admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix merge conflict in contentctl.yml. remove risk_score field from many new or updarted detections.

Browse Source
This commit is contained in:
pyth0n1c
2024-08-21 13:41:58 -07:00
parent 7d401f2d24
commit f172d78c68
36 changed files with 0 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contentctl.yml
-5
View File
@@ -182,8 +182,6 @@ apps:
version: 1.9.2
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
<<<<<<< HEAD
=======
- uid: 6853
title: Splunk Add-on for Admon Enrichment
appid: SA-admon
@@ -196,6 +194,3 @@ apps:
version: 3.2.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/crowdstrike-falcon-event-streams-technical-add-on_321.tgz
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
>>>>>>> develop
detections/application/windows_ad_dangerous_deny_acl_modification.yml
-1
View File
@@ -63,7 +63,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_dangerous_group_acl_modification.yml
-1
View File
@@ -67,7 +67,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_dangerous_user_acl_modification.yml
-1
View File
@@ -67,7 +67,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_dcshadow_privileges_acl_addition.yml
-1
View File
@@ -64,7 +64,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_domain_root_acl_deletion.yml
-1
View File
@@ -63,7 +63,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_domain_root_acl_modification.yml
-1
View File
@@ -63,7 +63,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_gpo_deleted.yml
-1
View File
@@ -43,7 +43,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 64
required_fields:
- _time
- OperationType
detections/application/windows_ad_gpo_disabled.yml
-1
View File
@@ -38,7 +38,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 64
required_fields:
- _time
- OperationType
detections/application/windows_ad_gpo_new_cse_addition.yml
-1
View File
@@ -50,7 +50,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_hidden_ou_creation.yml
-1
View File
@@ -62,7 +62,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_object_owner_updated.yml
-1
View File
@@ -57,7 +57,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_privileged_group_modification.yml
-1
View File
@@ -36,7 +36,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 50
required_fields:
- EventCode
- user
detections/application/windows_ad_self_dacl_assignment.yml
-1
View File
@@ -58,7 +58,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 80
required_fields:
- _time
- OperationType
detections/application/windows_ad_suspicious_attribute_modification.yml
-1
View File
@@ -52,7 +52,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
detections/application/windows_ad_suspicious_gpo_modification.yml
-1
View File
@@ -68,7 +68,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 80
required_fields:
- _time
- OperationType
detections/cloud/o365_application_available_to_other_tenants.yml
-1
View File
@@ -55,7 +55,6 @@ tags:
- UserId
- Workload
- Target{}.ID
risk_score: 50
security_domain: threat
tests:
- name: True Positive Test
detections/cloud/o365_cross_tenant_access_change.yml
-1
View File
@@ -52,7 +52,6 @@ tags:
- ModifiedProperties{}.Name
- UserId
- Workload
risk_score: 75
security_domain: threat
tests:
- name: True Positive Test
detections/cloud/o365_external_guest_user_invited.yml
-1
View File
@@ -54,7 +54,6 @@ tags:
- UserId
- Id
- Workload
risk_score: 25
security_domain: identity
tests:
- name: True Positive Test
detections/cloud/o365_external_identity_policy_changed.yml
-1
View File
@@ -54,7 +54,6 @@ tags:
- ModifiedProperties{}.Name
- UserId
- Workload
risk_score: 75
security_domain: threat
tests:
- name: True Positive Test
detections/cloud/o365_privileged_role_assigned.yml
-1
View File
@@ -54,7 +54,6 @@ tags:
- UserId
- ObjectId
- Workload
risk_score: 75
security_domain: identity
tests:
- name: True Positive Test
detections/cloud/o365_privileged_role_assigned_to_service_principal.yml
-1
View File
@@ -55,7 +55,6 @@ tags:
- UserId
- ObjectId
- Workload
risk_score: 75
security_domain: identity
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_admin_weak_password_policy.yml
-1
View File
@@ -49,7 +49,6 @@ tags:
- accounts{}.domain
- accounts{}.dn
- accounts{}.samAccountName
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_admin_with_duplicate_password.yml
-1
View File
@@ -48,7 +48,6 @@ tags:
- accounts{}.domain
- accounts{}.dn
- accounts{}.samAccountName
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_high_identity_risk_severity.yml
-1
View File
@@ -48,7 +48,6 @@ tags:
- accounts{}.domain
- accounts{}.dn
- accounts{}.samAccountName
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_medium_identity_risk_severity.yml
-1
View File
@@ -48,7 +48,6 @@ tags:
- accounts{}.domain
- accounts{}.dn
- accounts{}.samAccountName
risk_score: 70
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_medium_severity_alert.yml
-1
View File
@@ -50,7 +50,6 @@ tags:
- event.IncidentType
- event.NumbersOfAlerts
- event.SeverityName
risk_score: 49
security_domain: endpoint
manual_test: This detection is marked manual test because the attack_data file and
TA do not provide the event.EndpointIp and event.EndpointName fields. event.EndpointName
detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml
-1
View File
@@ -52,7 +52,6 @@ tags:
- event.IncidentType
- event.NumbersOfAlerts
- event.SeverityName
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml
-1
View File
@@ -50,7 +50,6 @@ tags:
- event.IncidentType
- event.NumbersOfAlerts
- event.SeverityName
risk_score: 49
security_domain: endpoint
manual_test: This detection is marked manual test because the attack_data file and
TA do not provide the event.EndpointIp and event.EndpointName fields. event.EndpointName
detections/endpoint/crowdstrike_user_weak_password_policy.yml
-1
View File
@@ -50,7 +50,6 @@ tags:
- accounts{}.domain
- accounts{}.dn
- accounts{}.samAccountName
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/crowdstrike_user_with_duplicate_password.yml
-1
View File
@@ -49,7 +49,6 @@ tags:
- accounts{}.domain
- accounts{}.dn
- accounts{}.samAccountName
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml
-1
View File
@@ -53,7 +53,6 @@ tags:
- DomainName
- Security
- WorkstationName
risk_score: 50
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml
-1
View File
@@ -53,7 +53,6 @@ tags:
- DomainName
- Security
- WorkstationName
risk_score: 25
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml
-1
View File
@@ -53,7 +53,6 @@ tags:
- DomainName
- Security
- WorkstationName
risk_score: 25
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml
-1
View File
@@ -53,7 +53,6 @@ tags:
- DomainName
- Security
- WorkstationName
risk_score: 25
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml
-1
View File
@@ -53,7 +53,6 @@ tags:
- DomainName
- Security
- WorkstationName
risk_score: 25
security_domain: endpoint
tests:
- name: True Positive Test