admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
27,912 Commits 697 Branches 195 Tags
create-vscode-schema
Commit Graph

418 Commits

Author SHA1 Message Date
Bhavin Patel 0f5eeb8ceb Updated TAs (#3854) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-07 10:17:04 +05:30
Bhavin Patel 6d1b940663 Cisco Isovalent - Add first batch of new detections (#3706) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-06 01:24:39 +01:00
Bhavin Patel cd961cac5b Updated TAs (#3849) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-21 19:20:09 +01:00
Bhavin Patel 4e90912faf Updated TAs (#3845) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-19 21:10:10 +05:30
Bhavin Patel 78d7f8cebd Updated TAs (#3832) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-12 15:06:49 +01:00
Bhavin Patel 378879ae67 Updated TAs (#3826) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-09 12:06:36 +01:00
Bhavin Patel 4b60fecd8e Automated Splunk TA Update 473 (#3820) 
* Updated TAs

* Adding ta-ollama

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: ljstella <lstella@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-12-08 16:05:19 +01:00
Nasreddine Bencherchali d8ddca1a2d Merge branch 'develop' into fix_cwd_path_detections 2025-12-03 00:25:40 +01:00
Nasreddine Bencherchali 572a93567f add missing extension 2025-12-02 18:59:42 +01:00
Nasreddine Bencherchali ff4fda6445 update indentations and logic 2025-12-02 18:58:56 +01:00
patel-bhavin 9604770975 Updated TAs 2025-11-27 06:59:55 +00:00
Nasreddine Bencherchali 515d736c62 Add New ASA Analytics (#3794) 
* first batch

* more updates

* update tags and filter

* more fixes

* Update cisco_asa___reconnaissance_command_activity.yml

* Update cisco_asa___reconnaissance_command_activity.yml

* Update cisco_asa___reconnaissance_command_activity.yml

* Update cisco_asa___reconnaissance_command_activity.yml

* update to production

* fixes and updates

* update date and fix typos

* apply suggestion

* Update cisco_asa___reconnaissance_command_activity.yml

* add explicit message ids

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-11-21 14:50:18 -08:00
Br3akp0int 888c2249e8 netsupport (#3798) 
* netsupport

* netsupport

* netsupport

* netsupport

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update data_sources/sysmon_eventid_29.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update data_sources/sysmon_eventid_29.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* netsupport

* netsupport

* netsupport

* netsupport

* updates

* small fixes

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-11-21 13:27:52 -08:00
patel-bhavin 50989c2650 Updated TAs 2025-11-21 06:59:48 +00:00
patel-bhavin 1bd5621d23 Updated TAs 2025-11-20 06:58:48 +00:00
Bhavin Patel 637e44267d Updated TAs (#3782) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-11-13 12:31:49 -08:00
Bhavin Patel e42da6eaf3 Automated Splunk TA Update 440 (#3761) 
* Updated TAs

* Applink

* Fix - Windows Kerberos Local Successful Logon (#3763)

* fixes?

* Update windows_svchost_exe_parent_process_anomaly.yml

revert

* manual test

* unicode

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-11-10 12:24:06 -08:00
Bhavin Patel d1a15f9e91 Ollama TA (#3757) 
* updating ta

* updating weird things
 2025-11-05 09:50:50 -08:00
Bhavin Patel d401d3a33b updating raw log (#3756) 2025-11-04 13:17:53 -08:00
Bhavin Patel bd66e7a1d3 remove TA (#3755) 2025-11-04 11:05:19 -08:00
Bhavin Patel 437a5cdf62 revert - Splunk Add-on for Microsoft Security (#3747) 
* revert this app

* revert versions
 2025-10-27 15:38:58 -07:00
Rod Soto 0bcb54b6f9 Ollama TA detections (#3710) 
* commit1oll

* olldet2

* olldet3

* fixeddet3

* fixsp

* olldet4

* olldet5

* detoll6

* olldet7

* olldet8

* datasets

* testfixes

* modifiedtasearch

* lotsofixes

* fixednewta

* addedmorerefs

* fixedatasource

* fixedthreatobject

* fixedetectionandalertmessage

* fixedalermessage

* fixedquotes

* fixedhowtoimp

* fixeddescriptionandhowto

* changedestforuripat

* fixedowasplink

* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_rce_via_model_loading.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* protoexnassuggestions

* mionr

* remove index=*

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 21:54:37 +02:00
Rod Soto 6cf5b0f8f6 Copilot based Detections (#3693) 
* det1

* fixeddt1

* det2

* d3

* det4

* djbk

* d6

* d7

* d8

* addedlnkds

* fixsctype

* pipegone

* fixp

* fixdevices

* jbfix

* datasetfix

* exp

* fixsynthax

* changedstory

* changeprinus

* improvedht

* changedSenderuser

* datas

* fixdoublesearch

* fixedpi

* fixeddescriptionsuser

* fixdatalink

* exportedlogsdatasource

* fixedhowtodatasource

* updating risk stuff

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 12:14:09 -07:00
patel-bhavin 5f36e1ea07 Updated TAs 2025-10-10 06:57:53 +00:00
patel-bhavin 73097a131f Updated TAs 2025-10-09 06:58:04 +00:00
patel-bhavin 50284777f7 Updated TAs 2025-10-08 06:57:56 +00:00
patel-bhavin 96cfc3ee82 Updated TAs 2025-10-07 06:58:20 +00:00
patel-bhavin 807bd7730e Updated TAs 2025-10-06 06:58:11 +00:00
patel-bhavin 4f4485d8bd Updated TAs 2025-10-02 06:58:12 +00:00
Bhavin Patel afb75a6bac Merge branch 'develop' into ctl_515 2025-09-29 12:07:09 -07:00
patel-bhavin b12935d33c Updated TAs 2025-09-29 06:59:13 +00:00
Bhavin Patel 4d7faff280 link for debug logging 2025-09-25 16:35:50 -07:00
Bhavin Patel 6fc52ccd51 updating to text 2025-09-25 16:21:47 -07:00
Bhavin Patel fd9394687e move to public 2025-09-25 13:05:25 -07:00
Bhavin Patel 5727b39bf8 updating rewuired output fields 2025-09-17 15:38:45 -07:00
patel-bhavin 8b3e0ef183 Updated TAs 2025-09-11 06:58:13 +00:00
patel-bhavin 5f529c8858 Updated TAs 2025-09-10 06:57:45 +00:00
patel-bhavin 9a0663e70a Updated TAs 2025-09-08 06:58:28 +00:00
patel-bhavin ea22018d32 Updated TAs 2025-08-27 06:57:46 +00:00
patel-bhavin e4135caf6e Updated TAs 2025-08-25 06:59:36 +00:00
Bhavin Patel 7541c45be5 data source description 2025-08-21 11:24:20 -07:00
Bhavin Patel c31013241b updatings with snort detection and lookup also contentctl 2025-08-21 09:43:02 -07:00
Michael Haag 125486536c DS + new 2025-08-21 10:08:59 -06:00
Bhavin Patel dc9bd32b13 udpating searches 2025-08-18 16:31:03 -07:00
Michael Haag 34d8db9847 updates 2025-08-18 16:21:35 -06:00
Michael Haag 1f709a9d67 The Lost Payload: MSIX Resurrection 
"They thought it was just a package."
 2025-08-18 11:46:34 -06:00
patel-bhavin 9572eb1853 Updated TAs 2025-08-11 07:02:06 +00:00
patel-bhavin fc4089f8bd Updated TAs 2025-08-07 07:02:29 +00:00
Bhavin Patel 2c6248de85 updating based on request from Ryan Long 2025-08-04 13:56:35 -05:00
patel-bhavin 391fedba18 Updated TAs 2025-07-29 07:01:46 +00:00