Closed josehelps closed 3 years ago
@d1vious awesome, much appreciated! We'll review and let you know if any changes need to be made.
@d1vious this looks awesome. A few things I noticed:
id
is hard-coded to a value of analytics
, when it should be the ID of the CAR analytic (e.g., CAR-2021-05-001
).bits_job_persistence_filter
. Let us know if there's anything we can do to help in this regard.@d1vious this looks awesome. A few things I noticed:
* `id` is hard-coded to a value of `analytics`, when it should be the ID of the CAR analytic (e.g., `CAR-2021-05-001`). * There's probably a bit of clean-up we can do to make the SPL queries more generic, since they still contain things like `bits_job_persistence_filter`. Let us know if there's anything we can do to help in this regard.
Ah, I can clean up the SPL a bit automatically so it removes the macros thank you for reminding me, also let me fix up that id issue, sounds like a fat finger on my end. If you see anything else wrong let me know happy to clean things up further.
Sounds great! Yeah I think if we can clean up the macros, it would make the SPL much more generalizable.
@ikiril01 just updated the PR, removed all the unnecessary macros, and updated the code base to do this as well. Also found a bug with how I was calculated the ID which I fixed. Let me know if you find any other inconsistencies. Cheers 😄
Ok @d1vious , this looks pretty good. I'm merging this in; I will add in the CAR data-model pseudocode implementations afterwards. In some cases I will add descriptions as well, where they are missing. Thanks!
Thank you so much for merging @pcmcpherson! Quick question to get https://car.mitre.org/coverage/ updated with a column for splunk would I have to create another PR for https://github.com/mitre-attack/car/blob/master/docs/coverage/index.md ?
@ikiril01 from our earlier conversation, attached is a PR with the following detections from [Splunk Security Content]():
to CAR analytics yml format, I did this via a script called
splunk_security_content_to_car.py
I added under scripts/I am sure I made mistakes along the way please let me know what modifications the generated output might need. Thank you again for your help!