removing CODEOWNERS

CODEOWNERS

@@ -1,2 +0,0 @@
-# Set a default so everything is owned by a codeowner
-* @okta-groups/sg-apps-strt-admin

dist/DA-ESS-ContentUpdate/default/app.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -10,7 +10,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 20240129185619
+build = 20240130211859
 
 [triggers]
 reload.analytic_stories = simple

dist/DA-ESS-ContentUpdate/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/content-version.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -217,6 +217,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_information_disclosure_in_splunk_add_on_builder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [splunk_list_all_nonstandard_admin_accounts_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -997,6 +1001,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[kubernetes_anomalous_inbound_network_activity_from_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [kubernetes_anomalous_inbound_outbound_network_io_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1005,6 +1013,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[kubernetes_anomalous_outbound_network_activity_from_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_anomalous_traffic_on_network_edge_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [kubernetes_aws_detect_suspicious_kubectl_calls_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1025,6 +1041,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[kubernetes_newly_seen_tcp_edge_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_newly_seen_udp_edge_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [kubernetes_nginx_ingress_lfi_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4617,6 +4641,30 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_impair_defense_change_win_defender_health_check_intervals_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_change_win_defender_quick_scan_interval_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_change_win_defender_throttle_rate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_change_win_defender_tracing_level_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_configure_app_install_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_define_win_defender_threat_action_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_impair_defense_delete_win_defender_context_menu_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4629,6 +4677,70 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_impair_defense_disable_controlled_folder_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_defender_firewall_and_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_defender_protocol_recognition_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_pua_protection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_realtime_signature_delivery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_web_evaluation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_app_guard_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_compute_file_hashes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_gen_reports_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_network_protection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_report_infection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_scan_on_update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_disable_win_defender_signature_retirement_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_overide_win_defender_phishing_filter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_override_smartscreen_prompt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_impair_defenses_disable_hvci_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4921,6 +5033,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_msiexec_hidewindow_rundll32_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_msiexec_remote_download_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5113,6 +5229,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_process_injection_in_non_service_searchindexer_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_process_injection_into_notepad_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5929,6 +6049,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[jenkins_arbitrary_file_read_cve_2024_23897_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [jetbrains_teamcity_rce_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -6128,7 +6252,7 @@ definition = sourcetype=PwSh:DriverInventory
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [dynamic_dns_providers]
-definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
+definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
 description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
 
 [dynamic_dns_web_traffic]

dist/DA-ESS-ContentUpdate/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-29T18:59:00 UTC
+# On Date: 2024-01-30T21:21:34 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/api/version.json

@@ -1 +1 @@
-{"version": {"name": "v4.22.0", "published_at": "2024-01-24T21:47:35Z"}}
+{"version": {"name": "v4.23.0", "published_at": "2024-01-30T21:25:29Z"}}