Tools for testing RBA

[ZachTheSplunker]

Question from "The Office" Hours meetup

Does anybody have an automated tool that generates simulated examples of something in the risk index (events, system calls, etc.) for testing RBA?

[ZachTheSplunker]

Answer from "The Office" Hours meetup

Splunk attack Range

• https://www.splunk.com/en_us/blog/security/introducing-splunk-attack-range-v2-0.html
• https://github.com/splunk/attack_range

Splunk Salo

• https://www.splunk.com/en_us/blog/security/introducing-synthetic-adversarial-log-objects-salo.html
• https://github.com/splunk/salo

[L0ranCyb]

https://github.com/whikernel/evtx2splunk : Ingest EVTX into a Splunk Instance