 Eric McGinnis
|
db8c7c8509
|
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
|
2026-05-13 14:02:27 -07:00 |
|
|
Nasreddine Bencherchali
|
bc1b413923
|
Fix Reported Issues - April Batch (#3962)
* Fix #3961
* Fix #3909
* Fix output fields
* Remove duplicate process_name entry
* Update outbound_network_connection_from_java_using_default_ports.yml
* Update detect_computer_changed_with_anonymous_account.yml
* Update detect_computer_changed_with_anonymous_account.yml
* Fix #3969
* update palo alto TA and beautify analytics
* Update vmware_aria_operations_exploit_attempt.yml
* fix source
* enhance metadata and fp info
* beautify spl for ease of reading
* add some missing attack techniques
* remove unnecessary usage of regex
* Update windows_uac_bypass_suspicious_escalation_behavior.yml
* small fix
* Refine description and improve regex
* Update windows_uac_bypass_suspicious_escalation_behavior.yml
* Update possible_lateral_movement_powershell_spawn.yml
* Update possible_lateral_movement_powershell_spawn.yml
* Update windows_event_log_security_4756.yml
* description update
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2026-03-30 14:34:11 +05:30 |
|
|
Br3akp0int
|
3da4f7958a
|
anomaly_standard_init_score (#3946)
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2026-03-10 14:19:08 +05:30 |
|
|
Nasreddine Bencherchali
|
11c909f725
|
Add YAML Formatting Job (#3889)
* Add YAML formatting and validation infrastructure
- Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings
- Add yamllint configuration (.yamllint) for syntax validation (detections/ only)
- Add pre-commit hook for automatic YAML formatting
- Add CI validation script with unified error output
- Add GitHub Actions workflow for PR validation
- Add documentation for setup and usage
- Support custom yamlfmt binary path via --yamlfmt-path flag
* comment yaml check from pre-commit
* apply yamlfmt
* Update yaml-validation.yml
* Update yaml-validation.yml
* application folder search formatting
* cloud folder search formatting
* web folder search formatting
* network folder search formatting
* endpoint folder search formatting
* resolve first conflict
* apply formatting
* remove additional pipe
* Update README.md
* update versions
* restore and update formatting (#3920)
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2026-02-26 00:00:35 +05:30 |
|
|
Eric
|
d9960562b8
|
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
|
2025-05-02 14:10:46 -07:00 |
|
|
research-bot
|
3d646fa16d
|
updating version
|
2025-01-21 14:34:51 -08:00 |
|
|
pyth0n1c
|
d1442c2805
|
remove update_timestamps, confidence, impact,
related_fields, and risk_score from detections
|
2025-01-03 15:25:52 -08:00 |
|
|
ljstella
|
9f14118bbc
|
application: cleanup tbd messages
|
2024-11-27 12:32:56 -06:00 |
|
|
ljstella
|
18a44d5f42
|
application: more typefixes
|
2024-11-15 10:35:52 -06:00 |
|
|
ljstella
|
92ab1d5e16
|
application: lowercase rba types
|
2024-11-15 10:18:09 -06:00 |
|
|
ljstella
|
d4a93b0268
|
Application detection score field rename
|
2024-11-15 09:49:32 -06:00 |
|
|
ljstella
|
c6739f2c72
|
application detections score fix
|
2024-11-15 09:41:01 -06:00 |
|
|
ljstella
|
a0a94f389b
|
Application detections
|
2024-11-13 15:47:11 -06:00 |
|
|
Bhavin Patel
|
385ac7adc1
|
remove end hours
|
2024-10-23 17:52:24 -07:00 |
|
|
Bhavin Patel
|
e2bff20247
|
updating detections
|
2024-10-17 08:21:25 -07:00 |
|
|
Bhavin Patel
|
7539e88c4c
|
Release Branch v4.33.0
|
2024-06-05 21:05:06 +00:00 |
|
|
P4T12ICK
|
78909f6429
|
merged with develop
|
2023-03-03 12:40:16 +01:00 |
|
|
P4T12ICK
|
fd0c8b349f
|
updated tags
|
2023-01-09 09:33:30 +01:00 |
|
|
P4T12ICK
|
5ae53c9368
|
Migrated all detections to v4
|
2023-01-03 13:42:10 +01:00 |
|
|
P4T12ICK
|
843d99f9d9
|
moved detections
|
2021-01-13 17:59:31 +01:00 |
|
|
P4T12ICK
|
466735ac5a
|
new test file
|
2020-12-08 11:19:49 +01:00 |
|