Merge pull request #837 from splunk/tor_traffic

Tor data
splunk · Sep 20, 2023 · d5388e6 · d5388e6
2 parents bcb08bf + 6f21f9e
commit d5388e6
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log b/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log
diff --git a/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.yml b/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.yml
@@ -0,0 +1,12 @@
+author: Bhavin Patel, Splunk
+id: 7bf3cd9f-08b8-45f4-93f4-0711175fb1e0
+date: '2023-09-20'
+description: Generated datasets for allowed tor traffic.
+environment: attack range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log
+sourcetypes:
+- pan:traffic
+references:
+  - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK
+  - https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks.