Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add missing summariesonly macro #3168

Draft
wants to merge 7 commits into
base: develop
Choose a base branch
from
Draft

add missing summariesonly macro #3168

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d027d55
add missing summariesonly macro.
pyth0n1c Oct 18, 2024
cb063f8
Branch was auto-updated.
patel-bhavin Oct 22, 2024
5a3e0bc
Branch was auto-updated.
patel-bhavin Oct 22, 2024
6e33664
fix names for time fields and add count
pyth0n1c Oct 22, 2024
c32080d
Branch was auto-updated.
patel-bhavin Oct 23, 2024
0c44f8e
Branch was auto-updated.
patel-bhavin Oct 23, 2024
8c9f561
Branch was auto-updated.
patel-bhavin Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions detections/network/detect_outbound_ldap_traffic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,12 @@ description: The following analytic identifies outbound LDAP traffic to external
network compromise.
data_source:
- Bro
search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip)
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_ip)
as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port
= 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR
All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip
All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip
| `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
|`detect_outbound_ldap_traffic_filter`'
how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. The search requires the Network_Traffic data model to be populated.
known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
Expand Down