Skip to content

Commit d3deda8

Browse files
pyth0n1cpyth0n1c
authored
Merge branch 'develop' into aws_to_ttp
2 parents a182c8c + 46c079b commit d3deda8

File tree

39 files changed

+2112
-1601
lines changed

39 files changed

+2112
-1601
lines changed

‎contentctl.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -167,9 +167,9 @@ apps:
167167
- uid: 4055
168168
title: Splunk Add-on for Microsoft Office 365
169169
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
170-
version: 4.8.0
170+
version: 4.8.1
171171
description: description of app
172-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_480.tgz
172+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_481.tgz
173173
- uid: 2890
174174
title: Splunk Machine Learning Toolkit
175175
appid: SPLUNK_MACHINE_LEARNING_TOOLKIT
@@ -221,8 +221,8 @@ apps:
221221
- uid: 3471
222222
title: Splunk Add-on for AppDynamics
223223
appid: Splunk_TA_AppDynamics
224-
version: 3.1.2
224+
version: 3.1.3
225225
description: The Splunk Add-on for AppDynamics enables you to easily configure data
226226
inputs to pull data from AppDynamics' REST APIs
227-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_312.tgz
227+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-splunk-add-on-for-appdynamics_313.tgz
228228
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd

‎data_sources/cisco_secure_application_appdynamics_alerts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ sourcetype: appdynamics_security
99
supported_TA:
1010
- name: Splunk Add-on for AppDynamics
1111
url: https://splunkbase.splunk.com/app/3471
12-
version: 3.1.2
12+
version: 3.1.3
1313
fields:
1414
- SourceType
1515
- apiServerExternal

‎data_sources/cisco_secure_firewall_threat_defense_connection_event.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco Secure Firewall Threat Defense Connection Event
22
id: 18878597-8f8a-4bca-a805-bfbe35e00032
3-
version: 1
4-
date: '2025-04-01'
3+
version: 2
4+
date: '2025-05-22'
55
author: Nasreddine Bencherchali, Splunk
66
description: Data source object for raw connection events from Cisco Secure Firewall
77
Threat Defense
@@ -114,7 +114,6 @@ output_fields:
114114
- dest_port
115115
- transport
116116
- rule
117-
- url
118117
- action
119118
example_log: '{"EventType":"ConnectionEvent", "FirstPacketSecond":1743500734, "DeviceUUID":"11bc8e94-f604-11ef-bcfe-eeb1de9c8a63",
120119
"InstanceID":1, "ConnectionID":259, "AC_RuleAction":"Block", "InitiatorIP":"172.16.3.110",

‎data_sources/o365.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@ source: o365
1515
sourcetype: o365:management:activity
1616
separator: Operation
1717
supported_TA:
18-
- name: Splunk Add-on for Microsoft Office 365
19-
url: https://splunkbase.splunk.com/app/4055
20-
version: 4.8.0
18+
- name: Splunk Add-on for Microsoft Office 365
19+
url: https://splunkbase.splunk.com/app/4055
20+
version: 4.8.1

‎data_sources/o365_add_app_role_assignment_grant_to_user_.yml‎

Lines changed: 78 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -15,81 +15,80 @@ sourcetype: o365:management:activity
1515
separator: Operation
1616
separator_value: Add app role assignment grant to user.
1717
supported_TA:
18-
- name: Splunk Add-on for Microsoft Office 365
19-
url: https://splunkbase.splunk.com/app/4055
20-
version: 4.8.0
18+
- name: Splunk Add-on for Microsoft Office 365
19+
url: https://splunkbase.splunk.com/app/4055
20+
version: 4.8.1
2121
fields:
22-
- _time
23-
- ActorContextId
24-
- ActorIpAddress
25-
- Actor{}.ID
26-
- Actor{}.Type
27-
- AzureActiveDirectoryEventType
28-
- ClientIP
29-
- CreationTime
30-
- ExtendedProperties{}.Name
31-
- ExtendedProperties{}.Value
32-
- Id
33-
- InterSystemsId
34-
- IntraSystemId
35-
- ModifiedProperties{}.Name
36-
- ModifiedProperties{}.NewValue
37-
- ModifiedProperties{}.OldValue
38-
- ObjectId
39-
- Operation
40-
- OrganizationId
41-
- RecordType
42-
- ResultStatus
43-
- SupportTicketId
44-
- TargetContextId
45-
- Target{}.ID
46-
- Target{}.Type
47-
- UserId
48-
- UserKey
49-
- UserType
50-
- Version
51-
- Workload
52-
- additionalDetails
53-
- app
54-
- authentication_service
55-
- command
56-
- date_hour
57-
- date_mday
58-
- date_minute
59-
- date_month
60-
- date_second
61-
- date_wday
62-
- date_year
63-
- date_zone
64-
- dest
65-
- dest_name
66-
- dvc
67-
- event_type
68-
- extendedAuditEventCategory
69-
- extended_properties
70-
- host
71-
- index
72-
- linecount
73-
- object
74-
- punct
75-
- record_type
76-
- signature
77-
- source
78-
- sourcetype
79-
- splunk_server
80-
- src
81-
- src_ip
82-
- src_user
83-
- status
84-
- timeendpos
85-
- timestartpos
86-
- user
87-
- user_id
88-
- user_type
89-
- vendor_account
90-
- vendor_product
91-
example_log:
92-
'{"Actor": [{"ID": "[email protected]", "Type": 5}, {"ID":
22+
- _time
23+
- ActorContextId
24+
- ActorIpAddress
25+
- Actor{}.ID
26+
- Actor{}.Type
27+
- AzureActiveDirectoryEventType
28+
- ClientIP
29+
- CreationTime
30+
- ExtendedProperties{}.Name
31+
- ExtendedProperties{}.Value
32+
- Id
33+
- InterSystemsId
34+
- IntraSystemId
35+
- ModifiedProperties{}.Name
36+
- ModifiedProperties{}.NewValue
37+
- ModifiedProperties{}.OldValue
38+
- ObjectId
39+
- Operation
40+
- OrganizationId
41+
- RecordType
42+
- ResultStatus
43+
- SupportTicketId
44+
- TargetContextId
45+
- Target{}.ID
46+
- Target{}.Type
47+
- UserId
48+
- UserKey
49+
- UserType
50+
- Version
51+
- Workload
52+
- additionalDetails
53+
- app
54+
- authentication_service
55+
- command
56+
- date_hour
57+
- date_mday
58+
- date_minute
59+
- date_month
60+
- date_second
61+
- date_wday
62+
- date_year
63+
- date_zone
64+
- dest
65+
- dest_name
66+
- dvc
67+
- event_type
68+
- extendedAuditEventCategory
69+
- extended_properties
70+
- host
71+
- index
72+
- linecount
73+
- object
74+
- punct
75+
- record_type
76+
- signature
77+
- source
78+
- sourcetype
79+
- splunk_server
80+
- src
81+
- src_ip
82+
- src_user
83+
- status
84+
- timeendpos
85+
- timestartpos
86+
- user
87+
- user_id
88+
- user_type
89+
- vendor_account
90+
- vendor_product
91+
example_log: '{"Actor": [{"ID": "[email protected]", "Type": 5}, {"ID":
9392
"10037FFEA938FB92", "Type": 3}, {"ID": "74658136-14ec-4630-ad9b-26e160ff0fc6", "Type":
9493
2}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
9594
"Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
@@ -115,8 +114,8 @@ example_log:
115114
"[email protected]", "UserKey": "[email protected]",
116115
"UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}'
117116
output_fields:
118-
- dest
119-
- user
120-
- src
121-
- vendor_account
122-
- vendor_product
117+
- dest
118+
- user
119+
- src
120+
- vendor_account
121+
- vendor_product

‎data_sources/o365_add_app_role_assignment_to_service_principal_.yml‎

Lines changed: 77 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -16,80 +16,79 @@ sourcetype: o365:management:activity
1616
separator: Operation
1717
separator_value: Add app role assignment to service principal.
1818
supported_TA:
19-
- name: Splunk Add-on for Microsoft Office 365
20-
url: https://splunkbase.splunk.com/app/4055
21-
version: 4.8.0
19+
- name: Splunk Add-on for Microsoft Office 365
20+
url: https://splunkbase.splunk.com/app/4055
21+
version: 4.8.1
2222
fields:
23-
- _time
24-
- ActorContextId
25-
- Actor{}.ID
26-
- Actor{}.Type
27-
- AzureActiveDirectoryEventType
28-
- CreationTime
29-
- ExtendedProperties{}.Name
30-
- ExtendedProperties{}.Value
31-
- Id
32-
- InterSystemsId
33-
- IntraSystemId
34-
- ModifiedProperties{}.Name
35-
- ModifiedProperties{}.NewValue
36-
- ModifiedProperties{}.OldValue
37-
- ObjectId
38-
- Operation
39-
- OrganizationId
40-
- RecordType
41-
- ResultStatus
42-
- SupportTicketId
43-
- TargetContextId
44-
- Target{}.ID
45-
- Target{}.Type
46-
- UserId
47-
- UserKey
48-
- UserType
49-
- Version
50-
- Workload
51-
- additionalDetails
52-
- app
53-
- authentication_service
54-
- command
55-
- date_hour
56-
- date_mday
57-
- date_minute
58-
- date_month
59-
- date_second
60-
- date_wday
61-
- date_year
62-
- date_zone
63-
- dest
64-
- dest_name
65-
- dvc
66-
- event_type
67-
- eventtype
68-
- extendedAuditEventCategory
69-
- host
70-
- index
71-
- linecount
72-
- object
73-
- punct
74-
- record_type
75-
- signature
76-
- source
77-
- sourcetype
78-
- splunk_server
79-
- status
80-
- tag
81-
- tag::eventtype
82-
- timeendpos
83-
- timestartpos
84-
- user
85-
- user_agent
86-
- user_agent_change
87-
- user_id
88-
- user_type
89-
- vendor_account
90-
- vendor_product
91-
example_log:
92-
'{"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1-b4fa-778fb05c43ac",
23+
- _time
24+
- ActorContextId
25+
- Actor{}.ID
26+
- Actor{}.Type
27+
- AzureActiveDirectoryEventType
28+
- CreationTime
29+
- ExtendedProperties{}.Name
30+
- ExtendedProperties{}.Value
31+
- Id
32+
- InterSystemsId
33+
- IntraSystemId
34+
- ModifiedProperties{}.Name
35+
- ModifiedProperties{}.NewValue
36+
- ModifiedProperties{}.OldValue
37+
- ObjectId
38+
- Operation
39+
- OrganizationId
40+
- RecordType
41+
- ResultStatus
42+
- SupportTicketId
43+
- TargetContextId
44+
- Target{}.ID
45+
- Target{}.Type
46+
- UserId
47+
- UserKey
48+
- UserType
49+
- Version
50+
- Workload
51+
- additionalDetails
52+
- app
53+
- authentication_service
54+
- command
55+
- date_hour
56+
- date_mday
57+
- date_minute
58+
- date_month
59+
- date_second
60+
- date_wday
61+
- date_year
62+
- date_zone
63+
- dest
64+
- dest_name
65+
- dvc
66+
- event_type
67+
- eventtype
68+
- extendedAuditEventCategory
69+
- host
70+
- index
71+
- linecount
72+
- object
73+
- punct
74+
- record_type
75+
- signature
76+
- source
77+
- sourcetype
78+
- splunk_server
79+
- status
80+
- tag
81+
- tag::eventtype
82+
- timeendpos
83+
- timestartpos
84+
- user
85+
- user_agent
86+
- user_agent_change
87+
- user_id
88+
- user_type
89+
- vendor_account
90+
- vendor_product
91+
example_log: '{"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1-b4fa-778fb05c43ac",
9392
"Operation": "Add app role assignment to service principal.", "OrganizationId":
9493
"75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success",
9594
"UserKey": "Not Available", "UserType": 4, "Version": 1, "Workload": "AzureActiveDirectory",
@@ -121,8 +120,8 @@ example_log:
121120
"Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com",
122121
"Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}'
123122
output_fields:
124-
- dest
125-
- user
126-
- src
127-
- vendor_account
128-
- vendor_product
123+
- dest
124+
- user
125+
- src
126+
- vendor_account
127+
- vendor_product

0 commit comments

Comments
 (0)