mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Rico Valdez
45 lines
2.3 KiB
JSON
45 lines
2.3 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2019-05-08",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Network_Resolution"
|
|
],
|
|
"data_source": [
|
|
"DNS"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Bro"
|
|
]
|
|
},
|
|
"eli5": "Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment.",
|
|
"how_to_implement": "To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"modification_date": "2019-05-08",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"earliest_time": "-31d@d",
|
|
"latest_time": "-1d@d"
|
|
},
|
|
"search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel",
|
|
"search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.",
|
|
"search_id": "c914844c-0ff5-4efc-8d44-c063443129ba",
|
|
"search_name": "Baseline of DNS Query Length - MLTK",
|
|
"search_type": "support",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|