contentctl icon indicating copy to clipboard operation
contentctl copied to clipboard

The "User Name" type should map to a "user" risk object and not "other"

Open cmcginley-splunk opened this issue 1 year ago • 0 comments

  • In detection_abstract.py we look for observable of type username
  • In practice, the valid type (see SES_OBSERVABLE_TYPE_MAPPING) is User Name; Username/username is invalid and static validation does not allwo for these values
  • This is causing a handful of detections to create risk objects of type other instead of type user
  • Additionally, device is not a valid observable type per SES_OBSERVABLE_TYPE_MAPPING (used in validation)

cmcginley-splunk avatar Aug 20 '24 06:08 cmcginley-splunk