Reordering keys

Author: ljstella

detections/application/okta_risk_threshold_exceeded.yml

@@ -30,6 +30,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Multiple suspicious Okta risk events - $risk_object$
+    entity:
+        field: risk_object
+        type: user
+        score: 0
 analytic_story:
     - Okta Account Takeover
     - Okta MFA Exhaustion
@@ -51,9 +57,3 @@ tests:
           source: risk_data
           sourcetype: stash
       test_type: unit
-finding:
-    title: Multiple suspicious Okta risk events - $risk_object$
-    entity:
-        field: risk_object
-        type: user
-        score: 0

detections/cloud/aws_s3_exfiltration_behavior_identified.yml

@@ -34,6 +34,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Suspicious AWS S3 exfiltration behavior identified - $risk_object$
+    entity:
+        field: risk_object
+        type: other
+        score: 0
 analytic_story:
     - Suspicious Cloud Instance Activities
     - Data Exfiltration
@@ -53,9 +59,3 @@ tests:
           sourcetype: stash
           source: aws_exfil
       test_type: unit
-finding:
-    title: Suspicious AWS S3 exfiltration behavior identified - $risk_object$
-    entity:
-        field: risk_object
-        type: other
-        score: 0

detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml

@@ -29,6 +29,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Risk Threshold Exceeded for $risk_object$
+    entity:
+        field: risk_object
+        type: other
+        score: 0
 analytic_story:
     - Dev Sec Ops
 asset_type: Amazon Elastic Container Registry
@@ -47,9 +53,3 @@ tests:
           source: aws_ecr_risk_dataset.log
           sourcetype: stash
       test_type: unit
-finding:
-    title: Risk Threshold Exceeded for $risk_object$
-    entity:
-        field: risk_object
-        type: other
-        score: 0

detections/endpoint/active_directory_lateral_movement_identified.yml

@@ -31,6 +31,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Active Directory Lateral Movement Identified - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Active Directory Lateral Movement
 asset_type: Endpoint
@@ -49,9 +55,3 @@ tests:
           source: adlm
           sourcetype: stash
       test_type: unit
-finding:
-    title: Active Directory Lateral Movement Identified - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0

detections/endpoint/active_directory_privilege_escalation_identified.yml

@@ -31,6 +31,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Active Directory Privilege Escalation Identified - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Active Directory Privilege Escalation
 asset_type: Endpoint
@@ -42,9 +48,3 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
-finding:
-    title: Active Directory Privilege Escalation Identified - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0

detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml

@@ -35,6 +35,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Linux Persistence and Privilege Escalation Risk Behavior - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Linux Privilege Escalation
     - Linux Persistence Techniques
@@ -54,9 +60,3 @@ tests:
           source: linuxrisk
           sourcetype: stash
       test_type: unit
-finding:
-    title: Linux Persistence and Privilege Escalation Risk Behavior - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0

detections/endpoint/living_off_the_land_detection.yml

@@ -31,6 +31,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Living Off The Land Behavior detected - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Living Off The Land
     - Hellcat Ransomware
@@ -53,9 +59,3 @@ tests:
           source: lotl
           sourcetype: stash
       test_type: unit
-finding:
-    title: Living Off The Land Behavior detected - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0

detections/endpoint/log4shell_cve_2021_44228_exploitation.yml

@@ -31,6 +31,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Log4Shell CVE-2021-44228 Exploitation detected - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Log4Shell CVE-2021-44228
     - CISA AA22-320A
@@ -53,9 +59,3 @@ tests:
           source: log4shell
           sourcetype: stash
       test_type: unit
-finding:
-    title: Log4Shell CVE-2021-44228 Exploitation detected - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0

detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml

@@ -31,6 +31,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Steal or Forge Authentication Certificates Behavior Identified - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Windows Certificate Services
 asset_type: Endpoint
@@ -53,9 +59,3 @@ tests:
           source: certs
           sourcetype: stash
       test_type: unit
-finding:
-    title: Steal or Forge Authentication Certificates Behavior Identified - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0

detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml

@@ -31,6 +31,12 @@ drilldown_searches:
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
       latest_offset: "0"
+finding:
+    title: Windows Common Abused Cmd Shell Risk Behavior - $risk_object$
+    entity:
+        field: risk_object
+        type: system
+        score: 0
 analytic_story:
     - Azorult
     - Volt Typhoon
@@ -65,9 +71,3 @@ tests:
           source: risk
           sourcetype: stash
       test_type: unit
-finding:
-    title: Windows Common Abused Cmd Shell Risk Behavior - $risk_object$
-    entity:
-        field: risk_object
-        type: system
-        score: 0