changing spl and notebook for feature transformations

Author: nsreekanta

detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

@@ -14,21 +14,22 @@ description: The following analytic uses a pre trained deep learning model to
   The model is a deep learning model that accepts DNS request as input along with a few custom features to generate a
   pred_is_exfiltration_proba score. The higher the pred_is_exfiltration_proba, the more likely the DNS request is data exfiltration. 
   The threshold for flagging a request as DNS exfiltration is set at 0.5. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Network_Resolution where
-  DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest
-  DNS.answer DNS.record_type 
-  | `drop_dm_object_name("DNS")` 
-  | rename answer as text 
-  | fields firstTime, lastTime, message_type,record_type,src,dest, text 
-  | apply detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl 
-  | rename predicted_is_unknown as is_suspicious_score 
-  | where is_suspicious_score > 0.5 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | rename src as "Source IP", dest as  "Destination IP", text as "DNS Answer", record_type as "DNS Record Type" 
-  | table "Source IP","Destination IP","DNS Answer","DNS Record Type", firstTime, lastTime,is_suspicious_score
-  | `detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.src _time DNS.query 
+| `drop_dm_object_name("DNS")` 
+| sort - _time,src, query 
+| streamstats count as count by src query 
+| where count < 10 
+| table src,query,count,_time 
+| apply dns_exfil11 
+| table src,_time, query,count,pred_is_dns_data_exfiltration_proba,pred_is_dns_data_exfiltration 
+| where count == 1
+| rename pred_is_dns_data_exfiltration_proba as is_exfiltration_score
+| rename pred_is_dns_data_exfiltration as is_exfiltration
+| where is_exfiltration_score > 0.5 
+| `security_content_ctime(_time)` 
+| rename src as "Source IP" _time as "time"
+| table "Source IP","time","query","is_exfiltration_score","is_exfiltration"
+| `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter`'
 
 how_to_implement: 'Steps to deploy detect DNS data exfiltration model into Splunk App
     DSDL. This detection depends on the Splunk app for Data Science and Deep