admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
995 Commits 697 Branches 195 Tags
Cloud_DM_bug
Commit Graph

995 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
divious1 a7b643d813 updated DM name 2019-10-24 01:02:47 -04:00
divious1 6f932b41a6 Merge branch 'develop' of github.com:splunk/security-content into develop 2019-10-24 00:59:51 -04:00
Rico Valdez 996b49bf31 updated to the proper datamodel name in the manifest metadata 2019-10-22 16:32:21 -06:00
Rico Valdez 692da8e67c change DM name to Cloud_Infrastructure 2019-10-22 16:23:29 -06:00
Rico Valdez a8cc3de5dd fix broken URL for appinspect 2019-10-22 16:04:59 -06:00
divious1 3699ec1696 Merge branch 'develop' of github.com:splunk/security-content into develop 2019-10-18 22:21:24 -04:00
divious1 f4b61d78b7 updating links in contributing 2019-10-18 22:21:17 -04:00
Jose Enrique Hernandez b5e7a9edde Merge pull request #226 from splunk/briannablacet-patch-1-1 
Update README.md
 2019-10-18 22:10:24 -04:00
briannablacet 19a09dd3dd Update README.md 
Various changes for grammar, punctuation, style, and flow.
 2019-10-18 19:02:18 -07:00
divious1 eea508972d adding contrib 2019-10-18 21:27:31 -04:00
divious1 a24203f9ee cleaning up readme 2019-10-18 21:03:56 -04:00
divious1 697d25a780 updating with support info 2019-10-18 20:41:44 -04:00
Jose Enrique Hernandez 33970c46fc Merge pull request #222 from splunk/change_json_to_yml 
Changed json to yml
 2019-10-16 12:53:50 -04:00
Jose Enrique Hernandez cacc5f03de Merge pull request #221 from splunk/CRL-1490 
Fixed typo in distsearch.conf that caused unnecessary bundle replication
 2019-10-16 11:12:50 -04:00
Patrick Bareiss af66ed5fe3 Changed json to yml 2019-10-16 16:38:05 +02:00
David Dorsey 14bfab7338 Fixed typo in distsearch.conf that caused unnecessary bundle replication 2019-10-15 16:28:26 -07:00
Jose Enrique Hernandez 7d0a8cfabd Merge pull request #217 from splunk/cloud_cryptominig 
Cloud cryptominig
 2019-10-08 08:48:00 -04:00
Jose Enrique Hernandez c08c11cb5e Merge pull request #213 from splunk/dependabot/pip/pathlib2-2.3.5 
Bump pathlib2 from 2.3.4 to 2.3.5
 2019-10-08 08:47:37 -04:00
Jose Enrique Hernandez 733c088621 Merge pull request #211 from splunk/dependabot/pip/contextlib2-0.6.0 
Bump contextlib2 from 0.5.5 to 0.6.0
 2019-10-08 08:47:16 -04:00
Jose Enrique Hernandez 9f0d4e510c Merge pull request #194 from splunk/dependabot/pip/zipp-0.6.0 
Bump zipp from 0.5.2 to 0.6.0
 2019-10-08 08:46:52 -04:00
Jose Enrique Hernandez 00d45d08f0 Merge pull request #191 from splunk/dependabot/pip/typing-3.7.4.1 
Bump typing from 3.7.4 to 3.7.4.1
 2019-10-08 08:42:04 -04:00
Jose Enrique Hernandez c9effaf169 Merge branch 'develop' into cloud_cryptominig 2019-10-08 08:40:51 -04:00
divious1 bfd2f43f16 updated configparser to right version 2019-10-08 08:39:20 -04:00
divious1 669ae04242 updating config parser to right version 2019-10-08 08:37:58 -04:00
dependabot-preview[bot] 10162d5808 Bump contextlib2 from 0.5.5 to 0.6.0 
Bumps [contextlib2](https://github.com/jazzband/contextlib2) from 0.5.5 to 0.6.0.
- [Release notes](https://github.com/jazzband/contextlib2/releases)
- [Commits](https://github.com/jazzband/contextlib2/compare/v0.5.5...v0.6.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-10-08 12:35:35 +00:00
Jose Enrique Hernandez accda2a493 Merge pull request #216 from splunk/dependabot/pip/attrs-19.2.0 
Bump attrs from 19.1.0 to 19.2.0
 2019-10-08 08:34:21 -04:00
Jose Enrique Hernandez 9c6c794b81 Merge pull request #215 from splunk/drilldown 
Added drilldown search and name to the detection spec.
 2019-10-08 08:32:49 -04:00
Jose Enrique Hernandez 2b5f46ab35 Merge pull request #212 from splunk/macros 
Adding macros for exception handling to spec
 2019-10-08 08:31:45 -04:00
David Dorsey a12fe635c6 Merge branch 'develop' into macros 2019-10-07 22:59:37 -05:00
David Dorsey ad20740605 Merge branch 'develop' into drilldown 2019-10-07 22:59:24 -05:00
David Dorsey 85a637b149 Merge branch 'develop' into cloud_cryptominig 2019-10-07 22:59:06 -05:00
David Dorsey 31b839b028 Actually ignore swap files now (forgot the * at the beginning) 2019-10-07 22:16:50 -05:00
David Dorsey 6bc1ce430b Ignore VIM swap files 2019-10-07 22:16:09 -05:00
David Dorsey 2a4b29e4c4 New investigation macros 
Updated validate to check for macro and lookup existence in both
    baselines and investigation searches
 2019-10-07 22:14:12 -05:00
David Dorsey 9034599d6f Added in exception handling to cloud compute activity in new region 
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
    a macro manifest
 2019-10-07 21:50:13 -05:00
David Dorsey fb93597cfc Merge branch 'macros' into cloud_cryptominig 2019-10-03 17:49:45 -07:00
David Dorsey 82e8b210a9 Files for new cloud cryptominig story. 
It's a cloud infrastructure generic version of AWS Cryptomining
 2019-10-03 17:42:40 -07:00
David Dorsey d11219e54d Updated generate code 2019-10-03 13:45:16 -07:00
David Dorsey cc6209a08e Started to create Cloud Cryptomining story 
Added 1 detection, 1 baseline, and 2 investigative searches
 2019-10-02 21:05:30 -07:00
Bhavin Patel a1ac59f593 Merge pull request #210 from splunk/CRL-1624_remove_contexualized 
cRL-1624 removed contexualized
 2019-10-02 17:27:13 -07:00
Jose Enrique Hernandez e71536f638 Merge pull request #214 from splunk/CRL-1627 
Fixed issue inside of where clause
 2019-10-02 17:22:10 -07:00
David Dorsey 24769e88c5 Added lookup to the search specs 2019-10-02 12:01:03 -07:00
dependabot-preview[bot] 9edd3b9c4d Bump attrs from 19.1.0 to 19.2.0 
Bumps [attrs](https://github.com/python-attrs/attrs) from 19.1.0 to 19.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-attrs/attrs/compare/19.1.0...19.2.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-10-02 07:06:42 +00:00
David Dorsey 2a8b470241 Added drilldown search and name to the detection spec. 
Added these fields to the suspicious wevtutil manifest
Updated validate to make sure both entries are there or neither are
Updated generate to output those fields if they are there
 2019-10-01 17:31:11 -07:00
David Dorsey aec9dd53f5 Fixed issue inside of where clause 2019-09-30 16:17:29 -07:00
David Dorsey 1bda6248ea Added code to validate macros manifest and lookups manifest 
Lookup manifest validation also checks to make sure either filename or collection is there
If a filename is listed, it makes sure the file exists as well
 2019-09-30 16:08:54 -07:00
David Dorsey 575b766f09 Minor spec change to macro.spec.json 2019-09-30 16:08:08 -07:00
David Dorsey e428f473c9 Added lookup files that weren't there 2019-09-30 16:07:44 -07:00
David Dorsey 3d25c40bf7 Updated macro definition in detections, investigations, and baselines to just be a list 
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
 2019-09-30 13:53:25 -07:00
dependabot-preview[bot] 1149f8b6a4 Bump pathlib2 from 2.3.4 to 2.3.5 
Bumps [pathlib2](https://github.com/mcmtroffaes/pathlib2) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/mcmtroffaes/pathlib2/releases)
- [Changelog](https://github.com/mcmtroffaes/pathlib2/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/mcmtroffaes/pathlib2/compare/2.3.4...2.3.5)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-09-30 06:19:03 +00:00