admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
9,921 Commits 697 Branches 195 Tags
AutoMerge-Token-Update
Commit Graph

62 Commits

Author SHA1 Message Date
P4T12ICK 99f0349e9f circle ci detecction 2021-09-02 10:42:01 +02:00
P4T12ICK 7f980b6a46 circle ci detecction 2021-09-01 17:54:38 +02:00
P4T12ICK bbf0a39460 new detection 2021-08-23 13:07:23 +02:00
P4T12ICK 9f6ec5febb new detection 2021-08-23 11:39:21 +02:00
P4T12ICK 622442cd3a new detection 2021-08-23 10:21:21 +02:00
P4T12ICK 749df59357 new detection 2021-08-23 10:17:40 +02:00
patel-bhavin c3db579480 lookup bug in generate 2021-07-13 11:52:17 -05:00
patel-bhavin 50bdf277c6 lookup definitions 2021-07-12 19:02:32 -05:00
patel-bhavin a0a57ab600 atttacker_tools_files 2021-07-12 18:54:24 -05:00
tccontre 69b11d3471 rttp4 2021-06-25 10:21:04 +02:00
Vatsal Jagani 838bbc4a58 JSWorm ransomware notes and extensions added. 2021-06-02 16:26:02 +05:30
mhaag-spl 2b5eb6fbc4 Masquerading - detections + analytic story 2021-04-26 13:38:52 -06:00
tcontreras 48120285ba clop_lookup_entry 2021-03-23 17:00:55 +01:00
divious1 6afaf49e44 fixing error reported by user 2021-02-16 09:45:00 -05:00
David Dorsey 88c9469541 More language clean up 2021-01-22 09:37:51 -06:00
David Dorsey 26050fae29 More language clean up 2021-01-22 09:34:33 -06:00
bpatel f5e653a552 duplicate PR 2021-01-21 11:27:24 -08:00
bpatel 1075e6b175 adding the lost lookup file 2020-12-15 18:30:54 -08:00
P4T12ICK 5fee68375f fix_bugs 2020-12-11 10:51:02 +01:00
bpatel dd647457c6 more app inspect 2020-12-08 15:14:11 -08:00
bpatel 25c7f33866 app inspect failures fixes 2020-12-08 14:56:39 -08:00
Ԝеѕ 0f2056149f add additional suspicious file extensions 
chm, vbe, additional media double ext exe's
 2020-11-18 16:19:11 -05:00
bpatel 8895ffddf7 updating macro fields 2020-11-16 17:22:29 -08:00
Bhavin Patel 3aa06e82b6 Merge branch 'develop' into mustang_beta 2020-11-10 09:59:18 -08:00
divious1 77af8684bc ryuk story and detections 2020-11-06 12:32:48 -05:00
bpatel 0cce001a42 merge with develop 2020-10-19 11:19:41 -07:00
wesinator 91a8cf9e08 add additional dynamic domains 
now-dns, other missing domains
 2020-10-13 12:44:52 -04:00
bpatel abac1c8b62 convert to kvstore and spl updates 2020-10-12 12:14:50 -07:00
bpatel 97ac9c5f62 spl updates and kvstore file 2020-10-12 11:49:37 -07:00
bpatel d237a2d984 lookup errors and consistency 2020-10-12 11:26:57 -07:00
bpatel b70138ed69 creating collections and search updates 2020-09-30 11:25:37 -07:00
David Dorsey 9763e75e02 Fixes 2020-09-23 00:07:54 -05:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e8bf1d9e96 updates for mustang 2020-09-03 17:10:02 -06:00
David Dorsey b48b40ff76 Updated search for abnormally high cloud instances. Including 
verifying that enough data is there
 2020-08-25 22:28:59 -05:00
David Dorsey b4ab45f299 Updated baseline searches for cloud provisioning activities. 
Broke them out into an initial search and update search
  Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
  relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
 2020-08-19 10:28:05 -05:00
Bhavin Patel 6de58bce6a Update api_call_by_user_baseline.yml 
latestCount is needed in detection search
 2020-08-18 15:28:54 -07:00
divious1 b748b3ee9c converted lookup to collection 2020-08-12 17:29:18 -04:00
Patrick Bareiss 5ceef308a7 bug fix generate script 2020-07-21 10:12:58 +02:00
David Dorsey af09770db1 Merge branch 'develop' into first_time_windows_service_bug 2020-06-26 08:32:34 -05:00
David Dorsey 6369f0f895 Changed running windows service to use kvstore as cache 2020-06-26 08:27:39 -05:00
Patrick Bareiss 000b56b0ee add cron schedule 2020-06-25 18:52:51 +02:00
Patrick Bareiss 85f13dd926 new deployment configurations 2020-06-25 09:53:44 +02:00
bpatel 35c4b110bc Merge branch 'develop' into azuretest 2020-06-04 11:06:04 -07:00
bpatel 8c75f502c1 merge with develop 2020-06-03 13:50:46 -07:00
bpatel 72d3ab875e converted to spec3 and other updates 2020-05-28 13:31:49 -07:00
Patrick Bareiss fd024fb4c0 small bug 2020-05-25 16:46:38 +02:00
Patrick Bareiss 052a7d7872 run generate 2020-05-25 10:46:40 +02:00