From fafa45fcc942387a8a05fd9c7b97208498ef7392 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 14 Dec 2021 19:41:19 -0600
Subject: [PATCH] fixing backslide

---
 playbooks/log4j_investigate_and_respond.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/playbooks/log4j_investigate_and_respond.yml b/playbooks/log4j_investigate_and_respond.yml
index 46ce8d2e8f..92109be805 100644
--- a/playbooks/log4j_investigate_and_respond.yml
+++ b/playbooks/log4j_investigate_and_respond.yml
@@ -22,6 +22,18 @@ app_list: []
 tags:
   platform_tags:
   - Response
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  detections:
+  - Curl Download and Bash Execution
+  - Wget Download and Bash Execution
+  - Linux Java Spawning Shell
+  - Windows Java Spawning Shell
+  - Java Class File download by Java User Agent
+  - Outbound Network Connection from Java Using Default Ports
+  - Log4Shell JNDI Payload Injection Attempt
+  - Log4Shell JNDI Payload Injection with Outbound Connection
+  - Detect Outbound LDAP Traffic
   playbook_fields: []
   product:
   - Splunk SOAR