deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-12-14

Description:
Published in response to CVE-2021-44228, this playbook and its sub-playbooks can be used to investigate and respond to attacks against hosts running vulnerable Java applications which use log4j. Between the parent playbook and seven sub-playbooks, each potentially compromised host found in Splunk Enteprise can be investigated and the risk can be mitigated using SSH for unix systems and WinRM for Windows systems.

References:
  - https://github.com/Neo23x0/Fenrir/blob/master/fenrir.sh
  - https://isc.sans.edu/diary/Log4j++Log4Shell+Followup%3A+What+we+see+and+how+to+defend+%28and+how+to+access+our+data%29/28122
  - https://twitter.com/ElektroWolle/status/[PII_REDACTED]49140224?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E[PII_REDACTED]49140224%7Ctwgr%5E%7Ctwcon%5Es1_c10&ref_url=https%3A%2F%2Fpublish.twitter.com%2F%3Fquery%3Dhttps3A2F2Ftwitter.com2FElektroWolle2Fstatus2F[PII_REDACTED]49140224widget%3DTweet
  - https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-12-14

Description:
Published in response to CVE-2021-44228, this playbook accepts a list of hosts and filenames to remediate on the endpoint. If filenames are provided, the endpoints will be searched and then the user can approve deletion. Then the user is prompted to quarantine the endpoint.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2020-12-08

Description:
This playbook resets the password of a potentially compromised user account. First, an analyst is prompted to evaluate the situation and choose whether to reset the account. If they approve, a strong password is generated and the password is reset.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-11-24

Description:
Use TruSTAR to gather threat information about indicators in a SOAR event. Tag the indicators with the normalized priority score from TruSTAR and summarize the findings in an analyst note. This playbook is meant to be used as a child playbook executed by a parent playbook such as "threat_intel_investigate".

References:
  - https://www.splunk.com/en_us/blog/security/TruSTAR-Enrich-Indicators-soar-in-seconds.html
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-02-28

Description:
Detects available indicators and routes them to dispatch related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as input and collects running processes, network connections and various system information from the device via Crowdstrike. We then generate an observable report for each. This can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-06-21

Description:
Accepts user, to be enabled using AWS IAM connector. Enabling an account involves reattaching their login profile which will require setting a new password. This playbook produces a normalized observables output for each user.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook checks for the presence of the Risk Investigation workbook and updates tasks or leaves generic notes.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/get-started-with-the-risk-notable-playbook-pack-for-splunk-soar
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2023-01-11

Description:
Detects available indicators and routes them to indicator reputation analysis playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags. https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
"This playbook prepares a risk notable for investigation by performing the following tasks: 1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD. 2. Posts a link to this container in the comment field of Splunk ES. 3. Updates the container name, description, and severity to reflect the data in the notable artifact."

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/get-started-with-the-risk-notable-playbook-pack-for-splunk-soar
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook was designed to be called by a user to process indicators that are marked as suspicious within the SOAR platform. Analysts will review indicators in a prompt and mark them as blocked or safe.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/use-the-tagging-system-with-the-playbook-pack-for-splunk-soar
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Lou Stella, Splunk
Date: 2023-01-11

Description:
Accepts a user or device and looks up the most recent attributes and groups for that user or device. This playbook produces a normalized output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-03-31

Description:
Accepts a URL or list of URLs and block them in ZScaler. Generates a list of observables with the blocked URLs.

References:
  - https://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-07-14

Description:
Accepts a domain or list of domains and block them in Cisco Umbrella. Generates a list of observables with the blocked domains.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-03-30

Description:
Accepts a file hash or domain name, and asks CrowdStrike for a list of device IDs that have interacted with each. The list of IDs is then sent back to Crowdstrike to get more information, and then produces a normalized output and summary table.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-02-03

Description:
Accepts an Internet Message ID, searches for its presence in each mailbox in the tenant, and then deletes the ones it finds. Microsoft does have a "soft-delete" option, messages run through the Message Eviction playbook will be recoverable.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-02-28

Description:
Accepts a user or device and identifies if related notables exists in a timeframe of last 24 hours. Generates a global report and list of observables.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-12-14

Description:
Investigate an internal unix host using SSH. This pushes a bash script to the endpoint and runs it, collecting information specific to the December 2021 log4j vulnerability disclosure. This includes the java version installed on the host, any running java processes, and the results of a scan for the affected JndiLookup.class file or log4j .jar files.

References:
  - https://github.com/Neo23x0/Fenrir/blob/master/fenrir.sh
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/build-playbooks-compatible-with-the-dispatch_input_playbooks-utility
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/use-the-tagging-system-with-the-playbook-pack-for-splunk-soar
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-01-21

Description:
The hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Eric Li, Splunk
Date: 2023-08-22

Description:
Accepts a user or device and identifies if related tickets exists in a timeframe of last 30 days. Generates a global report and list of observables.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk; Kelby Shelton, Splunk
Date: 2023-03-24

Description:
Accepts url link, domain or vault_id (hash) to be detonated using Splunk Attacker (SAA) API connector. This playbook produces a normalized output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as well as a file hash as input and add an indicator (IOC) for a device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report. Both reports can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-03-06

Description:
Detects available entities and routes them to attribute lookup playbooks. The output of the playbooks will create new artifacts for any technologies that returned information.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-11-01

Description:
Find AWS accounts that have not been used for a long time (90 days by default). For each unused account, gather additional group and policy information and create an artifact to enable further automation or manual action.

References:
  - https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-finding-and-disabling-inactive-users-on-aws.html
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook finds related events based on key fields in a risk notable and allows the user to process the results and decide which events to merge into the current investigation.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/get-started-with-the-risk-notable-playbook-pack-for-splunk-soar
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook attempts to find assets and users from the notable event and match those with assets and identities from Splunk ES. If a match was found and the user has playbooks available to contain entities, the analyst decides which entities to disable or quarantine.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/build-playbooks-compatible-with-the-dispatch_input_playbooks-utility
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2018-02-04

Description:
This playbook investigates and contains ransomware detected on endpoints.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-05-08

Description:
Accepts user, to be disabled using Microsoft AD LDAP connector. This playbook produces a normalized observables output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-11-30

Description:
This parent playbook collects data and launches appropriate child playbooks to gather threat intelligence information about indicators. After the child playbooks have run, this playbook posts the notes to the container and prompts the analyst to add tags to each enriched indicator based on the intelligence provided.

References:
  - https://www.splunk.com/en_us/blog/security/TruSTAR-Enrich-Indicators-soar-in-seconds.html
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-05-12

Description:
Accepts an internet message id, and asks Gmail for a list of mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk; Kelby Shelton, Splunk
Date: 2023-03-31

Description:
Accepts a file_hash, domain, IP address, or URL, and asks Splunk for a list of devices that have interacted with each. It then produces a normalized output and summary table.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook locates available playbooks with the response tag and presents them to the analyst. Based on the analyst selection, it will launch its chosen playbook.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/build-playbooks-compatible-with-the-dispatch_input_playbooks-utility
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-03-30

Description:
Accepts a file_hash or domain name, and asks Windows Defender ATP for a list of devices that have interacted with each. It then produces a normalized output and summary table.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-03-29

Description:
This playbook acts upon events where a file has been determined to be malicious (ie webshells being dropped on an end host). Before deleting the file, we run a "more" command on the file in question to extract its contents. We then run a delete on the file in question.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-05-19

Description:
Accepts a URL or list of URLs as input. Uses Panorama to block the given URLs in Palo Alto Firewall.

References:
  - https://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-11-01

Description:
Disable a list of AWS IAM user accounts. After checking the list of accounts against an allowlist and confirming with an analyst, each account is disabled. The change can be reversed with the `enable user` action.

References:
  - https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-finding-and-disabling-inactive-users-on-aws.html
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-05-22

Description:
Accepts a list of URLs and blocks them. Generates a global report and list of observables.

References:
  - https://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2023-12-23

Description:
Leverages Splunk technologies to determine if a .eml or .msg file in the vault is malicious, whether or not it contained suspect URLs or Files, and who may have interacted with the IoCs (email, URLs, or Files).
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-03-30

Description:
Automatically dispatches input playbooks with the 'sandbox' tag. This will produce a merge report and indicator tag for each inputs.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2023-01-11

Description:
Accepts a URL and does reputation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized as desired.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-06-21

Description:
Accepts user, to be unlocked using Microsoft AD LDAP connector. This playbook produces a normalized observable output for each user.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-01-21

Description:
This playbook investigates and remediates malware infections on the endpoint.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-02-15

Description:
Accepts an Internet Message ID and an email mailbox, searches for the Message ID's presence in each mailbox's recoverable deleted items, and then restores the ones it finds.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Patrick Bareiss, Teoderick Contreras, Lou Stella Splunk
Date: 2023-03-06

Description:
Moves the event status to open and then launches the Dispatch playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
{'type': 'str', 'description': 'Description of the lookup', 'required': True}
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
{'type': 'str', 'description': 'Description of the macro', 'required': True}
Sigma Detection Rule: 
Repository: splunk/security_content
Status: {'type': 'str', 'description': 'Status of the detection', 'enum': ['production', 'experimental', 'deprecated'], 'required': True}
Author: {'type': 'str', 'description': 'Author of the detection', 'required': True}
Date: {'type': 'str', 'description': 'Date of the detection, update this every time a change is made to the file', 'required': True}

Description:
{'type': 'str', 'description': 'Description of the detection', 'required': True}

References:
  - list
  - List of references to the MITRE ATT&CK, details of attack vector, blog posts, vulnerabilities, etc.
  - False
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of potentially abused libraries in Windows
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of privileged Azure Active Directory roles, includes updates for 2024 and template IDs.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk Threat Research Team
Date: 2025-10-22

Description:
A list that maps filetypes in cisco secure firewall threat defense with their ids and description
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of used Kuberntes Container Network IO Ratio
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-10-21

Description:
A subset of utilities provided by NirSoft that may be used by adversaries.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-05

Description:
A list of named pipes used with known RMM tooling.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain translations for AD object ace type strings
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of used AWS regions
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of dynammic dns providers that can be modified
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick
Date: 2025-02-07

Description:
A list of suspicious Windows Scheduled Task names and locations
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain translations for AD object ace access rights strings
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for a list of cmd line arugments that been seen before
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
List of domain admins
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-04

Description:
A list of named pipes used with known PUA tooling.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A csv of the ID and rule name for AppLocker event codes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-04-04

Description:
A list of Remote Access Software
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for the list of previously seen AWS provisioning activity
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of used Kuberntes Container Network IO
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for a list of IPs that have access S3
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of previously seen users creating cloud instances
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of used Kuberntes Process Resource
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-12-29

Description:
A list of suspicious extensions for email attachments