diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 3e468c1..71a98d0 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -131,8 +131,8 @@ install_splunk() { /opt/splunk/bin/splunk add index zeek -auth 'admin:changeme' /opt/splunk/bin/splunk add index suricata -auth 'admin:changeme' /opt/splunk/bin/splunk add index threathunting -auth 'admin:changeme' - /opt/splunk/bin/splunk install app /vagrant/resources/splunk_forwarder/splunk-add-on-for-microsoft-windows_500.tgz -auth 'admin:changeme' - /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_800.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_forwarder/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_1062.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/asn-lookup-generator_101.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/lookup-file-editor_331.tgz -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-zeek-aka-bro_400.tgz -auth 'admin:changeme' @@ -151,22 +151,22 @@ install_splunk() { ### BOTSv2 COMMENT BLOCK BEGINS ### # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_241.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_306.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' - # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_16.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_18.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' ### UNCOMMENT THIS BLOCK FOR THE ATTACK-ONLY DATASET (Recommended) ### @@ -187,6 +187,56 @@ install_splunk() { ### BOTSv2 COMMENT BLOCK ENDS ### + # Uncomment the following block to install BOTSv3 + # Thanks to @MHaggis for this addition! + # More information on BOTSv3 can be found at https://github.com/splunk/botsv3 + + ### BOTSv3 COMMENT BLOCK BEGINS ### + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/base64_11.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/jellyfisher_010.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz -auth 'admin:changeme' # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard_admin-master.zip -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/SA-ctf_scoreboard-master.zip -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/sa-investigator-for-enterprise-security_200.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-apache-web-server_100.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-iis_101.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-ta-for-suricata_233.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ssl-certificate-checker_32.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/website-monitoring_274.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/amazon-guardduty-add-on-for-splunk_104.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/cisco-anyconnect-network-visibility-module-nvm-app-for-splunk_20187.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/code42-for-splunk_3012.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/decrypt_20.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/microsoft-365-app-for-splunk_301.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/microsoft-azure-add-on-for-splunk_202.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-amazon-web-services_500.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-cisco-asa_340.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_401.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-office-365_201.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-sysmon_1062.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_301.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-tenable_514.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-es-content-update_1052.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-security-essentials_306.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/splunk-stream_720.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/ta-for-code42-app-for-splunk_3012.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/url-toolbox_18.tgz -auth 'admin:changeme' + # /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/virustotal-workflow-actions-for-splunk_020.tgz -auth 'admin:changeme' + + ### UNCOMMENT THIS BLOCK FOR THE ATTACK-ONLY DATASET (Recommended) ### + # echo "[$(date +%H:%M:%S)]: Downloading Splunk BOTSv3 Attack Only Dataset..." + # wget --progress=bar:force -P /opt/ https://botsdataset.s3.amazonaws.com/botsv3/botsv3_data_set.tgz + # echo "[$(date +%H:%M:%S)]: Download Complete." + # echo "[$(date +%H:%M:%S)]: Extracting to Splunk Apps directory" + # tar zxvf /opt/botsv3_data_set.tgz -C /opt/splunk/etc/apps/ + ### ATTACK-ONLY COMMENT BLOCK ENDS ### + + ### BOTSv3 COMMENT BLOCK ENDS ### + + # Add custom Macro definitions for ThreatHunting App cp /vagrant/resources/splunk_server/macros.conf /opt/splunk/etc/apps/ThreatHunting/default/macros.conf # Fix Windows TA macros diff --git a/Vagrant/resources/splunk_server/amazon-guardduty-add-on-for-splunk_104.tgz b/Vagrant/resources/splunk_server/amazon-guardduty-add-on-for-splunk_104.tgz new file mode 100644 index 0000000..5635f0f Binary files /dev/null and b/Vagrant/resources/splunk_server/amazon-guardduty-add-on-for-splunk_104.tgz differ diff --git a/Vagrant/resources/splunk_server/cisco-anyconnect-network-visibility-module-nvm-app-for-splunk_20187.tgz b/Vagrant/resources/splunk_server/cisco-anyconnect-network-visibility-module-nvm-app-for-splunk_20187.tgz new file mode 100644 index 0000000..fb81a86 Binary files /dev/null and b/Vagrant/resources/splunk_server/cisco-anyconnect-network-visibility-module-nvm-app-for-splunk_20187.tgz differ diff --git a/Vagrant/resources/splunk_server/code42-for-splunk_3012.tgz b/Vagrant/resources/splunk_server/code42-for-splunk_3012.tgz new file mode 100644 index 0000000..29a2698 Binary files /dev/null and b/Vagrant/resources/splunk_server/code42-for-splunk_3012.tgz differ diff --git a/Vagrant/resources/splunk_server/decrypt_20.tgz b/Vagrant/resources/splunk_server/decrypt_20.tgz new file mode 100644 index 0000000..be3d6a6 Binary files /dev/null and b/Vagrant/resources/splunk_server/decrypt_20.tgz differ diff --git a/Vagrant/resources/splunk_server/microsoft-365-app-for-splunk_301.tgz b/Vagrant/resources/splunk_server/microsoft-365-app-for-splunk_301.tgz new file mode 100644 index 0000000..3dcda04 Binary files /dev/null and b/Vagrant/resources/splunk_server/microsoft-365-app-for-splunk_301.tgz differ diff --git a/Vagrant/resources/splunk_server/microsoft-azure-add-on-for-splunk_202.tgz b/Vagrant/resources/splunk_server/microsoft-azure-add-on-for-splunk_202.tgz new file mode 100644 index 0000000..26e260b Binary files /dev/null and b/Vagrant/resources/splunk_server/microsoft-azure-add-on-for-splunk_202.tgz differ diff --git a/Vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz b/Vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz new file mode 100644 index 0000000..5e60aa9 Binary files /dev/null and b/Vagrant/resources/splunk_server/osquery-app-for-splunk_060.tgz differ diff --git a/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz b/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz deleted file mode 100644 index 91de9a7..0000000 Binary files a/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_611.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz b/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz new file mode 100644 index 0000000..cd536e4 Binary files /dev/null and b/Vagrant/resources/splunk_server/palo-alto-networks-add-on-for-splunk_620.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-amazon-web-services_500.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-amazon-web-services_500.tgz new file mode 100644 index 0000000..9c314f8 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-amazon-web-services_500.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-cisco-asa_340.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-cisco-asa_340.tgz new file mode 100644 index 0000000..c04726b Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-cisco-asa_340.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz deleted file mode 100644 index 187b680..0000000 Binary files a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_310.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_401.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_401.tgz new file mode 100644 index 0000000..4bf440c Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-cloud-services_401.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-office-365_201.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-office-365_201.tgz new file mode 100644 index 0000000..cce4fd5 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-office-365_201.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-sysmon_1062.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-sysmon_1062.tgz new file mode 100644 index 0000000..28e7535 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-sysmon_1062.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz deleted file mode 100644 index 9a7a604..0000000 Binary files a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_600.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz new file mode 100644 index 0000000..5027116 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-microsoft-windows_700.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz deleted file mode 100644 index a945375..0000000 Binary files a/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_230.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_301.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_301.tgz new file mode 100644 index 0000000..eda1583 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-symantec-endpoint-protection_301.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-tenable_514.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-tenable_514.tgz new file mode 100644 index 0000000..f006a59 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-tenable_514.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz deleted file mode 100644 index 1414faa..0000000 Binary files a/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_602.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz b/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz new file mode 100644 index 0000000..fbd7039 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-add-on-for-unix-and-linux_701.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz b/Vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz deleted file mode 100644 index 168ce3c..0000000 Binary files a/Vagrant/resources/splunk_server/splunk-app-for-osquery_10.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz b/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz deleted file mode 100644 index a6a9a86..0000000 Binary files a/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4130.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz b/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz new file mode 100644 index 0000000..e94a7e5 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-common-information-model-cim_4150.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-es-content-update_1052.tgz b/Vagrant/resources/splunk_server/splunk-es-content-update_1052.tgz new file mode 100644 index 0000000..625a032 Binary files /dev/null and b/Vagrant/resources/splunk_server/splunk-es-content-update_1052.tgz differ diff --git a/Vagrant/resources/splunk_server/splunk-security-essentials_241.tgz b/Vagrant/resources/splunk_server/splunk-security-essentials_306.tgz similarity index 70% rename from Vagrant/resources/splunk_server/splunk-security-essentials_241.tgz rename to Vagrant/resources/splunk_server/splunk-security-essentials_306.tgz index f0786e3..8db36e2 100644 Binary files a/Vagrant/resources/splunk_server/splunk-security-essentials_241.tgz and b/Vagrant/resources/splunk_server/splunk-security-essentials_306.tgz differ diff --git a/Vagrant/resources/splunk_server/ta-for-code42-app-for-splunk_3012.tgz b/Vagrant/resources/splunk_server/ta-for-code42-app-for-splunk_3012.tgz new file mode 100644 index 0000000..b2929a5 Binary files /dev/null and b/Vagrant/resources/splunk_server/ta-for-code42-app-for-splunk_3012.tgz differ diff --git a/Vagrant/resources/splunk_server/url-toolbox_16.tgz b/Vagrant/resources/splunk_server/url-toolbox_16.tgz deleted file mode 100644 index 4d601de..0000000 Binary files a/Vagrant/resources/splunk_server/url-toolbox_16.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/url-toolbox_18.tgz b/Vagrant/resources/splunk_server/url-toolbox_18.tgz new file mode 100644 index 0000000..f5becf2 Binary files /dev/null and b/Vagrant/resources/splunk_server/url-toolbox_18.tgz differ diff --git a/Vagrant/resources/splunk_server/virustotal-workflow-actions-for-splunk_020.tgz b/Vagrant/resources/splunk_server/virustotal-workflow-actions-for-splunk_020.tgz new file mode 100644 index 0000000..1a57588 Binary files /dev/null and b/Vagrant/resources/splunk_server/virustotal-workflow-actions-for-splunk_020.tgz differ