db8c7c8509
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
2026-05-13 14:02:27 -07:00
ba59855b1d
updating risk drilldowns ( #4016 )
...
* updating drilldows
* inspect failures
* updating versions
* updating versins
* chore: empty commit to trigger CI
2026-04-17 17:28:53 +05:30
2e2f6fc649
ttp_standard_init_score ( #3945 )
...
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
2026-03-10 14:10:37 +05:30
11c909f725
Add YAML Formatting Job ( #3889 )
...
* Add YAML formatting and validation infrastructure
- Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings
- Add yamllint configuration (.yamllint) for syntax validation (detections/ only)
- Add pre-commit hook for automatic YAML formatting
- Add CI validation script with unified error output
- Add GitHub Actions workflow for PR validation
- Add documentation for setup and usage
- Support custom yamlfmt binary path via --yamlfmt-path flag
* comment yaml check from pre-commit
* apply yamlfmt
* Update yaml-validation.yml
* Update yaml-validation.yml
* application folder search formatting
* cloud folder search formatting
* web folder search formatting
* network folder search formatting
* endpoint folder search formatting
* resolve first conflict
* apply formatting
* remove additional pipe
* Update README.md
* update versions
* restore and update formatting (#3920 )
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-02-26 00:00:35 +05:30
a52d560c80
lokibot ( #3701 )
...
* lokibot
* lokibot
* lokibot
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-10-10 18:32:18 +00:00
d9960562b8
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
1c9debe9a6
update versions
2025-03-14 13:47:44 +01:00
6a53921a8c
Merge branch 'develop' into output_normalization_endpoint
2025-02-19 12:09:16 +01:00
e0183d3cb0
output normalization endpoint
2025-02-19 12:03:21 +01:00
45599e0b18
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
fdaa038eab
Finish removing extra fields, or renaming
...
misnamed fields, in endpoint detections
2025-01-03 15:47:32 -08:00
eb9dfba620
endpoint: threat object type cleanup
2024-11-15 14:51:09 -06:00
bc14854c55
endpoint: more typefixes
2024-11-15 10:36:13 -06:00
c9186e0b7d
endpoint: lowercase rba types
2024-11-15 10:16:37 -06:00
514123089d
endpoint detection score field rename
2024-11-15 09:49:53 -06:00
f88eb16c6f
endpoint detection score fix
2024-11-15 09:34:59 -06:00
92cc97a5a7
endpoint first pass
2024-11-14 15:44:51 -06:00
7eafc7cd60
updating sysmon to XML
2024-11-01 13:40:43 -07:00
d1c7e1b6e5
udpating sysmon source
2024-10-30 18:42:30 -07:00
0bb378b19b
updating drilldowns
2024-10-24 14:13:05 -07:00
8b03f3d58f
updating all detections with quotes
2024-10-24 14:08:37 -07:00
7bc11be7dc
updating drilldown_formatting
2024-10-23 18:25:39 -07:00
385ac7adc1
remove end hours
2024-10-23 17:52:24 -07:00
cf169b3de0
adding drilldowns to all
2024-09-30 22:04:57 +05:30
d5fb6c520c
update ymls so that they refer to the correct names
...
of datasources. this was mostly removing spaces
to convert "Sysmon Event ID N" to
"Sysmon EventID N". Also fix some ymls
that used the field "data_sources" when
it should be "data_source"
2024-09-26 14:48:44 -07:00
23b4910cf6
No More Haag-gling with BlackSuit: A Tailored Analytic Story
2024-08-26 13:27:08 -06:00
3e9684660f
Endpoint detections
2024-08-15 15:36:03 -05:00
22e5ea3f83
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
6c5446cfbc
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
bf7abc8ebf
updated with proper format
2023-10-13 13:32:37 -07:00
b97b5458cb
Merge branch 'release_v4.14.0' into update_50_detections
2023-10-11 12:05:13 -07:00
724221f82b
Manually update the .yml
2023-10-10 19:29:33 -07:00
64096b6e44
Edit parsing
2023-09-29 12:11:01 -07:00
8cd1076f87
Update 50 detections
2023-09-29 11:57:39 -07:00
50d19ab56d
updating moar
2023-09-19 15:26:01 -07:00
1d35e00366
testing a change for sysmon
2023-09-19 15:17:24 -07:00
c541aacf10
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
78909f6429
merged with develop
2023-03-03 12:40:16 +01:00
fd0c8b349f
updated tags
2023-01-09 09:33:30 +01:00
5ae53c9368
Migrated all detections to v4
2023-01-03 13:42:10 +01:00
6f0ee68913
Refactored security content
2022-03-09 14:43:09 +01:00
d78bb53baa
Revert "Refactored security content"
2022-03-04 15:13:04 -05:00
4fd8604b9a
removed SAAWS and automated_detection_testing flag
2022-01-27 09:50:45 +01:00
da17a2a938
CARS_UPDATE_MITRE_ID_B3
...
CARS_UPDATE_MITRE_ID_B3
2021-10-13 11:07:20 +02:00
5e6e987fb7
resolved merge conflicts
2021-07-21 09:22:09 +02:00
44ea56053d
updating docs and package bits [ci skip]
2021-07-20 21:12:30 +00:00
65a92a64e1
add analytic types to detections
2021-07-19 16:49:33 +02:00
72d6020209
RISKY FRISKY
2021-07-13 13:47:54 -06:00
7c134dbb5d
WIP
2021-03-10 14:44:44 +01:00
b58843ca9f
added datamodels as an array
2021-02-10 22:35:58 -05:00
Eric McGinnis