42268eaf3e
typo
2020-10-05 11:08:38 -07:00
979a288fcb
adding dist=expon back again
2020-09-30 14:57:55 -07:00
13db9854d2
story name errors
2020-09-30 13:46:00 -07:00
b9f18705e7
spl errors and typos
2020-09-30 13:24:29 -07:00
b70138ed69
creating collections and search updates
2020-09-30 11:25:37 -07:00
1028f2c6d7
updating search aand fileames for consistenccy
2020-09-30 11:05:39 -07:00
d95a7452f5
removing dist param from baselines
2020-09-30 10:33:14 -07:00
9f3ff7c5e4
Merge branch 'develop' into TR-41_aws_ec2_mods
2020-09-29 16:58:02 -07:00
cc031f1b9e
fixing a mistake
2020-09-25 16:39:29 -04:00
3d029956cc
text fixes
2020-09-23 17:05:15 -06:00
5fbc68936b
baseline update search fix with macros
2020-09-23 16:58:26 -05:00
2d25205146
Fixes
2020-09-23 11:35:56 -05:00
58848e7326
Fixes for cryptomining demo
2020-09-23 00:01:02 -05:00
17eff649e7
Fixes
2020-09-21 23:23:57 -05:00
f411bfa91b
File no longer needed
2020-09-21 22:43:06 -05:00
7201713de3
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 23:59:18 -05:00
7a99d2c4dd
Fixing story mappings
2020-09-15 23:58:59 -05:00
7da91f2409
[TR-41] fixing last of merge conflicts.
2020-09-15 20:38:05 -07:00
0a6bafbe36
Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 20:33:32 -07:00
7f2f53d0a8
validate fixes
2020-09-15 20:19:45 -07:00
182c4116c9
tweaks and updates
2020-09-15 20:19:45 -07:00
248c3d412c
latest updates to create in new vendor_region
2020-09-15 20:19:45 -07:00
adeeab0ee8
Updated baseline searches to have correct deployment. Which was also created
2020-09-15 20:19:45 -07:00
483d492405
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-15 20:19:45 -07:00
b5914eacd9
bug fixes
2020-09-15 20:19:45 -07:00
8ffbe56392
Updated MLTK searches based on Peter's work
2020-09-15 20:19:45 -07:00
976971526d
updates to ymls to make sure validate passes
2020-09-15 20:17:49 -07:00
9f8418ee85
fixed validate issues
2020-09-15 20:17:49 -07:00
4af9407d8f
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
a65c01dedf
updates for mustang
2020-09-15 20:17:49 -07:00
c341614465
new files for unblocked searches
2020-09-15 20:17:49 -07:00
03245f6372
changes for mustang
2020-09-15 20:17:49 -07:00
4bd7eae3c8
Removed unused file
2020-09-15 20:15:27 -07:00
181f810dbb
Updated cloud instances destroyed to change data model
2020-09-15 20:15:23 -07:00
7d35bc9947
Remove show_options
2020-09-15 09:45:45 -07:00
1f56396028
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-09-14 14:11:02 -07:00
6fd7b6ef2f
more updates
2020-09-14 14:11:02 -07:00
56d0abdc31
Manifest cleanup
2020-09-14 14:11:01 -07:00
2f1f96c804
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-09-14 14:11:01 -07:00
481fb128c6
new files for translated detections
2020-09-14 14:11:01 -07:00
bb5384564a
new files - not finalized
2020-09-14 14:11:01 -07:00
60456b9e9a
some translated searches for change DM
2020-09-14 14:11:01 -07:00
9b785919de
validate fixes
2020-09-10 21:22:34 -05:00
b3eeaef59d
tweaks and updates
2020-09-10 14:19:45 -06:00
83015eba59
latest updates to create in new vendor_region
2020-09-09 16:26:25 -06:00
adf19afe6a
Updated baseline searches to have correct deployment. Which was also created
2020-09-09 01:35:38 -05:00
d588bbc8f6
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-09 01:01:16 -05:00
0748b5e8ee
bug fixes
2020-09-09 01:00:45 -05:00
3697092a4b
Updated MLTK searches based on Peter's work
2020-09-08 22:49:16 -05:00
cea3735f1a
updates to ymls to make sure validate passes
2020-09-04 13:31:16 -07:00
bpatel