Splunk ES Content Update
Overview
Details
Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.
The analytic stories and their searches are also available at https://github.com/splunk/security-content.
For more information please visit the Splunk ES Content Update user documentation.
Release Notes
Version 3.0.3
New search "AWS Investigate Security Hub alerts by dest" that leverages Security Hub alerts for investigation/response
Updated the detection searches AWS related stories with AWS Mitre Mappings where applicable:
- Suspicious AWS EC2 Activities
- AWS Suspicious Provisioning Activities
- AWS Cross Account Activity
- Cloud Cryptomining
- AWS User Monitoring
- Suspicious Cloud Authentication Activities
- Suspicious AWS Login Activities
- Suspicious AWS S3 Activities
- Unusual AWS EC2 Modifications
- Container Implantation Monitoring and Investigation
Updated analytic stories with new detection searches:
- Kubernetes Sensitive Role Activity
- Kubernetes Sensitive Object Access Activity
Fixed Issues:
- Updated Creation of Shadow Copy with wmic and powershell to use Endpoint Datamodel
Full documentation: https://docs.splunk.com/Documentation/ESSOC/3.0.3