admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #293 from splunk/briannablacet-patch-2

Browse Source 
Update README.md
This commit is contained in:
Bhavin Patel
2019-12-19 13:24:58 -08:00
committed by GitHub
parent e0020c24e6 5f43e47c2d
commit ef904c2dc8
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7
View File
@@ -113,6 +113,13 @@ To automatically generate docs from schema:
* note that [requirements.txt](https://github.com/splunk/security-content/blob/develop/requirements.txt) hard codes the versions for packages we use [dependabot](https://dependabot.com/) to make sure we safely always upgrade to the latest versions.
## Customize to Your Environment
Release 1.0.46 introduced input(pre-filter) and output(post-filter) macros for each of our detection searches. These macros let you update a macro definition once and then apply the new definition across all detections that leverage that macro. These changes will be local to your Splunk environment.
input(pre-filter): This macro specifies your environment-specific configurations (index, source, sourcetype, etc.) to get the specific data sources that you require. Replace the macro definition with configurations for your Splunk environment.
output(post-filter): This macro specifies your environment-specific values (dest, user, etc,), to filter out known false positives. Replace the macro definition with values that you'd like to exclude from detection results. Think of this as whitelisting/blacklisting using macros.
Note: Coming soon is an improved naming convention that will be consistent across all of our detections, investigations, and baselines.
## Support
Please use the [GitHub Issue Tracker](https://github.com/splunk/security-content/issues) to submit bugs or request features.