mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
42 lines
2.0 KiB
JSON
42 lines
2.0 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-06-27",
|
|
"data_metadata": {
|
|
"data_models": [],
|
|
"data_source": [
|
|
"Splunk Enterprise"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Enterprise Security"
|
|
]
|
|
},
|
|
"eli5": "This search outputs the interesting processes lookup table and filters out all processes in the table that haven't already been inserted by ESCU. It then appends to those results all the processes currently identified by ESCU that should be prohibited. Next, it fills in the required fields with processes identified by ESCU, and then writes the results back to the interesting process lookup table. This is done so any new processes identified that should be prohibited will be added to the lookup table without creating any duplicate entries.",
|
|
"how_to_implement": "This search should be run on each new install of ESCU.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-15",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"earliest_time": "-30d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count",
|
|
"search_description": "This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.",
|
|
"search_id": "251930a5-1451-4428-bb13-eed5775be0ce",
|
|
"search_name": "Add Prohibited Processes to Enterprise Security",
|
|
"search_type": "support",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|