-
Notifications
You must be signed in to change notification settings - Fork 359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Detection for Inactive Users with a Certain Period Who Suddenly Have Activity #3159
Conversation
…etection with Extended Inactivity Period
…enly_have_activity.yml to detections/network/
Downloading latest ESCU build from Splunkbase to serve as previous build during validation... Detection Metadata Validation: Anyone can help me with this issue ? i only want to contribute my logic to Research Splunk. Would you please fix this? i was download latest splunk-es-content-update_4410.tgz but i still can't found that metadata @patel-bhavin @ljstella |
I will create new one, too much error since i want to fixed it alone. Thankyou for your reply, will push with the new fresh and clean one |
Details
This PR introduces a new detection for Detection for Inactive Users with a Certain Period Who Suddenly Have Activity under the
Network
category. The detection identifies users who have not logged in for an extended period (over 30 days), based on network traffic logs. The detection uses theNetwork_Traffic
data model to calculate the inactivity period and flag inactive users.No changes to lookups or additional dependencies are required for this detection.
Checklist
<platform>_<mitre att&ck technique>_<short description>
nomenclature.Filename:
network_inactivity_detection.yml
T1078
,network
,inactivity
Network_Traffic
data model is populated.T1078 (Valid Accounts)
Notes for Submitters and Reviewers