96f9a8945e
adding sooshie detectinos, minor mods and ascii check in generate
2020-01-09 15:46:14 -08:00
78397edbf9
fixing a bug in generate due to intro of new field
2020-01-06 13:34:53 -05:00
2ed8b32696
Merged with develop
2019-12-17 09:13:43 +01:00
8ae3ebdbf5
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
bccd9746b8
WIP: liche check disabled
2019-12-16 13:18:25 +01:00
13d31154b7
updating the jinja to have quotes
2019-12-13 12:20:05 -08:00
6c35f20a55
added investigations to detections
2019-12-12 16:44:26 +01:00
3da0cbf8b2
added ctime macro to ESCU
2019-12-11 14:04:42 +01:00
cf13afa6c4
bug fix of generate.py
2019-12-11 13:29:27 +01:00
92e3489d72
remove escu next steps and AR actions
2019-11-26 15:03:09 -05:00
be5cd1dd13
migrating docgen to python3
2019-11-21 20:21:24 -05:00
20c4a18215
moving validate to python3
2019-11-21 20:17:15 -05:00
2663d3f88b
updating generate to use python3
2019-11-21 20:14:44 -05:00
541b72fd71
merge with develop and testing
2019-11-05 12:22:01 -08:00
a2445e1d1a
comment description in transforms.conf
2019-10-31 13:22:12 -07:00
6c3b53fdb1
added changes for ASX
2019-10-30 10:54:59 -07:00
0bfe786fcc
Code Refactoring od generate.py
2019-10-29 18:41:12 -07:00
2004017dea
Code Refactoring od generate.py
2019-10-29 18:35:16 -07:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
c9effaf169
Merge branch 'develop' into cloud_cryptominig
2019-10-08 08:40:51 -04:00
9c6c794b81
Merge pull request #215 from splunk/drilldown
...
Added drilldown search and name to the detection spec.
2019-10-08 08:32:49 -04:00
2a4b29e4c4
New investigation macros
...
Updated validate to check for macro and lookup existence in both
baselines and investigation searches
2019-10-07 22:14:12 -05:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
d11219e54d
Updated generate code
2019-10-03 13:45:16 -07:00
2a8b470241
Added drilldown search and name to the detection spec.
...
Added these fields to the suspicious wevtutil manifest
Updated validate to make sure both entries are there or neither are
Updated generate to output those fields if they are there
2019-10-01 17:31:11 -07:00
1bda6248ea
Added code to validate macros manifest and lookups manifest
...
Lookup manifest validation also checks to make sure either filename or collection is there
If a filename is listed, it makes sure the file exists as well
2019-09-30 16:08:54 -07:00
979938f707
cleaned up markdown logic from scripts
2019-09-04 12:42:58 -04:00
019791e8bd
Merge pull request #185 from splunk/CRL-1591
...
remove incorrect stanzas
2019-08-14 12:10:32 -04:00
1dc4964261
remove incorrect stanzas
2019-08-13 11:53:57 -07:00
b82eaa7750
fixing merge conflicts
2019-08-06 17:45:35 -04:00
5836446617
fixed channel in stories, minor tweaks to detections.
...
Also - updated spec to allow validation to pass for UBA detection, as well as updated validation script
2019-08-06 14:58:39 -06:00
b7fcf3ade1
fixing issue where i wiped out most of the original code
2019-07-29 14:47:02 -04:00
a41d7a9991
minor modifications base on Jes feedback
2019-07-26 15:48:09 -04:00
fa63216143
Merge pull request #161 from splunk/CRL-1577
...
CRL-1577: updating usage details configuations
2019-07-26 12:30:05 -07:00
57118d085c
Merge pull request #167 from splunk/CRL-1580
...
CRL 1580 :UBA Anomaly
2019-07-26 12:26:53 -07:00
bfef6024fe
more tweaks/fixes to manifests - also adjustments to validation script and spec files. Successfully validates with exception of usecase in stories
2019-07-25 14:56:40 -06:00
06f5aa70fb
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
0173d1a411
search update on UBA
2019-07-17 15:58:52 -07:00
2e9d302554
updates to validate and sample UBA manifest for detection
2019-07-15 17:44:10 -07:00
ccc472d794
errors in CI
2019-07-10 16:01:51 -07:00
b5bc171d0f
correcting paths
2019-07-10 15:59:20 -07:00
fcda138cc8
updating usage details configuations
2019-07-10 15:14:39 -07:00
ec4b2fff18
generate docs automatically
2019-06-19 12:51:52 -04:00
3813882fae
doc generation skeleton
2019-06-19 00:03:14 -04:00
7ecce8781f
removed trailing whitespace check
2019-06-05 13:50:12 -04:00
3d87b6eee8
resolving develop merge conflicts
2019-06-04 15:52:54 -04:00
32a7974878
corrected generator error
2019-06-03 20:22:50 -04:00
0a10f7cee5
fixed bug
2019-06-03 19:45:58 -04:00
1a40ecd329
fixed a bug with generate_inventory
2019-06-03 19:43:16 -04:00
a5082387b6
fixing bug
2019-05-31 12:29:22 -04:00
bpatel