Skip to content

Commit 6b6efd6

Browse files
P4T12ICKP4T12ICK
authored
Merge pull request #3357 from splunk/add_Data_source
Add data source objects
2 parents a3f20ac + 2fd6a8f commit 6b6efd6

File tree

66 files changed

+2103
-399
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+2103
-399
lines changed

‎data_sources/aws_cloudtrail_deleteloggingconfiguration.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: AWS CloudTrail DeleteLoggingConfiguration
2+
id: 24a28726-28f3-4537-a953-71bfbbc3b831
3+
version: 1
4+
date: '2025-02-21'
5+
author: Bhavin Patel, Splunk
6+
description: Data source object for AWS CloudTrail DeleteLoggingConfiguration
7+
source: aws_cloudtrail
8+
sourcetype: aws:cloudtrail
9+
separator: eventName
10+
supported_TA:
11+
- name: Splunk Add-on for AWS
12+
url: https://splunkbase.splunk.com/app/1876
13+
version: 7.9.0
14+
fields:
15+
- _time
16+
example_log: |-

‎data_sources/aws_cloudtrail_deleterulegroup.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: AWS CloudTrail DeleteRuleGroup
2+
id: 21c9b538-fa11-4bdf-9138-0dfe06b4d730
3+
version: 1
4+
date: '2025-02-21'
5+
author: Bhavin Patel, Splunk
6+
description: Data source object for AWS CloudTrail DeleteRuleGroup
7+
source: aws_cloudtrail
8+
sourcetype: aws:cloudtrail
9+
separator: eventName
10+
supported_TA:
11+
- name: Splunk Add-on for AWS
12+
url: https://splunkbase.splunk.com/app/1876
13+
version: 7.9.0
14+
fields:
15+
- _time
16+
example_log: |-

‎data_sources/aws_cloudtrail_describesnapshotattribute.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: AWS CloudTrail DescribeSnapshotAttribute
2+
id: f054c99b-63b8-4236-8a62-b52fbbabacba
3+
version: 1
4+
date: '2025-02-21'
5+
author: Bhavin Patel, Splunk
6+
description: Data source object for AWS CloudTrail DescribeSnapshotAttribute
7+
source: aws_cloudtrail
8+
sourcetype: aws:cloudtrail
9+
separator: eventName
10+
supported_TA:
11+
- name: Splunk Add-on for AWS
12+
url: https://splunkbase.splunk.com/app/1876
13+
version: 7.9.0
14+
fields:
15+
- action
16+
- app
17+
- authentication_method
18+
- awsRegion
19+
- aws_account_id
20+
- change_type
21+
- command
22+
- date_hour
23+
- date_mday
24+
- date_minute
25+
- date_month
26+
- date_second
27+
- date_wday
28+
- date_year
29+
- date_zone
30+
- desc
31+
- dest
32+
- dest_ip_range
33+
- dest_port_range
34+
- direction
35+
- dvc
36+
- errorCode
37+
- errorMessage
38+
- eventCategory
39+
- eventID
40+
- eventName
41+
- eventSource
42+
- eventTime
43+
- eventType
44+
- eventVersion
45+
- eventtype
46+
- host
47+
- image_id
48+
- index
49+
- instance_type
50+
- linecount
51+
- managementEvent
52+
- msg
53+
- object
54+
- object_attrs
55+
- object_category
56+
- object_id
57+
- product
58+
- protocol
59+
- protocol_code
60+
- punct
61+
- readOnly
62+
- reason
63+
- recipientAccountId
64+
- region
65+
- requestID
66+
- requestParameters.attributeType
67+
- requestParameters.snapshotId
68+
- responseElements
69+
- result
70+
- result_id
71+
- rule_action
72+
- signature
73+
- source
74+
- sourceIPAddress
75+
- sourcetype
76+
- splunk_server
77+
- splunk_server_group
78+
- src
79+
- src_ip
80+
- src_ip_range
81+
- src_port_range
82+
- src_user
83+
- src_user_id
84+
- src_user_name
85+
- src_user_role
86+
- src_user_type
87+
- start_time
88+
- status
89+
- tag
90+
- tag::action
91+
- tag::app
92+
- tag::eventtype
93+
- tag::object_category
94+
- temp_access_key
95+
- timeendpos
96+
- timestartpos
97+
- tlsDetails.cipherSuite
98+
- tlsDetails.clientProvidedHostHeader
99+
- tlsDetails.tlsVersion
100+
- user
101+
- userAgent
102+
- userIdentity.accessKeyId
103+
- userIdentity.accountId
104+
- userIdentity.arn
105+
- userIdentity.principalId
106+
- userIdentity.sessionContext.attributes.creationDate
107+
- userIdentity.sessionContext.attributes.mfaAuthenticated
108+
- userIdentity.sessionContext.sessionIssuer.accountId
109+
- userIdentity.sessionContext.sessionIssuer.arn
110+
- userIdentity.sessionContext.sessionIssuer.principalId
111+
- userIdentity.sessionContext.sessionIssuer.type
112+
- userIdentity.sessionContext.sessionIssuer.userName
113+
- userIdentity.type
114+
- userName
115+
- user_access_key
116+
- user_agent
117+
- user_arn
118+
- user_group_id
119+
- user_id
120+
- user_name
121+
- user_role
122+
- user_type
123+
- vendor
124+
- vendor_account
125+
- vendor_product
126+
- vendor_region
127+
- _bkt
128+
- _cd
129+
- _eventtype_color
130+
- _indextime
131+
- _raw
132+
- _serial
133+
- _si
134+
- _sourcetype
135+
- _time
136+
example_log: |-
137+
{"eventVersion": "1.10", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLBXYPYUKBH:aws-go-sdk-1740131590946446551", "arn": "arn:aws:sts::111111111111111:assumed-role/DAFTPUNK-cloud-security-audit/aws-go-sdk-1740131590946446551", "accountId": "111111111111111", "accessKeyId": "DAFTPUNK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLBXYPYUKBH", "arn": "arn:aws:iam::111111111111111:role/DAFTPUNK-cloud-security-audit", "accountId": "111111111111111", "userName": "DAFTPUNK-cloud-security-audit"}, "attributes": {"creationDate": "2025-02-21T10:48:43Z", "mfaAuthenticated": "false"}}}, "eventTime": "2025-02-21T11:29:27Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeSnapshotAttribute", "awsRegion": "eu-central-1", "sourceIPAddress": "54.203.114.197", "userAgent": "m/E aws-sdk-go-v2/1.30.5 os/linux lang/go#1.22.4 md/GOOS#linux md/GOARCH#amd64 api/ec2#1.177.3", "requestParameters": {"snapshotId": "snap-082bd5016636bbd94", "attributeType": "PRODUCT_CODES"}, "responseElements": null, "requestID": "70339070-6038-40b7-9acf-5ecb85cda843", "eventID": "bcc65c3f-a997-4a01-90bf-3b85f7268e70", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.eu-central-1.amazonaws.com"}}

‎data_sources/azure_active_directory_microsoftgraphactivitylogs.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Azure Active Directory MicrosoftGraphActivityLogs
2+
id: 63ff93ba-2bbb-4542-8773-239bf5266367
3+
version: 1
4+
date: '2025-02-21'
5+
author: Bhavin Patel, Splunk
6+
description: Data source object for Azure Active Directory MicrosoftGraphActivityLogs
7+
source: Azure AD
8+
sourcetype: azure:monitor:aad
9+
separator: operationName
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Cloud Services
12+
url: https://splunkbase.splunk.com/app/3110
13+
version: 5.4.2
14+
fields:
15+
- _time
16+
example_log: |-
17+
{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}

‎data_sources/azure_active_directory_noninteractiveusersigninlogs.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: Azure Active Directory NonInteractiveUserSignInLogs
2+
id: 11fe8a43-164d-47e4-b542-afc2f242068b
3+
version: 1
4+
date: '2025-02-21'
5+
author: Bhavin Patel, Splunk
6+
description: Data source object for Azure Active Directory NonInteractiveUserSignInLogs
7+
source: Azure AD
8+
sourcetype: azure:monitor:aad
9+
separator: operationName
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Cloud Services
12+
url: https://splunkbase.splunk.com/app/3110
13+
version: 5.4.2
14+
fields:
15+
- action
16+
- additional_details
17+
- app
18+
- authentication_method
19+
- authentication_service
20+
- callerIpAddress
21+
- category
22+
- change_type
23+
- command
24+
- correlationId
25+
- dataset_name
26+
- date_hour
27+
- date_mday
28+
- date_minute
29+
- date_month
30+
- date_second
31+
- date_wday
32+
- date_year
33+
- date_zone
34+
- description
35+
- dest
36+
- dest_type
37+
- duration
38+
- durationMs
39+
- dvc
40+
- enabled
41+
- eventtype
42+
- host
43+
- id
44+
- index
45+
- level
46+
- linecount
47+
- location
48+
- object
49+
- object_attrs
50+
- object_category
51+
- object_id
52+
- object_path
53+
- operationName
54+
- operationVersion
55+
- path_from_resourceId
56+
- properties.C_Iat
57+
- properties.C_Idtyp
58+
- properties.UserPrincipalObjectID
59+
- properties.__UDI_RequiredFields_EventTime
60+
- properties.__UDI_RequiredFields_RegionScope
61+
- properties.__UDI_RequiredFields_TenantId
62+
- properties.__UDI_RequiredFields_UniqueId
63+
- properties.apiVersion
64+
- properties.appId
65+
- properties.clientAuthMethod
66+
- properties.clientRequestId
67+
- properties.durationMs
68+
- properties.identityProvider
69+
- properties.ipAddress
70+
- properties.location
71+
- properties.operationId
72+
- properties.requestId
73+
- properties.requestMethod
74+
- properties.requestUri
75+
- properties.responseSizeBytes
76+
- properties.responseStatusCode
77+
- properties.resultReason
78+
- properties.roles
79+
- properties.scopes
80+
- properties.signInActivityId
81+
- properties.tenantId
82+
- properties.timeGenerated
83+
- properties.tokenIssuedAt
84+
- properties.userAgent
85+
- properties.userId
86+
- properties.wids
87+
- punct
88+
- reason
89+
- resourceId
90+
- response_time
91+
- result
92+
- resultSignature
93+
- result_id
94+
- severity
95+
- signature
96+
- signature_id
97+
- signinDateTime
98+
- source
99+
- sourcetype
100+
- splunk_server
101+
- splunk_server_group
102+
- src
103+
- src_ip
104+
- src_user
105+
- src_user_name
106+
- src_user_type
107+
- status
108+
- tag
109+
- tag::action
110+
- tag::app
111+
- tag::eventtype
112+
- tag::object_category
113+
- tenantId
114+
- time
115+
- timeendpos
116+
- timestartpos
117+
- user
118+
- user_agent
119+
- user_id
120+
- user_name
121+
- user_role
122+
- user_type
123+
- vendor_account
124+
- vendor_product
125+
- vendor_region
126+
- _bkt
127+
- _cd
128+
- _eventtype_color
129+
- _indextime
130+
- _raw
131+
- _serial
132+
- _si
133+
- _sourcetype
134+
- _subsecond
135+
- _time
136+
example_log: |-
137+
{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", "userPrincipalName": "[email protected]", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}

0 commit comments

Comments
 (0)