### {{APP_NAME}} DETECTIONS ###

{% for detection in objects %}
{% if (detection.type == 'TTP' or detection.type == 'Anomaly' or detection.type == 'Hunting' or detection.type == 'Correlation') %}
[{{APP_NAME}} - {{ detection.name }} - Rule]
action.escu = 0
action.escu.enabled = 1
{% if detection.deprecated %}
description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. {{ detection.description }} 
{% else %}
description = {{ detection.description }}
{% endif %}
action.escu.mappings = {{ detection.mappings | tojson }}
action.escu.data_models = {{ detection.datamodel | tojson }}
action.escu.eli5 = {{ detection.description }}
{% if detection.how_to_implement is defined %}
action.escu.how_to_implement = {{ detection.how_to_implement }}
{% else %}
action.escu.how_to_implement = none
{% endif %}
{% if detection.known_false_positives is defined %}
action.escu.known_false_positives = {{ detection.known_false_positives }}
{% else %}
action.escu.known_false_positives = None
{% endif %}
action.escu.creation_date = {{ detection.date }}
action.escu.modification_date = {{ detection.date }}
action.escu.confidence = high
action.escu.full_search_name = {{APP_NAME}} - {{ detection.name }} - Rule
action.escu.search_type = detection
{% if detection.tags.product is defined %}
action.escu.product = {{ detection.tags.product | tojson }}
{% endif %}
{% if detection.providing_technologies is defined %}
action.escu.providing_technologies = {{ detection.providing_technologies | tojson }}
{% else %}
action.escu.providing_technologies = []
{% endif %}
{% if detection.tags.analytic_story is defined %}
action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
{% if detection.deployment.rba.enabled is defined %}
action.risk = 1
action.risk.param._risk_message = {{ detection.tags.message }}
action.risk.param._risk = {{ detection.risk | tojson }}
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
{% endif %}
{% else %}
action.escu.analytic_story = []
{% endif %}
cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
action.correlationsearch.enabled = 1
{% if detection.deprecated %}
action.correlationsearch.label = {{APP_NAME}} - Deprecated - {{ detection.name }} - Rule
{% else %}
action.correlationsearch.label = {{APP_NAME}} - {{ detection.name }} - Rule
{% endif %}
action.correlationsearch.annotations = {{ detection.annotations | tojson }}
{% if detection.deployment.scheduling.schedule_window is defined %}
schedule_window = {{ detection.deployment.scheduling.schedule_window }}
{% endif %}
{% if detection.deployment is defined %}
{% if detection.deployment.notable.rule_title is defined %}
action.notable = 1
{% if detection.nes_fields is defined %}
action.notable.param.nes_fields = {{ detection.nes_fields }}
{% endif %}
action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }}
action.notable.param.rule_title = {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}
action.notable.param.security_domain = {{ detection.tags.security_domain }}
action.notable.param.severity = high
{% endif %}
{% if detection.deployment.email.to is defined %}
action.email.subject.alert = {{ detection.deployment.email.subject | custom_jinja2_enrichment_filter(detection) }}
action.email.to = {{ detection.deployment.email.to }}
action.email.message.alert = {{ detection.deployment.email.message | custom_jinja2_enrichment_filter(detection) }}
action.email.useNSSubject = 1
{% endif %}
{% if detection.deployment.slack.channel is defined %}
action.slack = 1
action.slack.param.channel = {{ detection.deployment.slack.channel | custom_jinja2_enrichment_filter(detection) }}
action.slack.param.message = {{ detection.deployment.slack.message | custom_jinja2_enrichment_filter(detection) }}
{% endif %}
{% if detection.deployment.phantom.phantom_server is defined %}
action.sendtophantom = 1
action.sendtophantom.param._cam_workers = {{ detection.deployment.phantom.cam_workers | custom_jinja2_enrichment_filter(detection) }}
action.sendtophantom.param.label = {{ detection.deployment.phantom.label | custom_jinja2_enrichment_filter(detection) }}
action.sendtophantom.param.phantom_server = {{ detection.deployment.phantom.phantom_server | custom_jinja2_enrichment_filter(detection) }}
action.sendtophantom.param.sensitivity = {{ detection.deployment.phantom.sensitivity | custom_jinja2_enrichment_filter(detection) }}
action.sendtophantom.param.severity = {{ detection.deployment.phantom.severity | custom_jinja2_enrichment_filter(detection) }}
{% endif %}
{% endif %}
alert.digest_mode = 1
{% if detection.disabled is defined %}
disabled = false
{% else %}
disabled = true
{% endif %}
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = {{ detection.search }}

{% endif %}
{% endfor %}
### END ESCU DETECTIONS ###
