admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-10-26 13:59:08 -07:00
committed by GitHub
parent 3845d1f17e 01ecf54b1f
commit 2a809e2d79
32 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/activedirectory_reset_password.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- compromisedUserName
product:
playbooks/aws_disable_user_accounts.yml
+1
View File
@@ -15,6 +15,7 @@ tags:
platform_tags:
- Cloud
playbook_type: Input
vpe_type: Modern
playbook_fields:
- aws_username
product:
playbooks/aws_find_inactive_users.yml
+1
View File
@@ -16,6 +16,7 @@ tags:
platform_tags:
- Cloud
playbook_type: Automation
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/block_indicators.yml
+1
View File
@@ -15,6 +15,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- destinationDnsDomain
- destinationAddress
playbooks/crowdstrike_malware_triage.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- filePath
- destinationAddress
playbooks/delete_detected_files.yml
+1
View File
@@ -17,6 +17,7 @@ tags:
- Executable File Written in Administrative SMB Share
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- filePath
- destinationAddress
playbooks/email_notification_for_malware.yml
+1
View File
@@ -16,6 +16,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- fileHash
- vaultId
playbooks/hunting.yml
+1
View File
@@ -17,6 +17,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- fileHash
- vault_id
playbooks/internal_host_splunk_investigate_log4j.yml
+1
View File
@@ -16,6 +16,7 @@ tags:
- Log4Shell CVE-2021-44228
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields:
- hostName
- destinationAddress
playbooks/internal_host_ssh_investigate.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_ssh_log4j_investigate.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_ssh_log4j_respond.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_winrm_investigate.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_winrm_log4j_investigate.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_winrm_log4j_respond.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Input
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/log4j_investigate.yml
+1
View File
@@ -30,5 +30,6 @@ tags:
- Detect Outbound LDAP Traffic
playbook_fields: []
playbook_type: Automation
vpe_type: Modern
product:
- Splunk SOAR
playbooks/log4j_respond.yml
+1
View File
@@ -30,5 +30,6 @@ tags:
- Detect Outbound LDAP Traffic
playbook_fields: []
playbook_type: Automation
vpe_type: Modern
product:
- Splunk SOAR
playbooks/malware_hunt_and_contain.yml
+1
View File
@@ -16,6 +16,7 @@ app_list:
tags:
platform_tags: []
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- fileHash
product:
playbooks/ransomware_investigate_and_contain.yml
+1
View File
@@ -23,6 +23,7 @@ tags:
platform_tags:
- Ransomware
playbook_type: Automation
vpe_type: Classic
playbook_fields:
- ComputerName
- Username
playbooks/risk_notable_block_indicators.yml
+1
View File
@@ -19,6 +19,7 @@ tags:
- note_title
- note_content
playbook_type: Automation
vpe_type: Modern
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_enrich.yml
+1
View File
@@ -18,6 +18,7 @@ tags:
- note_title
- note_content
playbook_type: Automation
vpe_type: Modern
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_import_data.yml
+1
View File
@@ -35,6 +35,7 @@ tags:
platform_tags:
- Risk Notable
playbook_type: Automation
vpe_type: Modern
playbook_fields:
- event_id
- info_min_time
playbooks/risk_notable_investigate.yml
+1
View File
@@ -15,6 +15,7 @@ tags:
labels:
- risk_notable
playbook_type: Automation
vpe_type: Modern
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_merge_events.yml
+1
View File
@@ -18,6 +18,7 @@ tags:
- note_title
- note_content
playbook_type: Automation
vpe_type: Modern
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_mitigate.yml
+1
View File
@@ -14,6 +14,7 @@ tags:
labels:
- risk_notable
playbook_type: Automation
vpe_type: Modern
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_preprocess.yml
+1
View File
@@ -21,6 +21,7 @@ tags:
platform_tags:
- Risk Notable
playbook_type: Automation
vpe_type: Modern
playbook_fields:
- event_id
- info_min_time
playbooks/risk_notable_protect_assets_and_users.yml
+1
View File
@@ -18,6 +18,7 @@ tags:
- note_title
- note_content
playbook_type: Automation
vpe_type: Modern
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_review_indicators.yml
+1
View File
@@ -17,5 +17,6 @@ tags:
platform_tags:
- Risk Notable
playbook_type: Automation
vpe_type: Modern
product:
- Splunk SOAR
playbooks/risk_notable_verdict.yml
+1
View File
@@ -17,5 +17,6 @@ tags:
platform_tags:
- Risk Notable
playbook_type: Automation
vpe_type: Modern
product:
- Splunk SOAR
playbooks/start_investigation.yml
+1
View File
@@ -13,5 +13,6 @@ tags:
platform_tags: []
playbook_fields: []
playbook_type: Automation
vpe_type: Modern
product:
- Splunk SOAR
playbooks/threat_intel_investigate.yml
+1
View File
@@ -14,6 +14,7 @@ tags:
platform_tags:
- threat_intel
playbook_type: Automation
vpe_type: Modern
playbook_fields: []
product:
- Splunk SOAR
playbooks/trustar_enrich_indicators.yml
+1
View File
@@ -16,6 +16,7 @@ tags:
- threat_intel
- risk_notable
playbook_type: Input
vpe_type: Modern
playbook_fields:
- indicators
product: