fixing SPL

Author: patel-bhavin

detections/network/detect_outbound_smb_traffic.yml

@@ -16,25 +16,20 @@ search: |
     values(All_Traffic.app) as app
     values(sourcetype) as sourcetype count
     from datamodel=Network_Traffic where
-      All_Traffic.action IN ("allowed", "allow") AND
-      (All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb")
-    AND All_Traffic.src_ip IN (
-      "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"
-    )
-    AND NOT All_Traffic.dest_ip IN (
-    "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-    "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-    "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-    "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
-    )
+      All_Traffic.action IN ("allowed", "allow")
+    AND (All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb")
+    AND All_Traffic.src_ip IN `non_public_ip_blocks`
+    AND All_Traffic.src IN `non_public_ip_blocks`
+    AND NOT All_Traffic.dest_ip IN `non_public_ip_blocks`
+    AND NOT All_Traffic.dest IN `non_public_ip_blocks`
     by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
     All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
     All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
     All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
     | `drop_dm_object_name("All_Traffic")`
     | `security_content_ctime(start_time)`
     | `security_content_ctime(end_time)`
+    | rename dest as dest_ip
     | iplocation dest_ip
     | `detect_outbound_smb_traffic_filter`
 how_to_implement: This search requires you to be ingesting your network traffic and populating the Network_Traffic data model.
@@ -78,3 +73,8 @@ tests:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log
           source: not_applicable
           sourcetype: cisco:sfw:estreamer
+    - name: Cisco Secure Firewall True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_access/firewall/smb.log
+          source: not_applicable
+          sourcetype: cisco:sfw:estreamer

macros/non_public_ip_blocks.yml

@@ -0,0 +1,8 @@
+definition: ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
+    "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
+    "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
+    "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
+    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1")
+description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution.
+  Replace the macro definition with configurations for your Splunk Environment.
+name: non_public_ip_blocks