splunk-security_content/dist/DA-ESS-ContentUpdate/default/workflow_actions.conf

#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2024-03-06T22:17:33 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############

[workbench_panel_all_backup_logs_for_host___response_task]
label                   = Workbench - All backup logs for host
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_all_backup_logs_for_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task]
label                   = Workbench - Amazon EKS Kubernetes activity by src ip
type                    = link
fields                  = src_ip
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task]
label                   = Workbench - AWS Investigate Security Hub alerts by dest
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task]
label                   = Workbench - AWS Investigate User Activities By AccessKeyId
type                    = link
fields                  = accessKeyId
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_investigate_user_activities_by_arn___response_task]
label                   = Workbench - AWS Investigate User Activities By ARN
type                    = link
fields                  = user
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_network_acl_details_from_id___response_task]
label                   = Workbench - AWS Network ACL Details from ID
type                    = link
fields                  = networkAclId
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_network_interface_details_via_resourceid___response_task]
label                   = Workbench - AWS Network Interface details via resourceId
type                    = link
fields                  = resourceId
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_s3_bucket_details_via_bucketname___response_task]
label                   = Workbench - AWS S3 Bucket details via bucketName
type                    = link
fields                  = bucketName
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task]
label                   = Workbench - GCP Kubernetes activity by src ip
type                    = link
fields                  = src_ip
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_city___response_task]
label                   = Workbench - Get All AWS Activity From City
type                    = link
fields                  = City
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_country___response_task]
label                   = Workbench - Get All AWS Activity From Country
type                    = link
fields                  = Country
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_ip_address___response_task]
label                   = Workbench - Get All AWS Activity From IP Address
type                    = link
fields                  = src_ip
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_region___response_task]
label                   = Workbench - Get All AWS Activity From Region
type                    = link
fields                  = Region
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_backup_logs_for_endpoint___response_task]
label                   = Workbench - Get Backup Logs For Endpoint
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_backup_logs_for_endpoint___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_certificate_logs_for_a_domain___response_task]
label                   = Workbench - Get Certificate logs for a domain
type                    = link
fields                  = domain
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_certificate_logs_for_a_domain___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_dns_server_history_for_a_host___response_task]
label                   = Workbench - Get DNS Server History for a host
type                    = link
fields                  = src_ip
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_dns_server_history_for_a_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_dns_traffic_ratio___response_task]
label                   = Workbench - Get DNS traffic ratio
type                    = link
fields                  = src_ip
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_dns_traffic_ratio___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_ec2_instance_details_by_instanceid___response_task]
label                   = Workbench - Get EC2 Instance Details by instanceId
type                    = link
fields                  = instanceId
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_ec2_launch_details___response_task]
label                   = Workbench - Get EC2 Launch Details
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_email_info___response_task]
label                   = Workbench - Get Email Info
type                    = link
fields                  = message_id
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_email_info___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_emails_from_specific_sender___response_task]
label                   = Workbench - Get Emails From Specific Sender
type                    = link
fields                  = src_user
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_emails_from_specific_sender___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task]
label                   = Workbench - Get First Occurrence and Last Occurrence of a MAC Address
type                    = link
fields                  = src_mac
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_history_of_email_sources___response_task]
label                   = Workbench - Get History Of Email Sources
type                    = link
fields                  = src
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_history_of_email_sources___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_logon_rights_modifications_for_endpoint___response_task]
label                   = Workbench - Get Logon Rights Modifications For Endpoint
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_endpoint___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_logon_rights_modifications_for_user___response_task]
label                   = Workbench - Get Logon Rights Modifications For User
type                    = link
fields                  = user
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_user___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_notable_history___response_task]
label                   = Workbench - Get Notable History
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_history___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get





[workbench_panel_get_process_responsible_for_the_dns_traffic___response_task]
label                   = Workbench - Get Process Responsible For The DNS Traffic
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_process_responsible_for_the_dns_traffic___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_sysmon_wmi_activity_for_host___response_task]
label                   = Workbench - Get Sysmon WMI Activity for Host
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_sysmon_wmi_activity_for_host___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_web_session_information_via_session_id___response_task]
label                   = Workbench - Get Web Session Information via session id
type                    = link
fields                  = session_id
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_web_session_information_via_session_id___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_aws_activities_via_region_name___response_task]
label                   = Workbench - Investigate AWS activities via region name
type                    = link
fields                  = vendor_region
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_aws_user_activities_by_user_field___response_task]
label                   = Workbench - Investigate AWS User Activities by user field
type                    = link
fields                  = user
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task]
label                   = Workbench - Investigate Failed Logins for Multiple Destinations
type                    = link
fields                  = user
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_network_traffic_from_src_ip___response_task]
label                   = Workbench - Investigate Network Traffic From src ip
type                    = link
fields                  = src_ip
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_network_traffic_from_src_ip___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_okta_activity_by_app___response_task]
label                   = Workbench - Investigate Okta Activity by app
type                    = link
fields                  = app
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_app___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_pass_the_hash_attempts___response_task]
label                   = Workbench - Investigate Pass the Hash Attempts
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_hash_attempts___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_pass_the_ticket_attempts___response_task]
label                   = Workbench - Investigate Pass the Ticket Attempts
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_ticket_attempts___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_previous_unseen_user___response_task]
label                   = Workbench - Investigate Previous Unseen User
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_previous_unseen_user___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_successful_remote_desktop_authentications___response_task]
label                   = Workbench - Investigate Successful Remote Desktop Authentications
type                    = link
fields                  = dest
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_successful_remote_desktop_authentications___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get


[workbench_panel_investigate_user_activities_in_okta___response_task]
label                   = Workbench - Investigate User Activities In Okta
type                    = link
fields                  = user
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_user_activities_in_okta___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_web_posts_from_src___response_task]
label                   = Workbench - Investigate Web POSTs From src
type                    = link
fields                  = src
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_posts_from_src___response_task&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get