mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
48 lines
1.8 KiB
JSON
48 lines
1.8 KiB
JSON
{
|
|
"category": "Best Practices",
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-06-15",
|
|
"description": "Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.",
|
|
"id": "abe807c7-1eb6-4304-ac32-6e7aacdb891d",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-12",
|
|
"name": "Monitor Backup Solution",
|
|
"narrative": "Having backups is a standard best practice that helps ensure continuity of business operations. Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable History",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Unsuccessful Netbackup backups",
|
|
"Extended Period Without Successful Netbackup Backups"
|
|
],
|
|
"investigative_searches": [
|
|
"All backup logs for host"
|
|
],
|
|
"support_searches": [
|
|
"Monitor Successful Backups",
|
|
"Monitor Unsuccessful Backups"
|
|
]
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|