mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
121 lines
3.2 KiB
JSON
121 lines
3.2 KiB
JSON
{
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Network_Resolution"
|
|
],
|
|
"data_source": [
|
|
"DNS"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Bro"
|
|
]
|
|
},
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "jhernandez@splunk.com",
|
|
"name": "Jose Hernandez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 1",
|
|
"CIS 3",
|
|
"CIS 8",
|
|
"CIS 12"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Command and Control"
|
|
],
|
|
"mitre_attack": [
|
|
"Exfiltration",
|
|
"Command and Control",
|
|
"Defense Evasion",
|
|
"Commonly Used Port"
|
|
],
|
|
"nist": [
|
|
"ID.AM",
|
|
"PR.DS",
|
|
"PR.IP",
|
|
"DE.AE",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "jhernandez@splunk.com",
|
|
"name": "Jose Hernandez"
|
|
}
|
|
],
|
|
"creation_date": "2019-02-14",
|
|
"modification_date": "2019-02-14",
|
|
"eli5": "This example phantom playbook will detect",
|
|
|
|
"how_to_implement": "Splunk>Phantom Playbook Integration",
|
|
"known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.",
|
|
|
|
"id": "1229w27b-ef78-4w59-aae8-5369073014e1",
|
|
|
|
"name": "Playbook that detects DNS Hijacks",
|
|
"description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.",
|
|
"product_type": "phantom",
|
|
"asset_type": "Endpoint",
|
|
"confidence": "medium",
|
|
"security_domain": "network",
|
|
"spec_version": 2,
|
|
"version": "1.0",
|
|
"baselines": [],
|
|
"entities":["dest"],
|
|
"detect": {
|
|
"phantom": {
|
|
"phantom_server": "automation (hostname)",
|
|
"playbook_name": "community/dns_hijack_investigation",
|
|
"playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/",
|
|
"sensitivity": "green",
|
|
"severity": "medium",
|
|
"schedule": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "src",
|
|
"rule_description": "The table represents a list of DNS records and their responses for corporate domains that have recently changed",
|
|
"rule_title": "DNS record changed"
|
|
},
|
|
"risk": {
|
|
"risk_object": "src",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 40
|
|
},
|
|
"schedule": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "src",
|
|
"suppress_period": "28800s"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"investigations": [
|
|
{
|
|
"name": "Discover DNS records,",
|
|
"product_type": "splunk",
|
|
"id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3"
|
|
},
|
|
{
|
|
"name": "DNS record change investigation",
|
|
"product_type": "phantom",
|
|
"id": "c096f721-8842-42ce-bfc7-74bd8c72b711"
|
|
}
|
|
],
|
|
"responses": []
|
|
} |