Add Detection for Inactive Users with a Certain Period Who Suddenly Have Activity

app_template/default/app.conf

@@ -1,13 +1,21 @@
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:57 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
 ## Splunk app configuration file
 
 [install]
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 16367
+build = 20240926154241
 
 [triggers]
 reload.analytic_stories = simple
+reload.usage_searches = simple
 reload.use_case_library = simple
 reload.correlationsearches = simple
 reload.analyticstories = simple
@@ -19,12 +27,15 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.9.0
+version = 4.41.0 
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
 is_visible = true
-label      = ES Content Updates
+label = ES Content Updates
 
 [package]
 id = DA-ESS-ContentUpdate
+
+
+

app_template/default/collections.conf

@@ -0,0 +1,104 @@
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:57 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+
+[api_call_by_user_baseline]
+enforceTypes = false
+replicate = false
+
+[cloud_instances_enough_data]
+enforceTypes = false
+replicate = false
+
+[k8s_container_network_io_baseline]
+enforceTypes = false
+replicate = false
+
+[k8s_container_network_io_ratio_baseline]
+enforceTypes = false
+replicate = false
+
+[k8s_process_resource_baseline]
+enforceTypes = false
+replicate = false
+
+[k8s_process_resource_ratio_baseline]
+enforceTypes = false
+replicate = false
+
+[previously_seen_api_calls_from_user_roles]
+enforceTypes = false
+replicate = false
+
+[previously_seen_aws_cross_account_activity]
+enforceTypes = false
+replicate = false
+
+[previously_seen_aws_regions]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_api_calls_per_user_role]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_compute_creations_by_user]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_compute_images]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_compute_instance_types]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_instance_modifications_by_user]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_provisioning_activity_sources]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_regions]
+enforceTypes = false
+replicate = false
+
+[previously_seen_gcp_storage_access_from_remote_ip]
+enforceTypes = false
+replicate = false
+
+[previously_seen_running_windows_services]
+enforceTypes = false
+replicate = false
+
+[previously_seen_S3_access_from_remote_ip]
+enforceTypes = false
+replicate = false
+
+[previously_seen_users_console_logins]
+enforceTypes = false
+replicate = false
+
+[remote_access_software_exceptions]
+enforceTypes = false
+replicate = false
+
+[s3_deletion_baseline]
+enforceTypes = false
+replicate = false
+
+[security_group_activity_baseline]
+enforceTypes = false
+replicate = false
+
+[zoom_first_time_child_process]
+enforceTypes = false
+replicate = false
+

app_template/default/content-version.conf

@@ -1,2 +1,9 @@
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:57 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
 [content-version]
-version = 4.9.0
+version = 4.41.0 

app_template/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>| search `netbackup` dest=$dest$</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?&lt;instance&gt;.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation |  table dest Title ProductArn Description FirstObservedAt RecordState Remediation</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn  | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`aws_description` | rename id as networkAclId | search  networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.*</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId  configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>

app_template/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml

@@ -0,0 +1,18 @@
+<!--
+#############
+# Automatically generated by 'contentctl build' from 
+# https://github.com/splunk/contentctl
+# On Date: 2024-09-26T15:42:58 UTC
+# Author: Splunk Threat Research Team - Splunk
+# Contact: [email protected]
+#############
+-->
+<panel>
+  <table>
+    <search>
+      <query>`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode</query>
+    </search>
+    <option name="drilldown">cell</option>
+    <option name="wrap">false</option>
+  </table>
+</panel>