f7498459c8
changes for mustang
2020-09-02 10:21:52 -06:00
bda59e0708
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
...
merging in Dorsey's changes
2020-08-28 10:18:40 -06:00
662d680870
more updates
2020-08-28 10:12:55 -06:00
d662b0538d
Removed unused file
2020-08-26 23:17:03 -05:00
0a47f73352
Updated cloud instances destroyed to change data model
2020-08-26 22:57:45 -05:00
b48b40ff76
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-08-25 22:28:59 -05:00
7de781c8f0
Manifest cleanup
2020-08-20 13:15:14 -05:00
b4ab45f299
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-08-19 10:28:05 -05:00
9302baefaf
new files for translated detections
2020-08-18 16:38:38 -06:00
a0730b0878
new files - not finalized
2020-08-18 16:38:13 -06:00
1db6e6096d
some translated searches for change DM
2020-08-08 18:04:57 -06:00
07ce28f433
Updated baseline deployments
2020-06-25 13:49:48 -05:00
8438bf71e8
Fixed the first time previously seen windows service search to work
...
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update
Made the default deployment template be -70m@m to -10m@m
Added a new deployment template for hourly baseline caches
2020-06-25 00:09:30 -05:00
82c209b539
Merge branch 'develop' into CRL-1771-update-story-windows-service-abuse
2020-06-17 14:25:20 -07:00
e96a91aeb4
removed searches that depend on non-extracted fields
2020-06-16 12:43:48 -06:00
f892cda659
testing and update of story Windows Service Abuse
2020-06-15 14:28:20 +02:00
36a29c3d6d
text updates for ES and AWS add-on version
2020-06-09 12:15:58 -06:00
f4bc32f336
rename search names
2020-06-08 18:57:50 -07:00
9aafe24e49
yml updates for validate
2020-06-08 16:57:42 -07:00
32b200fc33
updates for fixes noted by Bhavin
2020-06-08 13:36:06 -06:00
af64fabb68
Merge branch 'develop' into CRL-1766-auth-dm-updates
...
merging in current develop branch
2020-06-05 12:26:24 -06:00
ac3003c8c9
file name updates, initial migration to spec 3. dm2_yml files are legacy for reference and will be removed before merging
2020-05-28 14:36:36 -06:00
72d3ab875e
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
04f6e035bf
Merge branch 'develop' into CRL-1766-auth-dm-updates
...
merged in develop, changed names as necessary. Need to now convert to spec3 on the new files and add story file
2020-05-28 13:07:45 -06:00
1d9beb8d47
new files for updated detections
2020-05-26 14:19:05 -06:00
729419b24d
Updated searches
2020-05-25 11:06:36 +02:00
9a50a74ee7
bug in generate
2020-05-14 10:00:55 +02:00
151bbbaa5a
bug in generate
2020-05-12 13:53:48 +02:00
cda505d8fa
new generate script
2020-05-06 17:42:38 +02:00
cc464c87db
updated content
2020-05-05 12:58:56 +02:00
442a575e1d
WIP validate script
2020-04-30 15:51:16 +02:00
7cbc9a9ba6
WIP
2020-04-30 10:34:18 +02:00
d2e82224b0
Converted all objects to new spec
2020-04-29 13:01:45 +02:00
799d22da14
fixing reported error
2020-03-04 09:58:52 -05:00
54c9bc9c38
updated search/metadata, tested in attack_range
2020-01-13 12:42:35 -08:00
8ae3ebdbf5
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
b379395c3b
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
f8e3113412
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
f9bdf7e0e4
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
95f73c9039
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
2019-11-25 18:06:33 -08:00
604e2ecc11
CRL-1646 - changing from user to src_user
2019-11-25 15:49:32 -08:00
38be9ebb26
CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.
2019-11-25 15:17:32 -08:00
12d6587e4a
CRL-1646 - Adjusting how to implement to quote the string and escape the newlines to soothe our tool chain.
2019-11-22 10:21:29 -08:00
37cdeab391
CRL-1646 - fixing stats.
2019-11-21 15:33:02 -08:00
3d1846cd2e
CRL-1646 - Updating to add input_filter macro to searches and to reference baseline search from detection search.
2019-11-21 14:01:14 -08:00
f21db84f76
CRL-1646 - Modifying search to see if my yml is wrong for a multiline object with pipes.
2019-11-20 15:50:39 -08:00
b3b4f4e892
CRL-1646 - Implemented : Update Detection for abnormally_high_instances_launched to use MLTK
2019-11-20 14:18:50 -08:00
7fa96a766e
updates to propery use cloud_infrastructure
2019-10-24 13:26:55 -06:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
85a637b149
Merge branch 'develop' into cloud_cryptominig
2019-10-07 22:59:06 -05:00
Rico Valdez