DOCSEARCHbyAlgolia
Submit Docs

Splunk Security Content

repository·develop·Indexed 23 days ago

https://github.com/splunk/security_content

A repository of Analytic Stories, security guides, and detections mapped to frameworks such as MITRE ATT&CK, the Lockheed Martin Cyber Kill Chain, and CIS Controls. It provides Splunk searches, machine learning algorithms, and playbooks for threat detection and response. The repository includes tools like contentctl-ng for building and validating content, and supports the Splunk ES Content Update service for Splunk Enterprise Security version 4.5 or greater.

Tokens
975
Snippets
2
Records
8
Agent score
32%

What's inside Splunk Security Content

  1. Overview of Splunk ES Content Update

    develop
    Splunk ES Content Update is a subscription service that provides pre-packaged Security Content specifically designed for use with Splunk Enterprise Security. It delivers regular updates to help security practitioners address time-sensitive threats and customer problems more efficiently.

  2. Understand the Splunk Security Content directory structure

    develop

    The repository is organized into several functional parts:

    • baselines/: Searches executed before a detection to collect baseline system data.
    • data_sources/: Definitions of data sources, required TAs/Apps, and available fields.
    • deployments/: Configuration for schedules and alert actions.
    • detections/: The core collection of detection searches.
    • lookups/: Implementation of Splunk lookups (e.g., static lists like ransomware extensions).
    • macros/: Implementation of Splunk search macros for common patterns.
    • playbooks/: Incident Response Playbooks/Workflows for specific threats.
    • stories/: Analytic Stories (Use Cases) that group multiple detections together.

  3. Scaffold new content using VS Code Snippets

    develop

    The repository includes VS Code snippets located in .vscode/escu_6.code-snippets to help you quickly scaffold new content files.

    Steps to use:

    1. Create a new .yml file in the appropriate directory (e.g., detections/, macros/, stories/).
    2. Type one of the following prefixes and press Tab to expand the template:
      • detection_escu6
      • macro_escu6
      • data_source_escu6
      • story_escu6
      • lookup_csv_escu6
      • lookup_kvstore_escu6
      • dashboard_escu6
      • baseline_escu6
    3. Fill in the required fields. You can remove optional fields that are not relevant to your specific content piece.

  4. Set up the Splunk Security Content development environment

    develop

    To validate, build, and test content like the Splunk Threat Research team, follow these steps to set up your local environment:

    1. Clone the repository:
      git clone https://github.com/splunk/security_content.git
cd security_content
    2. Create and activate a virtual environment:
      python3.11 -m venv .venv
source .venv/bin/activate
    3. Install required tools:
      • contentctl-ng: The core tool for building, testing, and packaging content.
      • pre-commit: Used to validate and apply proper formatting.
    pip install contentctl-ng
pip install pre-commit
pre-commit install
    git clone https://github.com/splunk/security_content.git
cd security_content
python3.11 -m venv .venv
source .venv/bin/activate
pip install contentctl-ng

  7. Reference the JSON Schemas for content validation

    develop

    The project uses JSON schemas located in the /schemas/ folder to define the structure, required fields, and data types for YML files. Use these schemas to ensure your content is valid.

    Available Schemas:

    • detection: schemas/EventBasedDetection.schema.json
    • stories: schemas/Story.schema.json
    • macros: schemas/FileBackedMacro.schema.json
    • lookups: schemas/CsvLookup.schema.json
    • baseline: schemas/Baseline.schema.json
    • playbook: schemas/Playbook.schema.json
    • data_source: schemas/DataSource.schema.json

  8. Validate and build content with contentctl-ng

    develop

    Use the contentctl-ng build command to ensure your YML files adhere to defined specifications. This command validates:

    • Required fields
    • Correct data types
    • Overall consistency

    This process helps maintain the integrity and quality of the security content before distribution.

    contentctl-ng build