Analytics Story: Critical Alerts
Description
This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other findings and intermediate findings, it offers a nuanced perspective on potential threats and security posture of your organization.
Why it matters
Monitoring alerts from security tools is crucial because they act as an early warning system for potential threats. High and critical alerts signal serious issues that could compromise your systems if not addressed promptly. By keeping an eye on these alerts, you can quickly identify and respond to threats, minimizing damage and protecting sensitive data. This proactive approach not only strengthens your security posture but also ensures you're ready to tackle any compliance requirements by maintaining a detailed record of significant security events. This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
Detections
| Name | Technique | Type |
|---|---|---|
| Cisco AI Defense Allowed Sensitive Response | None | TTP |
| Microsoft Defender ATP Alerts | None | TTP |
| Splunk AppDynamics Secure Application Alerts | None | Anomaly |
| CrowdStrike Falcon Stream Alerts | None | Anomaly |
| Detect Spike in AWS Security Hub Alerts for EC2 Instance | None | Anomaly |
| Cisco AI Defense Security Alerts by Application Name | None | Anomaly |
| Detect Spike in AWS Security Hub Alerts for User | None | Anomaly |
| Cisco AI Defense Repeated High Risk Activity | None | TTP |
| Splunk Secure Application Alerts for Runtime Security | None | Anomaly |
| Microsoft Defender Incident Alerts | None | TTP |
| Cisco AI Defense Allowed Sensitive Prompt | None | TTP |
Data Sources
| Name | Platform | Sourcetype | Source |
|---|---|---|---|
| Cisco AI Defense Alerts | Other | cisco:ai:defense |
not_applicable |
| MS Defender ATP Alerts | Other | ms:defender:atp:alerts |
ms_defender_atp_alerts |
| Splunk AppDynamics Secure Application Alert |  Splunk |
appdynamics_security |
AppDynamics Security |
| CrowdStrike Falcon Stream Alert | Other | CrowdStrike:Event:Streams:JSON |
CrowdStrike:Event:Streams |
| AWS Security Hub |  AWS |
aws:securityhub:finding |
aws_securityhub_finding |
| MS365 Defender Incident Alerts | Other | ms365:defender:incident:alerts |
ms365_defender_incident_alerts |
References
- https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.0/using-the-common-information-model/use-the-common-action-model-to-build-custom-alert-actions
- https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.0/data-models/alerts
Source: GitHub | Version: 3