Merge pull request #278 from splunk/CRL-1700_ES_macros

CRL_1700 ES Macros

Author: patel-bhavin

baselines/baseline_network_acl_modifications.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: sourcetype=aws:cloudtrail `NetworkACLEvents` | spath output=arn path=userIdentity.arn
+    search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn
       | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
       as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
       stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
@@ -31,7 +31,7 @@ eli5: Use this search to create a baseline for API calls related to network ACLs
   This table is stored in a lookup file.
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove API event names for network ACLs, edit the macro `NetworkACLEvents`.
+  inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
 id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
 known_false_positives: ''
 maintainers:

baselines/baseline_security_group_activity_by_arn.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -90d@d
       latest_time: -10m@m
-    search: sourcetype=aws:cloudtrail `securityGroupAPIs` | spath output=arn path=userIdentity.arn
+    search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn
       | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
       as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
       stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
@@ -31,7 +31,7 @@ eli5: Use this search to create a baseline for API calls related to security gro
   of data points for each ARN. This table is stored in a lookup file.
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
   and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
-  inputs. To add or remove API event names for security groups, edit the macro `securityGroupAPIs`.
+  inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
 id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
 known_false_positives: ''
 maintainers:

baselines/discover_dns_records.yml

@@ -6,7 +6,7 @@ baseline:
       latest_time: -10m@m
     search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T
       cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv |
-      eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats summariesonly=true
+      eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly`
       count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution
       where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query
       | rename DNS.query as query | where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"]

baselines/identify_ports_on_network.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: '| tstats `summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts
+    search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts
       from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
       | sort - count'
 creation_date: '2017-06-24'

baselines/identify_systems_creating_rdp_traffic.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: '| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389
+    search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389
       by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count'
 creation_date: '2017-04-24'
 data_metadata:

baselines/identify_systems_receiving_rdp_traffic.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: '| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389
+    search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389
       by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count'
 creation_date: '2017-04-24'
 data_metadata:

baselines/identify_systems_using_remote_desktop.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: '| tstats `summariesonly` count from datamodel=Endpoint.Processes where
+    search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where
       Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name
       | `drop_dm_object_name(Processes)` | sort - count'
 creation_date: '2017-04-18'

baselines/monitor_successful_windows_updates.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: '| tstats `summariesonly` dc(Updates.dest) as count FROM datamodel=Updates
+    search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates
       where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed
       by _time span=1d'
 creation_date: '2017-08-24'

baselines/monitor_unsuccessful_windows_updates.yml

@@ -4,7 +4,7 @@ baseline:
       cron_schedule: ''
       earliest_time: -30d@d
       latest_time: -10m@m
-    search: '| tstats `summariesonly` dc(Updates.dest) as count FROM datamodel=Updates
+    search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates
       where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure
       by _time span=1d'
 creation_date: '2017-08-24'

baselines/previously_seen_aws_users.yml

@@ -6,7 +6,7 @@ baseline:
       latest_time: -10m@m
     search: sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn
       as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region
-      LIKE "",src,Region) | stats earliest(_time) as earliest latest(_time) as latest
+      LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime
       by user src City Region Country | outputlookup previously_seen_users_console_logins.csv
       | stats count
 creation_date: '2018-02-23'