search

splunk / security_content

Splunk Security Content
https://research.splunk.com
Apache License 2.0
1.29k stars 359 forks source link

TR-2335: Use of Incident Response/Review compatible fields in Correlation Searches #2319

Open beano500 opened 2 years ago

beano500 commented 2 years ago

A few of the use cases (e.g. "Detect Mimikatz With PowerShell Script Block Logging") generate fields in the notable events that are not compatible with the default configuration of Incident Response / Asset Enrichment (UserID) in this case.

If I have asset enrichment enabled, and the field that identifies a user is, for example, "user" - then within Incident Response fields like user_email, user_bunit, etc. are also pulled through - as they have been defined in "Incident Review - Event Attributes"

If a field of a different name is used, for example, "UserID", then these fields are not pulled through (and would have to be manually defined as an "Incident Review - Event Attributes"

Also the identity enrichment macro "get_identity4events()" currently reports that it only supports the field names - user, src_user, host_owner, orig_host_owner, src_owner, dest_owner, or dvc_owner. So I am not sure if UserID would work.

Consistency in naming fields across the whole of ESCU would be good, and I would suggest adopting some of the CIM based names would be good.

Many thanks Simon

ljstella commented 2 years ago

Update: We're aware of this issue, and have been for some time but are still determining the best route forward for revisiting every single search that's included as part of ESCU.