{
  "data_metadata": {
    "data_models": [
      "Network_Resolution"
    ],
    "data_source": [
      "DNS"
    ],
    "providing_technologies": [
      "Splunk Stream",
      "Bro"
    ]
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "jhernandez@splunk.com",
      "name": "Jose Hernandez"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 1",
      "CIS 3",
      "CIS 8",
      "CIS 12"
    ],
    "kill_chain_phases": [
      "Command and Control"
    ],
    "mitre_attack": [
      "Exfiltration",
      "Command and Control",
      "Defense Evasion",
      "Commonly Used Port"
    ],
    "nist": [
      "ID.AM",
      "PR.DS",
      "PR.IP",
      "DE.AE",
      "DE.CM"
    ]
  },
  "original_authors": [
    {
      "company": "Splunk",
      "email": "jhernandez@splunk.com",
      "name": "Jose Hernandez"
    }
  ],
  "creation_date": "2019-02-14",
  "modification_date": "2019-02-14",
  "eli5": "This example phantom playbook will detect",

  "how_to_implement": "Splunk>Phantom Playbook Integration",
  "known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.",

  "id": "1229w27b-ef78-4w59-aae8-5369073014e1",

  "name": "Playbook that detects DNS Hijacks",
  "description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.",
  "product_type": "phantom",
  "asset_type": "Endpoint",
  "confidence": "medium",
  "security_domain": "network",
  "spec_version": 2,
  "version": "1.0",
  "baselines": [],
   "entities":["dest"],
  "detect": {
    "phantom": {
      "phantom_server": "automation (hostname)",
      "playbook_name": "community/dns_hijack_investigation",
      "playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/",
      "sensitivity": "green",
      "severity": "medium",
      "schedule": {
          "cron_schedule": "0 * * * *",
          "earliest_time": "-70m@m",
          "latest_time": "-10m@m"
        },
      "correlation_rule": {
        "notable": {
          "nes_fields": "src",
          "rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed",
          "rule_title": "DNS record changed"
        },
        "risk": {
          "risk_object": "src",
          "risk_object_type": [
            "system"
          ],
          "risk_score": 40
        },
        "schedule": {
          "cron_schedule": "0 * * * *",
          "earliest_time": "-70m@m",
          "latest_time": "-10m@m"
        },
        "suppress": {
          "suppress_fields": "src",
          "suppress_period": "28800s"
        }
      }
    }
  },
  "investigations": [
    {
      "name": "Discover DNS records,",
      "product_type": "splunk",
      "id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3"
    },
    {
      "name": "DNS record change investigation",
      "product_type": "phantom",
      "id": "c096f721-8842-42ce-bfc7-74bd8c72b711"
    }
  ],
  "responses": []
}