07ce28f433
Updated baseline deployments
2020-06-25 13:49:48 -05:00
8438bf71e8
Fixed the first time previously seen windows service search to work
...
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update
Made the default deployment template be -70m@m to -10m@m
Added a new deployment template for hourly baseline caches
2020-06-25 00:09:30 -05:00
82c209b539
Merge branch 'develop' into CRL-1771-update-story-windows-service-abuse
2020-06-17 14:25:20 -07:00
e96a91aeb4
removed searches that depend on non-extracted fields
2020-06-16 12:43:48 -06:00
f892cda659
testing and update of story Windows Service Abuse
2020-06-15 14:28:20 +02:00
36a29c3d6d
text updates for ES and AWS add-on version
2020-06-09 12:15:58 -06:00
f4bc32f336
rename search names
2020-06-08 18:57:50 -07:00
9aafe24e49
yml updates for validate
2020-06-08 16:57:42 -07:00
32b200fc33
updates for fixes noted by Bhavin
2020-06-08 13:36:06 -06:00
af64fabb68
Merge branch 'develop' into CRL-1766-auth-dm-updates
...
merging in current develop branch
2020-06-05 12:26:24 -06:00
ac3003c8c9
file name updates, initial migration to spec 3. dm2_yml files are legacy for reference and will be removed before merging
2020-05-28 14:36:36 -06:00
72d3ab875e
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
04f6e035bf
Merge branch 'develop' into CRL-1766-auth-dm-updates
...
merged in develop, changed names as necessary. Need to now convert to spec3 on the new files and add story file
2020-05-28 13:07:45 -06:00
1d9beb8d47
new files for updated detections
2020-05-26 14:19:05 -06:00
729419b24d
Updated searches
2020-05-25 11:06:36 +02:00
9a50a74ee7
bug in generate
2020-05-14 10:00:55 +02:00
151bbbaa5a
bug in generate
2020-05-12 13:53:48 +02:00
cda505d8fa
new generate script
2020-05-06 17:42:38 +02:00
cc464c87db
updated content
2020-05-05 12:58:56 +02:00
442a575e1d
WIP validate script
2020-04-30 15:51:16 +02:00
7cbc9a9ba6
WIP
2020-04-30 10:34:18 +02:00
d2e82224b0
Converted all objects to new spec
2020-04-29 13:01:45 +02:00
799d22da14
fixing reported error
2020-03-04 09:58:52 -05:00
54c9bc9c38
updated search/metadata, tested in attack_range
2020-01-13 12:42:35 -08:00
8ae3ebdbf5
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
b379395c3b
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
f8e3113412
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
f9bdf7e0e4
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
95f73c9039
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
2019-11-25 18:06:33 -08:00
604e2ecc11
CRL-1646 - changing from user to src_user
2019-11-25 15:49:32 -08:00
38be9ebb26
CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.
2019-11-25 15:17:32 -08:00
12d6587e4a
CRL-1646 - Adjusting how to implement to quote the string and escape the newlines to soothe our tool chain.
2019-11-22 10:21:29 -08:00
37cdeab391
CRL-1646 - fixing stats.
2019-11-21 15:33:02 -08:00
3d1846cd2e
CRL-1646 - Updating to add input_filter macro to searches and to reference baseline search from detection search.
2019-11-21 14:01:14 -08:00
f21db84f76
CRL-1646 - Modifying search to see if my yml is wrong for a multiline object with pipes.
2019-11-20 15:50:39 -08:00
b3b4f4e892
CRL-1646 - Implemented : Update Detection for abnormally_high_instances_launched to use MLTK
2019-11-20 14:18:50 -08:00
7fa96a766e
updates to propery use cloud_infrastructure
2019-10-24 13:26:55 -06:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
85a637b149
Merge branch 'develop' into cloud_cryptominig
2019-10-07 22:59:06 -05:00
82e8b210a9
Files for new cloud cryptominig story.
...
It's a cloud infrastructure generic version of AWS Cryptomining
2019-10-03 17:42:40 -07:00
cc6209a08e
Started to create Cloud Cryptomining story
...
Added 1 detection, 1 baseline, and 2 investigative searches
2019-10-02 21:05:30 -07:00
aec9dd53f5
Fixed issue inside of where clause
2019-09-30 16:17:29 -07:00
fe0b0e1133
removing html tags
2019-09-04 12:20:27 -04:00
80c6870a8a
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
06f5aa70fb
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
6dd4f4dc4b
merge and testing the package
2019-05-30 15:57:28 -07:00
43ef842562
text updates and removed isOutlier from search output
2019-05-22 18:37:44 -06:00
4616971e38
removing datamodel
2019-05-17 12:03:31 -07:00
cb2c30de86
bringing the branch upto date with develop
2019-05-17 11:50:36 -07:00
438ac72bda
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
2019-05-17 11:17:49 -06:00
David Dorsey