Skip to content

Commit

Permalink
updating dataset
Browse files Browse the repository at this point in the history
  • Loading branch information
@patel-bhavin
patel-bhavin committed Mar 12, 2024
1 parent 56631ea commit 9c33a2a
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 1 deletion.
2 changes: 1 addition & 1 deletion datasets/attack_techniques/T1566/zscalar_web_proxy.txt
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{ "datetime": "2023-11-06 16:49:46 GMT", "reason": "Not allowed to browse this category", "event_id": "0000000000000000000", "protocol": "HTTPS", "action": "Blocked", "zstenantid": "zs0-0000000", "zstenantdomain": "example.com", "transactionsize": "15319", "responsesize": "14662", "requestsize": "657", "urlcategory": "Other Information Technology", "serverip": "00.000.00.000", "clienttranstime": "0", "requestmethod": "POST", "refererURL": "dummy-referer.example.com", "useragent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/00.0.0000.00 Safari/537.36", "product": "NSS", "location": "Road Warrior", "ClientIP": "00.000.0.000", "status": "403", "user": "[email protected]", "url": "dummy-url.example.com", "vendor": "Zscaler", "hostname": "dummy-hostname.example.com", "clientpublicIP": "000.00.00.000", "threatcategory": "None", "threatname": "r-adware-r", "filetype": "None", "appname": "General Browsing", "pagerisk": "0", "department": "0000DepartmentCode", "urlsupercategory": "Information Technology", "appclass": "General Browsing", "dlpengine": "None", "dlp_allow": "NA", "urlclass": "Business Use", "threatclass": "Behavior Analysis", "dlpdictionaries": "None", "dlphitcount": "None", "fileclass": "None", "servertranstime": "0", "contenttype": "Other", "unscannabletype": "None", "deviceowner": "dummyowner", "devicehostname": "DUMMY-HOSTNAME", "clientsslcipher": "TLS1_3_CK_AES_256_GCM_SHA384", "clientsslsessreuse": "NO", "clienttlsversion": "TLS1_3", "deviceappversion": "0.0.0.0", "devicename": "dummy-device-name", "deviceostype": "Dummy OS", "deviceosversion": "Dummy OS Version", "filename": "None", "filesubtype": "None", "md5": "d41d8cd98f00b204e9800998ecf8427e", "mobappcat": "None", "mobappname": "None", "mobdevtype": "None", "respcode": "403", "respversion": "1.1", "rulelabel": "Dummy Rule Label", "ruletype": "UrlCat", "serversslsessreuse": "UNKNOWN", "srvcertchainvalpass": "PASS", "srvcertvalidationtype": "DV", "srvcertvalidityperiod": "MEDIUM", "srvocspresult": "None", "srvsslcipher": "None", "srvtlsversion": "None", "srvwildcardcert": "NO", "ssldecrypted": "Yes", "externalspr": "INSPECTED", "trafficredirectmethod": "DummyRedirectMethod", "datacenter": "DC1", "datacentercity": "City", "datacentercountry": "CT", "df_hostname": "None", "df_hosthead": "None" }
{ "datetime": "2023-11-06 16:49:47 GMT", "reason": "Not allowed to browse this category", "event_id": "0000000000000000000", "protocol": "HTTPS", "action": "Blocked", "zstenantid": "zs0-0000000", "zstenantdomain": "example.com", "transactionsize": "15319", "responsesize": "14662", "requestsize": "657", "urlcategory": "Other Information Technology", "serverip": "00.000.00.000", "clienttranstime": "0", "requestmethod": "POST", "refererURL": "dummy-referer.example.com", "useragent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/00.0.0000.00 Safari/537.36", "product": "NSS", "location": "Road Warrior", "ClientIP": "00.000.0.000", "status": "403", "user": "[email protected]", "url": "dummy-url.example.com", "vendor": "Zscaler", "hostname": "dummy-hostname.example.com", "clientpublicIP": "000.00.00.000", "threatcategory": "None", "threatname": "r-adware-r", "filetype": "None", "appname": "General Browsing", "pagerisk": "0", "department": "0000DepartmentCode", "urlsupercategory": "Information Technology", "appclass": "General Browsing", "dlpengine": "None", "dlp_allow": "NA", "urlclass": "Business Use", "threatclass": "Behavior Analysis", "dlpdictionaries": "None", "dlphitcount": "None", "fileclass": "None", "servertranstime": "0", "contenttype": "Other", "unscannabletype": "None", "deviceowner": "dummyowner", "devicehostname": "DUMMY-HOSTNAME", "clientsslcipher": "TLS1_3_CK_AES_256_GCM_SHA384", "clientsslsessreuse": "NO", "clienttlsversion": "TLS1_3", "deviceappversion": "0.0.0.0", "devicename": "dummy-device-name", "deviceostype": "Dummy OS", "deviceosversion": "Dummy OS Version", "filename": "None", "filesubtype": "None", "md5": "d41d8cd98f00b204e9800998ecf8427e", "mobappcat": "None", "mobappname": "None", "mobdevtype": "None", "respcode": "403", "respversion": "1.1", "rulelabel": "Dummy Rule Label", "ruletype": "UrlCat", "serversslsessreuse": "UNKNOWN", "srvcertchainvalpass": "PASS", "srvcertvalidationtype": "DV", "srvcertvalidityperiod": "MEDIUM", "srvocspresult": "None", "srvsslcipher": "None", "srvtlsversion": "None", "srvwildcardcert": "NO", "ssldecrypted": "Yes", "externalspr": "INSPECTED", "trafficredirectmethod": "DummyRedirectMethod", "datacenter": "DC1", "datacentercity": "City", "datacentercountry": "CT", "df_hostname": "None", "df_hosthead": "None" }
{ "datetime": "2023-11-06 16:49:47 GMT", "reason": "Not allowed to browse this category", "event_id": "0000000000000000001", "protocol": "HTTPS", "action": "Blocked", "zstenantid": "zs0-0000000", "zstenantdomain": "example.com", "transactionsize": "15319", "responsesize": "14662", "requestsize": "657", "urlcategory": "Other Information Technology", "serverip": "00.000.00.000", "clienttranstime": "0", "requestmethod": "POST", "refererURL": "dummy-referer.example.com", "useragent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/00.0.0000.00 Safari/537.36", "product": "NSS", "location": "Road Warrior", "ClientIP": "00.000.0.000", "status": "403", "user": "[email protected]", "url": "dummy-url.example.com", "vendor": "Zscaler", "hostname": "dummy-hostname.example.com", "clientpublicIP": "000.00.00.000", "threatcategory": "None", "threatname": "r-miner-r", "filetype": "None", "appname": "General Browsing", "pagerisk": "0", "department": "0000DepartmentCode", "urlsupercategory": "Information Technology", "appclass": "General Browsing", "dlpengine": "None", "dlp_allow": "NA", "urlclass": "Business Use", "threatclass": "None", "dlpdictionaries": "None", "dlphitcount": "None", "fileclass": "None", "servertranstime": "0", "contenttype": "Other", "unscannabletype": "None", "deviceowner": "dummyowner", "devicehostname": "DUMMY-HOSTNAME", "clientsslcipher": "TLS1_3_CK_AES_256_GCM_SHA384", "clientsslsessreuse": "NO", "clienttlsversion": "TLS1_3", "deviceappversion": "0.0.0.0", "devicename": "dummy-device-name", "deviceostype": "Dummy OS", "deviceosversion": "Dummy OS Version", "filename": "None", "filesubtype": "None", "md5": "d41d8cd98f00b204e9800998ecf8427e", "mobappcat": "None", "mobappname": "None", "mobdevtype": "None", "respcode": "403", "respversion": "1.1", "rulelabel": "Dummy Rule Label", "ruletype": "UrlCat", "serversslsessreuse": "UNKNOWN", "srvcertchainvalpass": "PASS", "srvcertvalidationtype": "DV", "srvcertvalidityperiod": "MEDIUM", "srvocspresult": "None", "srvsslcipher": "None", "srvtlsversion": "None", "srvwildcardcert": "NO", "ssldecrypted": "Yes", "externalspr": "INSPECTED", "trafficredirectmethod": "DummyRedirectMethod", "datacenter": "DC1", "datacentercity": "City", "datacentercountry": "CT", "df_hostname": "None", "df_hosthead": "None" }
{ "datetime": "2023-11-06 16:49:48 GMT", "reason": "Not allowed to browse this category", "event_id": "0000000000000000002", "protocol": "HTTPS", "action": "Blocked", "zstenantid": "zs0-0000000", "zstenantdomain": "example.com", "transactionsize": "15319", "responsesize": "14662", "requestsize": "657", "urlcategory": "Other Information Technology", "serverip": "00.000.00.000", "clienttranstime": "0", "requestmethod": "POST", "refererURL": "dummy-referer.example.com", "useragent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/00.0.0000.00 Safari/537.36", "product": "NSS", "location": "Road Warrior", "ClientIP": "00.000.0.000", "status": "403", "user": "[email protected]", "url": "dummy-url.example.com", "vendor": "Zscaler", "hostname": "dummy-hostname.example.com", "clientpublicIP": "000.00.00.000", "threatcategory": "None", "threatname": "HTML.Phish.Genjp", "filetype": "None", "appname": "General Browsing", "pagerisk": "0", "department": "0000DepartmentCode", "urlsupercategory": "Information Technology", "appclass": "General Browsing", "dlpengine": "None", "dlp_allow": "NA", "urlclass": "Business Use", "threatclass": "None", "dlpdictionaries": "None", "dlphitcount": "None", "fileclass": "None", "servertranstime": "0", "contenttype": "Other", "unscannabletype": "None", "deviceowner": "dummyowner", "devicehostname": "DUMMY-HOSTNAME", "clientsslcipher": "TLS1_3_CK_AES_256_GCM_SHA384", "clientsslsessreuse": "NO", "clienttlsversion": "TLS1_3", "deviceappversion": "0.0.0.0", "devicename": "dummy-device-name", "deviceostype": "Dummy OS", "deviceosversion": "Dummy OS Version", "filename": "None", "filesubtype": "None", "md5": "d41d8cd98f00b204e9800998ecf8427e", "mobappcat": "None", "mobappname": "None", "mobdevtype": "None", "respcode": "403", "respversion": "1.1", "rulelabel": "Dummy Rule Label", "ruletype": "UrlCat", "serversslsessreuse": "UNKNOWN", "srvcertchainvalpass": "PASS", "srvcertvalidationtype": "DV", "srvcertvalidityperiod": "MEDIUM", "srvocspresult": "None", "srvsslcipher": "None", "srvtlsversion": "None", "srvwildcardcert": "NO", "ssldecrypted": "Yes", "externalspr": "INSPECTED", "trafficredirectmethod": "DummyRedirectMethod", "datacenter": "DC1", "datacentercity": "City", "datacentercountry": "CT", "df_hostname": "None", "df_hosthead": "None" }
{ "datetime": "2023-11-06 16:49:49 GMT", "reason": "Not allowed to browse this category", "event_id": "0000000000000000003", "protocol": "HTTPS", "action": "Blocked", "zstenantid": "zs0-0000000", "zstenantdomain": "example.com", "transactionsize": "15319", "responsesize": "14662", "requestsize": "657", "urlcategory": "Other Information Technology", "serverip": "00.000.00.000", "clienttranstime": "0", "requestmethod": "POST", "refererURL": "dummy-referer.example.com", "useragent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/00.0.0000.00 Safari/537.36", "product": "NSS", "location": "Road Warrior", "ClientIP": "00.000.0.000", "status": "403", "user": "[email protected]", "url": "dummy-url.example.com", "vendor": "Zscaler", "hostname": "dummy-hostname.example.com", "clientpublicIP": "000.00.00.000", "threatcategory": "None", "threatname": "r-scam-r", "filetype": "None", "appname": "General Browsing", "pagerisk": "0", "department": "0000DepartmentCode", "urlsupercategory": "Information Technology", "appclass": "General Browsing", "dlpengine": "None", "dlp_allow": "NA", "urlclass": "Business Use", "threatclass": "None", "dlpdictionaries": "None", "dlphitcount": "None", "fileclass": "None", "servertranstime": "0", "contenttype": "Other", "unscannabletype": "None", "deviceowner": "dummyowner", "devicehostname": "DUMMY-HOSTNAME", "clientsslcipher": "TLS1_3_CK_AES_256_GCM_SHA384", "clientsslsessreuse": "NO", "clienttlsversion": "TLS1_3", "deviceappversion": "0.0.0.0", "devicename": "dummy-device-name", "deviceostype": "Dummy OS", "deviceosversion": "Dummy OS Version", "filename": "None", "filesubtype": "None", "md5": "d41d8cd98f00b204e9800998ecf8427e", "mobappcat": "None", "mobappname": "None", "mobdevtype": "None", "respcode": "403", "respversion": "1.1", "rulelabel": "Dummy Rule Label", "ruletype": "UrlCat", "serversslsessreuse": "UNKNOWN", "srvcertchainvalpass": "PASS", "srvcertvalidationtype": "DV", "srvcertvalidityperiod": "MEDIUM", "srvocspresult": "None", "srvsslcipher": "None", "srvtlsversion": "None", "srvwildcardcert": "NO", "ssldecrypted": "Yes", "externalspr": "INSPECTED", "trafficredirectmethod": "DummyRedirectMethod", "datacenter": "DC1", "datacentercity": "City", "datacentercountry": "CT", "df_hostname": "None", "df_hosthead": "None" }
Expand Down
11 changes: 11 additions & 0 deletions datasets/attack_techniques/T1566/zscalar_web_proxy.yml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
author: Bhavin patel, Gowtham
id: e18714c0-ab84-44f6-9117-5531e3eb3a0c
date: '2024-03-12'
description: 'Synthentic Dataset generated for Zscaler detections for Blocked activities'
environment: attack_range
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon.log
sourcetypes:
- zscalernss-web
references:
- https://help.zscaler.com/zia/nss-feed-output-format-web-logs

0 comments on commit 9c33a2a

Please sign in to comment.