Skip to content

Commit 1f34478

Browse files
P4T12ICKP4T12ICK
authored
Merge branch 'develop' into output_normalization_aws
2 parents da8a7a2 + 9b15a7b commit 1f34478

21 files changed

+1052
-17
lines changed

‎contentctl.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ app:
33
uid: 3449
44
title: ES Content Updates
55
appid: DA-ESS-ContentUpdate
6-
version: 5.1.0
6+
version: 5.1.1
77
description: Explore the Analytic Stories included with ES Content Updates.
88
prefix: ESCU
99
label: ESCU
@@ -221,8 +221,8 @@ apps:
221221
- uid: 2882
222222
title: Splunk Add-on for AppDynamics
223223
appid: Splunk_TA_AppDynamics
224-
version: 3.0.0
224+
version: 3.1.0
225225
description: The Splunk Add-on for AppDynamics enables you to easily configure data
226226
inputs to pull data from AppDynamics' REST APIs
227-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-appdynamics_300.tgz
227+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_310.tgz
228228
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd

‎data_sources/cisco_secure_application_appdynamics_alerts.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ sourcetype: appdynamics_security
99
supported_TA:
1010
- name: Splunk Add-on for AppDynamics
1111
url: https://splunkbase.splunk.com/app/3471
12-
version: 3.0.0
12+
version: 3.1.0
1313
fields:
1414
- SourceType
1515
- apiServerExternal
@@ -133,4 +133,4 @@ fields:
133133
- _si
134134
- _sourcetype
135135
- _time
136-
example_log: '{ "SourceType": "secure_app_attacks", "attackId": "24815279", "attackSource": "EXTERNAL", "attackOutcome": "EXPLOITED", "attackTypes": "{SSRF}", "attackEventTrigger": "", "application": "AD-Ecommerce", "tier": "Order-Processing-Services", "businessTransaction": "Checkout", "attackStatus": "OPEN", "attackLastDetected": "2025-01-31 12:30:22 +0000 UTC", "attackEvents": [{"attackOutcome":"EXPLOITED","eventType":"SOCKET_RESOLVE","attackTypes":"SSRF","timestamp":"2025-01-31T12:30:22Z","applicationName":"AD-Ecommerce","tierName":"Order-Processing-Services","maliciousIpOut":"","maliciousIpSourceOut":"","detailJson":{"classname":"java.net.SocketPermission","ptype":"SOCKET","socketOut":"www.cisco.com","hostContext":"www.cisco.com","methodName":"sun.net.www.http.HttpClient.openServer","apiServerExternal":true,"apiServerInUrl":true},"blocked":false,"blockedReason":"","vulnerableMethod":"org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)","matchedCveName":"CVE-2020-13934","keyInfo":"","cveId":"a21931cd-52fa-11ec-a8b2-8e3051145156","stackTrace":"java.lang.SecurityManager.checkConnect(SecurityManager.java:1051)\nsun.net.www.http.HttpClient.openServer(HttpClient.java:510)\nsun.net.www.protocol.https.HttpsClient.\u003cinit\u003e(HttpsClient.java:264)\nsun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)\norg.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule.login(SomeFile.java:12)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1138)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1022)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1020)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1019)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)\nsun.net.www.protocol.http.HttpURLConnection.access$200(HttpURLConnection.java:91)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1466)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1464)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1463)\nsun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)\nservlet.ArgentoDemoApp$GenericExecution._executeServletCommand(ArgentoDemoApp.java:850)\nservlet.ArgentoDemoApp$GenericExecution.executeServletCommand(ArgentoDemoApp.java:778)\nservlet.ArgentoDemoApp$MyApplicationExecution.executeServletCommand(ArgentoDemoApp.java:718)\nservlet.ArgentoDemoApp._doGet(ArgentoDemoApp.java:441)\nservlet.ArgentoDemoApp.doGet(ArgentoDemoApp.java:376)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:634)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:741)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\norg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\norg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)\norg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\norg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)\norg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)\norg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:745)\n","jvmId":"EEcommerce_MS_NODE","maliciousIpSource":"","webTransactionUrl":"https://localhost:8088/argentoDemoApp/execute?upload=https://www.cisco.com/c/dam/cdc/t/ctm-core.js","clientAddressType":4,"clientAddress":"218.132.217.179","serverPort":"1047","serverAddress":"75.155.150.130","clientPort":"68389","serverName":"/usr/src/argento/prod/demo-run/tomcat-demo-app/webapps/argentoDemoApp/","vulnerabilityInfo":{"cvePublishDate":"2020-07-15T16:40:14.601976Z","cvssScore":5.3,"cvssSeverity":"MEDIUM","cveNvdUrl":"https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-584427","incidentFirstDetected":"2020-07-15T16:40:14.601976Z","kennaScore":53.0971,"library":"org.apache.tomcat.embed:tomcat-embed-core","title":"Denial of Service (DoS)","type":"java","kennaActiveInternetBreach":false,"kennaEasilyExploitable":false,"kennaMalwareExploitable":false,"kennaPredictedExploitable":true,"kennaPopularTarget":false}}]}'
136+
example_log: '{ "SourceType": "secure_app_attacks", "attackId": "24815279", "attackSource": "EXTERNAL", "attackOutcome": "EXPLOITED", "attackTypes": "{SSRF}", "attackEventTrigger": "", "application": "AD-Ecommerce", "tier": "Order-Processing-Services", "businessTransaction": "Checkout", "attackStatus": "OPEN", "attackLastDetected": "2025-01-31 12:30:22 +0000 UTC", "attackEvents": [{"attackOutcome":"EXPLOITED","eventType":"SOCKET_RESOLVE","attackTypes":"SSRF","timestamp":"2025-01-31T12:30:22Z","applicationName":"AD-Ecommerce","tierName":"Order-Processing-Services","maliciousIpOut":"","maliciousIpSourceOut":"","detailJson":{"classname":"java.net.SocketPermission","ptype":"SOCKET","socketOut":"www.cisco.com","hostContext":"www.cisco.com","methodName":"sun.net.www.http.HttpClient.openServer","apiServerExternal":true,"apiServerInUrl":true},"blocked":false,"blockedReason":"","vulnerableMethod":"org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)","matchedCveName":"CVE-2020-13934","keyInfo":"","cveId":"a21931cd-52fa-11ec-a8b2-8e3051145156","stackTrace":"java.lang.SecurityManager.checkConnect(SecurityManager.java:1051)\nsun.net.www.http.HttpClient.openServer(HttpClient.java:510)\nsun.net.www.protocol.https.HttpsClient.\u003cinit\u003e(HttpsClient.java:264)\nsun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)\norg.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule.login(SomeFile.java:12)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1138)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1022)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1020)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1019)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)\nsun.net.www.protocol.http.HttpURLConnection.access$200(HttpURLConnection.java:91)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1466)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1464)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1463)\nsun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)\nservlet.ArgentoDemoApp$GenericExecution._executeServletCommand(ArgentoDemoApp.java:850)\nservlet.ArgentoDemoApp$GenericExecution.executeServletCommand(ArgentoDemoApp.java:778)\nservlet.ArgentoDemoApp$MyApplicationExecution.executeServletCommand(ArgentoDemoApp.java:718)\nservlet.ArgentoDemoApp._doGet(ArgentoDemoApp.java:441)\nservlet.ArgentoDemoApp.doGet(ArgentoDemoApp.java:376)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:634)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:741)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\norg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\norg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)\norg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\norg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)\norg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)\norg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:745)\n","jvmId":"EEcommerce_MS_NODE","maliciousIpSource":"","webTransactionUrl":"https://localhost:8088/argentoDemoApp/execute?upload=https://www.cisco.com/c/dam/cdc/t/ctm-core.js","clientAddressType":4,"clientAddress":"218.132.217.179","serverPort":"1047","serverAddress":"75.155.150.130","clientPort":"68389","serverName":"/usr/src/argento/prod/demo-run/tomcat-demo-app/webapps/argentoDemoApp/","vulnerabilityInfo":{"cvePublishDate":"2020-07-15T16:40:14.601976Z","cvssScore":5.3,"cvssSeverity":"MEDIUM","cveNvdUrl":"https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-584427","incidentFirstDetected":"2020-07-15T16:40:14.601976Z","kennaScore":53.0971,"library":"org.apache.tomcat.embed:tomcat-embed-core","title":"Denial of Service (DoS)","type":"java","kennaActiveInternetBreach":false,"kennaEasilyExploitable":false,"kennaMalwareExploitable":false,"kennaPredictedExploitable":true,"kennaPopularTarget":false}}]}'

‎data_sources/windows_event_log_application_15457.yml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Windows Event Log Application 15457
2+
id: 4491537e-520c-46f7-9209-f56f852aa237
3+
version: 1
4+
date: '2025-03-04'
5+
author: Michael Haag, Splunk
6+
description: Data source object for Windows Event Log Application 15457
7+
source: XmlWinEventLog:Application
8+
sourcetype: XmlWinEventLog
9+
separator: EventCode
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- CategoryString
16+
- Channel
17+
- Computer
18+
- Error_Code
19+
- EventCode
20+
- EventData_Xml
21+
- EventID
22+
- EventRecordID
23+
- Guid
24+
- Image_File_Name
25+
- Keywords
26+
- Level
27+
- Name
28+
- Opcode
29+
- ProcessID
30+
- Qualifiers
31+
- RecordNumber
32+
- RenderingInfo_Xml
33+
- SourceName
34+
- SubStatus
35+
- SystemTime
36+
- System_Props_Xml
37+
- Task
38+
- TaskCategory
39+
- ThreadID
40+
- UserData_Xml
41+
- UserID
42+
- Version
43+
- _bkt
44+
- _cd
45+
- _eventtype_color
46+
- _indextime
47+
- _raw
48+
- _serial
49+
- _si
50+
- _sourcetype
51+
- _subsecond
52+
- _time
53+
- action
54+
- category
55+
- date_hour
56+
- date_mday
57+
- date_minute
58+
- date_month
59+
- date_second
60+
- date_wday
61+
- date_year
62+
- date_zone
63+
- dest
64+
- dvc
65+
- dvc_nt_host
66+
- event_id
67+
- eventtype
68+
- host
69+
- id
70+
- index
71+
- linecount
72+
- name
73+
- parent_process
74+
- process_name
75+
- punct
76+
- result
77+
- service
78+
- service_id
79+
- service_name
80+
- severity
81+
- severity_id
82+
- signature
83+
- signature_id
84+
- source
85+
- sourcetype
86+
- splunk_server
87+
- splunk_server_group
88+
- status
89+
- subject
90+
- tag
91+
- tag::action
92+
- tag::eventtype
93+
- timeendpos
94+
- timestartpos
95+
- user_group_id
96+
- user_id
97+
- vendor_product
98+
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='MSSQLSERVER'/><EventID Qualifiers='16384'>15457</EventID><Version>0</Version><Level>4</Level><Task>2</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-02-04T19:46:19.5339693Z'/><EventRecordID>15827</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>ar-win-2.attackrange.local</Computer><Security/></System><EventData><Data>show advanced options</Data><Data>1</Data><Data>0</Data><Binary>613C00000A00000009000000610072002D00770069006E002D0032000000070000006D00610073007400650072000000</Binary></EventData></Event>
99+

‎data_sources/windows_event_log_application_17135.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Windows Event Log Application 17135
2+
id: 4491537e-520c-46f7-9209-f56f852aa231
3+
version: 1
4+
date: '2025-02-26'
5+
author: Michael Haag, Splunk
6+
description: Data source object for Windows Event Log Application 17135
7+
source: XmlWinEventLog:Application
8+
sourcetype: XmlWinEventLog
9+
separator: EventCode
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- CategoryString
16+
- Channel
17+
- Computer
18+
- Error_Code
19+
- EventCode
20+
- EventData_Xml
21+
- EventID
22+
- EventRecordID
23+
- Image_File_Name
24+
- Keywords
25+
- Level
26+
- Name
27+
- Opcode
28+
- ProcessID
29+
- Qualifiers
30+
- RecordNumber
31+
- RenderingInfo_Xml
32+
- SourceName
33+
- SubStatus
34+
- SystemTime
35+
- System_Props_Xml
36+
- Task
37+
- TaskCategory
38+
- ThreadID
39+
- Version
40+
- _bkt
41+
- _cd
42+
- _eventtype_color
43+
- _indextime
44+
- _raw
45+
- _serial
46+
- _si
47+
- _sourcetype
48+
- _subsecond
49+
- _time
50+
- action
51+
- category
52+
- date_hour
53+
- date_mday
54+
- date_minute
55+
- date_month
56+
- date_second
57+
- date_wday
58+
- date_year
59+
- date_zone
60+
- dest
61+
- dvc
62+
- dvc_nt_host
63+
- event_id
64+
- eventtype
65+
- host
66+
- id
67+
- index
68+
- linecount
69+
- name
70+
- parent_process
71+
- process_name
72+
- punct
73+
- result
74+
- service
75+
- service_id
76+
- service_name
77+
- severity
78+
- severity_id
79+
- signature
80+
- signature_id
81+
- source
82+
- sourcetype
83+
- splunk_server
84+
- splunk_server_group
85+
- status
86+
- subject
87+
- tag
88+
- tag::action
89+
- tag::eventtype
90+
- timeendpos
91+
- timestartpos
92+
- user_group_id
93+
- user_id
94+
- vendor_product
95+
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='MSSQLSERVER'/><EventID Qualifiers='16384'>17135</EventID><Version>0</Version><Level>4</Level><Task>2</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-02-10T16:38:42.6969829Z'/><EventRecordID>16509</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>ar-win-2.attackrange.local</Computer><Security/></System><EventData><Data>sp_add_sysadmin</Data><Binary>EF4200000A00000009000000610072002D00770069006E002D0032000000070000006D00610073007400650072000000</Binary></EventData></Event>
96+

‎data_sources/windows_event_log_application_8128.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Windows Event Log Application 8128
2+
id: 4491537e-5e0c-46f7-9209-f56f852aa237
3+
version: 1
4+
date: '2025-02-26'
5+
author: Michael Haag, Splunk
6+
description: Data source object for Windows Event Log Application 8128
7+
source: XmlWinEventLog:Application
8+
sourcetype: XmlWinEventLog
9+
separator: EventCode
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- CategoryString
16+
- Channel
17+
- Computer
18+
- Error_Code
19+
- EventCode
20+
- EventData_Xml
21+
- EventID
22+
- EventRecordID
23+
- EventSourceName
24+
- Guid
25+
- Image_File_Name
26+
- Keywords
27+
- Level
28+
- Name
29+
- Opcode
30+
- ProcessID
31+
- Qualifiers
32+
- RecordNumber
33+
- RenderingInfo_Xml
34+
- SourceName
35+
- SubStatus
36+
- SystemTime
37+
- System_Props_Xml
38+
- Task
39+
- TaskCategory
40+
- ThreadID
41+
- UserID
42+
- Version
43+
- _bkt
44+
- _cd
45+
- _eventtype_color
46+
- _indextime
47+
- _raw
48+
- _serial
49+
- _si
50+
- _sourcetype
51+
- _time
52+
- action
53+
- category
54+
- dest
55+
- dvc
56+
- dvc_nt_host
57+
- event_id
58+
- eventtype
59+
- host
60+
- id
61+
- index
62+
- linecount
63+
- name
64+
- parent_process
65+
- process_name
66+
- punct
67+
- result
68+
- service
69+
- service_id
70+
- service_name
71+
- severity
72+
- severity_id
73+
- signature
74+
- signature_id
75+
- source
76+
- sourcetype
77+
- splunk_server
78+
- splunk_server_group
79+
- status
80+
- subject
81+
- tag
82+
- tag::action
83+
- tag::eventtype
84+
- user_group_id
85+
- user_id
86+
- vendor_product
87+
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='MSSQLSERVER'/><EventID Qualifiers='16384'>8128</EventID><Version>0</Version><Level>4</Level><Task>2</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-02-10T20:03:14.2006851Z'/><EventRecordID>16635</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>ar-win-2.attackrange.local</Computer><Security/></System><EventData><Data>odsole70.dll</Data><Data>2022.160.1000</Data><Data>sp_OACreate</Data><Binary>C01F00000A00000009000000610072002D00770069006E002D0032000000050000006D007300640062000000</Binary></EventData></Event>
88+

‎detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,4 +83,4 @@ tests:
8383
sourcetype: o365:management:activity
8484
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events.log
8585
source: o365_messagetrace
86-
sourcetype: o365:reporting:messagetrace
86+
sourcetype: o365:reporting:messagetrace

0 commit comments

Comments
 (0)