Types of detection analytics

In the ESCU app, detections have the following categories:

Each yaml file for the detection in the security_content Github repository has a field called type. These types drive the workflow on the product:

Type Description Example
TTP Designed to detect a certain adversary tactic, technique, or procedure. Attempted Credential Dump From Registry via Reg exe
Anomaly Triggers on behavior that is not normally observed. Anomalous might not be explicitly malicious but can be suspect. For example, detection of executables that are not run before or a process using the network which does not normally use the network. Add Default User And Password In Registry
Hunting Increases the risk of an asset or entity but tends to be too noisy to generate a notable event by itself. It leverages aggregated risk from various other detections to produce a notable. Also known as hunting queries. 7zip CommandLine To SMB Share Path
Correlation Correlates various detection results to identify a high-level threat and generate a notable. Living Off The Land Detection
Baseline Helps in the maintenance of the analytic or create a baseline of data that detections can leverage. Baseline Of Cloud Instances Launched
Investigation Searches that leverage tokens and are used in the pre-built panels shipped by ESCU for Investigative Workbench in Splunk Enterprise Security. AWS Investigate Security Hub alerts by dest

The following table displays how each type is configured out of the box in the ESCU app.

Analytic type Create notable Create risk and threat objects Triggers playbook Tied to a dashboard Runs on CRON schedule Enabled by default
Hunting No No No Yes No No
TTP Yes Yes Yes No Yes No
Baseline No Yes Yes No Yes No
Anomaly No Yes No No Yes No
Correlation Yes No Yes No Yes Yes
Investigation No No No Yes No No