admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-28 14:24:54 -08:00
committed by GitHub
parent f7bf9a793b 547d323dc6
commit fe06e00412
31 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/activedirectory_reset_password.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "LDAP"
tags:
platform_tags: []
playbook_type: Automation
playbook_fields:
- compromisedUserName
product:
playbooks/aws_disable_user_accounts.yml
+1
View File
@@ -14,6 +14,7 @@ app_list:
tags:
platform_tags:
- Cloud
playbook_type: Input
playbook_fields:
- aws_username
product:
playbooks/aws_find_inactive_users.yml
+1
View File
@@ -15,6 +15,7 @@ app_list:
tags:
platform_tags:
- Cloud
playbook_type: Automation
playbook_fields: []
product:
- Splunk SOAR
playbooks/block_indicators.yml
+1
View File
@@ -14,6 +14,7 @@ app_list:
- "OpenDNS Umbrella"
tags:
platform_tags: []
playbook_type: Automation
playbook_fields:
- destinationDnsDomain
- destinationAddress
playbooks/crowdstrike_malware_triage.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "Crowdstrike OAuth"
tags:
platform_tags: []
playbook_type: Automation
playbook_fields:
- filePath
- destinationAddress
playbooks/delete_detected_files.yml
+1
View File
@@ -16,6 +16,7 @@ tags:
detections:
- Executable File Written in Administrative SMB Share
platform_tags: []
playbook_type: Automation
playbook_fields:
- filePath
- destinationAddress
playbooks/email_notification_for_malware.yml
+1
View File
@@ -15,6 +15,7 @@ app_list:
- "SMTP"
tags:
platform_tags: []
playbook_type: Automation
playbook_fields:
- fileHash
- vaultId
playbooks/internal_host_splunk_investigate_log4j.yml
+1
View File
@@ -15,6 +15,7 @@ tags:
analytic_story:
- Log4Shell CVE-2021-44228
platform_tags: []
playbook_type: Input
playbook_fields:
- hostName
- destinationAddress
playbooks/internal_host_ssh_investigate.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "SSH"
tags:
platform_tags: []
playbook_type: Input
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_ssh_log4j_investigate.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "SSH"
tags:
platform_tags: []
playbook_type: Input
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_ssh_log4j_respond.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "SSH"
tags:
platform_tags: []
playbook_type: Input
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_winrm_investigate.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "Windows Remote Management"
tags:
platform_tags: []
playbook_type: Input
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_winrm_log4j_investigate.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "Windows Remote Management"
tags:
platform_tags: []
playbook_type: Input
playbook_fields: []
product:
- Splunk SOAR
playbooks/internal_host_winrm_log4j_respond.yml
+1
View File
@@ -12,6 +12,7 @@ app_list:
- "Windows Remote Management"
tags:
platform_tags: []
playbook_type: Input
playbook_fields: []
product:
- Splunk SOAR
playbooks/log4j_investigate.yml
+1
View File
@@ -30,5 +30,6 @@ tags:
- Log4Shell JNDI Payload Injection with Outbound Connection
- Detect Outbound LDAP Traffic
playbook_fields: []
playbook_type: Automation
product:
- Splunk SOAR
playbooks/log4j_respond.yml
+1
View File
@@ -30,5 +30,6 @@ tags:
- Log4Shell JNDI Payload Injection with Outbound Connection
- Detect Outbound LDAP Traffic
playbook_fields: []
playbook_type: Automation
product:
- Splunk SOAR
playbooks/malware_hunt_and_contain.yml
+1
View File
@@ -15,6 +15,7 @@ app_list:
- "VirusTotal"
tags:
platform_tags: []
playbook_type: Automation
playbook_fields:
- fileHash
product:
playbooks/ransomware_investigate_and_contain.yml
+1
View File
@@ -22,6 +22,7 @@ tags:
- Conti Common Exec parameter
platform_tags:
- Ransomware
playbook_type: Automation
playbook_fields:
- ComputerName
- Username
playbooks/risk_notable_block_indicators.yml
+1
View File
@@ -18,6 +18,7 @@ tags:
playbook_outputs:
- note_title
- note_content
playbook_type: Automation
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_enrich.yml
+1
View File
@@ -17,6 +17,7 @@ tags:
playbook_outputs:
- note_title
- note_content
playbook_type: Automation
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_import_data.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
- note_content
platform_tags:
- Risk Notable
playbook_type: Automation
playbook_fields:
- event_id
- info_min_time
playbooks/risk_notable_investigate.yml
+1
View File
@@ -14,6 +14,7 @@ app_list:
tags:
labels:
- risk_notable
playbook_type: Automation
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_merge_events.yml
+1
View File
@@ -17,6 +17,7 @@ tags:
playbook_outputs:
- note_title
- note_content
playbook_type: Automation
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_mitigate.yml
+1
View File
@@ -13,6 +13,7 @@ app_list:
tags:
labels:
- risk_notable
playbook_type: Automation
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_preprocess.yml
+1
View File
@@ -20,6 +20,7 @@ tags:
- risk_notable
platform_tags:
- Risk Notable
playbook_type: Automation
playbook_fields:
- event_id
- info_min_time
playbooks/risk_notable_protect_assets_and_users.yml
+1
View File
@@ -16,6 +16,7 @@ tags:
playbook_outputs:
- note_title
- note_content
playbook_type: Automation
platform_tags:
- Risk Notable
product:
playbooks/risk_notable_review_indicators.yml
+1
View File
@@ -15,5 +15,6 @@ tags:
- risk_notable
platform_tags:
- Risk Notable
playbook_type: Automation
product:
- Splunk SOAR
playbooks/risk_notable_verdict.yml
+1
View File
@@ -15,5 +15,6 @@ tags:
- risk_notable
platform_tags:
- Risk Notable
playbook_type: Automation
product:
- Splunk SOAR
playbooks/start_investigation.yml
+1
View File
@@ -12,5 +12,6 @@ app_list: []
tags:
platform_tags: []
playbook_fields: []
playbook_type: Automation
product:
- Splunk SOAR
playbooks/threat_intel_investigate.yml
+1
View File
@@ -13,6 +13,7 @@ app_list: []
tags:
platform_tags:
- threat_intel
playbook_type: Automation
playbook_fields: []
product:
- Splunk SOAR
playbooks/trustar_enrich_indicators.yml
+1
View File
@@ -15,6 +15,7 @@ tags:
platform_tags:
- threat_intel
- risk_notable
playbook_type: Input
playbook_fields:
- indicators
product: