more fixes

Author: nasbench

detections/network/detect_outbound_smb_traffic.yml

@@ -14,7 +14,6 @@ description: The following analytic detects outbound SMB (Server Message Block)
   this activity could lead to unauthorized access to sensitive data and potential
   full system compromise.
 data_source:
-- Zeek Conn
 - Cisco Secure Firewall Threat Defense Connection Event
 search: |
   | tstats `security_content_summariesonly` 
@@ -94,11 +93,6 @@ tags:
   - Splunk Cloud
   security_domain: network
 tests:
-- name: Zeek True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.002/outbound_smb_traffic/zeek_conn.log
-    sourcetype: bro:conn:json
-    source: conn.log
 - name: Cisco Secure Firewall True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log

detections/network/prohibited_network_traffic_allowed.yml

@@ -1,7 +1,7 @@
 name: Prohibited Network Traffic Allowed
 id: ce5a0962-849f-4720-a678-753fe6674479
-version: 8
-date: '2025-05-27'
+version: 9
+date: '2025-06-17'
 author: Rico Valdez, Splunk
 status: production
 type: TTP
@@ -14,7 +14,6 @@ description: The following analytic detects instances where network traffic, ide
   allow attackers to bypass network defenses, leading to potential data breaches and
   compromising the organization's security posture.
 data_source:
-- Zeek Conn
 - Cisco Secure Firewall Threat Defense Connection Event
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Network_Traffic where All_Traffic.action IN ("allowed", "allow") by
@@ -28,7 +27,7 @@ how_to_implement: In order to properly run this search, Splunk needs to ingest d
   into an environment. This is necessary so that the search can identify an 'action'
   taken on the traffic of interest. The search requires the Network_Traffic data model
   be populated.
-known_false_positives: None identified
+known_false_positives: Unknown
 references: []
 drilldown_searches:
 - name: View the detection results for - "$src_ip$"
@@ -67,13 +66,8 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   security_domain: network
-  manual_test: This detection uses builtin lookup from Enterprise Security.
+  manual_test: This detection uses a builtin lookup from Enterprise Security.
 tests:
-- name: Zeek Conn True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048/ftp_connection/zeek_conn.log
-    sourcetype: bro:conn:json
-    source: conn.log
 - name: Cisco Secure Firewall True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log