admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
26,069 Commits 697 Branches 195 Tags
deprecated_mapping
Commit Graph

1023 Commits

Author SHA1 Message Date
Bhavin Patel 52327020f9 Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil 2025-02-18 17:09:15 -08:00
pyth0n1c 8902d8c09e fix datasource reference in 
detection.
 2025-02-18 08:58:19 -08:00
Steven Dick 0a2bdd06b1 Merge branch 'splunk:develop' into nterl0k-t1567-o365-sus-file-exfil 2025-02-14 09:23:03 -05:00
pyth0n1c b9f5735bd3 Merge branch 'develop' into remove_type_and_subtype 2025-02-11 15:38:08 -08:00
Bhavin Patel f3e0d875e0 Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change 2025-02-11 08:42:28 -08:00
Bhavin Patel 25af0925e6 rba message 2025-02-11 08:41:18 -08:00
pyth0n1c 45599e0b18 Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined. 2025-02-10 12:28:22 -08:00
Bhavin Patel e2868a78b0 Merge branch 'develop' into nterl0k-t1213.002-sus-sharepoint-search 2025-02-05 15:31:38 -08:00
Bhavin Patel 5462f1ca72 Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change 2025-02-05 14:23:45 -08:00
Nasreddine Bencherchali cf69152cd5 Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil 2025-02-05 22:03:56 +01:00
Bhavin Patel dfc98cf162 Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change 2025-02-05 12:41:34 -08:00
Bhavin Patel d46de4f487 Merge branch 'develop' into nterl0k-t1110-mfasweep-detection 2025-02-05 11:59:44 -08:00
research-bot 76a9a02c9e updating versions 2025-02-05 10:49:03 -08:00
Steven Dick d11d2df008 Update o365_sharepoint_suspicious_search_behavior.yml 2025-02-02 12:59:26 -05:00
Steven Dick 816bffa538 Merge branch 'splunk:develop' into nterl0k-t1110-mfasweep-detection 2025-02-02 12:57:39 -05:00
Steven Dick 93fdd5aac8 Merge branch 'splunk:develop' into nterl0k-t1114.003-o365-transport-rule-change 2025-02-02 12:55:57 -05:00
Steven Dick 35590471bc Merge branch 'splunk:develop' into nterl0k-t1213.002-sus-sharepoint-search 2025-02-02 12:55:32 -05:00
Steven Dick 97b27a672f Update o365_sharepoint_suspicious_search_behavior.yml 
update to v5 yaml spec / update search yaml for better readability / remove single quote in SPL issues
 2025-02-02 12:52:02 -05:00
Steven Dick fab070785c Update o365_multiple_os_vendors_authenticating_from_user.yml 
update to new yaml spec / update search yaml for better readability / remove single quote in SPL issues
 2025-02-02 12:43:45 -05:00
Steven Dick 1ac26e3bc8 Update o365_exfiltration_via_file_sync_download.yml 
update search yaml for better readability / remove single quote in SPL issues
 2025-02-02 12:31:31 -05:00
Steven Dick 84c1a4c5e2 Update o365_exfiltration_via_file_download.yml 
update search yaml for better readability / remove single quote in SPL issues
 2025-02-02 12:31:04 -05:00
Steven Dick 9de89087f3 Update o365_exfiltration_via_file_access.yml 
update search yaml for better readability / remove single quote in SPL issues
 2025-02-02 12:30:38 -05:00
Steven Dick 02c5a24100 Update o365_email_transport_rule_changed.yml 2025-01-31 19:45:28 -05:00
Steven Dick 977c6785ae Update o365_email_transport_rule_changed.yml 2025-01-31 15:01:55 -05:00
Steven Dick ffc64431b7 Update o365_email_transport_rule_changed.yml 2025-01-31 14:58:01 -05:00
Steven Dick 4bd74d8606 Update o365_email_transport_rule_changed.yml 2025-01-31 12:08:20 -05:00
Steven Dick ae1b755f2f Update o365_exfiltration_via_file_sync_download.yml 2025-01-31 08:51:10 -05:00
Steven Dick 0e8ac8a29d Update o365_exfiltration_via_file_download.yml 2025-01-31 08:50:45 -05:00
Steven Dick 842ee12115 Update o365_exfiltration_via_file_access.yml 2025-01-31 08:50:31 -05:00
Steven Dick a136609516 Update o365_exfiltration_via_file_sync_download.yml 2025-01-31 08:48:07 -05:00
Steven Dick 38c3f574a7 Update o365_exfiltration_via_file_download.yml 2025-01-31 08:47:03 -05:00
Steven Dick 7a00c05673 Update o365_exfiltration_via_file_access.yml 2025-01-31 08:45:35 -05:00
Steven Dick bef252afde Update o365_exfiltration_via_file_sync_download.yml 2025-01-28 16:03:29 -05:00
Steven Dick 2f99dd1121 Update o365_exfiltration_via_file_download.yml 2025-01-28 16:03:10 -05:00
Steven Dick 2fdbb800e2 Update o365_exfiltration_via_file_access.yml 2025-01-28 16:02:55 -05:00
Steven Dick 039ef36865 Update o365_exfiltration_via_file_access.yml 2025-01-28 15:59:01 -05:00
Steven Dick 8297766f25 Update o365_exfiltration_via_file_download.yml 2025-01-28 15:58:44 -05:00
Steven Dick e29b0b3f01 Update o365_exfiltration_via_file_sync_download.yml 2025-01-28 15:58:20 -05:00
Steven Dick f74a15dcd7 Add files via upload 2025-01-28 15:51:23 -05:00
research-bot 6c3e7df1ad notable to finding 2 2025-01-24 17:03:47 -08:00
research-bot 217666c5d1 all but one fixes 2025-01-23 09:56:40 -08:00
ljstella ef2ac2a45f Removal of fields from new detections 2025-01-15 15:17:50 -06:00
Bhavin Patel 9ee2e1de7d Branch was auto-updated. 2025-01-15 13:05:43 -08:00
ljstella 70861d2d57 More migrations: AWS, Azure, O365 2025-01-15 15:05:18 -06:00
Steven Dick c0de38c353 Update o365_email_transport_rule_changed.yml 2025-01-15 15:39:31 -05:00
Steven Dick 61dcaf1d29 Update o365_email_transport_rule_changed.yml 
probably single tick closeness to start problem in SPL
 2025-01-15 15:36:39 -05:00
Steven Dick 46bc87e818 Add files via upload 2025-01-15 15:24:16 -05:00
Lou Stella 1d086b4a2b Merge branch 'rba_migration' into strict_yml_from_rba 2025-01-15 14:16:35 -06:00
Lou Stella 9c5b3aadd0 Merge branch 'develop' into rba_migration 2025-01-15 14:12:36 -06:00
Patrick Bareiss a7d061c5a1 Add ASL AWS CloudTrail data source 2025-01-15 14:07:43 -06:00