admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,059 Commits 697 Branches 195 Tags
drilldown_update
Commit Graph

28059 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bhavin Patel 2f931a3386 udpating spl and configs 2026-03-30 15:26:57 +05:30
Nasreddine Bencherchali b87507b551 Update Suricata TA and Related Analytics (#3974) 
* update suricata ta

* update analytics for new TA

* Update ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml

---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-28 10:09:22 +00:00
kbouchard 35e6ee2e97 Add files via upload (#3975) 
Updated OOB Response Plan for 8.5 Release of Splunk Enterprise Security

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-28 10:07:40 +00:00
Bhavin Patel 89391cf877 Tune detections based on Athena FPs (#3972) 
---------

Co-authored-by: p4t12ick <patrickbareiss1989@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-03-27 16:58:41 +01:00
p4t12ick fa45863186 Merge pull request #3971 from splunk/detections_improvement 
Improved detections based on telemetry.
 2026-03-27 13:20:26 +01:00
nasbench 30e0c54198 Update ryuk_wake_on_lan_command.yml 2026-03-27 12:21:22 +01:00
P4T12ICK 44f3125d35 bug fix 2026-03-27 10:13:56 +01:00
P4T12ICK 0b219a6b1e bug fix 2026-03-27 08:28:10 +01:00
P4T12ICK 8be3693cf3 changed back to Anomaly 2026-03-27 08:00:36 +01:00
P4T12ICK c40b390d3f updated suggestions 2026-03-27 07:58:29 +01:00
p4t12ick b4c002efb5 Update detections/endpoint/windows_account_access_removal_via_logoff_exec.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:45:57 +01:00
p4t12ick 3c1d41e219 Update detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:45:40 +01:00
p4t12ick 4912e09184 Update detections/endpoint/system_user_discovery_with_whoami.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:44:53 +01:00
p4t12ick b4c800deb2 Update detections/endpoint/conti_common_exec_parameter.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:43:29 +01:00
p4t12ick 6d5d970ee6 Update detections/endpoint/anomalous_usage_of_7zip.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:43:13 +01:00
P4T12ICK 520bfc060c bug fix 2026-03-26 10:19:11 +01:00
P4T12ICK dc3f50b24b bug fix 2026-03-26 10:13:15 +01:00
P4T12ICK 106a9ba5ca bug fixes 2026-03-26 09:28:52 +01:00
P4T12ICK fee2237a5f bug fix 2026-03-26 08:44:26 +01:00
P4T12ICK 90efd9a8ef bumped version numbers and dates 2026-03-26 08:01:41 +01:00
P4T12ICK e86354e45b bug fix 2026-03-26 07:55:10 +01:00
P4T12ICK 1e0096296b bug fix 2026-03-26 07:52:19 +01:00
p4t12ick eb0cb46f71 Merge branch 'develop' into detections_improvement 2026-03-26 07:51:05 +01:00
P4T12ICK e556cac279 Improved detections based on telemetry. 2026-03-26 07:46:49 +01:00
Br3akp0int 697a77cd08 Add Tagging and Analytic Story for Void Manticore (#3959) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-23 17:19:07 +01:00
Lou Stella 0f08a8b884 Tweaking attack_data links (#3966) 
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-23 14:38:28 +01:00
Bhavin Patel 37c9344ca0 chore: bump contentctl.yml to 5.25.0 (#3968) 
Co-authored-by: research bot <research@splunk.com>
 2026-03-23 17:52:55 +05:30
Bhavin Patel 45134af4ea Updated TAs (#3965) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
v5.24.0 		2026-03-19 00:13:23 +05:30
Lou Stella afccbee627 Changing parameter to hopefully fix TA "dependabot" (#3964) 
* Changing parameter to hopefully work

* typo

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-18 23:41:40 +05:30
Lou Stella c5506fa1f9 Merge pull request #3963 from splunk/bump_okta_ta 
bump okta ta to 5.0.1
 2026-03-18 12:57:29 -05:00
pyth0n1c fbf8bcbd40 bump okta ta. 5.0.0 was yanked from splunkbase 2026-03-18 10:42:14 -07:00
Bhavin Patel 709e57e129 Test- Integration failure fixes (#3960) 
* unit test

* testing second

* updating SPL

* prettyplz

* remove test
 2026-03-18 02:30:04 +05:30
Br3akp0int 27aeb7d95d Add BlankGrabber Stealer Related Analytics and Tagging (#3943) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 18:09:57 +01:00
Br3akp0int 9c7ef33e81 Fix Issue #3950 (#3957) 
---------

Co-authored-by: Bhavin Patel <bpatel@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 16:18:01 +01:00
Bhavin Patel 98ef843af8 Fix Windows AD Domain Replication ACL Addition (#3958) 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 16:08:55 +01:00
Michael Haag 4aeba4c377 Add Lotus Blossom Related Analytics and Tagging (#3953) 
---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 15:47:02 +01:00
Bhavin Patel b3fed38275 Deprecate MLTK detections (#3922) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-16 14:59:40 +01:00
Br3akp0int 3208147d4d Add Coverage For QuietVault (#3952) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-14 01:11:44 +01:00
Nasreddine Bencherchali 29113be7a7 Fix Broken Link, Versions and Pre-Commit (#3956) 
* fix links and versions

* more versions
 2026-03-13 19:17:15 +05:30
Andrei Banaru d1d4883e18 fix: replace src with src_user (#3955) 
Co-authored-by: Andrei Banaru <a.banaru@iaea.org>
 2026-03-13 17:29:46 +05:30
Emil a0059cf72c Adding dynamic information to static rba messages (#3951) 
* Adding dynamic information to static rba messages

* Updating rba message to bette represent what the detection triggers on

* Correcting syntax of rba message

* Updating version and date
 2026-03-13 11:27:18 +05:30
Br3akp0int de62304785 Add Analytic Story Tagging for Muddy Water (#3947) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-12 16:30:09 +00:00
Lou Stella 14a2a96f71 Merge pull request #3949 from splunk/dependabot/pre_commit/https-/github.com/pre-commit/pre-commit-hooks-6.0.0 
Bump https://github.com/pre-commit/pre-commit-hooks from v4.6.0 to 6.0.0
 2026-03-12 10:53:14 -05:00
Lou Stella 1e8aa4c728 Merge branch 'develop' into dependabot/pre_commit/https-/github.com/pre-commit/pre-commit-hooks-6.0.0 2026-03-12 10:51:02 -05:00
Nasreddine Bencherchali ed5884f607 More SD-WAN Content (#3944) 
* add more sd-wan content

* rename macro

* Update cisco_sd_wan_service_proxy_access.yml

* fix parsing

* Update cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml

* apply review suggestions
 2026-03-12 18:16:41 +05:30
ljstella f17bc8df6d Not every system has a python, but they should all have a python3 2026-03-11 10:39:42 -04:00
ljstella f0aadf7c81 Remove two hooks 2026-03-11 10:35:32 -04:00
dependabot[bot] 8231be2295 Bump https://github.com/pre-commit/pre-commit-hooks from v4.6.0 to 6.0.0 
Bumps [https://github.com/pre-commit/pre-commit-hooks](https://github.com/pre-commit/pre-commit-hooks) from v4.6.0 to 6.0.0.
- [Release notes](https://github.com/pre-commit/pre-commit-hooks/releases)
- [Changelog](https://github.com/pre-commit/pre-commit-hooks/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pre-commit/pre-commit-hooks/compare/v4.6.0...v6.0.0)

---
updated-dependencies:
- dependency-name: https://github.com/pre-commit/pre-commit-hooks
  dependency-version: 6.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-11 14:29:04 +00:00
Lou Stella e8f5e6453a Adding pre-commit to dependabot (#3948) 2026-03-11 19:58:11 +05:30
Br3akp0int 3da4f7958a anomaly_standard_init_score (#3946) 
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-10 14:19:08 +05:30