Merge branch 'develop' into dependabot/pip/boto3-1.16.59

2026-06-08 17:32:49 +00:00 · 2021-01-27 12:25:29 +01:00
parent 1b4c1ca9e2 9d6f84f973
commit f99945cf52
116 changed files with 175521 additions and 175242 deletions
@@ -350,7 +350,7 @@ jobs:
            aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml"
      - run:
          name: security content api smoke test
-          command: | 
+          command: |
            API_URL='https://content.splunkresearch.com/detections'
            API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" $API_URL)
            echo "Security Content API Status: $API_STATUS"
@@ -359,6 +359,40 @@ jobs:
              exit 1
            fi

+  create-report:
+    executor: content-executor
+    steps:
+      - run:
+          name: checkout repo
+          command: |
+            if [ "${CIRCLE_BRANCH}" == "" ]; then
+                git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+            else
+                git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+            fi
+      - run: *apt-install
+      - run:
+          name: install python dependencies
+          command: |
+            cd security-content
+            rm -rf venv
+            virtualenv --python=/usr/bin/python3 --clear venv
+            source venv/bin/activate
+            pip install -q -r requirements.txt
+      - run:
+          name: run reporting
+          command: |
+            cd security-content
+            source venv/bin/activate
+            python bin/reporting.py
+      - aws-cli/setup:
+          profile-name: default
+      - run:
+          name: upload reporting
+          command: |
+            cd security-content
+            aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg"
+

 workflows:
  version: 2.1
@@ -393,6 +427,15 @@ workflows:
          filters:
            tags:
              only: /.*/
+      - create-report:
+          requires:
+            - validate-content
+            - build-sources
+            - build-package
+            - run-appinspect
+          filters:
+            tags:
+              only: /^v.*/
      - update-sources-github:
        # update package and docs in github if is a tag
          requires:
@@ -400,6 +443,7 @@ workflows:
            - build-sources
            - build-package
            - run-appinspect
+            - create-report
          filters:
            tags:
              only: /^v.*/
@@ -412,6 +456,7 @@ workflows:
            - build-sources
            - build-package
            - run-appinspect
+            - create-report
            - update-sources-github
          filters:
            tags:
@@ -425,6 +470,7 @@ workflows:
            - build-sources
            - build-package
            - run-appinspect
+            - create-report
            - update-sources-github
            - publish-github-release
          filters:
@@ -439,6 +485,7 @@ workflows:
            - build-sources
            - build-package
            - run-appinspect
+            - create-report
            - update-sources-github
            - publish-github-release
            - attack-range-update
@@ -1,11 +1,24 @@
-# Splunk Security Content
-![security-content](docs/static/logo.png)
-=====
+</p>
+<p align="center">
+    <a href="https://github.com/splunk/security_content/releases">
+        <img src="https://img.shields.io/github/v/release/splunk/security_content" /></a>
+    <a href="https://circleci.com/gh/splunk/security_content/tree/develop">
+        <img src="https://img.shields.io/circleci/build/github/splunk/security_content?token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269" /></a>
+    <a href="https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+extension%3Ayml+path%3Adetections&type=Code&ref=advsearch&l=&l=">
+        <img src="https://img.shields.io/github/directory-file-count/splunk/security_content/detections?extension=.yml&label=detections" /></a>
+    <a href="https://github.com/splunk/security_content">
+        <img src="https://security_content.s3-us-west-2.amazonaws.com/reporting/detection_coverage.svg" /></a>
+    <a href="https://github.com/splunk/security_content">
+        <img src="https://img.shields.io/github/downloads/splunk/security_content/total" /></a>
+    <a href="https://github.com/splunk/security_content/graphs/contributors" alt="Contributors">
+        <img src="https://img.shields.io/github/contributors/splunk/security_content" /></a>
+    <a href="https://github.com/splunk/security_content/stargazers">
+        <img src="https://img.shields.io/github/stars/splunk/security_content?style=social" /></a>
+</p>

-| branch | build status |
-| ---    | ---          |
-| develop| [![develop status](https://circleci.com/gh/splunk/security-content/tree/develop.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/develop)|
-| master | [![master status](https://circleci.com/gh/splunk/security-content/tree/master.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/master)|
+# Splunk Security Content
+![security_content](docs/static/logo.png)
+=====

 Welcome to the Splunk Security Content

@@ -14,7 +27,7 @@ This project gives you access to our repository of Analytic Stories that are sec
 # Usage🛡
 The Splunk Security Content can be used via:

-#### [Splunk App](https://github.com/splunk/security-content/releases)
+#### [Splunk App](https://github.com/splunk/security_content/releases)
 Grab the latest release of DA-ESS-ContentUpdate and install it on a Splunk Enterprise instance. Alternatively, you can download it from [splunkbase](https://splunkbase.splunk.com/app/3449/), it is currently a Splunk Supported App.

 #### [API](https://docs.splunkresearch.com/?version=latest)
@@ -25,35 +38,35 @@ curl -s https://content.splunkresearch.com | jq
 }
 ```

-#### [GitHub Workflow](https://github.com/splunk/security-content/wiki/Installation-and-Usage)
-Create your customized version of Security Content by forking this project and following this [guide](https://github.com/splunk/security-content/wiki/Installation-and-Usage#github-workflow).
+#### [GitHub Workflow](https://github.com/splunk/security_content/wiki/Installation-and-Usage)
+Create your customized version of Security Content by forking this project and following this [guide](https://github.com/splunk/security_content/wiki/Installation-and-Usage#github-workflow).

 # MITRE ATT&CK
 ### Detection Coverage
-To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/develop/bin/generate-coverage-map.py).
+To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).

 ![](docs/mitre-map/coverage.png)

 ### Detection Priority by Threat Actors
-If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer. Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security-content/blob/develop/bin/generate-actors-map.py) script.
+If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer. Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.

 ![](docs/mitre-map/priority.png)

 # Customize to your Environment 🏗
-Customize your content to change how [often detections run](https://github.com/splunk/security-content/wiki/Customize-to-Your-Environment#customizing-scheduling-and-alert-actions-with-deployments), or what the right source type for [sysmon](https://github.com/splunk/security-content/wiki/Customize-to-Your-Environment#customizing-source-types-with-macros) in your environment is please follow this [guide](https://github.com/splunk/security-content/wiki/Customize-to-Your-Environment).  
+Customize your content to change how [often detections run](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-scheduling-and-alert-actions-with-deployments), or what the right source type for [sysmon](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-source-types-with-macros) in your environment is please follow this [guide](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment).  

 # Writing Content 📓
-Please see the Developing Content [guide](https://github.com/splunk/security-content/wiki/Developing-Content) for instructions.
+Please see the Developing Content [guide](https://github.com/splunk/security_content/wiki/Developing-Content) for instructions.

 # What's in an Analytic Story?
-A complete use case, specifically built to detect, investigate, and respond to a specific threat like [Credential Dumping](https://github.com/splunk/security-content/blob/develop/stories/credential_dumping.yml) or [Ransomware](https://github.com/splunk/security-content/blob/develop/stories/ransomware.yml). A group of detections and a response make up an analytic story, they are associated with the tag `analytics_story: <name>`.  
+A complete use case, specifically built to detect, investigate, and respond to a specific threat like [Credential Dumping](https://github.com/splunk/security_content/blob/develop/stories/credential_dumping.yml) or [Ransomware](https://github.com/splunk/security_content/blob/develop/stories/ransomware.yml). A group of detections and a response make up an analytic story, they are associated with the tag `analytics_story: <name>`.  

 # Execute an Analytic Story 🏃‍♀️
 Download and install the latest version of [Splunk Analytic Story Execution](https://github.com/splunk/analytic_story_execution/releases). This Splunk application will help the user do the following:

 1. Execute an analytic story in an ad-hoc mode and view the results.
 2. Schedule all the detection searches in an analytic story.
-3. Update security-content via an API
+3. Update security_content via an API

 # Content Parts 🧩

@@ -72,10 +85,10 @@ Download and install the latest version of [Splunk Analytic Story Execution](htt
 * [bin/](bin/): All binaries required to produce and test content

 # Contribution 🥰
-We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security-content/wiki/Contributing-to-the-Project) for more information on how to get involved.
+We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved.

 ## Support 💪
-Please use the [GitHub Issue Tracker](https://github.com/splunk/security-content/issues) to submit bugs or request features.
+Please use the [GitHub Issue Tracker](https://github.com/splunk/security_content/issues) to submit bugs or request features.

 If you have questions or need support, you can:

@@ -29,7 +29,7 @@ def main(args):
                        help="specify the url of the atack range repository")
    parser.add_argument("-arb", "--attack_range_branch", required=False, default="develop",
                        help="specify the atack range branch")
-    parser.add_argument("-scr", "--security_content_repo", required=False, default="splunk/security-content",
+    parser.add_argument("-scr", "--security_content_repo", required=False, default="splunk/security_content",
                        help="specify the url of the security content repository")
    parser.add_argument("-scb", "--security_content_branch", required=False, default="develop",
                        help="specify the security content branch")
@@ -66,7 +66,7 @@ def main(args):

    # clone repositories
    git.Repo.clone_from('https://github.com/' + attack_range_repo, "attack_range", branch=attack_range_branch)
-    security_content_repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/' + security_content_repo, "security-content", branch=security_content_branch)
+    security_content_repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/' + security_content_repo, "security_content", branch=security_content_branch)

    sys.path.append(os.path.join(os.getcwd(),'attack_range'))
    copyfile('attack_range/attack_range.conf.template', 'attack_range/attack_range.conf')
@@ -81,10 +81,10 @@ def main(args):
    os.chmod(ssh_key_name, 0o600)

    # build new version of ESCU
-    sys.path.append(os.path.join(os.getcwd(),'security-content/bin'))
+    sys.path.append(os.path.join(os.getcwd(),'security_content/bin'))
    try:
        module = __import__('generate')
-        module.sys.argv = ['generate', '-p', 'security-content', '-o' 'security-content/package']
+        module.sys.argv = ['generate', '-p', 'security_content', '-o' 'security_content/package']
        results = module.main(module.sys.argv)
    except Exception as e:
        print('Error: ' + str(e))
@@ -111,7 +111,7 @@ def main(args):
        os.system('cd attack_range/terraform/aws && terraform init && cd ../../..')

    module = __import__('attack_range')
-    module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security-content/tests/' + test_file_name]
+    module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security_content/tests/' + test_file_name]

    execution_error = False

@@ -127,7 +127,7 @@ def main(args):
    response = ec2.delete_key_pair(KeyName=ssh_key_name)

    # read_test_file
-    test_file = load_file('security-content/tests/' + test_file_name)
+    test_file = load_file('security_content/tests/' + test_file_name)

    # check if was succesful
    if not execution_error:
@@ -143,7 +143,7 @@ def main(args):
        counter = 0
        for test in results:
            if not test['detection_result']['error']:
-                file_path = 'security-content/detections/' + test['detection_result']['detection_file']
+                file_path = 'security_content/detections/' + test['detection_result']['detection_file']
                detection_obj = load_file(file_path)
                detection_obj['tags']['automated_detection_testing'] = 'passed'
                if 'attack_data' in test_file['tests'][counter]:
@@ -171,7 +171,7 @@ def main(args):
            security_content_repo_obj.remotes.origin.pull()
        security_content_repo_obj.git.push('--set-upstream', 'origin', branch_name)
        g = Github(O_AUTH_TOKEN_GITHUB)
-        repo = g.get_repo("splunk/security-content")
+        repo = g.get_repo("splunk/security_content")
        pull_requests = repo.get_pulls(state='open', sort='created', head=branch_name)
        for pr in pull_requests:
            if pr.head.label == str('splunk:' + branch_name):
@@ -1,4 +1,4 @@
-ansible==2.10.5
+ansible==2.10.6
 ansible-runner==1.4.6
 apipkg==1.5
 aspy.yaml==1.3.0
@@ -8,13 +8,13 @@ attrs==20.3.0
 azure-common==1.1.26
 azure-core==1.10.0
 azure-identity==1.5.0
-azure-mgmt-compute==18.0.0
+azure-mgmt-compute==18.1.0
 azure-mgmt-core==1.2.2
 azure-mgmt-network==17.0.0
 azure-mgmt-resource==15.0.0
 bcrypt==3.2.0
 boto3==1.16.59
-botocore==1.19.58
+botocore==1.19.60
 certifi==2020.12.5
 cffi==1.14.4
 cfgv==2.0.1
@@ -23,7 +23,7 @@ configparser==4.0.2
 contextlib2==0.6.0.post1
 cryptography==3.3.1
 Deprecated==1.2.11
-dnspython==2.0.0
+dnspython==2.1.0
 docutils==0.16
 execnet==1.7.1
 gitdb==4.0.5
@@ -50,19 +50,20 @@ pluggy==0.13.1
 pre-commit==2.9.3
 protobuf==3.14.0
 psutil==5.8.0
-py==1.10.0
 ptyprocess==0.7.0
+py==1.10.0
 pycparser==2.20
 PyGithub==1.54.1
+PyInquirer==1.0.3
 PyJWT==2.0.1
 PyNaCl==1.4.0
 pyparsing==2.4.7
-pytest==6.2.1
+pytest==6.2.2
 python-daemon==2.2.4
 python-dateutil==2.8.1
 python-terraform==0.10.1
 pywinrm==0.4.1
-PyYAML==5.4
+PyYAML==5.4.1
 requests==2.25.1
 requests-ntlm==1.1.0
 s3transfer==0.3.4
@@ -72,8 +73,8 @@ splunk-sdk==1.6.14
 tabulate==0.8.7
 termcolor==1.1.0
 toml==0.10.2
-urllib3==1.26.2
-virtualenv==20.2.2
+urllib3==1.26.3
+virtualenv==20.3.0
 wcwidth==0.2.5
 wget==3.2
 wrapt==1.12.1
@@ -663,7 +663,7 @@ if __name__ == "__main__":
    # grab arguments
    parser = argparse.ArgumentParser(description="generates documentation from our content", epilog="""
    This tool converts manifests information to documents in variious format like markdown and wiki markup used by Splunk docs.""")
-    parser.add_argument("-p", "--path", required=True, help="path to security-content repo")
+    parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
    parser.add_argument("-o", "--output", required=True, help="path to the output directory for the docs")
    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
    parser.add_argument("-gsd", "--gen_splunk_docs", required=False, default=True, action='store_true',
@@ -13,7 +13,7 @@ from stix2 import Filter

 VERSION = "4.1"
 NAME = "Detection Priority by Threat Actors"
-DESCRIPTION = "security-content detection priorty by common techniques used from threat actors"
+DESCRIPTION = "security_content detection priorty by common techniques used from threat actors"
 DOMAIN = "mitre-enterprise"

 def main(argv):
@@ -111,7 +111,7 @@ def get_matched_techniques(counted_techniques, detections):
        matched_splunk_detections = []

        # find detections from Splunks security content
-        # https://github.com/splunk/security-content
+        # https://github.com/splunk/security_content
        for detection in detections:
            if 'mitre_attack_id' in detection['object']['tags']:
                for mitreid in detection['object']['tags']['mitre_attack_id']:
@@ -150,7 +150,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):

        if len(technique["splunk_rules"]) > 0:
            for splunk_rule in technique["splunk_rules"]:
-                comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
+                comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])

        if len(comments) > 0:
            layer_technique["comment"] = "\n\n".join(comments)
@@ -209,7 +209,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):

 def generate_csv_file(matched_techniques, output):

-    security_content_url = 'https://github.com/splunk/security-content/blob/develop/detections/'
+    security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'

    with open(output + '/detections.csv', 'w') as f:
        writer = csv.writer(f)
@@ -13,7 +13,7 @@ from stix2 import Filter

 VERSION = "4.1"
 NAME = "Detection Coverage"
-DESCRIPTION = "security-content detection coverage"
+DESCRIPTION = "security_content detection coverage"
 DOMAIN = "mitre-enterprise"

 def main(argv):
@@ -86,7 +86,7 @@ def get_matched_techniques(counted_techniques, detections):
        matched_splunk_detections = []

        # find detections from Splunks security content
-        # https://github.com/splunk/security-content
+        # https://github.com/splunk/security_content
        for detection in detections:
            if 'mitre_attack_id' in detection['object']['tags']:
                for mitreid in detection['object']['tags']['mitre_attack_id']:
@@ -115,7 +115,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
        comments = []
        if len(technique["splunk_rules"]) > 0:
            for splunk_rule in technique["splunk_rules"]:
-                comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
+                comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])
                layer_technique = {
                "techniqueID": technique["ID"],
                "score" : technique["score"]
@@ -177,7 +177,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):

 def generate_csv_file(matched_techniques, output):

-    security_content_url = 'https://github.com/splunk/security-content/blob/develop/detections/'
+    security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'

    with open(output + '/coverage.csv', 'w') as f:
        writer = csv.writer(f)
@@ -1,7 +1,7 @@
 #!/usr/bin/python

 '''
-Generates splunk configurations from manifest files under the security-content repo.
+Generates splunk configurations from manifest files under the security_content repo.
 '''

 import glob
@@ -122,6 +122,8 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
            detection['risk_object_type'] = detection['tags']['risk_object_type']
        if 'risk_score' in detection['tags']:
            detection['risk_score'] = detection['tags']['risk_score']
+        if 'product' in detection['tags']:
+            detection['product'] = detection['tags']['product']

    for baseline in baselines:
        data_model = parse_data_models_from_search(baseline['search'])
@@ -340,6 +342,18 @@ def get_deployments(object, deployments):
                        matched_deployments.append(deployment)
                        continue

+        if 'product' in deployment['tags']:
+            if type(deployment['tags']['product']) is str:
+                if 'product' in object['tags']:
+                    if deployment['tags']['product'] == object['tags']['analytics_story'] or deployment['tags']['product']=='Splunk Security Analytics for AWS':
+                        matched_deployments.append(deployment)
+            else:
+                for story in deployment['tags']['product']:
+                    if story == object['tags']['product']:
+                        matched_deployments.append(deployment)
+                        continue
+
+
        if 'detection_name' in deployment['tags']:
            if type(deployment['tags']['detection_name']) is str:
                if deployment['tags']['detection_name'] == object['name']:
@@ -580,10 +594,10 @@ def generate_mitre_lookup(OUTPUT_PATH):

 def main(args):

-    parser = argparse.ArgumentParser(description="generates splunk conf files out of security-content manifests", epilog="""
+    parser = argparse.ArgumentParser(description="generates splunk conf files out of security_content manifests", epilog="""
    This tool converts manifests to the source files to be used by products like Splunk Enterprise.
    It generates the savesearches.conf, analytics_stories.conf files for ES.""")
-    parser.add_argument("-p", "--path", required=True, help="path to security-content repo")
+    parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
    parser.add_argument("-o", "--output", required=True, help="path to the output directory")
    parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")

@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -34,6 +34,9 @@ action.escu.modification_date = {{ detection.date }}
 action.escu.confidence = high
 action.escu.full_search_name = {{ detection.type | default('ESCU') }} - {{ detection.name }} - Rule
 action.escu.search_type = detection
+{% if detection.product is defined %}
+action.escu.product = {{ detection.product | tojson }}
+{% endif %}
 {% if detection.providing_technologies is defined %}
 action.escu.providing_technologies = {{ detection.providing_technologies | tojson }}
 {% else %}
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="20">
+<linearGradient id="a" x2="0" y2="100%">
+  <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+  <stop offset="2" stop-opacity=".1"/>
+</linearGradient>
+
+<rect rx="3" width="60" height="20" fill="#555"/> <!-- Comment -->
+<rect rx="3" x="60" width="40" height="20" fill="#4c1"/>
+
+<path fill="#4c1" d="M58 0h4v20h-4z"/>
+
+<rect rx="3" width="100" height="20" fill="url(#a)"/>
+<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
+    <text x="30" y="15" fill="#010101" fill-opacity=".3">coverage</text>
+    <text x="30" y="14">coverage</text>
+    <text x="80" y="14">{{ detection_coverage }}</text>
+</g>
+</svg>
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -1,5 +1,5 @@
 #############
-# Automatically generated by generator.py in splunk/security-content
+# Automatically generated by generator.py in splunk/security_content
 # On Date: {{ time }} UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
@@ -0,0 +1,67 @@
+#!/usr/bin/python
+
+import glob
+import yaml
+import argparse
+import os
+from os import path
+import sys
+import datetime
+from jinja2 import Environment, FileSystemLoader
+
+
+def load_objects(file_path, REPO_PATH):
+    files = []
+    manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
+    for file in sorted(glob.glob(manifest_files)):
+        files.append(load_file(file))
+    return files
+
+
+def load_file(file_path):
+    with open(file_path, 'r', encoding="utf-8") as stream:
+        try:
+            file = list(yaml.safe_load_all(stream))[0]
+        except yaml.YAMLError as exc:
+            print(exc)
+            sys.exit("ERROR: reading {0}".format(file_path))
+    return file
+
+
+
+def main(args):
+
+    # process all detections
+    REPO_PATH = os.path.join(os.path.dirname(__file__), '../')
+    detections = []
+    detections = load_objects("detections/application/*.yml", REPO_PATH)
+    detections.extend(load_objects("detections/cloud/*.yml", REPO_PATH))
+    detections.extend(load_objects("detections/endpoint/*.yml", REPO_PATH))
+    detections.extend(load_objects("detections/network/*.yml", REPO_PATH))
+    detections.extend(load_objects("detections/web/*.yml", REPO_PATH))
+
+    tests = load_objects("tests/*/*.yml", REPO_PATH)
+
+    counter_tests=0
+    counter_detection=0
+
+    for detection in detections:
+        counter_detection=counter_detection+1
+
+    for test in tests:
+        counter_tests=counter_tests+1
+
+    detection_coverage = "{:.0%}".format(counter_tests/counter_detection)
+
+    TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
+    OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting')
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True)
+    template = j2_env.get_template('svg_badge.j2')
+    output_path = path.join(OUTPUT_PATH, 'detection_coverage.svg')
+    output = template.render(detection_coverage=detection_coverage)
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+
+
+if __name__ == "__main__":
+    main(sys.argv[1:])
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="20">
+<linearGradient id="a" x2="0" y2="100%">
+  <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+  <stop offset="2" stop-opacity=".1"/>
+</linearGradient>
+
+<rect rx="3" width="60" height="20" fill="#555"/> <!-- Comment -->
+<rect rx="3" x="60" width="40" height="20" fill="#4c1"/>
+
+<path fill="#4c1" d="M58 0h4v20h-4z"/>
+
+<rect rx="3" width="100" height="20" fill="url(#a)"/>
+<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
+    <text x="30" y="15" fill="#010101" fill-opacity=".3">coverage</text>
+    <text x="30" y="14">coverage</text>
+    <text x="80" y="14">80%%</text>
+</g>
+</svg>
@@ -1,7 +1,7 @@
 #!/usr/bin/python

 '''
-Validates Manifest file under the security-content repo for correctness.
+Validates Manifest file under the security_content repo for correctness.
 '''

 import glob
@@ -0,0 +1,12 @@
+name: Enterprise Security config for Splunk Security Analytics for AWS customers
+id: bc91a8cd-35e7-4bb2-6140-e756cc46f211
+date: '2021-01-20'
+description: This configuration file applies to all correlation searches that are used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics for AWS searches do not need notable  configurations 
+author: Bhavin Patel
+scheduling:
+  cron_schedule: '0 * * * *'
+  earliest_time: -70m@m
+  latest_time: -10m@m
+  schedule_window: auto
+tags:
+  product: Splunk Security Analytics for AWS
@@ -31,7 +31,6 @@ known_false_positives: Many service accounts configured within a cloud infrastru
 tags:
  analytics_story:
  - Suspicious Cloud Instance Activities
-  - Cloud Cryptomining
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
@@ -41,6 +40,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: Cloud
  asset_type: Cloud Instance
  risk_score: 10
@@ -41,6 +41,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: Cloud
  asset_type: Cloud Instance
  risk_score: 40
@@ -37,6 +37,8 @@ tags:
  - PR.AC
  security_domain: network
  asset_type: AWS Instance
+  product:
+  - Splunk Security Analytics for AWS
  risk_score: 25
  risk_object_type: user
  risk_object: user
@@ -36,6 +36,8 @@ tags:
  - DE.DP
  - DE.CM
  - PR.AC
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: network
  asset_type: AWS Instance
  risk_score: 25
@@ -43,6 +43,8 @@ tags:
  risk_score: 15
  risk_object_type: user
  risk_object: user
+  product:
+  - Splunk Security Analytics for AWS
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
@@ -33,6 +33,8 @@ tags:
  - ID.AM
  mitre_attack_id:
  - T1078
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: AWS Instance
  risk_score: 25
@@ -31,6 +31,8 @@ tags:
  - T1078.004
  nist:
  - ID.AM
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: Cloud Compute Instance
  risk_score: 20
@@ -37,6 +37,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: network
  asset_type: Cloud Compute Instance
  risk_score: 20
@@ -32,6 +32,8 @@ tags:
  - CIS 1
  nist:
  - ID.AM
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: Cloud Compute Instance
  risk_score: 20
@@ -32,6 +32,8 @@ tags:
  - CIS 1
  nist:
  - ID.AM
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: Cloud Compute Instance
  risk_score: 20
@@ -32,6 +32,8 @@ tags:
  - CIS 1
  nist:
  - ID.AM
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: AWS Instance
  risk_score: 10
@@ -47,6 +47,8 @@ tags:
  - ID.AM
  mitre_attack_id:
  - T1078
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: AWS Instance
  risk_score: 10
@@ -47,6 +47,8 @@ tags:
  - ID.AM
  mitre_attack_id:
  - T1078
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: AWS Instance
  risk_score: 5
@@ -46,6 +46,8 @@ tags:
  - ID.AM
  mitre_attack_id:
  - T1078
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: AWS Instance
  risk_score: 5
@@ -47,6 +47,8 @@ tags:
  - ID.AM
  mitre_attack_id:
  - T1078
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: endpoint
  asset_type: AWS Instance
  risk_score: 5
@@ -35,6 +35,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: network
  asset_type: AWS Instance
  risk_score: 30
@@ -41,6 +41,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: network
  asset_type: AWS Instance
  risk_score: 5
@@ -43,6 +43,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: network
  asset_type: AWS Instance
  risk_score: 5
@@ -43,6 +43,8 @@ tags:
  nist:
  - DE.DP
  - DE.AE
+  product:
+  - Splunk Security Analytics for AWS
  security_domain: network
  asset_type: AWS Instance
  risk_score: 5
@@ -6,6 +6,7 @@ description: This search is used to detect attempts to use DNS tunneling, by cal
  the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission
  for data exfiltration, command and control, or evasion of security controls can
  often be detected by noting unusually large volumes of DNS traffic.
+  Deprecated because this detection should focus on DNS queries instead of DNS responses.
 how_to_implement: To successfully implement this search you need to ingest data from
  your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically,
  this query requires that the DNS data model is populated with information regarding
@@ -31,7 +32,7 @@ tags:
  - Suspicious DNS Traffic
  - Command and Control
  mitre_attack_id:
-  - T1071.004
+  - T1048.003
  kill_chain_phases:
  - Command and Control
  cis20:
@@ -19,7 +19,8 @@ how_to_implement: 'This search requires you to be ingesting web-traffic logs. Yo
  **Label:** IsDynamicDNS, **Field:** isDynDNS\

  Detailed documentation on how to create a new field within Incident Review may be
-  found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
+  found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
+  Deprecated because duplicate.'
 type: ESCU
 references: []
 author: Bhavin Patel, Splunk
@@ -9,6 +9,7 @@ description: This search is used to detect DNS tunneling, by calculating the sum
  method of transmission for data exfiltration, command and control, or evasion of
  security controls can often be detected by noting an unusually large volume of DNS
  traffic.
+  Deprecated because existing detection is doing the same.
 how_to_implement: To successfully implement this search, we must ensure that DNS data
  is being ingested and mapped to the appropriate fields in the Network_Resolution
  data model. Fields like src_category are automatically provided by the Assets and
@@ -43,7 +44,7 @@ tags:
  - Suspicious DNS Traffic
  - Command and Control
  mitre_attack_id:
-  - T1071.004
+  - T1048.003
  kill_chain_phases:
  - Command and Control
  - Actions on Objectives
@@ -1,13 +1,14 @@
 name: Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments
 id: 2cdb91d2-542c-497f-b252-be495e71f38c
-version: 5
-date: '2020-11-20'
+version: 6
+date: '2021-01-19'
 description: This search looks for PowerShell processes started with a base64 encoded
  command-line passed to it, with parameters to modify the execution policy for the
  process, and those that prevent the display of an interactive prompt to the user.
  This combination of command-line options is suspicious because it overrides the
  default PowerShell execution policy, attempts to hide itself from the user, and
  passes an encoded script to be run on the command-line.
+  Deprecated because almost the same as Malicious PowerShell Process - Encoded Command
 how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
@@ -21,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* AND process=*-NonI*
+  search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec*
  | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`'
 known_false_positives: Legitimate process can have this combination of command-line
  options, but it's not common.
@@ -29,7 +30,7 @@ tags:
  analytics_story:
  - Malicious PowerShell
  mitre_attack_id:
-  - T1027
+  - T1059.001
  kill_chain_phases:
  - Command and Control
  - Actions on Objectives
@@ -6,11 +6,11 @@ description: This search will return a table of rare processes, the names of the
  running them, and the users who initiated each process.
 how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts and populating the endpoint data model
-  with the resultant dataset. The macro `filter_rare_process_whitelist` searches two
-  lookup files to whitelist your processes.  These consist of `rare_process_whitelist_default.csv`
-  and `rare_process_whitelist_local.csv`. To add your own processes to the whitelist,
-  add them to `rare_process_whitelist_local.csv`. If you wish to remove an entry from
-  the default lookup file, you will have to modify the macro itself to set the whitelist
+  with the resultant dataset. The macro `filter_rare_process_allow_list` searches two
+  lookup files for allowed processes.  These consist of `rare_process_allow_list_default.csv`
+  and `rare_process_allow_list_local.csv`. To add your own processes to the allow list,
+  add them to `rare_process_allow_list_local.csv`. If you wish to remove an entry from
+  the default lookup file, you will have to modify the macro itself to set the allow_list
  value for that process to false. You can modify the limit parameter and search scheduling
  to better suit your environment.
 type: ESCU
@@ -22,9 +22,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.dest)
  as process | rex field=user "(?<user_domain>.*)\\\\(?<user_name>.*)" | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes
  by Processes.process_name | rare Processes.process_name limit=30 | rename Processes.process_name
-  as process| `filter_rare_process_whitelist`| table process ] | `detect_rare_executables_filter` '
+  as process| `filter_rare_process_allow_list`| table process ] | `detect_rare_executables_filter` '
 known_false_positives: Some legitimate processes may be only rarely executed in your
-  environment. As these are identified, update `rare_process_whitelist_local.csv`
+  environment. As these are identified, update `rare_process_allow_list_local.csv`
  to filter them out of your search results.
 tags:
  analytics_story:
@@ -17,7 +17,7 @@ author: Rico Valdez, Splunk
 search: '| tstats `security_content_summariesonly` values(Processes.process_id) as
  process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process)
  as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name=powershell.exe AND (Processes.process="* -ex*" OR Processes.process="*
+  where Processes.process_name=powershell.exe (Processes.process="* -ex*" OR Processes.process="*
  bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`'
 known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
@@ -41,3 +41,6 @@ tags:
  - PR.IP
  security_domain: endpoint
  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log
@@ -1,14 +1,14 @@
 name: Malicious PowerShell Process With Obfuscation Techniques
 id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
-version: 3
-date: '2020-07-21'
+version: 4
+date: '2021-01-19'
 description: This search looks for PowerShell processes launched with arguments that
  have characters indicative of obfuscation on the command-line.
 how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. Deprecated because the detection need rework and would need to work base on powershell logs.
+  model.
 type: ESCU
 references: []
 author: David Dorsey, Splunk
@@ -17,9 +17,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest
  Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,
-  "`"))-1) + (mvcount(split(process, "^"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter`
-  | search num_obfuscation > 0'
+  `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1)
+  + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter`
+  | search num_obfuscation > 10 '
 known_false_positives: These characters might be legitimately on the command-line,
  but it is not common.
 tags:
@@ -40,3 +40,6 @@ tags:
  - PR.IP
  security_domain: endpoint
  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log
@@ -7,7 +7,7 @@ description: Monitor for execution of reg.exe with parameters specifying an expo
 how_to_implement: You must be ingesting windows endpoint data that tracks process activity,
  including parent-child relationships from your endpoints.
 type: SSA
-references: ['https://github.com/splunk/security-content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml']
+references: ['https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml']
 author: Jose Hernandez, Splunk
 search: '
 | from read_ssa_enriched_events()
@@ -1,4 +1,4 @@
-name: Rare Parent/Child Process Relationship - SSA
+name: Rare Parent-Child Process Relationship
 id: e03aa905-6549-4e34-b304-7a922185b2c4
 version: 1
 date: '2020-08-13'
@@ -127,4 +127,4 @@ tags:
    - parent_process_name
    - _time
    - dest_device_id
-    - dest_user_id
+    - dest_user_id
@@ -5,8 +5,8 @@ date: '2020-08-25'
 description: An attacker tries might try to use different version of a system command without overriding original,
  or they might try to avoid some detection running the process from a different folder.
  This detection checks that a list of system processes run inside C:\\Windows\System32 or C:\\Windows\SysWOW64
-  The list of system processes has been extracted from https://github.com/splunk/security-content/blob/develop/lookups/is_windows_system_file.csv
-  and the original detection https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
+  The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
+  and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 references: []
 type: SSA
@@ -20,8 +20,8 @@ search: '|tstats `security_content_summariesonly` count min(_time) as firstTime
  | `suspicious_email___uba_anomaly_filter`'
 known_false_positives: This detection model will alert on any sender domain that is
  seen for the first time. This could be a potential false positive. The next step
-  is to investigate and whitelist the URL if you determine that it is a legitimate
-  sender.
+  is to investigate and add the URL to an allow list if you determine that it is a
+  legitimate sender.
 tags:
  analytics_story:
  - Suspicious Emails
@@ -23,7 +23,8 @@ known_false_positives: At this stage, there are no known false positives. During
  normal operation of re-opening applications on reboot. Therefore, it can be asumed
  that any occurences of this in the process events would be worth investigating.
  In the event that the legitimate modification by the system of these files is in
-  fact logged to the process log, then the process_name of that process can be whitelisted.
+  fact logged to the process log, then the process_name of that process can be added to
+  an allow list.
 tags:
  kill_chain_phases:
  - Installation
@@ -5,7 +5,7 @@ date: '2021-01-14'
 description: Malicious actors often abuse legitimate Dynamic DNS services to host
  malicious payloads or interactive command and control nodes. Attackers will automate
  domain resolution changes by routing dynamic domains to countless IP addresses to
-  circumvent firewall blocks, blacklists as well as frustrate a network defenders
+  circumvent firewall blocks, block lists as well as frustrate a network defenders
  analytic and investigative processes. This search will look for DNS queries made
  from within your infrastructure to suspicious dynamic domains.
 how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This
@@ -30,8 +30,8 @@ known_false_positives: ICMP packets are used in a variety of ways to help troubl
  that a large ICMP packet could be perfectly legitimate. If large ICMP packets are
  associated with command and control traffic, there will typically be a large number
  of these packets observed over time. If the search is providing a large number of
-  false positives, you can modify the search to adjust the byte threshold or whitelist
-  specific IP addresses, as necessary.
+  false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter`
+  to adjust the byte threshold or add specific IP addresses to an allow list.
 tags:
  analytics_story:
  - Command and Control
@@ -1,7 +1,7 @@
 name: DNS Query Length With High Standard Deviation
 id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
-version: 2
-date: '2020-07-21'
+version: 3
+date: '2021-01-18'
 description: This search allows you to identify DNS requests and compute the standard
  deviation on the length of the names being resolved, then filter on two times the
  standard deviation to show you those queries that are unusually large for your environment.
@@ -11,9 +11,9 @@ type: ESCU
 references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
-  by DNS.query DNS.record_type |  `drop_dm_object_name("DNS")` | eval query_length
-  = len(query) | table query query_length record_type count | eventstats stdev(query_length)
-  AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2)
+  by DNS.query |  `drop_dm_object_name("DNS")` | eval query_length = len(query) |
+  table query query_length record_type count | eventstats stdev(query_length) AS stdev
+  avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2)
  | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` '
 known_false_positives: It's possible there can be long domain names that are legitimate.
 tags:
@@ -22,7 +22,7 @@ tags:
  - Suspicious DNS Traffic
  - Command and Control
  mitre_attack_id:
-  - T1071.004
+  - T1048.003
  kill_chain_phases:
  - Command and Control
  cis20:
@@ -34,3 +34,6 @@ tags:
  - DE.CM
  security_domain: network
  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log
@@ -3,10 +3,10 @@ id: 272b8407-842d-4b3d-bead-a704584003d3
 version: 3
 date: '2020-07-07'
 description: This search looks for network traffic on TCP/3389, the default port used
-  by remote desktop. While remote desktop traffic is not uncommon on a network, it
-  is usually associated with known hosts. This search allows for whitelisting both
-  source and destination hosts to remove them from the output of the search so you
-  can focus on the uncommon uses of remote desktop on your network.
+  by remote desktop. While remote desktop traffic is not uncommon on a network, it is
+  usually associated with known hosts. This search will ignore common RDP sources and
+  common RDP destinations so you can focus on the uncommon uses of remote desktop on
+  your network.
 how_to_implement: To successfully implement this search you need to identify systems
  that commonly originate remote desktop traffic and that commonly receive remote
  desktop traffic. You can use the included support search "Identify Systems Creating
@@ -6,7 +6,7 @@ Welcome to the Splunk Security Content
 This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.

 ## View Our Content
-You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security-content/releases). 
+You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security_content/releases). 

 If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):

@@ -19,34 +19,34 @@ curl -s https://content.splunkresearch.com | jq

 ## Getting Started

-Once you've installed our [app](https://github.com/splunk/security-content/releases), we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute and schedule all of the detections a story automatically.   
+Once you've installed our [app](https://github.com/splunk/security_content/releases), we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute and schedule all of the detections a story automatically.   

 ## Test Out The Detections
 The [attack_range](https://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it to test the detections. 

 ## Questions?
-If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security-content#support). 
+If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security_content#support). 

 ## Contribute Content
-If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!
+If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!


 ## Content Parts
-* [stories/](https://github.com/splunk/security-content/tree/develop/stories): All Analytic Stories
-* [detections/](https://github.com/splunk/security-content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
-* [response_tasks/](https://github.com/splunk/security-content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
-* [responses/](https://github.com/splunk/security-content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
-* [baselines/](https://github.com/splunk/security-content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+* [stories/](https://github.com/splunk/security_content/tree/develop/stories): All Analytic Stories
+* [detections/](https://github.com/splunk/security_content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
+* [response_tasks/](https://github.com/splunk/security_content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
+* [responses/](https://github.com/splunk/security_content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
+* [baselines/](https://github.com/splunk/security_content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories

 #### Content Spec Files
-* [stories](https://github.com/splunk/security-content/blob/develop/docs/spec/stories.spec.md) 
-* [detections](https://github.com/splunk/security-content/blob/develop/docs/spec/detections.spec.md)
-* [deployments](https://github.com/splunk/security-content/blob/develop/docs/spec/deployments.spec.md)
-* [responses](https://github.com/splunk/security-content/blob/develop/docs/spec/responses.spec.md)
-* [response_tasks](https://github.com/splunk/security-content/blob/develop/docs/spec/response_tasks.spec.md)
-* [baselines](https://github.com/splunk/security-content/blob/develop/docs/spec/baselines.spec.md)
-* [lookups](https://github.com/splunk/security-content/blob/develop/docs/spec/lookups.spec.md)
-* [macros](https://github.com/splunk/security-content/blob/develop/docs/spec/macros.spec.md)
+* [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.spec.md) 
+* [detections](https://github.com/splunk/security_content/blob/develop/docs/spec/detections.spec.md)
+* [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.spec.md)
+* [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.spec.md)
+* [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.spec.md)
+* [baselines](https://github.com/splunk/security_content/blob/develop/docs/spec/baselines.spec.md)
+* [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.spec.md)
+* [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.spec.md)



@@ -1,3 +1,3 @@
-description: A list of domains that can be whitelisted
+description: A list of domains that can be ignored
 filename: domains.csv
 name: domains
@@ -1,3 +1,3 @@
-description: A list of legit domains to be used to whitelist possible phishing sites
+description: A list of legit domains to be used as an ignore list for possible phishing sites
 filename: legit_domains.csv
 name: legit_domains
@@ -0,0 +1,7 @@
+case_sensitive_match: 'false'
+default_match: 'false'
+description: A list of rare processes that are legitimate that is provided by Splunk
+filename: rare_process_allow_list_default.csv
+match_type: WILDCARD(process)
+min_matches: 1
+name: lookup_rare_process_allow_list_default
@@ -1,7 +1,7 @@
 case_sensitive_match: 'false'
 default_match: 'false'
 description: A list of rare processes that are legitimate provided by the end user
-filename: rare_process_whitelist_local.csv
+filename: rare_process_allow_list_local.csv
 match_type: WILDCARD(process)
 min_matches: 1
-name: lookup_rare_process_whitelist_local
+name: lookup_rare_process_allow_list_local
@@ -1,7 +0,0 @@
-case_sensitive_match: 'false'
-default_match: 'false'
-description: A list of rare processes that are legitimate provided by Splunk
-filename: rare_process_whitelist_default.csv
-match_type: WILDCARD(process)
-min_matches: 1
-name: lookup_rare_process_whitelist_default
@@ -0,0 +1,6 @@
+definition: lookup update=true lookup_rare_process_allow_list_default process as process
+  OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local
+  process as process OUTPUT allow_list | where allow_list="false"
+description: This macro is intended to allow_list processes that have been definied
+  as rare
+name: filter_rare_process_allow_list
@@ -1,6 +0,0 @@
-definition: lookup update=true lookup_rare_process_whitelist_default process as process
-  OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local
-  process as process OUTPUT whitelist | where whitelist="false"
-description: This macro is intended to whitelist processes that have been definied
-  as rare
-name: filter_rare_process_whitelist
@@ -121,7 +121,7 @@ version = 1
 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
 detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]}
-investigative_searches = ["ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Investigate Web POSTs From src", "ESCU - Investigate Suspicious Strings in HTTP Header"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1366,7 +1366,7 @@ version = 1
 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"]
 detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]}
-investigative_searches = ["ESCU - Get Web Session Information via session id", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender"]
+investigative_searches = ["ESCU - Get Web Session Information via session id", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -46,7 +46,7 @@ label = Apache Struts Vulnerability
 description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_suspicious_strings_in_http_header", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_investigate_suspicious_strings_in_http_header"]

 [panel_group://workbench_panel_group_asset_tracking]
 label = Asset Tracking
@@ -522,7 +522,7 @@ label = Web Fraud Detection
 description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
 disabled = 0

-panels = ["panel://workbench_panel_get_web_session_information_via_session_id", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_emails_from_specific_sender"]
+panels = ["panel://workbench_panel_get_web_session_information_via_session_id", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_history"]

 [panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350]
 label = Windows DNS SIGRed CVE-2020-1350
@@ -2033,13 +2033,13 @@ search = | tstats `security_content_summariesonly` count min(_time) as start_tim
 action.escu = 0
 action.escu.enabled = 1
 description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
-action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
+action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 action.escu.data_models = ["Network_Resolution"]
 action.escu.eli5 = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
 action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
 action.escu.known_false_positives = It's possible there can be long domain names that are legitimate.
-action.escu.creation_date = 2020-07-21
-action.escu.modification_date = 2020-07-21
+action.escu.creation_date = 2021-01-18
+action.escu.modification_date = 2021-01-18
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule
 action.escu.search_type = detection
@@ -2050,7 +2050,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule
-action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
+action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.rule_description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
@@ -2894,10 +2894,10 @@ search = | tstats `security_content_summariesonly` count earliest(_time) as firs
 [ESCU - Detect Long DNS TXT Record Response - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic.
-action.escu.mappings = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
+description = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses.
+action.escu.mappings = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic.
+action.escu.eli5 = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses.
 action.escu.how_to_implement = To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding the DNS record type that is being returned as well as the data in the answer section of the protocol.
 action.escu.known_false_positives = It's possible that legitimate TXT record responses can be long enough to trigger this search. You can modify the packet threshold for this search to help mitigate false positives.
 action.escu.creation_date = 2020-07-21
@@ -2912,7 +2912,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Long DNS TXT Record Response - Rule
-action.correlationsearch.annotations = {"analytics_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
+action.correlationsearch.annotations = {"analytics_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['dest', 'src']
@@ -4492,7 +4492,7 @@ action.escu.data_models = ["Web"]
 action.escu.eli5 = This search looks for web connections to dynamic DNS providers.
 action.escu.how_to_implement = This search requires you to be ingesting web-traffic logs. You can obtain these logs from indexing data from a web proxy or by using a network-traffic-analysis tool, such as Bro or Splunk Stream. The web data model must contain the URL being requested, the IP address of the host initiating the request, and the destination IP. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\
 This search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** IsDynamicDNS, **Field:** isDynDNS\
-Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
+Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` Deprecated because duplicate.
 action.escu.known_false_positives = It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate.
 action.escu.creation_date = 2020-07-21
 action.escu.modification_date = 2020-07-21
@@ -4527,10 +4527,10 @@ search = | tstats `security_content_summariesonly` count values(Web.url) as url
 [ESCU - Detection of DNS Tunnels - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic.
-action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "PR.DS"]}
+description = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic.
+action.escu.eli5 = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
 action.escu.how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
 action.escu.known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
 action.escu.creation_date = 2017-09-18
@@ -4545,7 +4545,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detection of DNS Tunnels - Rule
-action.correlationsearch.annotations = {"analytics_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "PR.DS"]}
+action.correlationsearch.annotations = {"analytics_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['src']
@@ -5576,10 +5576,10 @@ search = | tstats `security_content_summariesonly` count min(_time) values(Proce
 [ESCU - High Number of Login Failures from a single source - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.
+description = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate.
 action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]}
 action.escu.data_models = []
-action.escu.eli5 = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.
+action.escu.eli5 = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate.
 action.escu.how_to_implement = none
 action.escu.known_false_positives = unknown
 action.escu.creation_date = 2020-12-16
@@ -6647,13 +6647,13 @@ search = | tstats `security_content_summariesonly` values(Processes.process_id)
 action.escu = 0
 action.escu.enabled = 1
 description = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line.
-action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line.
 action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 action.escu.known_false_positives = Legitimate process can have this combination of command-line options, but it's not common.
-action.escu.creation_date = 2020-11-20
-action.escu.modification_date = 2020-11-20
+action.escu.creation_date = 2021-01-19
+action.escu.modification_date = 2021-01-19
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule
 action.escu.search_type = detection
@@ -6664,7 +6664,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule
-action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
+action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['user', 'dest']
@@ -6680,7 +6680,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* AND process=*-NonI* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`
+search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`

 [ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule]
 action.escu = 0
@@ -6691,8 +6691,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line.
 action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. Deprecated because the detection need rework and would need to work base on powershell logs.
 action.escu.known_false_positives = These characters might be legitimately on the command-line, but it is not common.
-action.escu.creation_date = 2020-07-21
-action.escu.modification_date = 2020-07-21
+action.escu.creation_date = 2021-01-19
+action.escu.modification_date = 2021-01-19
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule
 action.escu.search_type = detection
@@ -6719,7 +6719,8 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process, "`"))-1) + (mvcount(split(process, "^"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation > 0
+search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "'"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation > 10
+

 [ESCU - Monitor DNS For Brand Abuse - Rule]
 action.escu = 0
@@ -554,7 +554,7 @@ version = 1
 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}]
 spec_version = 3
-searches = ["ESCU - Detect Oulook exe writing a  zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Detect Oulook exe writing a  zip file - Rule", "ESCU - Get Parent Process Info"]
 description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.
 narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \
 As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \
@@ -1010,7 +1010,7 @@ version = 1
 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Get Notable History"]
+searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History"]
 description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise.  The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.
 narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s).  If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB).  This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included.  The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json.  These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB).

@@ -1615,7 +1615,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
 how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
-annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
+annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = It's possible there can be long domain names that are legitimate.
 providing_technologies = []

@@ -1847,9 +1847,9 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic.
+explanation = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses.
 how_to_implement = To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding the DNS record type that is being returned as well as the data in the answer section of the protocol.
-annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
+annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = It's possible that legitimate TXT record responses can be long enough to trigger this search. You can modify the packet threshold for this search to help mitigate false positives.
 providing_technologies = []

@@ -2262,7 +2262,7 @@ confidence = medium
 explanation = This search looks for web connections to dynamic DNS providers.
 how_to_implement = This search requires you to be ingesting web-traffic logs. You can obtain these logs from indexing data from a web proxy or by using a network-traffic-analysis tool, such as Bro or Splunk Stream. The web data model must contain the URL being requested, the IP address of the host initiating the request, and the destination IP. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\
 This search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** IsDynamicDNS, **Field:** isDynDNS\
-Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
+Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` Deprecated because duplicate.
 annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]}
 known_false_positives = It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate.
 providing_technologies = []
@@ -2271,9 +2271,9 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic.
+explanation = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
 how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
-annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "PR.DS"]}
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
 providing_technologies = []

@@ -2543,7 +2543,7 @@ providing_technologies = []
 type = detection
 asset_type = Office 365
 confidence = medium
-explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.
+explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate.
 how_to_implement = none
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = unknown
@@ -2825,7 +2825,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line.
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
-annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
+annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = Legitimate process can have this combination of command-line options, but it's not common.
 providing_technologies = []

@@ -1,4 +1,4 @@
-process,whitelist
+process,allow_list
 splunk-regmon.exe,true
 winword.exe,true
 excel.exe,true
@@ -0,0 +1 @@
+process,allow_list
@@ -1 +0,0 @@
-process,whitelist
@@ -16,7 +16,7 @@ humanfriendly==9.1
 identify==1.5.13
 idna==2.10
 importlib-metadata==3.4.0
-importlib-resources==4.1.1
+importlib-resources==5.0.0
 Jinja2==2.11.2
 jsonschema==3.2.0
 MarkupSafe==1.1.1
@@ -27,7 +27,7 @@ pre-commit==2.9.3
 pyrsistent==0.17.3
 python-dateutil==2.8.1
 pytz==2020.5
-PyYAML==5.4
+PyYAML==5.4.1
 requests==2.25.1
 scandir==1.10.0
 semantic-version==2.8.5
@@ -39,6 +39,6 @@ stix2==2.1.0
 taxii2-client==2.2.2
 toml==0.10.2
 typing==3.7.4.3
-urllib3==1.26.2
-virtualenv==20.2.2
+urllib3==1.26.3
+virtualenv==20.3.0
 zipp==3.4.0
@@ -1,5 +1,5 @@
 {
-  "$id": "https://raw.githubusercontent.com/splunk/security-content/develop/docs/spec/response_tasks.spec.json",
+  "$id": "https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response_tasks.spec.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
@@ -1,5 +1,5 @@
 {
-  "$id": "https://raw.githubusercontent.com/splunk/security-content/develop/docs/spec/response.spec.json",
+  "$id": "https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response.spec.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
@@ -8,7 +8,7 @@ description: Monitor your AWS provisioning activities for behaviors originating
 narrative: 'Because most enterprise AWS activities originate from familiar geographic
  locations, monitoring for activity from unknown or unusual regions is an important
  security measure. This indicator can be especially useful in environments where
-  it is impossible to whitelist specific IPs (because they vary).\
+  it is impossible to add specific IPs to an allow list because they vary. \

  This Analytic Story was designed to provide you with flexibility in the precision
  you employ in specifying legitimate geographic regions. It can be as specific as
@@ -14,7 +14,7 @@ narrative: Attackers employ a variety of tactics in order to avoid detection and
  Windows and various other programs reside, or explicitly attempting to shut down
  security-related services. Other times, attackers attempt various tricks to prevent
  specific programs from running, such as adding the certificates with which the security
-  tools are signed to a blacklist (which would prevent them from running).
+  tools are signed to a block list (which would prevent them from running).
 author: Rico Valdez, Splunk
 type: ESCU
 references:
--- a/Show More
+++ b/Show More