mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
9 lines
1.5 KiB
YAML
9 lines
1.5 KiB
YAML
definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest)
|
|
| lookup update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field
|
|
| eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field )
|
|
| lookup remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment
|
|
| eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED")
|
|
| search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED"))
|
|
| fields - asset_temp_field,exception_asset'
|
|
description: Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv
|
|
name: remote_access_software_usage_exceptions |