admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,145 Commits 697 Branches 195 Tags
cloud_appinspect_check
Commit Graph

155 Commits

Author SHA1 Message Date
Bhavin Patel 3aa6adebd6 Merge branch 'develop' into sh_test 2021-02-03 14:24:50 -08:00
P4T12ICK 7f8652b85b bug fix 2021-02-03 15:44:56 +01:00
bpatel 4fb0488ac6 duplicating files and experimental 2021-01-28 17:35:25 -08:00
bpatel ec76d28b60 rename 2021-01-26 19:28:03 -08:00
bpatel edeaa89c7d macros for all 2021-01-26 18:53:01 -08:00
David Dorsey fd76342c94 Changed the language in some of the descriptions 2021-01-21 23:53:47 -06:00
P4T12ICK 58627b44f9 changes 2020-12-15 12:27:16 +01:00
P4T12ICK 5fee68375f fix_bugs 2020-12-11 10:51:02 +01:00
bpatel 25c7f33866 app inspect failures fixes 2020-12-08 14:56:39 -08:00
bpatel c156c18b6b files not needed 2020-12-08 11:15:24 -08:00
Jose Enrique Hernandez 3c1cfbf4de Merge branch 'develop' into develop 2020-11-18 13:30:38 -05:00
Bhavin Patel 398ee5f947 Merge pull request #843 from splunk/ransomwares3 
Ransomwares3
 2020-11-12 11:51:39 -08:00
Jose Enrique Hernandez 3e9513f4b8 Merge branch 'develop' into develop 2020-11-11 22:04:16 -05:00
Jose Enrique Hernandez 4acc8c3efb Merge branch 'develop' into mbjerkeland-develop 2020-11-11 22:03:44 -05:00
Bhavin Patel e185ca89ba Merge branch 'develop' into ransomwares3 2020-11-11 16:36:34 -08:00
Bhavin Patel 3aa06e82b6 Merge branch 'develop' into mustang_beta 2020-11-10 09:59:18 -08:00
bpatel 64bd08b5ff these macro files are not needed 2020-11-10 09:14:23 -08:00
P4T12ICK 1f3f1ae408 Merge branch 'develop' into mbjerkeland-develop 2020-11-10 09:24:55 +01:00
Shannon Davis 098aa9019a mods 2020-11-06 11:08:38 +11:00
P4T12ICK 8a66f8e175 changed macro 2020-11-05 09:18:37 +01:00
Mikael Bjerkeland 17502e4722 Added various Network Infrastructure detections based on the MITRE Network Matrix 2020-10-28 23:14:06 +01:00
Mikael Bjerkeland 7e068a5267 Added detection for T1020.001, Traffic Duplication 2020-10-28 21:51:33 +01:00
Mikael Bjerkeland d5c6d72361 . 2020-10-28 21:14:40 +01:00
Bhavin Patel 5e62272a68 Merge branch 'develop' into mustang_beta 2020-10-05 16:20:10 -07:00
jzsplunk 3c49885ad6 Merge branch 'develop' into TR-104-missing-input-filters 2020-10-02 08:01:15 -07:00
David Dorsey e30924013c single and double quote order issue 2020-09-23 17:32:52 -05:00
David Dorsey 42549c5776 Macro fixes 2020-09-23 17:22:02 -05:00
David Dorsey b681f5faa4 macro fixes 2020-09-23 17:16:35 -05:00
David Dorsey 5fbc68936b baseline update search fix with macros 2020-09-23 16:58:26 -05:00
Rico Valdez 359926e89b text updates and a couple of fixes for mismatched macros 2020-09-23 14:44:00 -06:00
David Dorsey 65403cc027 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 2020-09-23 11:36:15 -05:00
David Dorsey 2d25205146 Fixes 2020-09-23 11:35:56 -05:00
Jose Enrique Hernandez 7bd6f5380e Merge branch 'develop' into TR-41_aws_ec2_mods 2020-09-23 12:09:37 -04:00
David Dorsey 17eff649e7 Fixes 2020-09-21 23:23:57 -05:00
divious1 b78035c976 adding macros 2020-09-18 17:36:46 -04:00
jzsplunk c33be23f10 [TR-104] add missing input filters. 2020-09-15 22:59:19 -07:00
David Dorsey 9b785919de validate fixes 2020-09-10 21:22:34 -05:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
David Dorsey fc99713981 Translated detections/detect_spike_in_security_group_activity.yml 2020-09-09 01:36:26 -05:00
David Dorsey d588bbc8f6 Translated detect_spike_in_aws_api_activity.yml to use Change DM 2020-09-09 01:01:16 -05:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
David Dorsey 7b098cf836 fixed validate issues 2020-09-04 13:13:22 -05:00
David Dorsey dbfecd9e29 New analytic story for suspicious cloud user activities. 2020-09-04 10:30:47 -05:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e9939cbc98 new files for unblocked searches 2020-09-03 11:10:14 -06:00
Rico Valdez f7498459c8 changes for mustang 2020-09-02 10:21:52 -06:00
Jose Enrique Hernandez 1c1ce46004 Merge branch 'develop' into mbjerkeland-develop 2020-08-24 01:04:40 -04:00
David Dorsey 80860d37f4 Created manifests for unseen city, region, and country and updated 
logic to reflect each case
 2020-08-20 14:07:21 -05:00
David Dorsey 7de781c8f0 Manifest cleanup 2020-08-20 13:15:14 -05:00
David Dorsey b4ab45f299 Updated baseline searches for cloud provisioning activities. 
Broke them out into an initial search and update search
  Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
  relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
 2020-08-19 10:28:05 -05:00