mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
389 lines
18 KiB
JSON
389 lines
18 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Message Identifier Activity Analysis",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Accepts an internet message id, and asks Splunk \n to look for records that have a matching internet message id. It then produces a normalized output and summary table.\n\nRef: D3-IAA https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis/",
|
|
"edges": [
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_3_to_port_5",
|
|
"sourceNode": "3",
|
|
"sourcePort": "3_out",
|
|
"targetNode": "5",
|
|
"targetPort": "5_in"
|
|
},
|
|
{
|
|
"id": "port_5_to_port_6",
|
|
"sourceNode": "5",
|
|
"sourcePort": "5_out",
|
|
"targetNode": "6",
|
|
"targetPort": "6_in"
|
|
},
|
|
{
|
|
"id": "port_7_to_port_8",
|
|
"sourceNode": "7",
|
|
"sourcePort": "7_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
},
|
|
{
|
|
"id": "port_8_to_port_1",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"id": "port_6_to_port_9",
|
|
"sourceNode": "6",
|
|
"sourcePort": "6_out",
|
|
"targetNode": "9",
|
|
"targetPort": "9_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_9_to_port_7",
|
|
"sourceNode": "9",
|
|
"sourcePort": "9_out",
|
|
"targetNode": "7",
|
|
"targetPort": "7_in"
|
|
},
|
|
{
|
|
"id": "port_0_to_port_3",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "3",
|
|
"targetPort": "3_in"
|
|
}
|
|
],
|
|
"hash": "03b4a7115a05c8be38f151e65c6feeeec2d4a77a",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 20,
|
|
"y": 0
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 20,
|
|
"y": 1220
|
|
},
|
|
"3": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "input filter",
|
|
"customNameId": 0,
|
|
"delimiter": ",",
|
|
"delimiter_enabled": true,
|
|
"join": [],
|
|
"note": "Ensure there is an input"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "playbook_input:message_id",
|
|
"value": "None"
|
|
},
|
|
{
|
|
"op": "!=",
|
|
"param": "playbook_input:sender",
|
|
"value": "None"
|
|
},
|
|
{
|
|
"op": "!=",
|
|
"param": "playbook_input:subject",
|
|
"value": "None"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "Input Valid",
|
|
"logic": "or"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "input_filter",
|
|
"id": "3",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "3",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 60,
|
|
"y": 148
|
|
},
|
|
"5": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "format message query",
|
|
"customNameId": 0,
|
|
"drop_none": false,
|
|
"join": [],
|
|
"note": "construct Splunk query with substitution of input",
|
|
"separator": ""
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "format_message_query",
|
|
"id": "5",
|
|
"parameters": [
|
|
"filtered-data:input_filter:condition_1:playbook_input:message_id",
|
|
"filtered-data:input_filter:condition_1:playbook_input:subject",
|
|
"filtered-data:input_filter:condition_1:playbook_input:sender"
|
|
],
|
|
"template": "summariesonly=false fillnull_value=\"Unknown\" count from datamodel=Email.All_Email where (All_Email.message_id IN (\n%%\n\"{0}\" \n%%\n) OR All_Email.subject IN (\n%%\n\"{1}\" \n%%\n) OR All_Email.src_user IN (\n%%\n\"{2}\" \n%%\n)) by All_Email.orig_recipient, All_Email.recipient, All_Email.src_user, All_Email.subject All_Email.message_id | `drop_dm_object_name(\"All_Email\")` | rename orig_recipient as Addressee, recipient as Recipient, src_user as Sender, subject as Subject message_id as Message_Id | fields Addressee, Recipient, Sender, Subject, Message_Id | fillnull value=\"Unknown\"",
|
|
"type": "format"
|
|
},
|
|
"errors": {},
|
|
"id": "5",
|
|
"type": "format",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 320
|
|
},
|
|
"6": {
|
|
"data": {
|
|
"action": "run query",
|
|
"actionType": "investigate",
|
|
"advanced": {
|
|
"customName": "run message query",
|
|
"customNameId": 0,
|
|
"join": [],
|
|
"note": "Run Splunk query created in prior block"
|
|
},
|
|
"connector": "Splunk",
|
|
"connectorConfigs": [
|
|
"splunk"
|
|
],
|
|
"connectorId": "91883aa8-9c81-470b-97a1-5d8f7995f560",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "run_message_query",
|
|
"id": "6",
|
|
"parameters": {
|
|
"command": "tstats",
|
|
"display": "Addressee,Recipient,Sender,Subject",
|
|
"query": "format_message_query:formatted_data",
|
|
"search_mode": "smart"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "query"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"default": "search",
|
|
"field": "command"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"default": "smart",
|
|
"field": "search_mode"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "6",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 506
|
|
},
|
|
"7": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "format message report",
|
|
"customNameId": 0,
|
|
"join": [],
|
|
"note": "Format the markdown table summary of this playbook execution"
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "format_message_report",
|
|
"id": "7",
|
|
"parameters": [
|
|
"filtered-data:input_filter:condition_1:playbook_input:message_id",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Recipient",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Addressee",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Subject",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Sender",
|
|
"filtered-data:input_filter:condition_1:playbook_input:subject",
|
|
"filtered-data:input_filter:condition_1:playbook_input:sender"
|
|
],
|
|
"template": "SOAR searched for occurrences of one of the following:\n- Message ID(s): `{0}` \n- Subject(s): `{5}`\n- Sender(s): `{6}`\nwithin your environment using Splunk's Email data model. The table below shows a summary of the information gathered.\n\n| Recipient | Addressed To | Subject | Sender |\n| --- | --- | --- | --- |\n%%\n| {1} | {2} | {3} | {4} |\n%%\n\n",
|
|
"type": "format"
|
|
},
|
|
"errors": {},
|
|
"id": "7",
|
|
"type": "format",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 860
|
|
},
|
|
"8": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "build message output",
|
|
"customNameId": 0,
|
|
"description": "Logic regarding observable construction goes here",
|
|
"join": [],
|
|
"note": "Format the observable output object produced by this playbook"
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "build_message_output",
|
|
"id": "8",
|
|
"inputParameters": [
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Recipient",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Addressee",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Subject",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Sender",
|
|
"filtered-data:results_filter:condition_1:run_message_query:action_result.data.*.Message_Id"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "8",
|
|
"type": "code",
|
|
"userCode": "\n # Variable renames for convenience\n recipients = filtered_result_0_data___recipient\n addressees = filtered_result_0_data___addressee\n subjects = filtered_result_0_data___subject\n senders = filtered_result_0_data___sender\n message_id = filtered_result_0_data___message_id\n \n build_message_output__observable_array = []\n recordList = []\n \n # unwind records\n for recipient, addressee, subject, sender, message_id in zip(recipients, addressees, subjects, senders, filtered_result_0_data___message_id):\n record = {\n \"recipient\": recipient,\n \"addressee\": addressee,\n \"subject\": subject,\n \"sender\": sender\n }\n\n observable = {\n \"value\": message_id,\n \"type\": \"internet message ID\",\n \"count\": len(recordList),\n \"source\": \"Splunk\",\n \"message_identifier_activity\": record\n }\n\n build_message_output__observable_array.append(observable)\n \n",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 1042
|
|
},
|
|
"9": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Results filter",
|
|
"customNameId": 0,
|
|
"delimiter": ",",
|
|
"delimiter_enabled": true,
|
|
"join": [],
|
|
"note": "Ensure there are results"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": ">",
|
|
"param": "run_message_query:action_result.summary.total_events",
|
|
"value": "0"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "Results exist",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "results_filter",
|
|
"id": "9",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "9",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 60,
|
|
"y": 684
|
|
}
|
|
},
|
|
"notes": "Inputs: internet message id\nInteractions: Splunk\nActions: run query\nOutputs: observable, markdown report"
|
|
},
|
|
"input_spec": [
|
|
{
|
|
"contains": [
|
|
"internet message id"
|
|
],
|
|
"description": "An Internet Message ID to look for within message logs in Splunk",
|
|
"name": "message_id"
|
|
},
|
|
{
|
|
"contains": [
|
|
"email"
|
|
],
|
|
"description": "A sender address to look for within message logs in Splunk",
|
|
"name": "sender"
|
|
},
|
|
{
|
|
"contains": [],
|
|
"description": "A subject line to look for within message logs in Splunk",
|
|
"name": "subject"
|
|
}
|
|
],
|
|
"output_spec": [
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"build_message_output:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of Observable objects ",
|
|
"metadata": {},
|
|
"name": "observable"
|
|
},
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"format_message_report:formatted_data"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of markdown reports",
|
|
"metadata": {},
|
|
"name": "markdown_report"
|
|
}
|
|
],
|
|
"playbook_type": "data",
|
|
"python_version": "3.13",
|
|
"schema": "5.0.10",
|
|
"version": "6.1.0.131"
|
|
},
|
|
"create_time": "2023-10-12T23:49:46.906299+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": [
|
|
"message_identifier_activity",
|
|
"internet_message_id",
|
|
"splunk",
|
|
"D3-IAA"
|
|
]
|
|
} |