9c6c794b81
Merge pull request #215 from splunk/drilldown
...
Added drilldown search and name to the detection spec.
2019-10-08 08:32:49 -04:00
2b5f46ab35
Merge pull request #212 from splunk/macros
...
Adding macros for exception handling to spec
2019-10-08 08:31:45 -04:00
a12fe635c6
Merge branch 'develop' into macros
2019-10-07 22:59:37 -05:00
ad20740605
Merge branch 'develop' into drilldown
2019-10-07 22:59:24 -05:00
85a637b149
Merge branch 'develop' into cloud_cryptominig
2019-10-07 22:59:06 -05:00
31b839b028
Actually ignore swap files now (forgot the * at the beginning)
2019-10-07 22:16:50 -05:00
6bc1ce430b
Ignore VIM swap files
2019-10-07 22:16:09 -05:00
2a4b29e4c4
New investigation macros
...
Updated validate to check for macro and lookup existence in both
baselines and investigation searches
2019-10-07 22:14:12 -05:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
fb93597cfc
Merge branch 'macros' into cloud_cryptominig
2019-10-03 17:49:45 -07:00
82e8b210a9
Files for new cloud cryptominig story.
...
It's a cloud infrastructure generic version of AWS Cryptomining
2019-10-03 17:42:40 -07:00
d11219e54d
Updated generate code
2019-10-03 13:45:16 -07:00
cc6209a08e
Started to create Cloud Cryptomining story
...
Added 1 detection, 1 baseline, and 2 investigative searches
2019-10-02 21:05:30 -07:00
a1ac59f593
Merge pull request #210 from splunk/CRL-1624_remove_contexualized
...
cRL-1624 removed contexualized
2019-10-02 17:27:13 -07:00
e71536f638
Merge pull request #214 from splunk/CRL-1627
...
Fixed issue inside of where clause
2019-10-02 17:22:10 -07:00
24769e88c5
Added lookup to the search specs
2019-10-02 12:01:03 -07:00
9edd3b9c4d
Bump attrs from 19.1.0 to 19.2.0
...
Bumps [attrs](https://github.com/python-attrs/attrs ) from 19.1.0 to 19.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases )
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/python-attrs/attrs/compare/19.1.0...19.2.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-02 07:06:42 +00:00
2a8b470241
Added drilldown search and name to the detection spec.
...
Added these fields to the suspicious wevtutil manifest
Updated validate to make sure both entries are there or neither are
Updated generate to output those fields if they are there
2019-10-01 17:31:11 -07:00
aec9dd53f5
Fixed issue inside of where clause
2019-09-30 16:17:29 -07:00
1bda6248ea
Added code to validate macros manifest and lookups manifest
...
Lookup manifest validation also checks to make sure either filename or collection is there
If a filename is listed, it makes sure the file exists as well
2019-09-30 16:08:54 -07:00
575b766f09
Minor spec change to macro.spec.json
2019-09-30 16:08:08 -07:00
e428f473c9
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
1149f8b6a4
Bump pathlib2 from 2.3.4 to 2.3.5
...
Bumps [pathlib2](https://github.com/mcmtroffaes/pathlib2 ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/mcmtroffaes/pathlib2/releases )
- [Changelog](https://github.com/mcmtroffaes/pathlib2/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/mcmtroffaes/pathlib2/compare/2.3.4...2.3.5 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-30 06:19:03 +00:00
5e5cd80145
Merge branch 'develop' into macros
2019-09-27 15:01:34 -05:00
6ee9d9962c
Added entry for macros in baseline, detections, and investigations spec.
2019-09-25 14:36:35 -05:00
ebd92527c3
updated base on feedback from Dave H.
2019-09-19 13:42:54 -04:00
48593b7ff6
Revert "removed contexualized"
...
This reverts commit 5ad6534ccd
2019-09-19 13:36:13 -04:00
85e033d0e2
Merge pull request #209 from splunk/dependabot/pip/importlib-metadata-0.23
...
Bump importlib-metadata from 0.22 to 0.23
2019-09-19 11:28:39 -04:00
5ad6534ccd
removed contexualized
2019-09-18 18:01:43 -04:00
4178965a66
Bump importlib-metadata from 0.22 to 0.23
...
Bumps [importlib-metadata](http://importlib-metadata.readthedocs.io/ ) from 0.22 to 0.23.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-17 05:43:55 +00:00
e1310d2192
adding ss.conf spec and example
2019-09-12 16:27:11 -07:00
6fdc4ff2bf
Merge pull request #208 from splunk/CRL-1617_bug
...
CRL-1617 changed process to process name
2019-09-12 11:15:02 -06:00
f3cb4bcc2a
bumping configparserr
2019-09-12 10:05:57 -07:00
a04729b663
changed process to process name
2019-09-12 09:55:57 -07:00
66b5cd25ba
Merge pull request #202 from splunk/remove_html_tags
...
CRL-1611 Remove html tags
2019-09-12 10:41:00 -06:00
b783922e62
Merge pull request #196 from splunk/dependabot/pip/identify-1.4.7
...
Bump identify from 1.4.6 to 1.4.7
2019-09-12 12:34:58 -04:00
90ef83a474
Merge branch 'develop' into dependabot/pip/typing-3.7.4.1
2019-09-12 12:31:53 -04:00
1c8e76029b
Merge branch 'develop' into dependabot/pip/zipp-0.6.0
2019-09-12 12:30:21 -04:00
235beccb12
Bump typing from 3.7.4 to 3.7.4.1
...
Bumps [typing](https://docs.python.org/3/library/typing.html ) from 3.7.4 to 3.7.4.1.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 16:29:44 +00:00
ca109f84db
Merge pull request #201 from splunk/dependabot/pip/virtualenv-16.7.5
...
Bump virtualenv from 16.7.2 to 16.7.5
2019-09-12 12:29:34 -04:00
e5a67a7145
Merge pull request #197 from splunk/dependabot/pip/pre-commit-1.18.3
...
Bump pre-commit from 1.18.1 to 1.18.3
2019-09-12 12:29:03 -04:00
d5d03995d0
Bump identify from 1.4.6 to 1.4.7
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.6 to 1.4.7.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.6...v1.4.7 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 16:28:42 +00:00
c6e5e85581
Merge pull request #203 from splunk/dependabot/pip/semantic-version-2.8.2
...
Bump semantic-version from 2.6.0 to 2.8.2
2019-09-12 12:28:38 -04:00
9a2575b771
Merge pull request #204 from splunk/dependabot/pip/configparser-4.0.1
...
Bump configparser from 3.8.1 to 4.0.1
2019-09-12 12:27:55 -04:00
54819dbe80
Merge pull request #207 from splunk/dependabot/pip/importlib-metadata-0.22
...
Bump importlib-metadata from 0.19 to 0.22
2019-09-12 12:27:27 -04:00
295a8587ea
Bump importlib-metadata from 0.19 to 0.22
...
Bumps [importlib-metadata](http://importlib-metadata.readthedocs.io/ ) from 0.19 to 0.22.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 05:39:52 +00:00
64a8d8990d
static method error
2019-09-11 18:37:19 -07:00
6061aec7f8
adding detection results to KV store
2019-09-11 17:05:57 -07:00
af1a9d89e7
correcting new line char
2019-09-11 15:58:02 -04:00
Jose Enrique Hernandez