mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
49 lines
1.5 KiB
JSON
49 lines
1.5 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2018-12-06",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Web"
|
|
],
|
|
"data_source": [
|
|
"Web"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Bro",
|
|
"Bluecoat",
|
|
"Palo Alto Firewall"
|
|
]
|
|
},
|
|
"fields_required": [
|
|
"src"
|
|
],
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "jhernandez@splunk.com",
|
|
"name": "Jose Hernandez"
|
|
}
|
|
],
|
|
"modification_date": "2018-12-06",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "jhernandez@splunk.com",
|
|
"name": "Jose Hernandez"
|
|
}
|
|
],
|
|
"search": "| tstats `summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name(\"Web\")`| where like(src, \"{src}\") and like(http_method, \"POST\")",
|
|
"search_description": "This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. ",
|
|
"search_id": "f5c39fac-205c-4e07-9004-8fd61ea3431a",
|
|
"search_name": "Investigate Web POSTs From src",
|
|
"search_type": "investigative",
|
|
"search_window": {
|
|
"earliest_time_offset": 3600,
|
|
"latest_time_offset": 3600
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|