Skip to content

Commit cb07b5c

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into APT37
2 parents 29a1dde + 0bcb54b commit cb07b5c

File tree

182 files changed

+3824
-1095
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

182 files changed

+3824
-1095
lines changed

‎contentctl.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ app:
33
uid: 3449
44
title: ES Content Updates
55
appid: DA-ESS-ContentUpdate
6-
version: 5.14.0
6+
version: 5.16.0
77
description: Explore the Analytic Stories included with ES Content Updates.
88
prefix: ESCU
99
label: ESCU
@@ -38,15 +38,15 @@ apps:
3838
- uid: 6553
3939
title: Splunk Add-on for Okta Identity Cloud
4040
appid: Splunk_TA_okta_identity_cloud
41-
version: 4.0.0
41+
version: 4.1.0
4242
description: description of app
43-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_400.tgz
43+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-okta-identity-cloud_410.tgz
4444
- uid: 7404
4545
title: Cisco Security Cloud
4646
appid: CiscoSecurityCloud
47-
version: 3.4.1
47+
version: 3.4.2
4848
description: description of app
49-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_341.tgz
49+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_342.tgz
5050
- uid: 6652
5151
title: Add-on for Linux Sysmon
5252
appid: Splunk_TA_linux_sysmon
@@ -77,9 +77,9 @@ apps:
7777
- uid: 833
7878
title: Splunk Add-on for Unix and Linux
7979
appid: Splunk_TA_nix
80-
version: 10.1.0
80+
version: 10.2.0
8181
description: description of app
82-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_1010.tgz
82+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-unix-and-linux_1020.tgz
8383
- uid: 5579
8484
title: Splunk Add-on for CrowdStrike FDR
8585
appid: Splunk_TA_CrowdStrike_FDR
@@ -167,9 +167,9 @@ apps:
167167
- uid: 4055
168168
title: Splunk Add-on for Microsoft Office 365
169169
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
170-
version: 4.9.0
170+
version: 5.0.0
171171
description: description of app
172-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_490.tgz
172+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_500.tgz
173173
- uid: 2890
174174
title: Splunk Machine Learning Toolkit
175175
appid: SPLUNK_MACHINE_LEARNING_TOOLKIT
@@ -185,9 +185,9 @@ apps:
185185
- uid: 6207
186186
title: Splunk Add-on for Microsoft Security
187187
appid: Splunk_TA_MS_Security
188-
version: 2.5.4
188+
version: 2.6.0
189189
description: description of app
190-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_254.tgz
190+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_260.tgz
191191
- uid: 2734
192192
title: URL Toolbox
193193
appid: URL_TOOLBOX
@@ -249,8 +249,8 @@ apps:
249249
- uid: 1467
250250
title: Cisco Networks Add-on
251251
appid: TA-cisco_ios
252-
version: 2.7.8
253-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_278.tgz
252+
version: 2.7.9
253+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_279.tgz
254254
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
255255
test_data_caches:
256256
- base_url: https://media.githubusercontent.com/media/splunk/attack_data/master/

‎data_sources/aws_cloudwatchlogs_vpcflow.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@ output_fields:
7373
- action
7474
- src
7575
- src_ip
76-
- src_port
7776
- dest
7877
- dest_ip
7978
- dest_port

‎data_sources/cisco_ai_defense_alerts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ separator: null
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.1
13+
version: 3.4.2
1414
fields: null

‎data_sources/cisco_asa_logs.yml‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
name: Cisco ASA Logs
2+
id: 3f2a9b6d-1c8e-4f7b-a2d3-8b7f1c2a9d4e
3+
version: 1
4+
date: '2025-09-23'
5+
author: Bhavin Patel, Splunk
6+
description: "Data source object for Cisco ASA system logs. Cisco ASA logs provide\
7+
\ firewall operational and security telemetry (connection events, ACL denies, VPN\
8+
\ events, NAT translations, and device health). Deploy the Splunk Add-on for Cisco\
9+
\ ASA (TA-cisco_asa) on indexers/heavy forwarders and the Cisco ASA App on search\
10+
\ heads for best parsing, CIM mapping, and dashboards. This data is ingested via\
11+
\ SYSLOG. You must be ingesting Cisco ASA syslog data into your Splunk environment.\
12+
\ To ensure all detections work, configure your ASA and FTD devices to generate\
13+
\ and forward both debug and informational level syslog messages before they are\
14+
\ sent to Splunk. A few analytics are designed to be used with comprehensive logging\
15+
\ enabled, as it relies on the presence of specific message IDs. You can find specific\
16+
\ instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.\
17+
\ \n"
18+
source: cisco:asa
19+
sourcetype: cisco:asa
20+
separator: null
21+
supported_TA:
22+
- name: Cisco Security Cloud
23+
url: https://splunkbase.splunk.com/app/7404
24+
version: 3.4.2
25+
fields:
26+
- Cisco_ASA_action
27+
- Cisco_ASA_message_id
28+
- Cisco_ASA_user
29+
- Cisco_ASA_vendor_action
30+
- IP
31+
- Username
32+
- _bkt
33+
- _cd
34+
- _eventtype_color
35+
- _indextime
36+
- _raw
37+
- _serial
38+
- _si
39+
- _sourcetype
40+
- _time
41+
- acl
42+
- action
43+
- app
44+
- assigned_ip
45+
- bytes
46+
- category
47+
- command
48+
- communication_protocol
49+
- connections_in_use
50+
- date_hour
51+
- date_mday
52+
- date_minute
53+
- date_month
54+
- date_second
55+
- date_wday
56+
- date_year
57+
- date_zone
58+
- dest
59+
- dest_host
60+
- dest_interface
61+
- dest_ip
62+
- dest_nt_domain
63+
- dest_port
64+
- dest_public_port
65+
- dest_translated_host
66+
- dest_translated_ip
67+
- dest_translated_port
68+
- dest_user
69+
- dest_zone
70+
- direction
71+
- duration
72+
- duration_day
73+
- duration_hour
74+
- duration_minute
75+
- duration_second
76+
- dvc
77+
- eventtype
78+
- group
79+
- host
80+
- ids_type
81+
- index
82+
- laction
83+
- linecount
84+
- most_used_connections
85+
- object
86+
- object_attrs
87+
- object_category
88+
- object_id
89+
- product
90+
- protocol
91+
- protocol_version
92+
- punct
93+
- reason
94+
- result
95+
- rule
96+
- rule_name
97+
- session_id
98+
- severity
99+
- signature
100+
- signature_id
101+
- source
102+
- sourcetype
103+
- splunk_server
104+
- splunk_server_group
105+
- src
106+
- src_host
107+
- src_interface
108+
- src_ip
109+
- src_nt_domain
110+
- src_port
111+
- src_public_port
112+
- src_translated_host
113+
- src_translated_ip
114+
- src_translated_port
115+
- src_user
116+
- src_zone
117+
- ssl_is_valid
118+
- status
119+
- tag
120+
- tag::action
121+
- tag::app
122+
- tag::eventtype
123+
- tag::object_category
124+
- teardown_initiator
125+
- timeendpos
126+
- timestartpos
127+
- transport
128+
- type
129+
- user
130+
- vendor
131+
- vendor_action
132+
- vendor_product
133+
- vendor_severity
134+
- zone
135+
example_log: 'Sep 23 19:27:50 18.144.133.67 :2025-09-23T19:27:49Z: %ASA-session-7-609002:
136+
Teardown local-host management:54.245.234.201 duration 0:02:01 Sep 23 18:07:00 18.144.133.67
137+
:2025-09-23T18:07:00Z: %ASA-session-7-710005: TCP request discarded from 198.27.166.158/55508
138+
to management:172.31.12.229/443'

‎data_sources/cisco_duo_activity.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: null
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.1
13+
version: 3.4.2
1414
fields:
1515
- access_device.browser
1616
- access_device.browser_version

‎data_sources/cisco_duo_administrator.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: null
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.1
13+
version: 3.4.2
1414
fields:
1515
- action
1616
- actionlabel

‎data_sources/cisco_ios_logs.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,22 @@ id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f
33
version: 1
44
date: '2025-08-21'
55
author: Michael Haag, Splunk
6-
description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG.
6+
description: Data source object for Cisco IOS system logs. Cisco IOS logs provide
7+
operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS
8+
XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes
9+
these events by setting proper sourcetypes and extracting fields for switches, routers,
10+
controllers, and access points; deploy the TA on indexers/HFs and search heads,
11+
and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include
12+
Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent
13+
investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This
14+
data is ingested via SYSLOG.
715
source: cisco:ios
816
sourcetype: cisco:ios
917
separator: null
1018
supported_TA:
1119
- name: Cisco Networks Add-on
1220
url: https://splunkbase.splunk.com/app/1467
13-
version: 2.7.8
21+
version: 2.7.9
1422
fields:
1523
- _time
1624
- aci_message_text
@@ -81,7 +89,8 @@ fields:
8189
output_fields:
8290
- user
8391
- dest
84-
example_log: 'Aug 20 17:10:21.639: %AAA-6-USERNAME_CONFIGURATION: user with username: attacker configured
85-
Aug 20 17:10:21.664: %AAA-6-USER_PRIVILEGE_UPDATE: username: attacker privilege updated with priv-15
86-
Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:username attacker privilege 15 secret *
87-
Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:!config: USER TABLE MODIFIED'
92+
example_log: 'Aug 20 17:10:21.639: %AAA-6-USERNAME_CONFIGURATION: user with username:
93+
attacker configured Aug 20 17:10:21.664: %AAA-6-USER_PRIVILEGE_UPDATE: username:
94+
attacker privilege updated with priv-15 Aug 20 17:10:21.665: %PARSER-5-CFGLOG_LOGGEDCMD:
95+
User:ec2-user logged command:username attacker privilege 15 secret * Aug 20 17:10:21.665:
96+
%PARSER-5-CFGLOG_LOGGEDCMD: User:ec2-user logged command:!config: USER TABLE MODIFIED'

‎data_sources/cisco_secure_firewall_threat_defense_connection_event.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.1
13+
version: 3.4.2
1414
fields:
1515
- AC_RuleAction
1616
- action

‎data_sources/cisco_secure_firewall_threat_defense_file_event.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.1
13+
version: 3.4.2
1414
fields:
1515
- app
1616
- Application

‎data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
1010
supported_TA:
1111
- name: Cisco Security Cloud
1212
url: https://splunkbase.splunk.com/app/7404
13-
version: 3.4.1
13+
version: 3.4.2
1414
fields:
1515
- Application
1616
- Classification

0 commit comments

Comments
 (0)