Skip to content

Commit 641c590

Browse files
author
Patrick Bareiss
committed
Merge branch 'develop' into output_normalization_endpoint
2 parents 18eded0 + 4583864 commit 641c590

File tree

551 files changed

+4130
-1344
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

551 files changed

+4130
-1344
lines changed

‎baselines/deprecated/.gitkeep

Whitespace-only changes.

‎baselines/previously_seen_aws_cross_account_activity___initial.yml ‎baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ version: 1
44
date: '2020-08-15'
55
author: Rico Valdez, Splunk
66
type: Baseline
7-
status: production
7+
status: deprecated
88
description: This search looks for **AssumeRole** events where the requesting account
99
differs from the requested account, then writes these relationships to a lookup
1010
file.

‎baselines/previously_seen_aws_cross_account_activity___update.yml ‎baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ version: 1
44
date: '2020-08-15'
55
author: Rico Valdez, Splunk
66
type: Baseline
7-
status: production
7+
status: deprecated
88
description: This search looks for **AssumeRole** events where the requesting account
99
differs from the requested account, then writes these relationships to a lookup
1010
file.

‎contentctl.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ app:
33
uid: 3449
44
title: ES Content Updates
55
appid: DA-ESS-ContentUpdate
6-
version: 5.1.1
6+
version: 5.2.0
77
description: Explore the Analytic Stories included with ES Content Updates.
88
prefix: ESCU
99
label: ESCU
@@ -218,11 +218,11 @@ apps:
218218
version: 3.1.0
219219
description: description of app
220220
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-github_310.tgz
221-
- uid: 2882
221+
- uid: 3471
222222
title: Splunk Add-on for AppDynamics
223223
appid: Splunk_TA_AppDynamics
224-
version: 3.1.0
224+
version: 3.0.0
225225
description: The Splunk Add-on for AppDynamics enables you to easily configure data
226226
inputs to pull data from AppDynamics' REST APIs
227-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_310.tgz
227+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_300.tgz
228228
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd

‎data_sources/asl_aws_cloudtrail.yml

+16-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,22 @@
11
name: ASL AWS CloudTrail
22
id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898
3-
version: 1
4-
date: '2025-01-14'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for ASL AWS CloudTrail
6+
description: Represents AWS API dataset data collection from Amazon Security Lake.
7+
mitre_components:
8+
- Cloud Service Metadata
9+
- Cloud Service Modification
10+
- Cloud Storage Access
11+
- Instance Creation
12+
- Instance Deletion
13+
- Instance Start
14+
- Instance Stop
15+
- Instance Modification
16+
- Cloud Storage Creation
17+
- Cloud Storage Deletion
18+
- Cloud Service Enumeration
19+
- Cloud Storage Enumeration
720
source: aws_asl
821
sourcetype: aws:asl
922
separator: api.operation
@@ -12,7 +25,6 @@ supported_TA:
1225
url: https://splunkbase.splunk.com/app/1876
1326
version: 7.9.1
1427
output_fields:
15-
- action
1628
- dest
1729
- user
1830
- user_agent

‎data_sources/aws_cloudfront.yml

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,17 @@
11
name: AWS Cloudfront
22
id: 780086dc-2384-45b6-ade7-56cb00105464
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS Cloudfront
6+
description: Logs requests made to AWS CloudFront distributions, including details
7+
on client access, response data, and performance metrics.
8+
mitre_components:
9+
- Network Traffic Content
10+
- Network Traffic Flow
11+
- Response Metadata
12+
- Response Content
13+
- Logon Session Metadata
14+
- Cloud Service Metadata
715
source: aws
816
sourcetype: aws:cloudfront:accesslogs
917
supported_TA:

‎data_sources/aws_cloudtrail.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ id: e8ace6db-1dbd-4c72-a1fb-334684619a38
33
version: 1
44
date: '2024-07-24'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail
6+
description: All AWS CloudTrail events
77
source: aws_cloudtrail
88
sourcetype: aws:cloudtrail
99
separator: eventName

‎data_sources/aws_cloudtrail_assumerolewithsaml.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
name: AWS CloudTrail AssumeRoleWithSAML
22
id: 1e28f2a6-2db9-405f-b298-18734a293f77
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail AssumeRoleWithSAML
6+
description: Logs attempts to assume roles via SAML authentication in AWS, including
7+
details of identity provider and role mapping.
8+
mitre_components:
9+
- User Account Authentication
10+
- Logon Session Creation
11+
- User Account Metadata
12+
- Cloud Service Metadata
13+
- Instance Modification
714
source: aws_cloudtrail
815
sourcetype: aws:cloudtrail
916
separator: eventName
17+
separator_value: AssumeRoleWithSAML
1018
supported_TA:
1119
- name: Splunk Add-on for AWS
1220
url: https://splunkbase.splunk.com/app/1876
@@ -125,7 +133,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "SAMLUser", "pri
125133
"eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management",
126134
"recipientAccountId": "111111111111"}'
127135
output_fields:
128-
- action
129136
- dest
130137
- user
131138
- user_agent

‎data_sources/aws_cloudtrail_consolelogin.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
name: AWS CloudTrail ConsoleLogin
22
id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail ConsoleLogin
6+
description: Logs attempts to sign in to the AWS Management Console, including successful
7+
and failed login events.
8+
mitre_components:
9+
- User Account Authentication
10+
- Logon Session Creation
11+
- User Account Metadata
12+
- Logon Session Metadata
13+
- Cloud Service Metadata
714
source: aws_cloudtrail
815
sourcetype: aws:cloudtrail
916
separator: eventName
17+
separator_value: ConsoleLogin
1018
supported_TA:
1119
- name: Splunk Add-on for AWS
1220
url: https://splunkbase.splunk.com/app/1876
@@ -101,7 +109,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "acco
101109
"Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
102110
"clientProvidedHostHeader": "signin.aws.amazon.com"}}'
103111
output_fields:
104-
- action
105112
- dest
106113
- user
107114
- user_agent

‎data_sources/aws_cloudtrail_copyobject.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CopyObject
22
id: 965083f4-64a8-403f-99cc-252e1a6bd3b6
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CopyObject
6+
description: Logs operations that copy objects within or between AWS S3 buckets, including
7+
details of source and destination.
8+
mitre_components:
9+
- Cloud Storage Access
10+
- Cloud Storage Modification
11+
- Cloud Storage Metadata
12+
- Instance Modification
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CopyObject
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -118,7 +125,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin
118125
"eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "111111111111",
119126
"eventCategory": "Data"}'
120127
output_fields:
121-
- action
122128
- dest
123129
- user
124130
- user_agent

‎data_sources/aws_cloudtrail_createaccesskey.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateAccessKey
22
id: 0460f7da-3254-4d90-b8c0-2ca657d0cea0
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateAccessKey
6+
description: Logs the creation of new AWS access keys, including details of the associated
7+
user and permissions.
8+
mitre_components:
9+
- User Account Creation
10+
- User Account Metadata
11+
- Cloud Service Modification
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateAccessKey
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -102,7 +109,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin
102109
"AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId":
103110
"121521347698"}'
104111
output_fields:
105-
- action
106112
- dest
107113
- user
108114
- user_agent

‎data_sources/aws_cloudtrail_createkey.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateKey
22
id: fcfc1593-b6b5-4a0f-91c5-3c395116a8b9
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateKey
6+
description: Logs the creation of new AWS KMS keys, including details of key properties
7+
and associated metadata.
8+
mitre_components:
9+
- Cloud Service Creation
10+
- Cloud Service Metadata
11+
- Instance Creation
12+
- Volume Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateKey
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -149,7 +156,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "
149156
"eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management",
150157
"recipientAccountId": "111111111111"}'
151158
output_fields:
152-
- action
153159
- dest
154160
- user
155161
- user_agent

‎data_sources/aws_cloudtrail_createloginprofile.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateLoginProfile
22
id: 0024fdb1-0d62-4449-970a-746952cf80b6
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateLoginProfile
6+
description: Logs the creation of login profiles for IAM users, including associated
7+
metadata and authentication settings.
8+
mitre_components:
9+
- User Account Creation
10+
- User Account Metadata
11+
- Logon Session Metadata
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateLoginProfile
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -101,7 +108,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin
101108
"AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId":
102109
"111111111111"}'
103110
output_fields:
104-
- action
105111
- dest
106112
- user
107113
- user_agent

‎data_sources/aws_cloudtrail_createnetworkaclentry.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateNetworkAclEntry
22
id: 45934028-10ec-4ab5-a7b1-a6349b833e67
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateNetworkAclEntry
6+
description: Logs the creation of new entries in a network ACL, including rules to
7+
allow or deny specific network traffic.
8+
mitre_components:
9+
- Firewall Rule Modification
10+
- Network Connection Creation
11+
- Cloud Service Modification
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateNetworkAclEntry
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -120,7 +127,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "
120127
"6d1ce00e-4099-463c-8a4d-2af2fb2178ba", "readOnly": false, "eventType": "AwsApiCall",
121128
"managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}'
122129
output_fields:
123-
- action
124130
- dest
125131
- user
126132
- user_agent

‎data_sources/aws_cloudtrail_createpolicyversion.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreatePolicyVersion
22
id: f9f0f3da-37ec-4164-9ea0-0ae46645a86b
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreatePolicyVersion
6+
description: Logs the creation of new versions of IAM policies, including changes
7+
to permissions and attached roles or resources.
8+
mitre_components:
9+
- Cloud Service Modification
10+
- Cloud Service Metadata
11+
- User Account Metadata
12+
- Group Modification
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreatePolicyVersion
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -105,7 +112,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin
105112
"AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId":
106113
"111111111111"}'
107114
output_fields:
108-
- action
109115
- dest
110116
- user
111117
- user_agent

‎data_sources/aws_cloudtrail_createsnapshot.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
name: AWS CloudTrail CreateSnapshot
22
id: 514135a2-f4b2-4d32-8f31-d87824887f9f
3-
version: 1
4-
date: '2024-07-18'
3+
version: 2
4+
date: '2025-01-23'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for AWS CloudTrail CreateSnapshot
6+
description: Logs the creation of a new snapshot of a cloud resource, such as an Amazon
7+
EBS volume, including details about the snapshot ID and resource type.
8+
mitre_components:
9+
- Snapshot Creation
10+
- Snapshot Metadata
11+
- Volume Metadata
12+
- Cloud Service Metadata
713
source: aws_cloudtrail
814
sourcetype: aws:cloudtrail
915
separator: eventName
16+
separator_value: CreateSnapshot
1017
supported_TA:
1118
- name: Splunk Add-on for AWS
1219
url: https://splunkbase.splunk.com/app/1876
@@ -117,7 +124,6 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "prin
117124
"111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2",
118125
"cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}'
119126
output_fields:
120-
- action
121127
- dest
122128
- user
123129
- user_agent

0 commit comments

Comments
 (0)