17eff649e7
Fixes
2020-09-21 23:23:57 -05:00
f411bfa91b
File no longer needed
2020-09-21 22:43:06 -05:00
7201713de3
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 23:59:18 -05:00
7a99d2c4dd
Fixing story mappings
2020-09-15 23:58:59 -05:00
7da91f2409
[TR-41] fixing last of merge conflicts.
2020-09-15 20:38:05 -07:00
0a6bafbe36
Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 20:33:32 -07:00
7f2f53d0a8
validate fixes
2020-09-15 20:19:45 -07:00
182c4116c9
tweaks and updates
2020-09-15 20:19:45 -07:00
248c3d412c
latest updates to create in new vendor_region
2020-09-15 20:19:45 -07:00
adeeab0ee8
Updated baseline searches to have correct deployment. Which was also created
2020-09-15 20:19:45 -07:00
483d492405
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-15 20:19:45 -07:00
b5914eacd9
bug fixes
2020-09-15 20:19:45 -07:00
8ffbe56392
Updated MLTK searches based on Peter's work
2020-09-15 20:19:45 -07:00
976971526d
updates to ymls to make sure validate passes
2020-09-15 20:17:49 -07:00
9f8418ee85
fixed validate issues
2020-09-15 20:17:49 -07:00
4af9407d8f
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
a65c01dedf
updates for mustang
2020-09-15 20:17:49 -07:00
c341614465
new files for unblocked searches
2020-09-15 20:17:49 -07:00
03245f6372
changes for mustang
2020-09-15 20:17:49 -07:00
4bd7eae3c8
Removed unused file
2020-09-15 20:15:27 -07:00
181f810dbb
Updated cloud instances destroyed to change data model
2020-09-15 20:15:23 -07:00
7d35bc9947
Remove show_options
2020-09-15 09:45:45 -07:00
1f56396028
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-09-14 14:11:02 -07:00
6fd7b6ef2f
more updates
2020-09-14 14:11:02 -07:00
56d0abdc31
Manifest cleanup
2020-09-14 14:11:01 -07:00
2f1f96c804
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-09-14 14:11:01 -07:00
481fb128c6
new files for translated detections
2020-09-14 14:11:01 -07:00
bb5384564a
new files - not finalized
2020-09-14 14:11:01 -07:00
60456b9e9a
some translated searches for change DM
2020-09-14 14:11:01 -07:00
9b785919de
validate fixes
2020-09-10 21:22:34 -05:00
b3eeaef59d
tweaks and updates
2020-09-10 14:19:45 -06:00
83015eba59
latest updates to create in new vendor_region
2020-09-09 16:26:25 -06:00
adf19afe6a
Updated baseline searches to have correct deployment. Which was also created
2020-09-09 01:35:38 -05:00
d588bbc8f6
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-09 01:01:16 -05:00
0748b5e8ee
bug fixes
2020-09-09 01:00:45 -05:00
3697092a4b
Updated MLTK searches based on Peter's work
2020-09-08 22:49:16 -05:00
cea3735f1a
updates to ymls to make sure validate passes
2020-09-04 13:31:16 -07:00
7b098cf836
fixed validate issues
2020-09-04 13:13:22 -05:00
dbfecd9e29
New analytic story for suspicious cloud user activities.
2020-09-04 10:30:47 -05:00
e8bf1d9e96
updates for mustang
2020-09-03 17:10:02 -06:00
e9939cbc98
new files for unblocked searches
2020-09-03 11:10:14 -06:00
f7498459c8
changes for mustang
2020-09-02 10:21:52 -06:00
bda59e0708
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
...
merging in Dorsey's changes
2020-08-28 10:18:40 -06:00
662d680870
more updates
2020-08-28 10:12:55 -06:00
d662b0538d
Removed unused file
2020-08-26 23:17:03 -05:00
0a47f73352
Updated cloud instances destroyed to change data model
2020-08-26 22:57:45 -05:00
b48b40ff76
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-08-25 22:28:59 -05:00
7de781c8f0
Manifest cleanup
2020-08-20 13:15:14 -05:00
b4ab45f299
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-08-19 10:28:05 -05:00
9302baefaf
new files for translated detections
2020-08-18 16:38:38 -06:00
David Dorsey