mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
48 lines
1.4 KiB
JSON
48 lines
1.4 KiB
JSON
{
|
|
"creation_date": "2017-04-10",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"DNS"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Bro"
|
|
]
|
|
},
|
|
"description": "While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours.",
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting your DNS traffic",
|
|
"id": "c096f721-8842-42ce-bfc7-74bd8c72b712",
|
|
"investigate": {
|
|
"phantom": {
|
|
"phantom_server": "automation (hostname)",
|
|
"playbook_name": "community/dns_hijack_investigation",
|
|
"playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/",
|
|
"sensitivity": "green",
|
|
"severity": "medium",
|
|
"window": {
|
|
"earliest_time_offset": 0,
|
|
"latest_time_offset": 86400
|
|
}
|
|
}
|
|
},
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-11-09",
|
|
"name": "DNS record change investigation",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"spec_version": 2,
|
|
"product_type": "phantom",
|
|
"version": "1.0"
|
|
}
|