Skip to content

Commit d2b2bf6

Browse files
ccl0utierccl0utier
authored
Merge pull request #15 from dlamspl/dev
Dev
2 parents 29e102e + 2e5073c commit d2b2bf6

File tree

11 files changed

+357
-78
lines changed

11 files changed

+357
-78
lines changed

‎README.md‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,25 @@ This application has the following depencencies:
2121
+ [Splunk Security Essentials v3.x.x](https://splunkbase.splunk.com/app/3435/)
2222
+ [Status Indicator - Custom Visualization](https://splunkbase.splunk.com/app/3119/)
2323
+ [Sankey Diagram - Custom Visualization](https://splunkbase.splunk.com/app/3112/)
24+
+ [Parallel Coordinates - Custom Visualization](https://splunkbase.splunk.com/app/3137)
25+
+ [Treemap - Custom Visualization](https://splunkbase.splunk.com/app/3118)
26+
27+
**Note:** The application will fallback to not showing any panels that rely on prerequisite visualizations if they are missing.
2428

2529
## What does it look like ?
2630

2731
The Main dashboard gives you an overview of the simulations run, users, hosts, MITRE ATT&CK tactics and techniques, tests executed and potential mapping with analytic stories.
2832

2933
![Main Dashboard](appserver/static/docs/img/ar_main_dashboardv1.0.png?raw=true "Main Dashboard")
3034

31-
The second dashboard (Navigator) shows all the available Atomic Red tests and their potential mappings to security content. The reason we categorize those as "potential" is because the mapping is simply made based on the MITRE tactic referenced in the test and the security content. This does not necessarily mean that a specific Atomic Red Test will trigger a particular detection. This is where you should read more on what ATT&CK is all about and how the Splunk [Security Content](https://research.splunk.com) maps to it. :)
32-
35+
The second dashboard (Navigator) shows all the available Atomic Red tests and their potential mappings to security content. The reason we categorize those as "potential" is because the mapping is simply made based on the MITRE technique/subtechnique referenced in the test and the security content. This does not necessarily mean that a specific Atomic Red Test will trigger a particular detection. This is where you should read more on what ATT&CK is all about and how the Splunk [Security Content](https://research.splunk.com) maps to it. :)
3336

3437
![Navigator](appserver/static/docs/img/ar_navigator_dashboardv1.0.png?raw=true "Navigator")
3538

39+
The 3rd dashboard allows you to search for potential Splunk Security Detections, Atomic Red Tests or determine PurpleSharp support for one or more MITRE Att&ck Technique/Subtechnique.
40+
41+
![MITRE Content Based Search](appserver/static/docs/img/ar_mitre_content_search_dashboard.png?raw=true "Content Search")
42+
3643
Finally there is a dashboard made with Splunk dashboards - Beta which looks nice but still in beta !
3744

3845
![Main - Beta](appserver/static/docs/img/ar_dashboards_beta_preview.png?raw=true "Main-Beta")

‎app.manifest‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"id": {
66
"group": null,
77
"name": "splunk_attack_range_reporting",
8-
"version": "1.0.8"
8+
"version": "1.0.9"
99
},
1010
"author": [
1111
{

‎appserver/static/docs/img/ar_mitre_content_search_dashboard.png‎

518 KB
Loading

‎appserver/static/docs/img/ar_navigator_dashboardv1.0.png‎

-256 KB
Loading

‎default/app.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ is_configured = 0
55

66
[launcher]
77
description = Splunk Attack range dashboards
8-
version = 1.0.8
8+
version = 1.0.9
99
author = [email protected]
1010

1111
[ui]

‎default/data/ui/nav/default.xml‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,11 @@
11
<nav search_view="search">
2-
32
<!-- Set "attack_range_main_dashboard" as the default page -->
43
<collection label="Attack Range Dashboards">
5-
6-
<view name="attack_range_main_dashboard" default="true"/>
7-
<view name="attack_range_navigator" />
8-
9-
10-
4+
<view default="true" name="attack_range_main_dashboard"/>
5+
<view name="attack_range_navigator"/>
6+
<view name="attack_range_mitre_content_search"/>
117
</collection>
12-
13-
<view name="search" />
14-
<view name="datasets" />
15-
<view name="dashboards" />
16-
17-
18-
19-
</nav>
8+
<view name="search"/>
9+
<view name="datasets"/>
10+
<view name="dashboards"/>
11+
</nav>

‎default/data/ui/views/attack_range_main_dashboard.xml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -272,15 +272,16 @@
272272
</progress>
273273
<query>`get_attack_data`
274274
| lookup enterprise-attack-lookup Technique
275-
| eval Label = Tactic + " - " + mitre_tactic_display
276-
| eval Label2 = Technique + " - " + mitre_technique_display
275+
| eval Label = mvindex(Tactic,0) + " - " + mvindex(mitre_tactic_display, 0)
276+
| eval Label2 = Technique + " - " + mvindex(mitre_technique_display, 0)
277277
| stats count by Label2, Label
278278
| table Label, Label2, count
279279
| rename Label as step1, Label2 as step2
280280
| append [
281281
search `get_attack_data`
282282
| lookup enterprise-attack-lookup Technique
283-
| eval Label = Technique + " - " + mitre_technique_display
283+
| eval Label = Technique + " - " + mvindex(mitre_technique_display, 0)
284+
| eval Tactic = mvindex(Tactic, 0)
284285
| eventstats dc("Test Name") as count by Label, Tactic, "Test Name"
285286
| table Label, "Test Name", count
286287
| rename Label as step1, "Test Name" as step2
@@ -289,11 +290,13 @@
289290
<latest>$time_token.latest$</latest>
290291
</search>
291292
<option name="drilldown">none</option>
293+
<option name="refresh.display">progressbar</option>
292294
</viz>
293295
</panel>
294296
<panel depends="$SanskeyNotInstalled$">
295297
<html>
296-
<p>In order for this panel to show properly, please install the SanKey visualization available <a href="https://splunkbase.splunk.com/app/3112/">here</a></p>
298+
<p>In order for this panel to show properly, please install the SanKey visualization available <a href="https://splunkbase.splunk.com/app/3112/">here</a>
299+
</p>
297300
</html>
298301
</panel>
299302
</row>
@@ -402,9 +405,9 @@
402405
| search mitre_id!="None"
403406
| mvexpand mitre_id
404407
| rename mitre_id as mitre_technique]
405-
| stats dc(name) by name, mitre_technique, displayapp
406-
| table name, mitre_technique, displayapp
407-
| rename name as "Detection", mitre_technique as "Att&amp;ck Technique", displayapp as "Source"
408+
| stats dc(name) by name, mitre_technique, analytic_story, displayapp
409+
| table analytic_story, name, mitre_technique, displayapp
410+
| rename analytic_story as "Analytic Story", name as "Detection", mitre_technique as "Att&amp;ck Technique", displayapp as "Source"
408411
</query>
409412
<earliest>$time_token.earliest$</earliest>
410413
<latest>$time_token.latest$</latest>

‎default/data/ui/views/attack_range_mitre_content_search.xml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
<form version="1.1" theme="dark">
2+
<label>MITRE ATT&amp;CK Based Content Search</label>
3+
<description>Displays Splunk Security Detections and Atomic Red/PurpleSharp Tests based on selected MITRE Att&amp;ck technique(s).</description>
4+
<!-- Check if the Parallel Coordinates Visualiztion is installed, and inform the user if not (and adapt the relevant panel content accordingly) -->
5+
<search id="ParallelCoordinatesInstalledSearch">
6+
<query>
7+
| rest /services/apps/local
8+
| where title = "parallel_coordinates_app"
9+
</query>
10+
<finalized>
11+
<condition match=" 'job.resultCount' != 0">
12+
<set token="ParallelCoordinatesInstalled">1</set>
13+
<unset token="ParallelCoordinatesNotInstalled"></unset>
14+
</condition>
15+
<condition>
16+
<unset token="ParallelCoordinatesInstalled"></unset>
17+
<set token="ParallelCoordinatesNotInstalled">1</set>
18+
</condition>
19+
</finalized>
20+
</search>
21+
<fieldset submitButton="false" autoRun="true">
22+
<input type="multiselect" token="tokTechniques" searchWhenChanged="true">
23+
<label>Selected Att&amp;ck Technique(s)</label>
24+
<valuePrefix>mitre_id="</valuePrefix>
25+
<delimiter> OR </delimiter>
26+
<fieldForLabel>label</fieldForLabel>
27+
<fieldForValue>value</fieldForValue>
28+
<search>
29+
<query>| inputlookup enterprise-attack-lookup
30+
| stats count by Technique, mitre_technique_display
31+
| eval value = Technique, label = value + " - " + mitre_technique_display
32+
| fields value, label
33+
| sort value</query>
34+
</search>
35+
<valueSuffix>"</valueSuffix>
36+
<prefix>(</prefix>
37+
<suffix>)</suffix>
38+
</input>
39+
</fieldset>
40+
<row>
41+
<panel depends="$ParallelCoordinatesInstalled$">
42+
<title>Splunk Detections/ATT&amp;CK Technique(s)/Atomic Tests Mapping</title>
43+
<viz type="parallel_coordinates_app.parallel_coordinates">
44+
<search>
45+
<query>| sseanalytics
46+
| fields mitre_id, name
47+
| mvexpand mitre_id
48+
| search $tokTechniques$
49+
| table mitre_id, name
50+
| lookup atomic-red-windows-tests "Technique #" AS mitre_id OUTPUT "Test Name" as test_name, "Test #" as test_no
51+
| eval label = mvzip(test_no, test_name, " - ")
52+
| fields mitre_id, name, label
53+
| mvexpand label
54+
| eval label = if(isnull(label) OR label=="", "&lt;NO TEST YET&gt;", label)
55+
| lookup purplesharp-techniques-lookup Technique as mitre_id OUTPUTNEW Technique as matched_technique
56+
| eval "Supported by PurpleSharp" = if(isnull(matched_technique), "No", "Yes")
57+
| fields - matched_technique
58+
| table name, mitre_id, "Supported by PurpleSharp", label
59+
| sort mitre_id, label, name
60+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique", name as "Splunk Security Detection", label as "Atomic Test Name"</query>
61+
<earliest>-24h@h</earliest>
62+
<latest>now</latest>
63+
</search>
64+
<option name="drilldown">none</option>
65+
<option name="parallel_coordinates_app.parallel_coordinates.colorMode">categorical</option>
66+
<option name="parallel_coordinates_app.parallel_coordinates.hideTicks">false</option>
67+
<option name="parallel_coordinates_app.parallel_coordinates.maxCategories">35</option>
68+
<option name="parallel_coordinates_app.parallel_coordinates.maxColor">#3fc77a</option>
69+
<option name="parallel_coordinates_app.parallel_coordinates.minColor">#006d9c</option>
70+
<option name="refresh.display">progressbar</option>
71+
</viz>
72+
</panel>
73+
<panel depends="$ParallelCoordinatesNotInstalled$">
74+
<html>
75+
<p>In order for this panel to show properly, please install the Parallel Coordinates visualization available <a href="https://splunkbase.splunk.com/app/3137">here</a>
76+
</p>
77+
</html>
78+
</panel>
79+
</row>
80+
<row>
81+
<panel>
82+
<title>Available Splunk Security Detections</title>
83+
<table>
84+
<search>
85+
<query>| sseanalytics
86+
| fields mitre_id, name, displayapp, dashboard
87+
| eval _SSE_url = "" + dashboard
88+
| mvexpand mitre_id
89+
| search $tokTechniques$
90+
| eval Link = "[View Details]"
91+
| table mitre_id, displayapp, name, Link, _SSE_url
92+
| sort mitre_id, name
93+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique", displayapp as "Source", name as "Security Detection"</query>
94+
<earliest>-24h@h</earliest>
95+
<latest>now</latest>
96+
</search>
97+
<option name="count">10</option>
98+
<option name="drilldown">row</option>
99+
<option name="refresh.display">progressbar</option>
100+
<drilldown>
101+
<link target="_blank">/app/Splunk_Security_Essentials/$row._SSE_url|n$</link>
102+
</drilldown>
103+
</table>
104+
</panel>
105+
<panel>
106+
<title>Available Atomic Red Tests</title>
107+
<table>
108+
<search>
109+
<query>| inputlookup atomic-red-windows-tests
110+
| eval name = 'Test #' + " - " + 'Test Name'
111+
| rename "Technique #" as mitre_id
112+
| search $tokTechniques$
113+
| fields mitre_id, name, "Test GUID"
114+
| eval Link = "[View Details]"
115+
| eval _mitre_id = mitre_id
116+
| sort mitre_id, name
117+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique", name as "Test Name"</query>
118+
<earliest>-24h@h</earliest>
119+
<latest>now</latest>
120+
</search>
121+
<option name="drilldown">row</option>
122+
<option name="refresh.display">progressbar</option>
123+
<drilldown>
124+
<link target="_blank">https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/$row._mitre_id|n$/$row._mitre_id|n$.md</link>
125+
</drilldown>
126+
</table>
127+
</panel>
128+
<panel>
129+
<title>PurpleSharp Supported Techniques</title>
130+
<table>
131+
<search>
132+
<query>| inputlookup purplesharp-techniques-lookup
133+
| rename "Technique" as mitre_id
134+
| search $tokTechniques$
135+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique"
136+
| eval "Has related tests?" = "Yes"
137+
| eval Link = "[View Details]"
138+
| appendpipe
139+
[ stats count
140+
| eval "Has related tests?"="None of the selected technique(s) have tests yet"
141+
| where count==0
142+
| table "Has related tests?"]</query>
143+
<earliest>-24h@h</earliest>
144+
<latest>now</latest>
145+
</search>
146+
<option name="drilldown">row</option>
147+
<option name="refresh.display">progressbar</option>
148+
<format type="color" field="Has related tests?">
149+
<colorPalette type="map">{"Yes":#53A051, "None of the selected technique(s) have tests yet":#FF0000}</colorPalette>
150+
</format>
151+
<drilldown>
152+
<link target="_blank">https://www.purplesharp.com/en/latest/techniques/techniques.html</link>
153+
</drilldown>
154+
</table>
155+
</panel>
156+
</row>
157+
</form>

0 commit comments

Comments
 (0)