mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
75 lines
2.3 KiB
JSON
75 lines
2.3 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "high",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest",
|
|
"rule_description": "The system $dest$ attempted a backup but encountered an error.",
|
|
"rule_title": "Failed backup attempt by $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 10
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2017-06-15",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Backup Systems"
|
|
],
|
|
"data_sourcetypes": [
|
|
"netbackup_logs"
|
|
],
|
|
"providing_technologies": [
|
|
"Netbackup"
|
|
]
|
|
},
|
|
"eli5": "This search looks across the most recent backup events for each host, and returns those messages that indicate there was a backup failure.",
|
|
"how_to_implement": "To successfully implement this search you need to obtain data from your backup solution, either from the backup logs on your endpoints or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your specific backup solution.",
|
|
"known_false_positives": "None identified",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 10"
|
|
],
|
|
"nist": [
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2017-09-12",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 7 * * *",
|
|
"earliest_time": "-24h@h",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=\"netbackup_logs\" | stats latest(_time) as latestTime by COMPUTERNAME, MESSAGE | search MESSAGE=\"An error occurred, failed to backup.\" | `ctime(latestTime)` | rename COMPUTERNAME as dest, MESSAGE as signature | table latestTime, dest, signature",
|
|
"search_description": "This search gives you the hosts where a backup was attempted and then failed.",
|
|
"search_id": "a34aae96-ccf8-4aaa-952c-3ea21444444f",
|
|
"search_name": "Unsuccessful Netbackup backups",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|