diff --git a/README.md b/README.md index 63ef339a91..c539d804e9 100644 --- a/README.md +++ b/README.md @@ -7,13 +7,11 @@ | develop| [![develop status](https://circleci.com/gh/splunk/security-content/tree/develop.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/develop)| | master | [![master status](https://circleci.com/gh/splunk/security-content/tree/master.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/master)| -The Splunk Security Content Exchange was designed to bring the community together to improve our collective defenses. By sharing research and analytics, we can help the entire industry craft more effective strategies. This project provides a mechanism to facilitate this exchange. +Welcome to the Splunk Security Research Team's Security Content Exchange! -The repo includes a collection of security guides called Analytic Stories that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats. +This project gives you access to our repository of Analytic Stories--themed security guides that contain that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats. -You can set this tool to run [detections and automatically](https://github.com/splunk/analytic_story_execution) funnel the results to investigations, reducing the need for manual intervention. When available, you can automatically trigger reponses, as well. The alerts you'll get include context (history, correlations, etc.), so they help you better understand their importance. The net effect is a more efficient workflow, as well as more comprehensive, effective defenses. - -Follow the instructions below to get started. +While this content is available via Splunk Enterprise Security and Enterprise Security Content Updates (https://splunkbase.splunk.com/app/3449/), we have now made it available as an open-source project (which you just found--hi!). The Security Research Content Exchange was designed to bring the community together to improve our collective defenses. By sharing research and analytics, we can help the entire industry craft more effective strategies. This project provides a mechanism to facilitate this exchange. # Usage @@ -37,6 +35,11 @@ curl -s https://content.splunkresearch.com | jq ] } ``` +# How to Get Started + +While you you can configure each detection individually, the real power lies in running the Analytic Stories end-to-end. Using the Analytic Story Execution (ASX) app (https://github.com/splunk/analytic_story_execution), you can funnel the results to investigations, reducing the need for manual intervention. When available, you can automatically trigger reponses, as well. The alerts you'll get include context (history, correlations, etc.), so they help you better understand their importance. The net effect is a more efficient workflow, as well as more comprehensive, effective defenses. + +Follow the instructions below to get started. # What's in an Analytic Story? [Analytic Stories](https://github.com/splunk/security-content/blob/develop/docs/stories_categories.md) and their corresponding searches are composed of **.yml** files (manifests) and associated .conf files. The stories reside in [/stories](https://github.com/splunk/security-content/tree/develop/stories) and the searches live in [/detections](https://github.com/splunk/security-content/tree/develop/detections). @@ -44,11 +47,11 @@ curl -s https://content.splunkresearch.com | jq Manifests contain a number of mandatory and optional fields. You can see the full field list for each piece of content [here](https://github.com/splunk/security-content/tree/develop/docs#spec-documentation). # Writing Content -First, make sure to follow the steps to install **dependencies and pre-commit hooks** under ["Developing"](https://github.com/splunk/security-content#developing) before you begin. +Before you begin, follow the steps to install **dependencies and pre-commit hooks** under ["Developing"](https://github.com/splunk/security-content#developing). 1. Select the content [piece](https://github.com/splunk/security-content#content-parts) you want to write. 2. Copy an example and edit it to suit your needs. At a minimum, you must write a [story](stories/), [a detection search](detections/), and an [investigative search](investigations/). -3. Make a pull request. If Circle CI fails, refer to [troubleshooting](https://github.com/splunk/security-content#troubleshooting). +3. Make a pull request. The pull request will trigger CircleCI, a continuous-integration app thatintegrates with a VCS and automatically runs a series of steps every time that it detects a change to your repository. A CircleCI build consists of a series of steps, usually Dependencies, Testing, and Deployment. If your tests pass, you're good to go! If the CircleCI check fails, refer to [troubleshooting](https://github.com/splunk/security-content#troubleshooting). For a more detailed explanation on how to contribute to the project, please see ["Contributing"](#Contributing) @@ -84,7 +87,7 @@ Tools that help with testing CI jobs: 2. To test a local change to CircleCI or build, make sure you are running Docker, then enter `circleci local execute -e GITHUB_TOKEN=$GITHUB_TOKEN --branch `. -#### Generate Docs from Schema +##### Generate Docs from Schema To automatically generate docs from schema: 1. Install https://github.com/adobe/jsonschema2md. @@ -97,7 +100,7 @@ To automatically generate docs from schema: 3. [CI](https://github.com/splunk/security-content/blob/44946063173f7bc9921f0da0aa62139c084d1c51/.circleci/config.yml#L107) builds a DA-ESS-ContentUpdate Splunk package using the [Splunk Packaging Toolkit](http://dev.splunk.com/view/packaging-toolkit/SP-CAAAE9V). 4. [CI](https://github.com/splunk/security-content/blob/44946063173f7bc9921f0da0aa62139c084d1c51/.circleci/config.yml#L145) tests the newly produced package using [Splunk Appinspect](http://dev.splunk.com/view/appinspect/SP-CAAAE9U). -* note that [requirements.txt](https://github.com/splunk/security-content/blob/develop/requirements.txt) hardcodes the versions for packages we use [dependabot](https://dependabot.com/) to make sure we safely always upgrade to the latest versions. +* note that [requirements.txt](https://github.com/splunk/security-content/blob/develop/requirements.txt) hard codes the versions for packages we use [dependabot](https://dependabot.com/) to make sure we safely always upgrade to the latest versions. ## Support Please use the [GitHub Issue Tracker](https://github.com/splunk/security-content/issues) to submit bugs or request features. diff --git a/docs/README.md b/docs/README.md index c24c5b6a71..dda91ce796 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,10 +1,14 @@ -# Welcome to Splunk Security Research +# Welcome to Splunk Security Research! ![](static/logo.png) -## View Our Content -You can review our analytics stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security-content/releases). +Thanks for stopping by the Splunk Security Research Team's resource portal! Here you'll find background and links to our security content and other related tools. -Is the command line more your flavor? Check out our [API](https://docs.splunkresearch.com/?version=latest): +Splunk security content is organized into "Analytic Stories," themed security guides that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all built to work together to detect, investigate, and respond to threats. The other apps were designed to help you derive more value from this content. + +## View Our Content +You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security-content/releases). + +If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest): ``` curl -s https://content.splunkresearch.com | jq @@ -21,18 +25,18 @@ curl -s https://content.splunkresearch.com | jq } ``` +## Getting Started -## Execute Our Content -We have built the the Analytics Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) specifically "run" Analytics Stories in Splunk. +Once you've cloned the security-content repo, we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute all of the searches, machine-learning models, and Splunk Phantom playbooks in the story automatically. -## Test Our Content -The [attack_range](https://http://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it in order to test all our detections. +## Test Out The Detections +The [attack_range](https://http://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it to test the detections. ## Questions? -Stuck, need help with any of our tools, see our [support options](https://github.com/splunk/security-content#support). +If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security-content#support). ## Contribute Content -Ready to give back and contribute your detections back to the community. See our [contributor guide](https://github.com/splunk/security-content#Contributing). +If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content#Contributing). Digital defenders unite! ## Content Spec Documentation diff --git a/docs/_config.yml b/docs/_config.yml index fc24e7a62d..18854876c6 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -1 +1 @@ -theme: jekyll-theme-hacker \ No newline at end of file +theme: jekyll-theme-midnight \ No newline at end of file diff --git a/macros/security_content_ctime.yml b/macros/security_content_ctime.yml index 00d03a125f..716c440c77 100644 --- a/macros/security_content_ctime.yml +++ b/macros/security_content_ctime.yml @@ -1,5 +1,5 @@ arguments: - field -definition: '`ctime($field$,"%m/%d/%Y %H:%M:%S")`' +definition: 'convert timeformat="%m/%d/%Y %H:%M:%S" ctime($field$)' description: convert epoch time to string name: security_content_ctime