Splunk - Classifier

Classifies Splunk events.

Splunk Classification

Details

IDSplunkPy
Typeclassification
Version-1
From Version6.0.0
Default Incident Type—
FeedNo

Key Type Map

KeyIncident Type
Access - Brute Force Access Behavior Detected - Rule Access
Access - Brute Force Access Behavior Detected Over 1d - Rule Access
Access - Concurrent App Accesses - Rule Access
Access - Excessive Failed Logins - Rule Access
Access - High or Critical Priority Individual Logging into Infected Machine - Rule Access
Endpoint - High Or Critical Priority Host With Malware - Rule Malware
Threat - Suspicious Email - URL - Rule Phishing Alerts

Source

classifier-SplunkPy.json classifier-SplunkPyV2.json
Download History Raw 
{
    "description": "Classifies Splunk events.",
    "feed": false,
    "id": "SplunkPy",
    "keyTypeMap": {
        "Access - Brute Force Access Behavior Detected - Rule": "Access",
        "Access - Brute Force Access Behavior Detected Over 1d - Rule": "Access",
        "Access - Concurrent App Accesses - Rule": "Access",
        "Access - Excessive Failed Logins - Rule": "Access",
        "Access - High or Critical Priority Individual Logging into Infected Machine - Rule": "Access",
        "Endpoint - High Or Critical Priority Host With Malware - Rule": "Malware",
        "Threat - Suspicious Email - URL - Rule": "Phishing Alerts"
    },
    "name": "Splunk - Classifier",
    "transformer": {
        "simple": "source"
    },
    "type": "classification",
    "version": -1,
    "fromVersion": "6.0.0",
    "supportedModules": [
        "xsiam",
        "agentix"
    ]
}