admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,167 Commits 697 Branches 195 Tags
develop
Commit Graph

54 Commits

Author SHA1 Message Date
Eric McGinnis db8c7c8509 Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit. 2026-05-13 14:02:27 -07:00
Nasreddine Bencherchali 11c909f725 Add YAML Formatting Job (#3889) 
* Add YAML formatting and validation infrastructure

- Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings
- Add yamllint configuration (.yamllint) for syntax validation (detections/ only)
- Add pre-commit hook for automatic YAML formatting
- Add CI validation script with unified error output
- Add GitHub Actions workflow for PR validation
- Add documentation for setup and usage
- Support custom yamlfmt binary path via --yamlfmt-path flag

* comment yaml check from pre-commit

* apply yamlfmt

* Update yaml-validation.yml

* Update yaml-validation.yml

* application folder search formatting

* cloud folder search formatting

* web folder search formatting

* network folder search formatting

* endpoint folder search formatting

* resolve first conflict

* apply formatting

* remove additional pipe

* Update README.md

* update versions

* restore and update formatting (#3920)

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-02-26 00:00:35 +05:30
Eric d9960562b8 Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different. 2025-05-02 14:10:46 -07:00
Patrick Bareiss 3122cbbc8b output improvements 2025-03-18 12:56:30 +01:00
Patrick Bareiss f587288967 version bump 2025-02-26 11:10:59 +01:00
Patrick Bareiss e2bc6c1a66 Merge branch 'develop' into output_normalization_aws 2025-02-18 09:50:28 +01:00
pyth0n1c 45599e0b18 Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined. 2025-02-10 12:28:22 -08:00
Patrick Bareiss 3349099691 output normlaization 2025-02-03 10:15:07 +01:00
pyth0n1c d1442c2805 remove update_timestamps, confidence, impact, 
related_fields, and risk_score from detections
 2025-01-03 15:25:52 -08:00
ljstella 91e76c6567 cloud: remove rba from hunting 2024-11-15 11:02:10 -06:00
ljstella bf5d4c12c2 cloud: ip address typefix 2024-11-15 10:25:34 -06:00
ljstella a27edb3162 cloud: lowercase rba types 2024-11-15 10:17:19 -06:00
ljstella 318311f1c7 cloud detections initial translation 2024-11-14 16:45:49 -06:00
Bhavin Patel 385ac7adc1 remove end hours 2024-10-23 17:52:24 -07:00
Bhavin Patel e2bff20247 updating detections 2024-10-17 08:21:25 -07:00
Bhavin Patel 22e5ea3f83 Release Branch - ESCU v4.34.0 2024-06-26 14:41:53 +00:00
Bhavin Patel 6c5446cfbc Release Branch - ESCU v4.32.0 2024-05-22 16:47:39 +00:00
Bhavin Patel 7115026c81 mionr 2023-06-22 14:46:26 -07:00
Bhavin Patel a6ed42aef4 Update aws_createaccesskey.yml 2023-06-22 14:38:19 -07:00
P4T12ICK 5ad9ac276e Improve description 2023-06-22 16:34:18 +02:00
P4T12ICK 78909f6429 merged with develop 2023-03-03 12:40:16 +01:00
P4T12ICK fd0c8b349f updated tags 2023-01-09 09:33:30 +01:00
P4T12ICK 5ae53c9368 Migrated all detections to v4 2023-01-03 13:42:10 +01:00
pyth0n1c 578e6bb088 Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links. 2022-05-02 17:12:50 -07:00
pyth0n1c 9f50f52b35 Branch was auto-updated. 2022-03-14 10:14:17 -07:00
Michael Haag e08e7f3e5a syntax 2022-03-10 08:16:21 -07:00
P4T12ICK 6f0ee68913 Refactored security content 2022-03-09 14:43:09 +01:00
Bhavin Patel e53e25aee4 Update aws_createaccesskey.yml 2022-03-08 09:23:58 -08:00
pyth0n1c b2037a2712 Branch was auto-updated. 2022-03-04 12:21:26 -08:00
Jose Enrique Hernandez d78bb53baa Revert "Refactored security content" 2022-03-04 15:13:04 -05:00
pyth0n1c 19b631aca4 Branch was auto-updated. 2022-03-04 09:34:03 -08:00
patel-bhavin 33b5987f16 spl updates 2022-03-03 12:46:44 -08:00
P4T12ICK 4fd8604b9a removed SAAWS and automated_detection_testing flag 2022-01-27 09:50:45 +01:00
tccontre 8a1bed2fb9 CARS_UPDATE_MITRE_ID_B1 2021-10-11 11:03:20 +02:00
P4T12ICK 5e6e987fb7 resolved merge conflicts 2021-07-21 09:22:09 +02:00
research bot 44ea56053d updating docs and package bits [ci skip] 2021-07-20 21:12:30 +00:00
github-actions[bot] ed7f7456b6 Branch was auto-updated. 2021-07-20 19:43:24 +00:00
research bot 3740535cca updating docs and package bits [ci skip] 2021-07-20 17:49:09 +00:00
github-actions[bot] d74c858cdd Branch was auto-updated. 2021-07-20 15:56:34 +00:00
github-actions[bot] 5e909eea9b Branch was auto-updated. 2021-07-20 15:56:32 +00:00
patel-bhavin b100388abb fixes 2021-07-19 14:44:42 -07:00
P4T12ICK 65a92a64e1 add analytic types to detections 2021-07-19 16:49:33 +02:00
github-actions[bot] 51ce55801d Branch was auto-updated. 2021-07-02 15:06:54 +00:00
patel-bhavin 36cb084235 first 6 ymls 2021-06-30 16:48:13 -05:00
patel-bhavin 42d2afeae8 adding keys to all cloud detections with a 2021-06-29 16:58:47 -05:00
divious1 022c5be43e Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming" 
This reverts commit 45c138d518.
 2021-06-25 15:03:55 -04:00
divious1 f262360d0a updated CloudTrails to AWS CloudTrails 2021-06-25 14:50:50 -04:00
divious1 45c138d518 updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming 2021-06-25 14:44:02 -04:00
research bot 6212932c35 updating docs and package bits [ci skip] 2021-03-25 19:35:07 +00:00
bpatel 4e0776d751 updates 2021-03-23 13:12:47 -07:00