admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
27,806 Commits 697 Branches 195 Tags
data_source_bug_fix
Commit Graph

1253 Commits

Author SHA1 Message Date
Michael Haag a548ed769a Hellcat United (#3723) 
* Hellcat United

* fixes

* 🍱

* 1 mas

* Update powershell_4104_hunting.yml
 2025-10-16 16:53:02 -07:00
Bhavin Patel 68e7778b8a Update azure_ad_multi_source_failed_authentications_spike.yml 2025-09-29 14:45:01 -07:00
Bhavin Patel f450563436 updateing based on issue 2025-09-18 13:54:48 -07:00
Brian Serocki 939ee285a3 Correct Azure localization issues 2025-09-03 16:07:29 -05:00
Brian Serocki 7b24f8a54f Correct Azure localization issues 2025-09-03 13:17:03 -05:00
Bhavin Patel b04570fe56 updating SPL to match the issue fix after testing 2025-08-26 14:14:45 -07:00
Bhavin Patel f6fdcd098c updating search and other meta 2025-08-26 12:55:56 -07:00
Jake Enea e4cfd3c338 aad multiple denied mfa requests: updating version and date 2025-07-31 20:42:11 -04:00
Jake Enea 11a2f6a4ce aad multiple denied mfa requests: add _time in 'stats count by' to limit to 10 min windows 2025-07-31 20:37:59 -04:00
0xC0FFEEEE 3ccf82c437 update risk message 2025-07-24 09:00:34 +01:00
0xC0FFEEEE 1032077679 Add rule name to risk message 2025-07-23 09:42:34 +01:00
0xC0FFEEEE afefa1506c use correct drilldown field 2025-07-23 09:41:21 +01:00
0xC0FFEEEE 43fa38ef77 Add threshold filter 
Accidentally removed during testing of previous SPL update
 2025-07-23 09:39:53 +01:00
0xC0FFEEEE a278863c13 remove unneccesary json normalization 2025-07-03 09:17:50 +01:00
0xC0FFEEEE 3ba50a2d97 Add support for Set-InboxRule 2025-07-01 16:42:06 +01:00
ljstella 0f3feac263 Version bumps 2025-06-24 12:43:01 -05:00
ljstella 397107f88a Updated docs links in detections 2025-06-24 11:27:59 -05:00
ljstella 437b5cf59c Version bump 2025-06-17 09:14:07 -05:00
ljstella bded2e9379 Silly casing... 2025-06-17 09:09:53 -05:00
ljstella 342b06c308 Swap detections to experimental as test data no longer matches expectations of TA 2025-06-17 09:08:59 -05:00
ljstella ff624b020a change to supported sourcetype 2025-06-17 09:08:10 -05:00
Nasreddine Bencherchali 4801780532 Merge branch 'develop' into updates-june 2025-06-17 11:15:26 +02:00
Nasreddine Bencherchali 6c5aa91dbf more updates 2025-06-16 23:38:10 +02:00
Nasreddine Bencherchali feb9ec41b2 update to fix ci errors 2025-06-16 16:24:51 +02:00
Raven Tait 25617e6770 Initial remote employment fraud detections. 2025-06-12 14:43:59 -04:00
Nasreddine Bencherchali 8efe3b11d2 add manual_test tag 2025-06-10 21:25:21 +02:00
Nasreddine Bencherchali e4c733a3b4 update output fields 2025-06-10 20:07:40 +02:00
Nasreddine Bencherchali a62ddcc7b5 add drilldowns to production analytics 2025-06-10 16:26:40 +02:00
Nasreddine Bencherchali d985dc1105 upgrade detection with tests to production 2025-06-10 13:56:06 +02:00
pyth0n1c 4cfe72f575 Merge branch 'develop' into aws_to_ttp 2025-06-02 14:24:22 -07:00
Nasreddine Bencherchali d11917e14d Update o365_concurrent_sessions_from_different_ips.yml 2025-06-02 22:18:24 +02:00
Bhavin Patel a182c8c616 updating to TTP 2025-05-22 13:25:53 -07:00
Eric d9960562b8 Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different. 2025-05-02 14:10:46 -07:00
Eric 170ed93d9d Merge branch 'develop' into fix_bad_attack_data_paths 2025-04-29 16:54:17 -07:00
pyth0n1c aa3187d61e Merge branch 'develop' into remove_v5.4.0 2025-04-18 10:13:12 -07:00
Bhavin Patel eae0a4ed66 updating spls to match with output from data sources 2025-04-17 14:49:05 -07:00
Bhavin Patel 5b7cfdb7d3 updating versions 2025-04-16 16:45:16 -07:00
Bhavin Patel 1cbf9d3d2d updating and testing aws detections 2025-04-09 16:06:07 -07:00
Bhavin Patel b6b55499db Merge branch 'develop' into aws_bedrock 2025-04-09 14:38:00 -07:00
Bhavin Patel d28418800b fix with validate 2025-04-03 17:13:18 -07:00
Bhavin Patel 032dbfda68 adding kb detection 2025-04-03 16:55:45 -07:00
Bhavin Patel 1b2f69d137 adding new detection file 2025-04-03 12:13:43 -07:00
Bhavin Patel 70174e8318 update detection 2025-04-01 12:45:27 -07:00
Eric fc2be9e0b7 fix pass at attack data name fixes 2025-03-31 17:05:54 -07:00
Bhavin Patel 96bd1501b6 update inspect failures 2025-03-27 10:54:24 -07:00
Bhavin Patel 1e1700cd4d Merge branch 'develop' into output_normalization_endpoint 2025-03-26 10:04:43 -07:00
Bhavin Patel 7a9ebda18f delete guardrail 2025-03-25 17:38:14 -07:00
Bhavin Patel 428413f23b adding two bedrock detections 2025-03-25 17:02:16 -07:00
Bhavin Patel 63380103e5 udpate date format 2025-03-25 12:07:17 -07:00
Bhavin Patel 87eeec65a6 updating dates and verrsion 2025-03-25 11:21:38 -07:00