Skip to content

Commit 8be1c3b

Browse files
v-dvedakv-dvedak
authored
Merge pull request #14346 from elakkuvan-r/whisper-solution-v3.0.24
Whisper Security Solution: Add new solution v3.0.0
2 parents b6d1b37 + 5adf7c0 commit 8be1c3b

75 files changed

Lines changed: 32616 additions & 2 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.script/tests/KqlvalidationsTests/CustomTables/WhisperASNReputation_CL.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"Name": "WhisperASNReputation_CL",
3+
"Properties": [
4+
{
5+
"name": "asn",
6+
"type": "String"
7+
},
8+
{
9+
"name": "asnName",
10+
"type": "String"
11+
},
12+
{
13+
"name": "reputationScore",
14+
"type": "Double"
15+
},
16+
{
17+
"name": "reputationLevel",
18+
"type": "String"
19+
},
20+
{
21+
"name": "maxThreatScore",
22+
"type": "Double"
23+
},
24+
{
25+
"name": "avgThreatScore",
26+
"type": "Double"
27+
},
28+
{
29+
"name": "hasThreateningPrefixes",
30+
"type": "Boolean"
31+
},
32+
{
33+
"name": "country",
34+
"type": "String"
35+
},
36+
{
37+
"name": "prefixCount",
38+
"type": "Int"
39+
},
40+
{
41+
"name": "peerCount",
42+
"type": "Int"
43+
},
44+
{
45+
"name": "TimeGenerated",
46+
"type": "DateTime"
47+
}
48+
]
49+
}

‎.script/tests/KqlvalidationsTests/CustomTables/WhisperHistory_CL.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"Name": "WhisperHistory_CL",
3+
"Properties": [
4+
{
5+
"name": "indicator",
6+
"type": "String"
7+
},
8+
{
9+
"name": "indicatorType",
10+
"type": "String"
11+
},
12+
{
13+
"name": "snapshotDate",
14+
"type": "DateTime"
15+
},
16+
{
17+
"name": "registrar",
18+
"type": "String"
19+
},
20+
{
21+
"name": "registrant",
22+
"type": "String"
23+
},
24+
{
25+
"name": "country",
26+
"type": "String"
27+
},
28+
{
29+
"name": "nameServers",
30+
"type": "String"
31+
},
32+
{
33+
"name": "createDate",
34+
"type": "DateTime"
35+
},
36+
{
37+
"name": "updateDate",
38+
"type": "DateTime"
39+
},
40+
{
41+
"name": "expiryDate",
42+
"type": "DateTime"
43+
},
44+
{
45+
"name": "bgpOrigin",
46+
"type": "String"
47+
},
48+
{
49+
"name": "bgpPrefix",
50+
"type": "String"
51+
},
52+
{
53+
"name": "bgpVisibility",
54+
"type": "Double"
55+
},
56+
{
57+
"name": "TimeGenerated",
58+
"type": "DateTime"
59+
}
60+
]
61+
}

‎.script/tests/KqlvalidationsTests/CustomTables/WhisperInfraContext_CL.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"Name": "WhisperInfraContext_CL",
3+
"Properties": [
4+
{
5+
"name": "indicator",
6+
"type": "String"
7+
},
8+
{
9+
"name": "indicatorType",
10+
"type": "String"
11+
},
12+
{
13+
"name": "ipAddresses",
14+
"type": "String"
15+
},
16+
{
17+
"name": "prefixes",
18+
"type": "String"
19+
},
20+
{
21+
"name": "asns",
22+
"type": "String"
23+
},
24+
{
25+
"name": "asnNames",
26+
"type": "String"
27+
},
28+
{
29+
"name": "cities",
30+
"type": "String"
31+
},
32+
{
33+
"name": "countries",
34+
"type": "String"
35+
},
36+
{
37+
"name": "registrar",
38+
"type": "String"
39+
},
40+
{
41+
"name": "registrant",
42+
"type": "String"
43+
},
44+
{
45+
"name": "nameservers",
46+
"type": "String"
47+
},
48+
{
49+
"name": "domainAge",
50+
"type": "Int"
51+
},
52+
{
53+
"name": "dnssecAlgorithm",
54+
"type": "String"
55+
},
56+
{
57+
"name": "cohostedCount",
58+
"type": "Int"
59+
},
60+
{
61+
"name": "spfIncludes",
62+
"type": "String"
63+
},
64+
{
65+
"name": "bgpStatus",
66+
"type": "String"
67+
},
68+
{
69+
"name": "TimeGenerated",
70+
"type": "DateTime"
71+
}
72+
]
73+
}

‎.script/tests/KqlvalidationsTests/CustomTables/WhisperThreatIntel_CL.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"Name": "WhisperThreatIntel_CL",
3+
"Properties": [
4+
{
5+
"name": "indicator",
6+
"type": "String"
7+
},
8+
{
9+
"name": "indicatorType",
10+
"type": "String"
11+
},
12+
{
13+
"name": "threatScore",
14+
"type": "Double"
15+
},
16+
{
17+
"name": "threatLevel",
18+
"type": "String"
19+
},
20+
{
21+
"name": "isThreat",
22+
"type": "Boolean"
23+
},
24+
{
25+
"name": "isC2",
26+
"type": "Boolean"
27+
},
28+
{
29+
"name": "isMalware",
30+
"type": "Boolean"
31+
},
32+
{
33+
"name": "isPhishing",
34+
"type": "Boolean"
35+
},
36+
{
37+
"name": "isTor",
38+
"type": "Boolean"
39+
},
40+
{
41+
"name": "isAnonymizer",
42+
"type": "Boolean"
43+
},
44+
{
45+
"name": "isSpam",
46+
"type": "Boolean"
47+
},
48+
{
49+
"name": "isBruteforce",
50+
"type": "Boolean"
51+
},
52+
{
53+
"name": "isScanner",
54+
"type": "Boolean"
55+
},
56+
{
57+
"name": "threatSources",
58+
"type": "Int"
59+
},
60+
{
61+
"name": "feedNames",
62+
"type": "String"
63+
},
64+
{
65+
"name": "explanation",
66+
"type": "String"
67+
},
68+
{
69+
"name": "factors",
70+
"type": "String"
71+
},
72+
{
73+
"name": "lastSeen",
74+
"type": "DateTime"
75+
},
76+
{
77+
"name": "TimeGenerated",
78+
"type": "DateTime"
79+
}
80+
]
81+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -324,5 +324,6 @@
324324
"VaikoraO365",
325325
"GambitSecurityPush",
326326
"TailscaleCCF",
327-
"TailscalePremiumCCF"
328-
]
327+
"TailscalePremiumCCF",
328+
"WhisperSecurityConnector"
329+
]

‎Logos/Whisper.svg‎

Lines changed: 12 additions & 0 deletions
Loading

‎Solutions/Whisper/Analytic Rules/AsnReputationDegradation.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: 32e7bcab-4424-516e-9c7c-dbe868144494
2+
name: Whisper Security - ASN Reputation Degradation
3+
description: |
4+
Detects autonomous systems whose reputation score has increased by more than 20 points in the last 24 hours. Higher scores indicate worse reputation, so a score increase signals degradation that may indicate adversary use of the network.
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: WhisperSecurityConnector
9+
dataTypes:
10+
- WhisperASNReputation_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1d
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- ResourceDevelopment
17+
relevantTechniques:
18+
- T1583
19+
query: |
20+
// MITRE ATT&CK: T1583.002 - Acquire Infrastructure: DNS Server
21+
// Tactic: Resource Development
22+
// Detects ASN reputation degradation (score increase > 20 points in 24h)
23+
// Note: Higher reputationScore = worse reputation
24+
let degradationThreshold = 20;
25+
let currentScores = WhisperASNReputation_CL
26+
| where TimeGenerated > ago(1h)
27+
| summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn
28+
| project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount;
29+
let previousScores = WhisperASNReputation_CL
30+
| where TimeGenerated between (ago(1d) .. ago(1h))
31+
| summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn
32+
| project asn, PreviousScore;
33+
currentScores
34+
| join kind=inner (previousScores) on asn
35+
| extend ScoreDelta = CurrentScore - PreviousScore
36+
| where ScoreDelta > degradationThreshold
37+
| project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount
38+
customDetails:
39+
ASN: ASN
40+
AsnName: AsnName
41+
OldScore: OldScore
42+
NewScore: NewScore
43+
ScoreDelta: ScoreDelta
44+
incidentConfiguration:
45+
createIncident: true
46+
groupingConfiguration:
47+
enabled: true
48+
reopenClosedIncident: false
49+
lookbackDuration: PT5H
50+
matchingMethod: AllEntities
51+
version: 1.0.0
52+
kind: Scheduled

0 commit comments

Comments
 (0)