admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Manual Testing flag due to ES Lookups

Browse Source
This commit is contained in:
ljstella
2024-07-25 10:52:00 -05:00
parent 8b3c53f1a0
commit a86ea6fa51
5 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+2 -1
View File
@@ -65,7 +65,8 @@ tags:
- process_name
- process
risk_score: 25
security_domain: endpoint
security_domain: endpoint
manual_test: This detection uses A&I lookups from Enterprise Security.
tests:
- name: True Positive Test
attack_data:
detections/endpoint/detect_remote_access_software_usage_process.yml
+1
View File
@@ -79,6 +79,7 @@ tags:
- Processes.parent_process_name
risk_score: 25
security_domain: endpoint
manual_test: This detection uses A&I lookups from Enterprise Security.
tests:
- name: True Positive Test
attack_data:
detections/network/detect_remote_access_software_usage_dns.yml
+1
View File
@@ -65,6 +65,7 @@ tags:
- DNS.answer
risk_score: 25
security_domain: endpoint
manual_test: This detection uses A&I lookups from Enterprise Security.
tests:
- name: True Positive Test
attack_data:
detections/network/detect_remote_access_software_usage_traffic.yml
+1
View File
@@ -65,6 +65,7 @@ tags:
- user
risk_score: 25
security_domain: network
manual_test: This detection uses A&I lookups from Enterprise Security.
tests:
- name: True Positive Test
attack_data:
detections/web/detect_remote_access_software_usage_url.yml
+1
View File
@@ -72,6 +72,7 @@ tags:
- Web.url_domain
risk_score: 25
security_domain: network
manual_test: This detection uses A&I lookups from Enterprise Security.
tests:
- name: True Positive Test
attack_data: