privilege
+  escalation. Hunting queries are designed to be executed manual during threat hunting.
+data_source: []
+search: '`amazon_security_lake` api.operation=CreateAccessKey http_request.user_agent!=console.amazonaws.com
+  api.response.error=null | rename unmapped{}.key as unmapped_key , unmapped{}.value
+  as unmapped_value | eval keyjoin=mvzip(unmapped_key,unmapped_value) | mvexpand keyjoin
+  | rex field=keyjoin "^(?<key>[^,]+),(?<value>.*)$" | eval {key} = value | search
+  responseElements.accessKey.userName = * | rename identity.user.name as identity_user_name,
+  responseElements.accessKey.userName as responseElements_accessKey_userName | eval
+  match=if(identity_user_name=responseElements_accessKey_userName,1,0) | search match=0
+  | rename identity_user_name as identity.user.name , responseElements_accessKey_userName
+  as responseElements.accessKey.userName | stats count min(_time) as firstTime max(_time)
+  as lastTime by responseElements.accessKey.userName api.operation api.service.name
+  identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type
+  identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` |`asl_aws_createaccesskey_filter`'
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876)
+  that includes includes a merge of all the capabilities of the Splunk Add-on for
+  Amazon Security Lake. This search works with Amazon Security Lake logs which are
+  parsed in the Open Cybersecurity Schema Framework (OCSF)format.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately created keys for another user.
+references:
+- https://bishopfox.com/blog/privilege-escalation-in-aws
+- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  asset_type: AWS Account
+  confidence: 90
+  impact: 70
+  message: User $responseElements.accessKey.userName$ is attempting to create access
+    keys for $responseElements.accessKey.userName$ from this IP $src_endpoint.ip$
+  mitre_attack_id:
+  - T1078
+  observable:
+  - name: src_endpoint.ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: identity.user.name
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - api.service.name
+  - api.operation
+  - identity.user.account_uid
+  - identity.user.credential_uid
+  - identity.user.name
+  - identity.user.type
+  - identity.user.uid
+  - identity.user.uuid
+  - http_request.user_agent
+  - src_endpoint.ip
+  - unmapped{}.key
+  - unmapped{}.value
+  risk_score: 63
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/amazon_security_lake.json
+    sourcetype: aws:asl
+    source: aws_asl
+    update_timestamp: true
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -9,12 +9,16 @@ description: This search looks for AWS CloudTrail events and analyse the amount
  eventNames which starts with Describe by a single user. This indicates that this
  user scans the configuration of your AWS cloud environment.
 data_source: []
-search: '`amazon_security_lake` api.operation=Describe* OR api.operation=List* OR api.operation=Get* 
-  | stats dc(api.operation) as dc_api_operations min(_time) as firstTime max(_time) as lastTime values(http_request.user_agent) as http_request.user_agent 
-  values(src_endpoint.ip) as src_endpoint.ip values(cloud.region) as cloud.region values(identity.user.account_uid) as identity.user.account_uid by identity.user.name 
-  | where dc_api_operations > 50 | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`|`asl_aws_excessive_security_scanning_filter`'
-how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
+search: '`amazon_security_lake` api.operation=Describe* OR api.operation=List* OR
+  api.operation=Get* | stats dc(api.operation) as dc_api_operations min(_time) as
+  firstTime max(_time) as lastTime values(http_request.user_agent) as http_request.user_agent
+  values(src_endpoint.ip) as src_endpoint.ip values(cloud.region) as cloud.region
+  values(identity.user.account_uid) as identity.user.account_uid by identity.user.name
+  | where dc_api_operations > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`asl_aws_excessive_security_scanning_filter`'
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876)
+  that includes includes a merge of all the capabilities of the Splunk Add-on for
+  Amazon Security Lake. This search works with Amazon Security Lake logs which are
+  parsed in the Open Cybersecurity Schema Framework (OCSF)format.
 known_false_positives: While this search has no known false positives.
 references:
 - https://github.com/aquasecurity/cloudsploit
@@ -47,4 +51,11 @@ tags:
  - http_request.user_agent
  - src_endpoint.ip
  risk_score: 18
-  security_domain: network
+  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,20 +5,23 @@ date: '2024-10-17'
 author: Patrick Bareiss, Splunk
 status: deprecated
 type: Hunting
-description: This search looks for AWS CloudTrail events from Amazon Security Lake where a user is making successful
-  API calls to view/update/delete the existing password policy in an AWS organization.
-  It is unlikely for a regular user to conduct this operation. These events may potentially
-  be malicious, adversaries often use this information to gain more understanding
-  of the password defenses in place and exploit them to increase their attack surface
-  when a user account is compromised.
+description: This search looks for AWS CloudTrail events from Amazon Security Lake
+  where a user is making successful API calls to view/update/delete the existing password
+  policy in an AWS organization. It is unlikely for a regular user to conduct this
+  operation. These events may potentially be malicious, adversaries often use this
+  information to gain more understanding of the password defenses in place and exploit
+  them to increase their attack surface when a user account is compromised.
 data_source: []
-search: '`amazon_security_lake` "api.service.name"="iam.amazonaws.com" "api.operation" IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") "api.response.error"=null 
-  | stats count min(_time) as firstTime max(_time) as lastTime by identity.user.account_uid identity.user.credential_uid identity.user.name 
-  identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`  
-  | `asl_aws_password_policy_changes_filter`'
-how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876) that includes includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This search works with Amazon Security Lake logs which are parsed in the Open Cybersecurity Schema Framework (OCSF)format. 
+search: '`amazon_security_lake` "api.service.name"="iam.amazonaws.com" "api.operation"
+  IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy")
+  "api.response.error"=null | stats count min(_time) as firstTime max(_time) as lastTime
+  by identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type
+  identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_password_policy_changes_filter`'
+how_to_implement: You must install Splunk Add-On for AWS Version v7.0.0 (https://splunkbase.splunk.com/app/1876)
+  that includes includes a merge of all the capabilities of the Splunk Add-on for
+  Amazon Security Lake. This search works with Amazon Security Lake logs which are
+  parsed in the Open Cybersecurity Schema Framework (OCSF)format.
 known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately triggered an AWS audit tool activity which may
  trigger this event.
@@ -31,11 +34,12 @@ tags:
  asset_type: AWS Account
  confidence: 80
  impact: 90
-  message: User $identity.user.name$ is attempting to $api.operation$ the password policy for accounts
+  message: User $identity.user.name$ is attempting to $api.operation$ the password
+    policy for accounts
  mitre_attack_id:
  - T1201
  observable:
-  - name: src_endpoint.ip 
+  - name: src_endpoint.ip
    type: IP Address
    role:
    - Attacker
@@ -66,4 +70,11 @@ tests:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/amazon_security_lake.json
    sourcetype: aws:asl
    source: aws_asl
-    update_timestamp: true
+    update_timestamp: true
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,10 +5,10 @@ date: '2024-10-17'
 author: David Dorsey, Splunk
 status: deprecated
 type: Anomaly
-description: 'This search looks for AWS provisioning activities from previously unseen
+description: This search looks for AWS provisioning activities from previously unseen
  cities.  Provisioning activities are defined broadly as any event that begins with
  "Run" or "Create." This search is deprecated and have been translated to use the
-  latest Change Datamodel.'
+  latest Change Datamodel.
 data_source: []
 search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress
  | search City=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation
@@ -27,16 +27,16 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
  that have provisioned AWS resources.
 known_false_positives: 'This is a strictly behavioral search, so we define "false
  positive" slightly differently. Every time this fires, it will accurately reflect
-  the first occurrence in the time period you''re searching within, plus what is
-  stored in the cache feature. But while there are really no "false positives"
-  in a traditional sense, there is definitely lots of noise.
-  
-  This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning
-  activity. If you typically do all provisioning from tools inside of your city,
-  there should be few false positives. If you are located in countries where the
-  free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution
-  (particularly small countries in less economically powerful regions), this may
-  be much less valuable to you.'
+  the first occurrence in the time period you''re searching within, plus what is stored
+  in the cache feature. But while there are really no "false positives" in a traditional
+  sense, there is definitely lots of noise.
+
+  This search will fire any time a new city is seen in the **GeoIP** database for
+  any kind of provisioning activity. If you typically do all provisioning from tools
+  inside of your city, there should be few false positives. If you are located in
+  countries where the free version of **MaxMind GeoIP** that ships by default with
+  Splunk has weak resolution (particularly small countries in less economically powerful
+  regions), this may be much less valuable to you.'
 references: []
 tags:
  analytic_story:
@@ -62,3 +62,10 @@ tags:
  - sourceIPAddress
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,10 +5,10 @@ date: '2024-10-17'
 author: David Dorsey, Splunk
 status: deprecated
 type: Anomaly
-description: 'This search looks for AWS provisioning activities from previously unseen
+description: This search looks for AWS provisioning activities from previously unseen
  countries. Provisioning activities are defined broadly as any event that begins
  with "Run" or "Create." This search is deprecated and have been translated to use
-  the latest Change Datamodel.'
+  the latest Change Datamodel.
 data_source: []
 search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress
  | search Country=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) |
@@ -31,13 +31,13 @@ known_false_positives: 'This is a strictly behavioral search, so we define "fals
  the first occurrence in the time period you''re searching over plus what is stored
  in the cache feature. But while there are really no \"false positives\" in a traditional
  sense, there is definitely lots of noise.
-  
-  This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity.
-  If you typically do all provisioning from tools inside of your country, there
-  should be few false positives. If you are located in countries where the free
-  version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution
-  (particularly small countries in less economically powerful regions), this may
-  be much less valuable to you.'
+
+  This search will fire any time a new country is seen in the **GeoIP** database for
+  any kind of provisioning activity. If you typically do all provisioning from tools
+  inside of your country, there should be few false positives. If you are located
+  in countries where the free version of **MaxMind GeoIP** that ships by default with
+  Splunk has weak resolution (particularly small countries in less economically powerful
+  regions), this may be much less valuable to you.'
 references: []
 tags:
  analytic_story:
@@ -63,3 +63,10 @@ tags:
  - sourceIPAddress
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,10 +5,10 @@ date: '2024-10-17'
 author: David Dorsey, Splunk
 status: deprecated
 type: Anomaly
-description: 'This search looks for AWS provisioning activities from previously unseen
+description: This search looks for AWS provisioning activities from previously unseen
  IP addresses. Provisioning activities are defined broadly as any event that begins
  with "Run" or "Create." This search is deprecated and have been translated to use
-  the latest Change Datamodel.'
+  the latest Change Datamodel.
 data_source: []
 search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run*
  OR eventName=Create*) | iplocation sourceIPAddress | search Country=* | stats earliest(_time)
@@ -27,15 +27,15 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
  that have provisioned AWS resources.
 known_false_positives: 'This is a strictly behavioral search, so we define "false
  positive" slightly differently. Every time this fires, it will accurately reflect
-  the first occurrence in the time period you''re searching within, plus what is
-  stored in the cache feature. But while there are really no "false positives"
-  in a traditional sense, there is definitely lots of noise.
-  
-  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind
-  of provisioning activity. If you typically do all provisioning from tools inside
-  of your country, there should be few false positives. If you are located in countries
-  where the free version of **MaxMind GeoIP** that ships by default with Splunk
-  has weak resolution (particularly small countries in less economically powerful
+  the first occurrence in the time period you''re searching within, plus what is stored
+  in the cache feature. But while there are really no "false positives" in a traditional
+  sense, there is definitely lots of noise.
+
+  This search will fire any time a new IP address is seen in the **GeoIP** database
+  for any kind of provisioning activity. If you typically do all provisioning from
+  tools inside of your country, there should be few false positives. If you are located
+  in countries where the free version of **MaxMind GeoIP** that ships by default with
+  Splunk has weak resolution (particularly small countries in less economically powerful
  regions), this may be much less valuable to you.'
 references: []
 tags:
@@ -60,3 +60,10 @@ tags:
  - sourceIPAddress
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -27,16 +27,16 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
  that have provisioned AWS resources.
 known_false_positives: 'This is a strictly behavioral search, so we define "false
  positive" slightly differently. Every time this fires, it will accurately reflect
-  the first occurrence in the time period you''re searching within, plus what is
-  stored in the cache feature. But while there are really no "false positives"
-  in a traditional sense, there is definitely lots of noise.
-  
-  This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning
-  activity. If you typically do all provisioning from tools inside of your region,
-  there should be few false positives. If you are located in regions where the free
-  version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution
-  (particularly small countries in less economically powerful regions), this may
-  be much less valuable to you.'
+  the first occurrence in the time period you''re searching within, plus what is stored
+  in the cache feature. But while there are really no "false positives" in a traditional
+  sense, there is definitely lots of noise.
+
+  This search will fire any time a new region is seen in the **GeoIP** database for
+  any kind of provisioning activity. If you typically do all provisioning from tools
+  inside of your region, there should be few false positives. If you are located in
+  regions where the free version of **MaxMind GeoIP** that ships by default with Splunk
+  has weak resolution (particularly small countries in less economically powerful
+  regions), this may be much less valuable to you.'
 references: []
 tags:
  analytic_story:
@@ -66,3 +66,10 @@ tags:
  - sourceIPAddress
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -37,3 +37,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -21,7 +21,7 @@ how_to_implement: 'This search requires that DNS data is being ingested and popu
  contribute additional context to the notable. To see the additional metadata, add
  the following fields, if not already present, to Incident Review - Event Attributes
  (Configure > Incident Management > Incident Review Settings > Add New Entry):
-  
+
  * **Label:** Distinct DNS Connections, **Field:** dest_count

  Detailed documentation on how to create a new field within Incident Review may be
@@ -57,3 +57,10 @@ tags:
  - DNS.src
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -50,3 +50,10 @@ tags:
  - arn
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,60 @@
+name: Correlation by Repository and Risk
+id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
+version: 2
+date: '2024-10-17'
+author: Patrick Bareiss, Splunk
+status: deprecated
+type: Correlation
+description: This search has been deprecated and updated with Risk Rule for Dev Sec
+  Ops by Repository detection. The following analytic detects by correlating repository
+  and risk score to identify patterns and trends in the data based on the level of
+  risk associated. The analytic adds any null values and calculates the sum of the
+  risk scores for each detection. Then, the analytic captures the source and user
+  information for each detection and sorts the results in ascending order based on
+  the risk score. Finally, the analytic filters the detections with a risk score below
+  80 and focuses only on high-risk detections.This detection is important because
+  it provides valuable insights into the distribution of high-risk activities across
+  different repositories. It also identifies the most vulnerable repositories that
+  are frequently targeted by potential threats. Additionally, it proactively detects
+  and responds to potential threats, thereby minimizing the impact of attacks and
+  safeguarding critical assets. Finally, it provides a comprehensive view of the risk
+  landscape and helps to make informed decisions to protect the organization's data
+  and infrastructure. False positives might occur so it is important to identify the
+  impact of the attack and prioritize response and mitigation efforts.
+data_source: []
+search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source)
+  as signals values(user) as user by repository | sort - risk_score | where risk_score
+  > 80 | `correlation_by_repository_and_risk_filter`'
+how_to_implement: For Dev Sec Ops POC
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  confidence: 100
+  impact: 70
+  message: Correlation triggered for user $user$
+  mitre_attack_id:
+  - T1204.003
+  - T1204
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 70
+  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,56 @@
+name: Correlation by User and Risk
+id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
+version: 2
+date: '2024-10-17'
+author: Patrick Bareiss, Splunk
+status: deprecated
+type: Correlation
+description: The following analytic detects the correlation between the user and risk
+  score and identifies users with a high risk score that pose a significant security
+  risk such as unauthorized access attempts, suspicious behavior, or potential insider
+  threats. Next, the analytic calculates the sum of the risk scores and groups the
+  results by user, the corresponding signals, and the repository. The results are
+  sorted in descending order based on the risk score and filtered to include records
+  with a risk score greater than 80. Finally, the results are passed through a correlation
+  filter specific to the user and risk. This detection is important because it identifies
+  users who have a high risk score and helps to prioritize investigations and allocate
+  resources. False positives might occur but the impact of such an attack can vary
+  depending on the specific scenario such as data exfiltration, system compromise,
+  or the disruption of critical services. Please investigate this notable event.
+data_source: []
+search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source)
+  as signals values(repository) as repository by user | sort - risk_score | where
+  risk_score > 80 | `correlation_by_user_and_risk_filter`'
+how_to_implement: For Dev Sec Ops POC
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  confidence: 100
+  impact: 70
+  message: Correlation triggered for user $user$
+  mitre_attack_id:
+  - T1204.003
+  - T1204
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 70
+  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -6,14 +6,17 @@ author: Bhavin Patel, Patrick Bareiss, Splunk
 status: deprecated
 type: Hunting
 description: This search looks for specific authentication events from the Windows
-  Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts.
+  Security Event logs to detect potential attempts at using the Pass-the-Hash technique.
+  This search is DEPRECATED as it is possible for event code 4624 to generate a high
+  level of noise, as legitimate logon events may also trigger this event code. This
+  can be especially true in environments with high levels of user activity, such as
+  those with many concurrent logons or frequent logon attempts.
 data_source:
 - Windows Event Log Security 4624
-search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) 
-  | fillnull 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp
+  NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) | fillnull
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type,
+  WorkstationName, user, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_activity_related_to_pass_the_hash_attacks_filter`'
 how_to_implement: To successfully implement this search, you must ingest your Windows
  Security Event logs and leverage the latest TA for Windows.
@@ -62,3 +65,10 @@ tests:
    source: WinEventLog:Security
    sourcetype: WinEventLog
    update_timestamp: true
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -17,17 +17,18 @@ search: '`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa
  as user]| stats  count min(_time) as firstTime max(_time) as lastTime values(eventName)
  as eventName by userIdentity.arn userIdentity.type user | `security_content_ctime(firstTime)`  |
  `security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter`'
-
-how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS 
-  (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Leverage the support search `Create 
-  a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.
+how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
+  inputs. Leverage the support search `Create a list of approved AWS service accounts`:
+  run it once every 30 days to create a list of service accounts and validate them.

  This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`)
  that are not yet supported by ES Incident Review and therefore cannot be viewed
  when a notable event is raised. These fields contribute additional context to the
  notable. To see the additional metadata, add the following fields, if not already
-  present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):
-  
+  present, to Incident Review - Event Attributes (Configure > Incident Management
+  > Incident Review Settings > Add New Entry):
+
  * **Label:** AWS Event Name, **Field:** eventName

  * **Label:** AWS User ARN, **Field:** userIdentity.arn
@@ -67,3 +68,10 @@ tags:
  - user
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -31,7 +31,7 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
  additional metadata, add the following fields, if not already present, to Incident
  Review - Event Attributes (Configure > Incident Management > Incident Review Settings
  > Add New Entry):
-  
+
  * **Label:** AWS Event Name, **Field:** eventName

  * **Label:** First Time, **Field:** firstTime
@@ -71,3 +71,10 @@ tags:
  - user
  risk_score: 25.0
  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -20,21 +20,21 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  | table dest domain url] | table count src dest query answer domain url | `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter`'
 how_to_implement: 'You need to ingest data from your DNS logs in the Network_Resolution
  datamodel. Specifically you must ingest the domain that is being queried and the
-  IP of the host originating the request. Ideally, you should also be ingesting
-  the answer to the query and the query type. This approach allows you to also create
+  IP of the host originating the request. Ideally, you should also be ingesting the
+  answer to the query and the query type. This approach allows you to also create
  your own localized passive DNS capability which can aid you in future investigations.
  You will have to add legitimate domain names to the `legit_domains.csv` file shipped
  with the app.
-  
+
  **Splunk>Phantom Playbook Integration**
-  
-  If Splunk>Phantom is also configured in your environment, a Playbook called `Lets Encrypt Domain
-  Investigate` can be configured to run when any results are found by this detection
-  search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`,
-  add the correct hostname to the "Phantom Instance" field in the Adaptive Response
-  Actions when configuring this detection search, and set the corresponding Playbook
-  to active.
-  
+
+  If Splunk>Phantom is also configured in your environment, a Playbook called `Lets
+  Encrypt Domain Investigate` can be configured to run when any results are found
+  by this detection search. To use this integration, install the Phantom App for Splunk
+  `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom
+  Instance" field in the Adaptive Response Actions when configuring this detection
+  search, and set the corresponding Playbook to active.
+
  (Playbook link:`https://my.phantom.us/4.2/playbook/lets-encrypt-domain-investigate/`)'
 known_false_positives: If a known good domain is not listed in the legit_domains.csv
  file, then the search could give you false postives. Please update that lookup file
@@ -67,3 +67,10 @@ tags:
  - host
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -57,3 +57,10 @@ tags:
  - DNS.answer
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -6,13 +6,14 @@ author: Patrick Bareiss, Splunk
 status: deprecated
 type: TTP
 description: This search looks for reading loaded Images unique to credential dumping
-  with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code.
+  with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon
+  Event Code.
 data_source:
 - Sysmon EventID 7
 search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId)
  as ProcessId by dest, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll
-  ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `detect_mimikatz_using_loaded_images_filter`'
+  ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter`'
 how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
  includes EventCode 7 with powershell.exe. This search uses an input macro named
  `sysmon`. We strongly recommend that you specify your environment-specific configurations
@@ -70,3 +71,10 @@ tests:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: XmlWinEventLog
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -53,3 +53,10 @@ tags:
  - Process_ID
  risk_score: 25
  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -54,3 +54,10 @@ tags:
  - eventName
  risk_score: 25.0
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -51,3 +51,10 @@ tags:
  - userIdentity.arn
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,16 +38,16 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
  notable. To see the additional metadata, add the following fields, if not already
  present, to Incident Review - Event Attributes (Configure > Incident Management
  > Incident Review Settings > Add New Entry):
-  
+
  * **Label:** AWS Event Name, **Field:** eventName
-  
+
  * **Label:** Number of API Calls, **Field:** numberOfApiCalls

  * **Label:** Unique API Calls, **Field:** uniqueApisCalled

  Detailed documentation on how to create a new field within Incident Review may be
  found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
-known_false_positives: 'None.'
+known_false_positives: None.
 references: []
 tags:
  analytic_story:
@@ -73,3 +73,10 @@ tags:
  - userIdentity.arn
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -59,3 +59,10 @@ tags:
  - userIdentity.arn
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -60,3 +60,10 @@ tags:
  - serIdentity.arn
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -50,3 +50,10 @@ tags:
  - All_Changes.dest
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -24,7 +24,7 @@ how_to_implement: 'This search requires you to be ingesting web-traffic logs. Yo
  contribute additional context to the notable. To see the additional metadata, add
  the following fields, if not already present, to Incident Review - Event Attributes
  (Configure > Incident Management > Incident Review Settings > Add New Entry):
-  
+
  * **Label:** IsDynamicDNS, **Field:** isDynDNS

  Detailed documentation on how to create a new field within Incident Review may be
@@ -59,3 +59,10 @@ tags:
  - Web.dest
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -72,3 +72,10 @@ tags:
  - DNS.src
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -48,3 +48,10 @@ tags:
  - DNS.dest
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -21,18 +21,17 @@ how_to_implement: 'To successfully implement this search you will need to ensure
  DNS data is populating the `Network_Resolution` data model. It also requires that
  the `discover_dns_record` lookup table be populated by the included support search
  "Discover DNS record".
-  
+
  **Splunk>Phantom Playbook Integration**
-  
-  If Splunk>Phantom is also configured in your environment, a Playbook called "DNS Hijack Enrichment"
-  can be configured to run when any results are found by this detection search.
-  The playbook takes in the DNS record changed and uses Geoip, whois, Censys and
-  PassiveTotal to detect if DNS issuers changed. To use this integration, install
-  the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the
-  correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions
-  when configuring this detection search, and set the corresponding Playbook to
-  active.
-  
+
+  If Splunk>Phantom is also configured in your environment, a Playbook called "DNS
+  Hijack Enrichment" can be configured to run when any results are found by this detection
+  search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys
+  and PassiveTotal to detect if DNS issuers changed. To use this integration, install
+  the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct
+  hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when
+  configuring this detection search, and set the corresponding Playbook to active.
+
  (Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`)'
 known_false_positives: Legitimate DNS changes can be detected in this search. Investigate,
  verify and update the list of provided current answers for the domains in question
@@ -65,3 +64,10 @@ tags:
  - DNS.query
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -17,9 +17,10 @@ description: 'Detect a renamed instance of procdump.exe dumping the lsass proces
 data_source:
 - Sysmon EventID 1
 search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1
-  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
-  process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
+  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* |  stats count min(_time)
+  as firstTime max(_time) as lastTime by dest, parent_process_name, process_name,
+  OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `dump_lsass_via_procdump_rename_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -67,3 +68,10 @@ tags:
  - parent_process_name
  risk_score: 80
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -50,3 +50,10 @@ tags:
  - userIdentity.arn
  risk_score: 25.0
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -48,3 +48,10 @@ tags:
  - awsRegion
  risk_score: 25.0
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -51,3 +51,10 @@ tags:
  - requestParameters.instancesSet.items{}.imageId
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -51,3 +51,10 @@ tags:
  - requestParameters.instanceType
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -52,3 +52,10 @@ tags:
  - userIdentity.arn
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -54,3 +54,10 @@ tags:
  - Processes.process_name
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -42,3 +42,10 @@ tags:
  - COMPUTERNAME
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -66,3 +66,10 @@ tags:
  - Processes.dest
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -53,3 +53,10 @@ tags:
  - data.protoPayload.response.bindings{}.members{}
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -52,3 +52,10 @@ tags:
  - data.resource.labels.project_id
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -42,3 +42,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -46,3 +46,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -41,3 +41,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -36,3 +36,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -37,4 +37,11 @@ tags:
  required_fields:
  - _time
  risk_score: 25
-  security_domain: threat
+  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -14,8 +14,8 @@ search: '`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrole
  user.groups{} |`kubernetes_aws_detect_sensitive_role_access_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with cloudwatch logs.
-known_false_positives: 'Sensitive role resource access is necessary for cluster operation,
-  however source IP, namespace and user group may indicate possible malicious use.'
+known_false_positives: Sensitive role resource access is necessary for cluster operation,
+  however source IP, namespace and user group may indicate possible malicious use.
 references: []
 tags:
  analytic_story:
@@ -37,3 +37,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -37,3 +37,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -14,8 +14,8 @@ search: '`kubernetes_azure` category=kube-audit | spath input=properties.log| se
  | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`'
 how_to_implement: You must install the Add-on for Microsoft Cloud Services and Configure
  Kube-Audit data diagnostics
-known_false_positives: 'Sensitive role resource access is necessary for cluster operation,
-  however source IP, namespace and user group may indicate possible malicious use.'
+known_false_positives: Sensitive role resource access is necessary for cluster operation,
+  however source IP, namespace and user group may indicate possible malicious use.
 references: []
 tags:
  analytic_story:
@@ -37,3 +37,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -37,3 +37,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -40,3 +40,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -37,3 +37,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -39,3 +39,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -14,9 +14,9 @@ search: '`google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=Clu
  | dedup src_ip src_user |`kubernetes_gcp_detect_sensitive_role_access_filter`'
 how_to_implement: You must install splunk add on for GCP. This search works with pubsub
  messaging servicelogs.
-known_false_positives: 'Sensitive role resource access is necessary for cluster operation,
+known_false_positives: Sensitive role resource access is necessary for cluster operation,
  however source IP, user agent, decision and reason may indicate possible malicious
-  use.'
+  use.
 references: []
 tags:
  analytic_story:
@@ -38,3 +38,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -40,3 +40,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -39,3 +39,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -45,3 +45,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: network
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,12 +5,11 @@ date: '2024-10-17'
 author: Michael Haag, Mauricio Velazco, Rico Valdez, Splunk
 status: deprecated
 type: TTP
-description: 
-  '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Users Failing To Authenticate From Ip`.
-  This analytic identifies multiple failed logon attempts from
-  a single IP in a short period of time. Use this analytic to identify patterns of suspicious logins from a
-  single source and filter as needed or use this to drive tuning for higher fidelity
-  analytics.'
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `Okta Multiple Users Failing To Authenticate From Ip`. This analytic identifies
+  multiple failed logon attempts from a single IP in a short period of time. Use this
+  analytic to identify patterns of suspicious logins from a single source and filter
+  as needed or use this to drive tuning for higher fidelity analytics.'
 data_source: []
 search: '`okta` eventType=user.session.start outcome.result=FAILURE | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
@@ -66,4 +65,11 @@ tests:
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log
    source: Okta
-    sourcetype: OktaIM2:log
+    sourcetype: OktaIM2:log
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,10 +5,9 @@ date: '2024-10-17'
 author: Patrick Bareiss, Splunk
 status: deprecated
 type: Anomaly
-description: 
-  '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Mailbox Email Forwarding Enabled`.
-  This search detects when an admin configured a forwarding rule for multiple
-  mailboxes to the same destination.'
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `O365 Mailbox Email Forwarding Enabled`. This search detects when an admin
+  configured a forwarding rule for multiple mailboxes to the same destination.'
 data_source: []
 search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters
  | rename Identity AS src_user | search ForwardingAddress=* | stats dc(src_user)
@@ -52,3 +51,10 @@ tests:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled.json
    sourcetype: o365:management:activity
    source: o365
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,86 @@
+name: O365 Suspicious Rights Delegation
+id: b25d2973-303e-47c8-bacd-52b61604c6a7
+version: 3
+date: '2024-10-17'
+author: Patrick Bareiss, Mauricio Velazco, Splunk
+status: deprecated
+type: TTP
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `O365 Elevated Mailbox Permission Assigned`. This analytic identifies instances
+  where potentially suspicious rights are delegated within the Office 365 environment.
+  Specifically, it detects when a user is granted FullAccess, SendAs, or SendOnBehalf
+  permissions on another users mailbox. Such permissions can allow a user to access,
+  send emails from, or send emails on behalf of the target mailbox. The detection
+  leverages O365 audit logs, focusing on the Add-MailboxPermission operation. By parsing
+  the parameters of this operation, the analytic filters for events where FullAccess,
+  SendAs, or SendOnBehalf rights are granted. It then aggregates this data to capture
+  the source user (who was granted the permissions), the destination user (whose mailbox
+  was affected), the specific operation, and the type of access rights granted. Delegating
+  mailbox rights, especially those as powerful as FullAccess, can pose significant
+  security risks. While there are legitimate scenarios for these permissions, such
+  as an executive assistant needing access to an executives mailbox, there are also
+  malicious scenarios where an attacker or a compromised insider might grant themselves
+  unauthorized access to sensitive mailboxes. Monitoring for these permissions changes
+  is crucial to detect potential insider threats, compromised accounts, or other malicious
+  activities.If the detection is a true positive, it indicates that a user has been
+  granted potentially high-risk permissions on another users mailbox. This could lead
+  to unauthorized access to sensitive emails, impersonation through sending emails
+  as or on behalf of the mailbox owner, or data manipulation by altering or deleting
+  emails. Immediate investigation is required to validate the legitimacy of the permission
+  change and to assess the potential risks associated with the granted access.'
+data_source: []
+search: '`o365_management_activity` Operation=Add-MailboxPermission | spath input=Parameters
+  | rename User AS src_user, Identity AS dest_user | search AccessRights=FullAccess
+  OR AccessRights=SendAs OR AccessRights=SendOnBehalf | stats count earliest(_time)
+  as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights
+  |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_rights_delegation_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
+  Office 365 management activity events.
+known_false_positives: While there are legitimate scenarios for these permissions,
+  such as an executive assistant needing access to an executive's mailbox, there are
+  also malicious scenarios. Investigate and filter as needed.
+references:
+- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
+- https://attack.mitre.org/techniques/T1098/002/
+- https://attack.mitre.org/techniques/T1114/002/
+tags:
+  analytic_story:
+  - Office 365 Collection Techniques
+  asset_type: O365 Tenant
+  confidence: 60
+  impact: 80
+  message: User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$
+    that allow access to sensitive
+  mitre_attack_id:
+  - T1114.002
+  - T1114
+  - T1098.002
+  - T1098
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
+  risk_score: 48
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/suspicious_rights_delegation.json
+    sourcetype: o365:management:activity
+    source: o365
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,88 @@
+name: O365 Suspicious User Email Forwarding
+id: f8dfe015-dbb3-4569-ba75-b13787e06aa4
+version: 3
+date: '2024-10-17'
+author: Patrick Bareiss, Splunk
+status: deprecated
+type: Anomaly
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `O365 Mailbox Email Forwarding Enabled`. The following analytic detects when
+  multiple users have configured a forwarding rule to the same destination to proactively
+  identify and investigate potential security risks related to email forwarding and
+  take appropriate actions to protect the organizations data and prevent unauthorized
+  access or data breaches. This detection is made by a Splunk query to O365 management
+  activity logs with the operation `Set-Mailbox` to gather information about mailbox
+  configurations. Then, the query uses the `spath` function to extract the parameters
+  and rename the "Identity" field as "src_user" and searches for entries where the
+  "ForwardingSmtpAddress" field is not empty, which indicates the presence of a forwarding
+  rule. Next, the analytic uses the `stats` command to group the results by the forwarding
+  email address and count the number of unique source users (`src_user`). Finally,
+  it filters the results and only retains entries where the count of source users
+  (`count_src_user`) is greater than 1, which indicates that multiple users have set
+  up forwarding rules to the same destination. This detection is important because
+  it suggests that multiple users are forwarding emails to the same destination without
+  proper authorization, which can lead to the exposure of sensitive information, loss
+  of data control, or unauthorized access to confidential emails. Investigating and
+  addressing this issue promptly can help prevent data breaches and mitigate potential
+  damage.indicates a potential security risk since multiple users forwarding emails
+  to the same destination can be a sign of unauthorized access, data exfiltration,
+  or a compromised account. Additionally, it also helps to determine if the forwarding
+  rules are legitimate or if they indicate a security incident. False positives can
+  occur if there are legitimate reasons for multiple users to forward emails to the
+  same destination, such as a shared mailbox or a team collaboration scenario. Next
+  steps include further investigation and context analysis to determine the legitimacy
+  of the forwarding rules.'
+data_source: []
+search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters
+  | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user)
+  AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user)
+  AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user
+  > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`'
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Office 365 Collection Techniques
+  - Data Exfiltration
+  asset_type: O365 Tenant
+  confidence: 60
+  impact: 80
+  message: User $user$ configured multiple users $src_user$ with a count of $count_src_user$,
+    a forwarding rule to same destination $ForwardingSmtpAddress$
+  mitre_attack_id:
+  - T1114.003
+  - T1114
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ForwardingSmtpAddress
+    type: Email Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
+  risk_score: 48
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled.json
+    sourcetype: o365:management:activity
+    source: o365
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,15 +5,15 @@ date: '2024-10-17'
 author: Michael Haag, Splunk
 status: deprecated
 type: Anomaly
-description: 
-  '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`.
-  The following analytic utilizes the user.acount.lock event to identify
-  associates who are locked out of Okta. An adversary attempting to brute force or
-  password spray account names may lock accounts out depending on the threshold.'
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `Okta Multiple Accounts Locked Out`. The following analytic utilizes the user.acount.lock
+  event to identify associates who are locked out of Okta. An adversary attempting
+  to brute force or password spray account names may lock accounts out depending on
+  the threshold.'
 data_source: []
 search: '`okta` eventType=user.account.lock | stats count min(_time) as firstTime
-  max(_time) as lastTime values(displayMessage) values(src_user) as user by src_ip eventType status
-  | where count >=3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
+  max(_time) as lastTime values(displayMessage) values(src_user) as user by src_ip
+  eventType status | where count >=3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `okta_account_locked_out_filter`'
 how_to_implement: This analytic is specific to Okta and requires Okta logs to be ingested.
 known_false_positives: False positives may be present. Tune Okta and tune the analytic
@@ -53,4 +53,11 @@ tests:
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log
    source: Okta
-    sourcetype: OktaIM2:log
+    sourcetype: OktaIM2:log
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,16 +5,16 @@ date: '2024-10-17'
 author: Michael Haag, Rico Valdez, Splunk
 status: deprecated
 type: Anomaly
-description: 
-  '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`.
-  The following anomaly will generate based on account lockout events utilizing
-  Okta eventTypes of user.account.lock.limit or user.account.lock. Per the Okta docs
-  site, this event is fired when a user account has reached the lockout limit. The
-  account will not auto-unlock and a user or client cannot gain access to the account.
-  This event indicates an account that will not be able to log in until remedial action
-  is taken by the account admin. This event can be used to understand the specifics
-  of an account lockout. Often this indicates a client application that is repeatedly
-  attempting to authenticate with invalid credentials such as an old password.'
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `Okta Multiple Accounts Locked Out`. The following anomaly will generate based
+  on account lockout events utilizing Okta eventTypes of user.account.lock.limit or
+  user.account.lock. Per the Okta docs site, this event is fired when a user account
+  has reached the lockout limit. The account will not auto-unlock and a user or client
+  cannot gain access to the account. This event indicates an account that will not
+  be able to log in until remedial action is taken by the account admin. This event
+  can be used to understand the specifics of an account lockout. Often this indicates
+  a client application that is repeatedly attempting to authenticate with invalid
+  credentials such as an old password.'
 data_source: []
 search: '`okta` eventType IN (user.account.lock.limit,user.account.lock) | rename
  client.geographicalContext.country as country, client.geographicalContext.state
@@ -63,4 +63,11 @@ tests:
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log
    source: Okta
-    sourcetype: OktaIM2:log
+    sourcetype: OktaIM2:log
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,7 +5,10 @@ date: '2024-10-17'
 author: Michael Haag, Rico Valdez, Splunk
 status: deprecated
 type: Anomaly
-description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with this detection `Okta Unauthorized Access to Application - DM`.  The following anomaly identifies failed Okta SSO events utilizing the legacy Okta event "unauth app access attempt".'
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with this detection `Okta Unauthorized Access to Application - DM`.  The following
+  anomaly identifies failed Okta SSO events utilizing the legacy Okta event "unauth
+  app access attempt".'
 data_source: []
 search: '`okta` eventType=app.generic.unauth_app_access_attempt | stats min(_time)
  as firstTime max(_time) as lastTime values(app) as Apps count by src_user, result
@@ -45,3 +48,10 @@ tags:
  - src_ip
  risk_score: 16
  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,60 @@
+name: Okta ThreatInsight Login Failure with High Unknown users
+id: 632663b0-4562-4aad-abe9-9f621a049738
+version: 3
+date: '2024-10-17'
+author: Okta, Inc, Michael Haag, Splunk
+type: TTP
+status: deprecated
+data_source: []
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas
+  ThreatInsight to identify Login failures with high unknown users count and any included
+  secondary outcome reasons. This event will trigger when a brute force attempt occurs
+  with unknown usernames attempted.'
+search: '`okta` eventType="security.threat.detected" AND outcome.reason="Login failures
+  with high unknown users count*" | stats count min(_time) as firstTime max(_time)
+  as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent
+  client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `okta_threatinsight_login_failure_with_high_unknown_users_filter`'
+how_to_implement: This search is specific to Okta and requires Okta logs to be ingested
+  in your Splunk deployment.
+known_false_positives: Fidelity of this is high as it is Okta ThreatInsight. Filter
+  and modify as needed.
+references:
+- https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 100
+  impact: 50
+  message: Okta ThreatInsight has detected or prevented a high number of login failures.
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  - T1110.004
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType
+  - client.userAgent.rawUserAgent
+  - client.userAgent.browser
+  - outcome.reason
+  - displayMessage
+  risk_score: 50
+  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -0,0 +1,59 @@
+name: Okta ThreatInsight Suspected PasswordSpray Attack
+id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2
+version: 3
+date: '2024-10-17'
+author: Okta, Inc, Michael Haag, Splunk
+type: TTP
+status: deprecated
+data_source: []
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas
+  ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons.
+  This event will trigger when a brute force attempt occurs with unknown usernames
+  attempted.'
+search: '`okta` eventType="security.threat.detected" AND outcome.reason="Password
+  Spray" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
+  by eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_suspected_passwordspray_attack_filter`'
+how_to_implement: This search is specific to Okta and requires Okta logs to be ingested
+  in your Splunk deployment.
+known_false_positives: Fidelity of this is high as it is Okta ThreatInsight. Filter
+  and modify as needed.
+references:
+- https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  confidence: 100
+  impact: 60
+  message: Okta ThreatInsight has detected or prevented a PasswordSpray attack.
+  mitre_attack_id:
+  - T1078
+  - T1078.001
+  - T1110.003
+  observable:
+  - name: outcome.reason
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventType
+  - client.userAgent.rawUserAgent
+  - client.userAgent.browser
+  - outcome.reason
+  - displayMessage
+  risk_score: 60
+  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -5,11 +5,10 @@ date: '2024-10-17'
 author: Michael Haag, Marissa Bower, Splunk
 status: deprecated
 type: TTP
-description: 
-  '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Failed MFA Requests For User`.
-  The following analytic identifies an account that has rejected more than
-  2 Push notifications in a 10 minute window. Modify this query for your environment
-  by upping the count or time window.'
+description: '**DEPRECATION NOTE** - This search has been deprecated and replaced
+  with `Okta Multiple Failed MFA Requests For User`. The following analytic identifies
+  an account that has rejected more than 2 Push notifications in a 10 minute window.
+  Modify this query for your environment by upping the count or time window.'
 data_source: []
 search: '`okta` outcome.reason="User rejected Okta push verify" OR (debugContext.debugData.factor="OKTA_VERIFY_PUSH"
  outcome.result=FAILURE legacyEventType="core.user.factor.attempt_fail" "target{}.detailEntry.methodTypeUsed"="Get
@@ -55,3 +54,10 @@ tags:
  - status
  risk_score: 64
  security_domain: access
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -41,3 +41,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: threat
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -59,3 +59,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -50,3 +50,10 @@ tags:
  - _times
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -54,3 +54,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -47,3 +47,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -13,8 +13,8 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime values(Processes.process) as process  from datamodel=Endpoint.Processes
  where Processes.process_name=schtasks.exe (Processes.process= "*create*"  OR Processes.process=
-  "*delete*") by Processes.parent_process Processes.process_name Processes.user Processes.dest |
-  `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  "*delete*") by Processes.parent_process Processes.process_name Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
  | search (process=*rhaegal* OR process=*drogon* OR *viserion_*) | `scheduled_tasks_used_in_badrabbit_ransomware_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection
  and Response (EDR) agents. These agents are designed to provide security-related
@@ -53,3 +53,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -40,3 +40,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
@@ -55,3 +55,10 @@ tags:
  - _time
  risk_score: 25
  security_domain: endpoint
+deprecation_metadata:
+  date: 01-20-2025
+  version: 5.0.0
+  replacement_id: null
+  replacement_name: null
+  migration_guide: URL_to_migration_doc
+  reason: These analytics are deprecated and are no longer supported
--- a/Show More
+++ b/Show More