Merge branch 'develop' into rdpland

contentctl.yml

@@ -29,12 +29,6 @@ mode: {}
 splunk_api_username: null
 post_test_behavior: pause_on_failure
 apps:
-# - uid: 263
-#   title: Splunk Enterprise Security
-#   appid: SplunkEnterpriseSecuritySuite
-#   version: 7.3.1
-#   description: description of app
-#   hardcoded_path: apps/splunk-enterprise-security_731.spl
 - uid: 1621
   title: Splunk Common Information Model (CIM)
   appid: Splunk_SA_CIM
@@ -142,10 +136,10 @@ apps:
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-kinesis-firehose_132.tgz
 - uid: 1876
   title: Splunk Add-on for AWS
-  appid: Splunk_TA_aws  
-  version: 7.7.1
+  appid: Splunk_TA_aws
+  version: 7.8.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services-aws_771.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-amazon-web-services-aws_780.tgz
 - uid: 3088
   title: Splunk Add-on for Google Cloud Platform
   appid: SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM
@@ -185,9 +179,9 @@ apps:
 - uid: 6207
   title: Splunk Add-on for Microsoft Security
   appid: Splunk_TA_MS_Security
-  version: 2.3.0
+  version: 2.4.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_230.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_240.tgz
 - uid: 2734
   title: URL Toolbox
   appid: URL_TOOLBOX
@@ -207,4 +201,3 @@ apps:
   description: description of app
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/crowdstrike-falcon-event-streams-technical-add-on_321.tgz
 githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
-

data_sources/aws_cloudfront.yml

@@ -9,7 +9,7 @@ sourcetype: aws:cloudfront:accesslogs
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail.yml

@@ -10,4 +10,4 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0

data_sources/aws_cloudtrail_assumerolewithsaml.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_consolelogin.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_copyobject.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_createaccesskey.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createkey.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_createloginprofile.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createnetworkaclentry.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createpolicyversion.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createsnapshot.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_createtask.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_createvirtualmfadevice.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deactivatemfadevice.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletealarms.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletedetector.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_deletegroup.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deleteipset.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_deleteloggroup.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_deletelogstream.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_deletenetworkaclentry.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletepolicy.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deleterule.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_deletesnapshot.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletetrail.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_deletevirtualmfadevice.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletewebacl.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_describeeventaggregates.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_describeimagescanfindings.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_getobject.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_getpassworddata.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_jobcreated.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_modifydbinstance.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_modifyimageattribute.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_modifysnapshotattribute.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_putbucketacl.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_putbucketlifecycle.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_putbucketreplication.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_putbucketversioning.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_putimage.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_putkeypolicy.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_replacenetworkaclentry.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_setdefaultpolicyversion.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_stoplogging.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_updateloginprofile.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_updatesamlprovider.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_updatetrail.yml

@@ -10,7 +10,7 @@ separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - app

data_sources/aws_cloudwatchlogs_vpcflow.yml

@@ -9,7 +9,7 @@ sourcetype: aws:cloudwatchlogs:vpcflow
 separator: eventName
 supported_TA:
 - name: Splunk Add-on for AWS
-  version: 7.7.1
+  version: 7.8.0
   url: https://splunkbase.splunk.com/app/1876
 fields:
 - _raw

data_sources/aws_security_hub.yml

@@ -9,7 +9,7 @@ sourcetype: aws:securityhub:finding
 supported_TA:
 - name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.7.1
+  version: 7.8.0
 fields:
 - _time
 - AwsAccountId

data_sources/ms365_defender_incident_alerts.yml

@@ -9,7 +9,7 @@ sourcetype: ms365:defender:incident:alerts
 supported_TA:
 - name: Splunk Add-on for Microsoft Security
   url: https://splunkbase.splunk.com/app/6207
-  version: 2.3.0
+  version: 2.4.0
 fields:
 - actorName
 - alertId

data_sources/ms_defender_atp_alerts.yml

@@ -9,7 +9,7 @@ sourcetype: ms:defender:atp:alerts
 supported_TA:
 - name: Splunk Add-on for Microsoft Security
   url: https://splunkbase.splunk.com/app/6207
-  version: 2.3.0
+  version: 2.4.0
 fields:
 - column
 - accountName