mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
48 lines
1.9 KiB
JSON
48 lines
1.9 KiB
JSON
{
|
|
"category": "Best Practices",
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-06-01",
|
|
"description": "Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.",
|
|
"id": "91c676cf-0b23-438d-abee-f6335e1fce77",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-13",
|
|
"name": "Asset Tracking",
|
|
"narrative": "This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get First Occurrence and Last Occurrence of a MAC Address",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Detect Unauthorized Assets by MAC address"
|
|
],
|
|
"investigative_searches": [],
|
|
"support_searches": [
|
|
"Count of assets by category"
|
|
]
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|