Components of a detection analytic

Detections tailored to specific source types in Splunk are comprised of the following three components:

• Input macro: Located at the start of each detection, the input macro requires configuration to accurately reference the appropriate Splunk index values that contain the relevant data. This ensures that the detection logic operates on the correct dataset.
• Detection logic: Core component of the analytic, where the primary detection mechanisms are implemented. It encapsulates the specific conditions and queries that identify potential security incidents based on the data ingested from the defined source type.
• Filter macros: Play a crucial role in refining the detection outcomes. Filter macros must be meticulously reviewed and updated as needed to minimize false positives, thereby enhancing the accuracy and relevance of the alerts generated.

For example, the detection analytic Access LSASS Memory for Dump Creation (view on Github):

`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, TargetProcessId, SourceImage, SourceProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` `access_lsass_memory_for_dump_creation_filter`

has the following components:

• Input Macro -`sysmon` - *Modify this macro (view on Github) to update with the splunk index where this Sysmon data lives.
• Filter Macro - `access_lsass_memory_for_dump_creation_filter`- For tuning of alerts purposes, you can update this filter macro to filter out legitimate destinations that report this activity. These configurations are present in macros.conf in the ESCU app
• Detection logic and output formatting

<div>
EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, TargetProcessId, SourceImage, SourceProcessId | `security_content_ctime(firstTime)`|  `security_content_ctime(lastTime)`
</div>

This is the core of the detection logic that identifies processes to dump LSASS process memory. Each of these components must be correctly configured and maintained to ensure the effectiveness and reliability of the detection analytic within your environment.

Detections written against datamodel (view on Github) do not have an input macro since the assumption is that the appropriate data is mapped to the Splunk data models and accelerated.