830c9189e9
bump pulled AWS TA version
2026-05-21 16:06:38 -07:00
db8c7c8509
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
2026-05-13 14:02:27 -07:00
29616ca93e
Updated TAs ( #4079 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-05-12 17:30:36 +02:00
76dbdce682
Updated TAs ( #4069 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-05-07 19:32:10 +05:30
ccc7f9bfd0
Updated TAs ( #4055 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-05-02 13:04:05 +02:00
becdb58b9f
Add Secure Access Firewall Detections ( #3986 )
...
---------
Co-authored-by: Lou Stella <ljstella@gmail.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-04-29 20:41:09 +02:00
1e1748cec6
Updated TAs ( #4033 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-04-28 11:25:21 +02:00
a94a743b63
Automated Splunk TA Update 610 ( #4029 )
...
---------
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com >
2026-04-24 08:36:18 +00:00
063a6fc38b
Updated TAs ( #4026 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-04-23 10:16:37 +05:30
6ee1a47e71
Updated TAs ( #4022 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-04-20 12:18:40 +02:00
c6241660c7
Remove missing fields in Windows Event Log Cleared detection ( #4001 )
...
* fix: remove missing fields in Windows Event Log Cleared detection
* fix: source should be XmlWinEventLog:System
* update ds and output fields
* Update windows_event_log_security_1102.yml
---------
Co-authored-by: Andrei Banaru <a.banaru@iaea.org >
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-04-16 10:52:16 +05:30
48698cbc4f
updating osquery ( #4013 )
2026-04-15 12:39:38 +02:00
8050483569
Snap Mac Detections ( #3935 )
...
* Snap Mac Detections
* add osquery
* Update links and formatting
* update datasource name
* update formatting
* bump version
* Updates per PR comments
* Add commandline to RBA for gatekeeper bypass
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com >
2026-04-14 19:48:42 +05:30
90536d0e5a
Palo Alto Ta 3.0.0 was pulled from Splukbase. ( #3985 )
...
As such we must bump the TA to the newest
(and only) available release, 3.0.1.
2026-03-31 22:42:26 +05:30
bc1b413923
Fix Reported Issues - April Batch ( #3962 )
...
* Fix #3961
* Fix #3909
* Fix output fields
* Remove duplicate process_name entry
* Update outbound_network_connection_from_java_using_default_ports.yml
* Update detect_computer_changed_with_anonymous_account.yml
* Update detect_computer_changed_with_anonymous_account.yml
* Fix #3969
* update palo alto TA and beautify analytics
* Update vmware_aria_operations_exploit_attempt.yml
* fix source
* enhance metadata and fp info
* beautify spl for ease of reading
* add some missing attack techniques
* remove unnecessary usage of regex
* Update windows_uac_bypass_suspicious_escalation_behavior.yml
* small fix
* Refine description and improve regex
* Update windows_uac_bypass_suspicious_escalation_behavior.yml
* Update possible_lateral_movement_powershell_spawn.yml
* Update possible_lateral_movement_powershell_spawn.yml
* Update windows_event_log_security_4756.yml
* description update
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-03-30 14:34:11 +05:30
b87507b551
Update Suricata TA and Related Analytics ( #3974 )
...
* update suricata ta
* update analytics for new TA
* Update ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml
---------
Co-authored-by: Lou Stella <ljstella@gmail.com >
2026-03-28 10:09:22 +00:00
45134af4ea
Updated TAs ( #3965 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-03-19 00:13:23 +05:30
fbf8bcbd40
bump okta ta. 5.0.0 was yanked from splunkbase
2026-03-18 10:42:14 -07:00
ed5884f607
More SD-WAN Content ( #3944 )
...
* add more sd-wan content
* rename macro
* Update cisco_sd_wan_service_proxy_access.yml
* fix parsing
* Update cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml
* apply review suggestions
2026-03-12 18:16:41 +05:30
96a4df100d
Automated Splunk TA Update 560 ( #3938 )
...
* Updated TAs
* updating app name
* testing TA
* remove comments
---------
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
Co-authored-by: Lou Stella <ljstella@gmail.com >
2026-03-06 12:26:52 +05:30
f930b525ee
Add New Analytics - February Batch ( #3886 )
...
* add percent encoded curl exec
* Fix #3916
* Add other calc process names entries
* apply formatting
* add more color
* add cisco sd-wan stuff
* update tags
* Update cisco_sd_wan___low_frequency_rogue_peer.yml
* add ds and maps it
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-03-03 18:31:37 +05:30
0fcd63a821
Updated TAs ( #3919 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-02-25 22:21:02 +05:30
91b957d103
Updated TAs ( #3918 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-02-24 22:18:56 +05:30
07d5e7d54d
Updated TAs ( #3914 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-02-20 10:49:23 +01:00
02573684ce
Add New MCP Related Detections ( #3895 )
...
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: Bhavin Patel <bpatel@splunk.com >
2026-02-17 23:39:01 +01:00
b29ba95b51
Updated TAs ( #3906 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-02-11 22:18:24 +05:30
91ab062bb4
Updated TAs ( #3900 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-02-10 19:52:27 +05:30
7cf9641f5f
upodated SPL based on new raw events ( #3898 )
...
* upodated SPL based on new raw events
* updating dataset link and data source file
---------
Co-authored-by: Bhavin Patel <bpatel@splunk.com >
Co-authored-by: Lou Stella <ljstella@gmail.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-02-10 12:59:45 +05:30
a43838a3f5
Automated Splunk TA Update 532 ( #3891 )
...
* Updated TAs
* Update Splunk app version and hardcoded path
---------
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-02-06 18:21:07 +05:30
c233cf9c04
Updated TAs ( #3884 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-01-31 19:40:56 +01:00
7941673530
Add Snort/IOS Correlation and Other Things ( #3857 )
2026-01-12 12:15:11 +01:00
06db914290
Updated TAs ( #3858 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-01-10 14:20:32 +01:00
478ecc0a4b
Updated TAs ( #3856 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-01-09 20:23:37 +00:00
0f5eeb8ceb
Updated TAs ( #3854 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2026-01-07 10:17:04 +05:30
6d1b940663
Cisco Isovalent - Add first batch of new detections ( #3706 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-01-06 01:24:39 +01:00
cd961cac5b
Updated TAs ( #3849 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2025-12-21 19:20:09 +01:00
4e90912faf
Updated TAs ( #3845 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2025-12-19 21:10:10 +05:30
78d7f8cebd
Updated TAs ( #3832 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2025-12-12 15:06:49 +01:00
378879ae67
Updated TAs ( #3826 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2025-12-09 12:06:36 +01:00
4b60fecd8e
Automated Splunk TA Update 473 ( #3820 )
...
* Updated TAs
* Adding ta-ollama
---------
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
Co-authored-by: ljstella <lstella@splunk.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-12-08 16:05:19 +01:00
d8ddca1a2d
Merge branch 'develop' into fix_cwd_path_detections
2025-12-03 00:25:40 +01:00
572a93567f
add missing extension
2025-12-02 18:59:42 +01:00
ff4fda6445
update indentations and logic
2025-12-02 18:58:56 +01:00
9604770975
Updated TAs
2025-11-27 06:59:55 +00:00
515d736c62
Add New ASA Analytics ( #3794 )
...
* first batch
* more updates
* update tags and filter
* more fixes
* Update cisco_asa___reconnaissance_command_activity.yml
* Update cisco_asa___reconnaissance_command_activity.yml
* Update cisco_asa___reconnaissance_command_activity.yml
* Update cisco_asa___reconnaissance_command_activity.yml
* update to production
* fixes and updates
* update date and fix typos
* apply suggestion
* Update cisco_asa___reconnaissance_command_activity.yml
* add explicit message ids
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-11-21 14:50:18 -08:00
888c2249e8
netsupport ( #3798 )
...
* netsupport
* netsupport
* netsupport
* netsupport
* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update data_sources/sysmon_eventid_29.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update data_sources/sysmon_eventid_29.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
* netsupport
* netsupport
* netsupport
* netsupport
* updates
* small fixes
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-11-21 13:27:52 -08:00
50989c2650
Updated TAs
2025-11-21 06:59:48 +00:00
1bd5621d23
Updated TAs
2025-11-20 06:58:48 +00:00
637e44267d
Updated TAs ( #3782 )
...
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2025-11-13 12:31:49 -08:00
e42da6eaf3
Automated Splunk TA Update 440 ( #3761 )
...
* Updated TAs
* Applink
* Fix - Windows Kerberos Local Successful Logon (#3763 )
* fixes?
* Update windows_svchost_exe_parent_process_anomaly.yml
revert
* manual test
* unicode
---------
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com >
2025-11-10 12:24:06 -08:00
Eric