### **Describe the bug**
When interesting_ports_lookup is used, only the port is checked, not the protocol.
Plus, only the first result is returned.
This lookup include several entries for the same port (like 514 rsh/syslog) and the wrong entry can get returned.
This create false match. The wrong enrichment is given (including a wrong transport method) and a notable is generated when it shouldn't.
It can also be greatly optimized by moving the filter logic to the where of the tstats.
### **Expected behavior**
If a 514 udp is detected by the firewall, it should match syslog and not create a notable (or risk) telling me we detected a rsh 514 tcp.
### **Additional context**
Here is a solution (we get the transport from the log instead of adding it from the lookup, add transport to the match and move the filter logique up).
* Detections for default user agents
* various updates for user agent detections
* Apply suggestions from code review
* Rename suspicious_user_agent.yml to suspicious_user_agents.yml
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Create response_plan directory
* Update directory name
* Copy response_templates artifacts to dist/api
* Add response-templates schema validation workflow
* Add feature branch for testing purpose
* Update endpoint to playground
* Revert back debug changes
* Move scripts to workflows
* Remove manual check in
* Add sorting for version and template name
* Raise exception when file name not match
* Add indentation for json output
* Add debug option to dump json schema
* Generate merged templates at runtime
* Rename openAPI spec yaml to yml
* Move validation to build.yml
* Use stem to get file name
* Fix python package install
* Update version sorting using int
* Update openAPI spec for version
* Move build response templates to separate workflow
* Fix naming in build-response-templates.yml
* Update response templates to the ones for first release
* Fix naming of response templates
* Response templates to be added by response plan team
* Keep response_templates directory
* Skip .gitkeep checking when check non-json files
* Remove the .gitkeep
* Initial version of Response Templates
* Initial version of Response Templates
* Initial version of Response Templates
* Revert "Initial version of Response Templates"
This reverts commit 3a174dd02e.
* Revert "Initial version of Response Templates"
This reverts commit 26fa66ddde.
* Revert "Initial version of Response Templates"
This reverts commit 6014b4870b.
* Initial version of Response Templates
* Initial version of Response Templates
* Update and rename AccountCompromise_v14.json to AccountCompromise_v2.json
* Update and rename DataBreach_v15.json to DataBreach_v2.json
* Update and rename GenericIncidentResponse_v13.json to GenericIncidentResponse_v2.json
* Update and rename NIST80061_v14.json to NIST80061_v2.json
* Update and rename NetworkIndicatorEnrichment_v6.json to NetworkIndicatorEnrichment_v2.json
* Update and rename SelfReplicatingMalware_v14.json to SelfReplicatingMalware_v2.json
* Update and rename SuspiciousEmail_v35.json to SuspiciousEmail_v2.json
* Update and rename VulnerabilityDisclosure_v10.json to VulnerabilityDisclosure_v2.json
* Add comments
---------
Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Co-authored-by: Christian Cloutier <ccloutier@splunk.com>
Co-authored-by: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
LaLaGuy