admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'CRL-1766-auth-dm-updates' of github.com:splunk/security-content into CRL-1766-auth-dm-updates

Browse Source 
fixed conflict from merging in develop
This commit is contained in:
Rico Valdez
2020-06-16 11:12:31 -06:00
parent e244df84af 48dc133d41
commit ef9b67ea6d
3 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/aws_cross_account_activity_from_previously_unseen_account___dm.yml
+1 -1
View File
@@ -27,7 +27,7 @@ known_false_positives: Using multiple AWS accounts and roles is perfectly valid
You should validate with the account owner that this is a legitimate request.
tags:
analytics_story:
- Suspicious Cloud Authentication Activites
- Suspicious Cloud Authentication Activities
kill_chain_phases:
- Actions on Objectives
cis20:
docs/README.md
+13 -13
View File
@@ -32,21 +32,21 @@ If you want to help the rest of the security community by sharing your own detec
## Content Parts
* [stories/](stories/): All Analytic Stories
* [detections/](detections/): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
* [response_tasks/](response_tasks/): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
* [responses/](responses/): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
* [baselines/](baselines/): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
* [stories/](https://github.com/splunk/security-content/tree/develop/stories): All Analytic Stories
* [detections/](https://github.com/splunk/security-content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
* [response_tasks/](https://github.com/splunk/security-content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
* [responses/](https://github.com/splunk/security-content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
* [baselines/](https://github.com/splunk/security-content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
#### Content Spec Files
* [stories](docs/spec/stories.spec.md)
* [detections](docs/spec/detections.spec.md)
* [deployments](docs/spec/deployments.spec.md)
* [responses](docs/spec/responses.spec.md)
* [response_tasks](docs/spec/response_tasks.spec.md)
* [baselines](docs/spec/baselines.spec.md)
* [lookups](docs/spec/lookups.spec.md)
* [macros](docs/spec/macros.spec.md)
* [stories](https://github.com/splunk/security-content/blob/develop/docs/spec/stories.spec.md)
* [detections](https://github.com/splunk/security-content/blob/develop/docs/spec/detections.spec.md)
* [deployments](https://github.com/splunk/security-content/blob/develop/docs/spec/deployments.spec.md)
* [responses](https://github.com/splunk/security-content/blob/develop/docs/spec/responses.spec.md)
* [response_tasks](https://github.com/splunk/security-content/blob/develop/docs/spec/response_tasks.spec.md)
* [baselines](https://github.com/splunk/security-content/blob/develop/docs/spec/baselines.spec.md)
* [lookups](https://github.com/splunk/security-content/blob/develop/docs/spec/lookups.spec.md)
* [macros](https://github.com/splunk/security-content/blob/develop/docs/spec/macros.spec.md)
requirements.txt
+3 -3
View File
@@ -17,7 +17,7 @@ MarkupSafe==1.1.1
more-itertools==8.3.0
nodeenv==1.4.0
pathlib2==2.3.5
pre-commit==2.5.0
pre-commit==2.5.1
pyrsistent==0.16.0
python-dateutil==2.8.1
pytz==2020.1
@@ -29,8 +29,8 @@ simplejson==3.17.0
six==1.15.0
stix2==1.4.0
stix2-patterns==1.3.0
taxii2-client==2.0.0
toml==0.10.0
taxii2-client==2.1.0
toml==0.10.1
typing==3.7.4.1
urllib3==1.25.9
virtualenv==20.0.21