security-content

Contains a collection of security stories with their corresponding detection, investigative, contexual and support splunk searches

branch	build status
develop
master

Usage

Can be consumed using:

Splunk App

grab the latest release of DA-ESS-ContentUpdate and install it in a Splunk Server.

API

curl https://g7jbilqdth.execute-api.us-west-2.amazonaws.com/api/

CLI

python content-update.py -o $SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate --splunk_user admin --splunk_password xxxx

Writing Content

Make sure you followed step 1 to 3 under developing before starting.

1. select which content piece you want to write.
2. copy an example and edit to your needs, most sure you at minium write a story, detection and investigation
3. make a pull request .. if CI failed refer to troubleshooting

Security Content Layout

Content Parts

• stories/ - contains all analytics stories/use cases for ESCU
• detections/ - splunk, uba and phantom detections that power stories
• investigations/ - splunk, and phantom investigation content that are used in stories
• responses/ - automated splunk and phantom responses that are used in stories
• baselines/ - phantom and Splunk baseline needed to support detections in stories

Supporting parts

• package/ - splunk content app source files, includes lookups, binaries, and defaul config files
• bin/ - where all binaries to produce, and test content lives

Docs

• docs/ - documentation for all of the spec files
• spec/ - location of all spec files that describe ESCU content

Developing

For getting pre-commit checks, install the hooks see below for steps:

1. create virtualenv and install requirements: virtualenv venv && source venv/bin/activate && pip install -r requirements.txt
2. install pre-commit pre-commit install
3. Install circleci CLI Tool

To test a local change to CI or build make sure you are running docker and then

circleci local execute -e GITHUB_TOKEN=$GITHUB_TOKEN --branch <your branch>

To generate docs from schema automatically

1. install https://github.com/adobe/jsonschema2md
2. jsonschema2md -d spec/v2/detections.json.spec -o docs

Troubleshooting

Our Automated Tests

1. CI validates that the content was written to spec using validate.py, to run validation manually execute: python bin/generate.py --path . --output package --storiesv1 --use_case_lib -v
2. CI generates splunk configuration files using generate.py. If you want to export splunk conf files manually from the content run: python bin/generate.py --path . --output package --storiesv1 --use_case_lib -v
3. CI builds a DA-ESS-ContentUpdate splunk package using the Splunk Packaging Toolkit
4. CI tests the newly produce package using Splunk Appinspect

Todo's

• build cli for interacting and developing