This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.

Usage🛡

The Splunk Security Content can be used via:

Splunk App

Grab the latest release of DA-ESS-ContentUpdate and install it on a Splunk Enterprise instance. Alternatively you can download it from splunkbase, it is currently a Splunk Supported App.

API

curl -s https://content.splunkresearch.com | jq
{
  "hello": "welcome to Splunks Research security content api"
}

GitHub Workflow

Create your customized version of Security Content by forking this project and following this guide.

Customize to your Environment 🏗

Customize you content to change how often detections run, or what the right source type for sysmon in your environment is please follow this guide.

Execute an Analytic Story 🏃‍♀️

Download and install the latest version of [Splunk Analytic Story Execution] (https://github.com/splunk/analytic_story_execution/releases). This Splunk application will help the user do the following:

Execute an analytic story in an adhoc mode and view the results.
Schedule all the detection searches in an analytic story.
Update security-content via an API

Writing Content 📓

Please see the Developing Content guide for instructions.

Content Parts 🧩

detections/: Contains all 209 detection searches to-date and growing.
stories/: All Analytic Stories that are group detections or also known as Use Cases
deployments/: Configuration for the schedule and alert action for all content
responses/: Incident Response Playbooks/Workflow for responding to a specific Use Case or Threat.
response_tasks/: Individual steps in responses that help the user investigate via a Splunk search, automate via a phantom playbook, and visualize via dashboards threats.
baselines/: Searches that must be executed before a detection runs. It is specifically useful for collecting data on a system before running your detection on the collected data.
dashboards/: JSON definitions of Mission Control dashboards, to be used as a response task. Currently not used.
macros/: Implements Splunk’s search macros, shortcuts to commonly used search patterns like sysmon source type. More on how macros are used to customize content below.
lookups/: Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions.

Supporting Parts

package/: Splunk content app-source files, including lookups, binaries, and default config files
bin/: All binaries required to produce and test content

Contribution 🥰

We welcome feedback and contributions from the community! Please see our contributing to the project for more information on how to get involved.

Support 💪

Please use the GitHub Issue Tracker to submit bugs or request features.

If you have questions or need support, you can:

Post a question to Splunk Answers
Join the #security-research room in the Splunk Slack channel
If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can also open a support case on the https://www.splunk.com/ support portal

README.md Unescape Escape

Splunk Security Content