Skip to content

Yml validation cleanups #3839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pyth0n1c wants to merge 16 commits into
base: develop
Choose a base branch
from
+87 −722
Draft

Yml validation cleanups #3839

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
30a6a9f
Add some missing products. I assume all these detections want to be f…
pyth0n1c Dec 17, 2025
9fe76df
accidentally removed security_domain from detection. removed filter m…
pyth0n1c Dec 17, 2025
0f1862c
add deprecation info to one detection
pyth0n1c Dec 22, 2025
3b49316
Merge branch 'develop' into yml_validation_cleanups
pyth0n1c Dec 22, 2025
bc46ab2
Remove the default.xml due to conflict. It is not required.
pyth0n1c Jan 8, 2026
aca791b
remove mitre lookup as an apptemplate file so it can later be added a…
pyth0n1c Jan 9, 2026
1360c8d
Merge branch 'develop' into yml_validation_cleanups
patel-bhavin Jan 9, 2026
b8ac2c2
migrate deprecation info
pyth0n1c Jan 9, 2026
457ac84
rename deprecation mapping file
pyth0n1c Jan 14, 2026
0f9014f
Merge branch 'develop' into yml_validation_cleanups
pyth0n1c Jan 28, 2026
adba897
fix wrong format failing validations
pyth0n1c Jan 28, 2026
5786c31
Accidentally renamed extension for file
pyth0n1c Jan 28, 2026
f6ea72f
bump dates and verisons
pyth0n1c Jan 28, 2026
95f20fa
fix date format
pyth0n1c Jan 28, 2026
74ed412
more required bumps
pyth0n1c Jan 28, 2026
15f1e39
Merge branch 'develop' into yml_validation_cleanups
pyth0n1c Feb 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 0 additions & 9 deletions app_template/default/data/ui/nav/default.xml
View file
Open in desktop

This file was deleted.

657 changes: 0 additions & 657 deletions app_template/lookups/mitre_enrichment.csv
View file
Open in desktop

This file was deleted.

4 changes: 2 additions & 2 deletions baselines/baseline_of_open_s3_bucket_decommissioning.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ search: '`cloudtrail` eventSource="s3.amazonaws.com" (eventName=DeleteBucket OR
| eval policy_details = if(isPublicPolicy==1, "Policy: Principal=" . mvjoin(principals, ", ") . " Effect=" . mvjoin(effects, ", ") . " Action=" . mvjoin(actions, ", "), "No Public Policy")
| eval website_details = if(isWebsite==1, "Static Website Enabled", "No Website Hosting")
| table bucketName, hosts, firstEvent, lastEvent, events, policy_details, website_details, accountIds, userARNs, awsRegions
| outputlookup append=true decommissioned_buckets | `baseline_of_open_s3_bucket_decommissioning_filter`'
| outputlookup append=true decommissioned_buckets'
how_to_implement: To implement this baseline, you need to have AWS CloudTrail logs being ingested into Splunk with the AWS Add-on properly configured. The search looks for S3 bucket events related to bucket policies, website hosting configuration, and bucket deletion. The results are stored in a lookup KVStore named decommissioned_buckets which tracks the history of deleted buckets that were previously exposed to the public.
known_false_positives: Some buckets may be intentionally made public for legitimate business purposes before being decommissioned. Review the policy_details and website_details fields to understand the nature of the public access that was configured.
references:
Expand All @@ -61,4 +61,4 @@ deployment:
cron_schedule: 0 2 * * 0
earliest_time: -30d@d
latest_time: -1d@d
schedule_window: auto
schedule_window: auto
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___aaa_policy_tampering.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - AAA Policy Tampering
id: 8f2c4e9a-5d3b-4c7e-9a1f-6e8d5b2c3a9f
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -74,6 +74,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___device_file_copy_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Device File Copy Activity
id: 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -78,6 +78,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___device_file_copy_to_remote_location.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Device File Copy to Remote Location
id: 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -103,6 +103,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___logging_disabled_via_cli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Logging Disabled via CLI
id: 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
version: 3
date: '2025-10-17'
version: 4
date: '2026-01-28'
author: Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk
status: production
type: TTP
Expand Down Expand Up @@ -76,6 +76,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___logging_filters_configuration_tampering.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Logging Filters Configuration Tampering
id: b87b48a8-6d1a-4280-9cf1-16a950dbf901
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -87,6 +87,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___logging_message_suppression.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Logging Message Suppression
id: 4e6c9d2a-8f3b-4c7e-9a5f-2d8b6e1c4a9f
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -74,6 +74,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___new_local_user_account_created.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - New Local User Account Created
id: 9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -66,6 +66,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___packet_capture_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Packet Capture Activity
id: 7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -74,6 +74,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___reconnaissance_command_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - Reconnaissance Command Activity
id: 6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -130,6 +130,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___user_account_deleted_from_local_database.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - User Account Deleted From Local Database
id: 2d4b9e7f-5c3a-4d8e-9b1f-8a6c5e2d4f7a
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -66,6 +66,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___user_account_lockout_threshold_exceeded.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - User Account Lockout Threshold Exceeded
id: 3e8f9c2a-6d4b-4a7e-9c5f-1b8d7e3a9f2c
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -66,6 +66,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/application/cisco_asa___user_privilege_level_change.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco ASA - User Privilege Level Change
id: 5f7d8c3e-9a2b-4d6f-8e1c-3b5a9d7f2c4e
version: 1
date: '2025-11-18'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -67,6 +67,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Curl Execution With Insecure Flags
id: cc695238-3117-4e60-aa83-4beac2a42c69
version: 4
date: '2025-10-24'
version: 5
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -92,6 +92,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Installation of Typosquatted Python Package
id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d
version: 1
date: '2025-07-03'
version: 2
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
Expand Down Expand Up @@ -89,6 +89,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e
version: 2
date: '2025-09-09'
version: 3
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -95,6 +95,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Non-Network Binary Making Network Connection
id: c6db35af-8a0e-4b61-88ed-738e66f15715
version: 2
date: '2025-09-09'
version: 3
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -91,6 +91,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Outbound Connection to Suspicious Port
id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d
version: 2
date: '2025-09-09'
version: 3
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -88,6 +88,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Rclone Execution With Network Activity
id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a
version: 3
date: '2025-10-14'
version: 4
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -99,6 +99,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0
version: 2
date: '2025-09-09'
version: 3
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -86,6 +86,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
5 changes: 3 additions & 2 deletions detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Cisco NVM - Susp Script From Archive Triggering Network Activity
id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
version: 2
date: '2025-09-09'
version: 3
date: '2026-01-28'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -87,6 +87,7 @@ tags:
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test - Cisco NVM
Expand Down
Loading
Loading