mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
52 lines
2.3 KiB
YAML
52 lines
2.3 KiB
YAML
baseline:
|
|
splunk:
|
|
schedule:
|
|
cron_schedule: ''
|
|
earliest_time: -31d@d
|
|
latest_time: -1d@d
|
|
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query
|
|
DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` |
|
|
eval query_length = len(query) | fit DensityFunction query_length by record_type
|
|
into dns_query_pdfmodel'
|
|
creation_date: '2019-05-08'
|
|
data_metadata:
|
|
data_models:
|
|
- Network_Resolution
|
|
data_source:
|
|
- DNS
|
|
providing_technologies:
|
|
- Splunk Stream
|
|
- Bro
|
|
description: This search is used to build a Machine Learning Toolkit (MLTK) model
|
|
to characterize the length of the DNS queries for each DNS record type observed
|
|
in the environment. By default, the search uses the last 30 days of data to build
|
|
the model. The model created by this search is then used in the corresponding detection
|
|
search, which uses it to identify outliers in the length of the DNS query.
|
|
eli5: Create a machine-learning (ML) model to characterize the length of DNS requests
|
|
seen in your environment to help identify unusually long ones that may be indicative
|
|
of attacker infrastrucutre or the use of DNS as a command-and-control channel in
|
|
your environment.
|
|
how_to_implement: To successfully implement this search, you will need to ensure that
|
|
DNS data is populating the Network_Resolution data model. In addition, you must
|
|
have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any
|
|
required dependencies. By default, the search builds the model using the past 30
|
|
days of data. You can modify the search window to build the model over a longer
|
|
period of time, which may give you better results. You may also want to periodically
|
|
re-run this search to rebuild the model with the latest data. More information on
|
|
the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
|
|
id: c914844c-0ff5-4efc-8d44-c063443129ba
|
|
known_false_positives: ''
|
|
maintainers:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
modification_date: '2019-05-08'
|
|
name: Baseline of DNS Query Length - MLTK
|
|
original_authors:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
spec_version: 2
|
|
type: splunk
|
|
version: '1.0'
|