Skip to content

Commit 61f7154

Browse files
pyth0n1cpyth0n1c
committed
Macros were missed during the porting copy over. They have now been added.
1 parent 58c7164 commit 61f7154

161 files changed

Lines changed: 1128 additions & 487 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎macros/admon.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
definition: source=ActiveDirectory
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
41
name: admon
2+
id: 0cb6c059-e840-4887-8564-9db206ff1115
3+
version: 1
4+
creation_date: '2020-04-30'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
8+
definition: source=ActiveDirectory

‎macros/amazon_security_lake.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
definition: sourcetype=aws:asl
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
41
name: amazon_security_lake
2+
id: b25c757e-d3e1-40a5-8762-4be3fe2190f0
3+
version: 1
4+
creation_date: '2020-04-30'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
8+
definition: sourcetype=aws:asl

‎macros/appdynamics_security.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1+
name: appdynamics_security
2+
id: a6eb6e52-7b54-4163-b574-665c1f79419b
3+
version: 1
4+
creation_date: '2020-04-30'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
18
definition: sourcetype=appdynamics_security
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
4-
name: appdynamics_security

‎macros/applocker.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1-
definition: (source="WinEventLog:Microsoft-Windows-AppLocker/*" OR source="XmlWinEventLog:Microsoft-Windows-AppLocker/*")
2-
description: This macro is designed to simplify the search for AppLocker events by providing a predefined search query. AppLocker, a feature in Windows, helps administrators control which executables, scripts, and libraries can run on their systems. By using this macro, analysts can quickly query AppLocker logs to monitor application control policies and investigate potential unauthorized software executions or policy violations. To modify this macro for a customer environment, you may need to adjust the source field to match the specific log source or index where AppLocker events are stored. Additionally, if the organization uses custom naming conventions or has AppLocker logs aggregated with other data, further refinement of the search query might be necessary to accurately filter for relevant events.
31
name: applocker
2+
id: d7e1567e-5e93-4337-b4d2-c488bece65f5
3+
version: 1
4+
creation_date: '2024-04-17'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: This macro is designed to simplify the search for AppLocker events by providing a predefined search query. AppLocker, a feature in Windows, helps administrators control which executables, scripts, and libraries can run on their systems. By using this macro, analysts can quickly query AppLocker logs to monitor application control policies and investigate potential unauthorized software executions or policy violations. To modify this macro for a customer environment, you may need to adjust the source field to match the specific log source or index where AppLocker events are stored. Additionally, if the organization uses custom naming conventions or has AppLocker logs aggregated with other data, further refinement of the search query might be necessary to accurately filter for relevant events.
8+
definition: (source="WinEventLog:Microsoft-Windows-AppLocker/*" OR source="XmlWinEventLog:Microsoft-Windows-AppLocker/*")

‎macros/aws_cloudwatchlogs_eks.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
definition: sourcetype="aws:cloudwatchlogs:eks"
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
41
name: aws_cloudwatchlogs_eks
2+
id: 3c38a8b2-937b-4db1-8a5f-33044625a7b6
3+
version: 1
4+
creation_date: '2020-05-05'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
8+
definition: sourcetype="aws:cloudwatchlogs:eks"

‎macros/aws_ecr_users.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1-
definition: userName IN (user)
2-
description: specify the user allowed to push Images to AWS ECR.
31
name: aws_ecr_users
2+
id: 5774a0e0-ad59-4df0-89a1-40843ca7ca24
3+
version: 1
4+
creation_date: '2021-08-19'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: specify the user allowed to push Images to AWS ECR.
8+
definition: userName IN (user)

‎macros/aws_ecr_users_asl.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1-
definition: actor.user.name IN (admin)
2-
description: specify the user allowed to push Images to AWS ECR.
31
name: aws_ecr_users_asl
2+
id: 88a41da0-322c-4b81-8002-be88ade4cb70
3+
version: 1
4+
creation_date: '2021-08-19'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: specify the user allowed to push Images to AWS ECR.
8+
definition: actor.user.name IN (admin)

‎macros/aws_s3_accesslogs.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
definition: sourcetype=aws:s3:accesslogs
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
41
name: aws_s3_accesslogs
2+
id: b476100b-b0b3-4fdb-aa18-87eb91db5aea
3+
version: 1
4+
creation_date: '2020-05-05'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
8+
definition: sourcetype=aws:s3:accesslogs

‎macros/aws_securityhub_finding.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
definition: sourcetype="aws:securityhub:finding"
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
41
name: aws_securityhub_finding
2+
id: 28467776-425b-4c42-a749-4a301e0f1d41
3+
version: 1
4+
creation_date: '2020-05-05'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
8+
definition: sourcetype="aws:securityhub:finding"

‎macros/azure_audit.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
definition: sourcetype=mscs:azure:audit
2-
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
41
name: azure_audit
2+
id: 61af3b50-d482-4cd2-b9ae-6d1e3d655932
3+
version: 1
4+
creation_date: '2020-04-30'
5+
modification_date: '2026-05-13'
6+
author: Splunk Threat Research Team
7+
description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
8+
definition: sourcetype=mscs:azure:audit

0 commit comments

Comments
 (0)