admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,167 Commits 697 Branches 195 Tags
develop
Commit Graph

246 Commits

Author SHA1 Message Date
Bhavin Patel 0c3e5887e8 Bump contentctl.yml and build.yml to 6.1.0 (#4113) 
* chore: bump contentctl.yml and build.yml to 6.1.0

* move to removed

* status is removed

---------

Co-authored-by: research bot <research@splunk.com>
 2026-06-08 15:58:54 +02:00
Bhavin Patel 29616ca93e Updated TAs (#4079) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-05-12 17:30:36 +02:00
Bhavin Patel d37930351c Bump contentctl.yml to 6.0.0 (#4067) 
* chore: bump contentctl.yml to 5.28.0

* Update contentctl.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-12 11:19:34 +05:30
Bhavin Patel 76dbdce682 Updated TAs (#4069) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-05-07 19:32:10 +05:30
Bhavin Patel ccc7f9bfd0 Updated TAs (#4055) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-05-02 13:04:05 +02:00
Bhavin Patel becdb58b9f Add Secure Access Firewall Detections (#3986) 
---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-29 20:41:09 +02:00
Bhavin Patel 1e1748cec6 Updated TAs (#4033) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-04-28 11:25:21 +02:00
Bhavin Patel a94a743b63 Automated Splunk TA Update 610 (#4029) 
---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
 2026-04-24 08:36:18 +00:00
Bhavin Patel e98b868b8d chore: bump contentctl.yml to 5.27.0 (#4028) 
Co-authored-by: research bot <research@splunk.com>
 2026-04-24 10:34:16 +02:00
Bhavin Patel 063a6fc38b Updated TAs (#4026) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-04-23 10:16:37 +05:30
Bhavin Patel 6ee1a47e71 Updated TAs (#4022) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-04-20 12:18:40 +02:00
Raven Tait 8050483569 Snap Mac Detections (#3935) 
* Snap Mac Detections

* add osquery

* Update links and formatting

* update datasource name

* update formatting

* bump version

* Updates per PR comments

* Add commandline to RBA for gatekeeper bypass

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-14 19:48:42 +05:30
Bhavin Patel 116ab57d18 Remove AITK/MLTK TAs references from Contentctl.yml (#3911) 
---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-02 17:47:55 +02:00
Bhavin Patel 8c6453e0ea Bump contentctl.yml to 5.26.0 (#3989) 
* chore: bump contentctl.yml to 5.26.0

* remove detections

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-02 17:41:06 +02:00
pyth0n1c 90536d0e5a Palo Alto Ta 3.0.0 was pulled from Splukbase. (#3985) 
As such we must bump the TA to the newest 
(and only) available release, 3.0.1.
 2026-03-31 22:42:26 +05:30
Nasreddine Bencherchali bc1b413923 Fix Reported Issues - April Batch (#3962) 
* Fix #3961

* Fix #3909

* Fix output fields

* Remove duplicate process_name entry

* Update outbound_network_connection_from_java_using_default_ports.yml

* Update detect_computer_changed_with_anonymous_account.yml

* Update detect_computer_changed_with_anonymous_account.yml

* Fix #3969

* update palo alto TA and beautify analytics

* Update vmware_aria_operations_exploit_attempt.yml

* fix source

* enhance metadata and fp info

* beautify spl for ease of reading

* add some missing attack techniques

* remove unnecessary usage of regex

* Update windows_uac_bypass_suspicious_escalation_behavior.yml

* small fix

* Refine description and improve regex

* Update windows_uac_bypass_suspicious_escalation_behavior.yml

* Update possible_lateral_movement_powershell_spawn.yml

* Update possible_lateral_movement_powershell_spawn.yml

* Update windows_event_log_security_4756.yml

* description update

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-30 14:34:11 +05:30
Nasreddine Bencherchali b87507b551 Update Suricata TA and Related Analytics (#3974) 
* update suricata ta

* update analytics for new TA

* Update ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml

---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-28 10:09:22 +00:00
Bhavin Patel 37c9344ca0 chore: bump contentctl.yml to 5.25.0 (#3968) 
Co-authored-by: research bot <research@splunk.com>
 2026-03-23 17:52:55 +05:30
Bhavin Patel 45134af4ea Updated TAs (#3965) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-03-19 00:13:23 +05:30
pyth0n1c fbf8bcbd40 bump okta ta. 5.0.0 was yanked from splunkbase 2026-03-18 10:42:14 -07:00
Bhavin Patel 96a4df100d Automated Splunk TA Update 560 (#3938) 
* Updated TAs

* updating app name

* testing TA

* remove comments

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-06 12:26:52 +05:30
research bot 1eaa1a12d2 chore: bump contentctl.yml to 5.24.0 2026-03-04 19:11:57 +00:00
Bhavin Patel 0fcd63a821 Updated TAs (#3919) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-25 22:21:02 +05:30
Bhavin Patel 91b957d103 Updated TAs (#3918) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-24 22:18:56 +05:30
Bhavin Patel 15deedd635 chore: bump contentctl.yml to 5.23.0 (#3913) 
Co-authored-by: research bot <research@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-02-20 10:51:49 +01:00
Bhavin Patel 07d5e7d54d Updated TAs (#3914) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-20 10:49:23 +01:00
Rod Soto 02573684ce Add New MCP Related Detections (#3895) 
---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-02-17 23:39:01 +01:00
Bhavin Patel b29ba95b51 Updated TAs (#3906) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-11 22:18:24 +05:30
Bhavin Patel 91ab062bb4 Updated TAs (#3900) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-10 19:52:27 +05:30
Bhavin Patel d13e377a27 Bump contentctl.yml to 5.22.0 (#3894) 
* chore: bump contentctl.yml to 5.22.0

* remove detections

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-02-10 10:27:49 +05:30
Bhavin Patel a43838a3f5 Automated Splunk TA Update 532 (#3891) 
* Updated TAs

* Update Splunk app version and hardcoded path

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-02-06 18:21:07 +05:30
Bhavin Patel c233cf9c04 Updated TAs (#3884) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-31 19:40:56 +01:00
Bhavin Patel ce2de7a83c chore: bump contentctl.yml to 5.21.0 (#3872) 
Co-authored-by: research bot <research@splunk.com>
 2026-01-21 16:04:40 +01:00
Bhavin Patel 06db914290 Updated TAs (#3858) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-10 14:20:32 +01:00
Bhavin Patel 478ecc0a4b Updated TAs (#3856) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-09 20:23:37 +00:00
Bhavin Patel cd961cac5b Updated TAs (#3849) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-21 19:20:09 +01:00
Bhavin Patel 4e90912faf Updated TAs (#3845) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-19 21:10:10 +05:30
Bhavin Patel 2bcff6573a Bump contentctl.yml to 5.20.0 (#3829) 
* chore: bump contentctl.yml to 5.20.0

* move removed detections

---------

Co-authored-by: research bot <research@splunk.com>
 2025-12-15 23:12:19 +05:30
Bhavin Patel 78d7f8cebd Updated TAs (#3832) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-12 15:06:49 +01:00
Bhavin Patel 378879ae67 Updated TAs (#3826) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-09 12:06:36 +01:00
Bhavin Patel 4b60fecd8e Automated Splunk TA Update 473 (#3820) 
* Updated TAs

* Adding ta-ollama

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: ljstella <lstella@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-12-08 16:05:19 +01:00
patel-bhavin 9604770975 Updated TAs 2025-11-27 06:59:55 +00:00
Bhavin Patel 19d3c489fe CIM App name and Switch sourcetypes (#3799) 
* fix app issue

* splunkbase_file_name

* updating detections

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-11-21 08:33:33 -08:00
Bhavin Patel 637e44267d Updated TAs (#3782) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-11-13 12:31:49 -08:00
Bhavin Patel 075bd54bcf updating contentctl to 5.19 2025-11-12 17:02:24 -08:00
Bhavin Patel e42da6eaf3 Automated Splunk TA Update 440 (#3761) 
* Updated TAs

* Applink

* Fix - Windows Kerberos Local Successful Logon (#3763)

* fixes?

* Update windows_svchost_exe_parent_process_anomaly.yml

revert

* manual test

* unicode

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-11-10 12:24:06 -08:00
Bhavin Patel c5413e93f2 updating version and removing detections (#3749) 2025-10-30 10:29:04 -07:00
Bhavin Patel 437a5cdf62 revert - Splunk Add-on for Microsoft Security (#3747) 
* revert this app

* revert versions
 2025-10-27 15:38:58 -07:00
Bhavin Patel 1286d0fcd8 ctl_bump (#3734) 2025-10-17 12:25:15 -07:00
patel-bhavin 5f36e1ea07 Updated TAs 2025-10-10 06:57:53 +00:00