splunk-security_content/response_tasks/get_notable_history.yml

name: Get Notable History
id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
version: 2
date: '2017-09-20'
description: This search queries the notable index and returns all the Notable Events
  for the particular destination host, giving the analyst an overview of the incidents
  that may have occurred with the host under investigation.
how_to_implement: If you are using Enterprise Security you are likely already creating
  notable events with your correlation rules. No additional configuration is necessary.
author: Bhavin Patel, Splunk
inputs:
- dest
search: '| search `notable` | search dest=$dest$ | table _time, rule_name, owner,
  priority, severity, status_description'
tags:
  analytics_story:
  - AWS Cross Account Activity
  - AWS Cryptomining
  - AWS Network ACL Activity
  - AWS User Monitoring
  - Account Monitoring and Controls
  - Apache Struts Vulnerability
  - Asset Tracking
  - Brand Monitoring
  - Cloud Cryptomining
  - ColdRoot MacOS RAT
  - Collection and Staging
  - Command and Control
  - DHS Report TA18-074A
  - DNS Amplification Attacks
  - Data Protection
  - Disabling Security Tools
  - Dynamic DNS
  - 'Emotet Malware  DHS Report TA18-201A '
  - Hidden Cobra Malware
  - Host Redirection
  - JBoss Vulnerability
  - Kubernetes Scanning Activity
  - Lateral Movement
  - Malicious PowerShell
  - Monitor Backup Solution
  - Monitor for Unauthorized Software
  - Monitor for Updates
  - Netsh Abuse
  - Orangeworm Attack Group
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Prohibited Traffic Allowed or Protocol Mismatch
  - Ransomware
  - Router and Infrastructure Security
  - SQL Injection
  - SamSam Ransomware
  - Spectre And Meltdown Vulnerabilities
  - Splunk Enterprise Vulnerability
  - Splunk Enterprise Vulnerability CVE-2018-11409
  - Suspicious AWS EC2 Activities
  - Suspicious AWS S3 Activities
  - Suspicious AWS Traffic
  - Suspicious Cloud Authentication Activities
  - Suspicious Command-Line Executions
  - Suspicious DNS Traffic
  - Suspicious Emails
  - Suspicious MSHTA Activity
  - Suspicious WMI Use
  - Suspicious Windows Registry Activities
  - Unusual AWS EC2 Modifications
  - Unusual Processes
  - Use of Cleartext Protocols
  - Web Fraud Detection
  - Windows Defense Evasion Tactics
  - Windows File Extension and Association Abuse
  - Windows Log Manipulation
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Service Abuse