admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1718 from splunk/devsecops_bug

Browse Source 
errors and text updates
This commit is contained in:
Michael Haag
2021-10-12 15:01:12 -06:00
committed by GitHub
parent 08d172d13b 46b7d220cc
commit be69d68150
9 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/github_commit_changes_in_master.yml
+1 -1
View File
@@ -23,7 +23,7 @@ references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
automated_detection_testing: passed
confidence: 30
context:
detections/cloud/github_commit_in_develop.yml
+1 -1
View File
@@ -22,7 +22,7 @@ references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
automated_detection_testing: passed
confidence: 30
context:
detections/cloud/gsuite_drive_share_in_external_email.yml
+3 -3
View File
@@ -19,14 +19,14 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
| `gsuite_drive_share_in_external_email_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.
extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
known_false_positives: network admin or normal user may share files to customer and
external team.
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
confidence: 90
context:
- Source:Endpoint
@@ -46,7 +46,7 @@ tags:
- name: parameters.owner
type: User
role:
- attacker
- Attacker
- name: email
type: User
role:
detections/cloud/gsuite_email_suspicious_attachment.yml
+1 -1
View File
@@ -28,7 +28,7 @@ references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
confidence: 70
context:
- Source:Endpoint
detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+1 -1
View File
@@ -35,7 +35,7 @@ references:
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
automated_detection_testing: passed
confidence: 50
context:
detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+1 -1
View File
@@ -26,7 +26,7 @@ references:
- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
automated_detection_testing: passed
confidence: 50
context:
detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
+1 -1
View File
@@ -27,7 +27,7 @@ references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
confidence: 30
context:
- Source:Endpoint
detections/cloud/gsuite_suspicious_shared_file_name.yml
+2 -2
View File
@@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
| `gsuite_suspicious_shared_file_name_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.
extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
known_false_positives: normal user or normal transaction may contain the subject and
file type attachment that this detection try to search
references:
@@ -32,7 +32,7 @@ references:
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
tags:
analytic_story:
- DevSecOps
- Dev Sec Ops
automated_detection_testing: passed
confidence: 70
context:
stories/dev_sec_ops.yml
+1 -1
View File
@@ -14,7 +14,7 @@ narrative: DevSecOps is a collaborative framework, which thinks about applicatio
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story: DevSecOps
analytic_story: Dev Sec Ops
category:
- Cloud Security
product: