Splunk - Classifier

Details

ID	`SplunkPy`
Type	classification
Version	-1
From Version	6.0.0
Default Incident Type	—
Feed	No

Key Type Map

Key	Incident Type
`Access - Brute Force Access Behavior Detected - Rule`	Access
`Access - Brute Force Access Behavior Detected Over 1d - Rule`	Access
`Access - Concurrent App Accesses - Rule`	Access
`Access - Excessive Failed Logins - Rule`	Access
`Access - High or Critical Priority Individual Logging into Infected Machine - Rule`	Access
`Endpoint - High Or Critical Priority Host With Malware - Rule`	Malware
`Threat - Suspicious Email - URL - Rule`	Phishing Alerts

Source

classifier-SplunkPy.json classifier-SplunkPyV2.json

Download History Raw

{
    "description": "Classifies SplunkPy v2 events (Splunk Finding and Splunk Investigation).",
    "feed": false,
    "id": "SplunkPyV2 - Classifier",
    "keyTypeMap": {
        "Finding": "Splunk Finding",
        "Investigation": "Splunk Investigation"
    },
    "name": "SplunkPyV2 - Classifier",
    "transformer": {
        "complex": {
            "filters": [],
            "root": "splunk_es_event_type",
            "transformers": []
        }
    },
    "type": "classification",
    "version": -1,
    "fromVersion": "6.0.0",
    "marketplaces": [
        "xsoar",
        "marketplacev2",
        "platform"
    ],
    "supportedModules": [
        "xsiam",
        "agentix"
    ]
}