2a15f8b170
Branch was auto-updated.
2021-12-20 12:42:51 -08:00
d60bcec3a4
Branch was auto-updated.
2021-12-20 12:42:50 -08:00
59b9068998
Merge pull request #1894 from splunk/Fix_Log4j_detection
...
Update Log4J Detection to use data models
2021-12-20 15:42:26 -05:00
7230b5c63d
Print out some system usage information on each update.
...
This will help users dianose if their systems are overburdend
and also helps us figure out what the appropriate number
of containers to run on cloud infrastructure, like GitHub
Actions, may be without logging directly into the machine
doing the testing. In some cases, we can't log into those
machines by design. If you're running tests at home, you
can also just listen to the volume of your computer's fans.
2021-12-20 12:02:11 -08:00
cc8113ec86
Fixed output of manifest for detection_failure_manifest.json. Previously, it contained mostly default settings and most notably did not container the proper apps configuration. Also updated a few documentation strings.
2021-12-20 08:34:54 -08:00
e1261b36ca
Update ssa___hiding_files_and_directories_with_attrib_exe.yml
2021-12-20 17:18:44 +01:00
b61311f72b
new_ssa_info_sabotage
2021-12-20 13:44:02 +01:00
f144fc5df3
new_ssa_info_sabotage
2021-12-20 12:37:12 +01:00
c53510c42a
new_ssa_info_sabotage
2021-12-20 12:31:21 +01:00
9cf834a5f1
new_ssa_info_sabotage
2021-12-20 12:25:34 +01:00
d6581e728b
new_ssa_info_sabotage
2021-12-20 12:21:04 +01:00
cdab1e8c74
new_ssa_ifo_sabotage
2021-12-20 12:17:04 +01:00
76364bf1c0
Updated the default configuration to use attack_range
...
apps stored on S3. Pointed at the PATCHED linux_sysmon.
Added a slight delay in between starts of containers for
performance reasons. Enabled better handling and ability
to download http_path local apps to a folder instead of
passing them in as string for the container to download.
2021-12-17 20:06:42 -08:00
2ebb9f8c40
Updated Log4shell hunt
2021-12-17 11:43:40 -07:00
c8082984f0
A large number of changes and fixes to make
...
everything smoother. The largest differences
are improving detection of containers that
take too long to start (or that crash while)
they are starting by adding a timeout. That
timeout is set to 360 seconds and might need
to be tuned in the future to a larger number
since this was tested on a fast machine with
fast network. The other large change is an
initial pass at updating and committing
detections that have passed the test back
to the repo. This still needs a lot of testing and
refinement.
2021-12-17 10:13:49 -08:00
422a0f5b9d
add builder design pattern instead of repository
2021-12-17 18:08:12 +01:00
6e12b4f2ad
Branch was auto-updated.
2021-12-16 12:55:23 -08:00
3eb630b220
Branch was auto-updated.
2021-12-16 12:55:22 -08:00
eff3306f89
Merge pull request #1897 from splunk/ssa_descriptive_branch_name
...
SSA descriptive branch name
2021-12-16 14:55:05 -06:00
55fd63fe2f
Caps fix
2021-12-16 14:53:54 -06:00
3aa223a948
Adding sourcetype to sysproc_unexpected_location test
2021-12-16 10:44:05 -06:00
ba83011191
Adding addl humvee runner and fixing macro def
2021-12-16 10:42:01 -06:00
4a1b55931b
WIP
2021-12-16 09:42:36 +01:00
46c4c874d3
Branch was auto-updated.
2021-12-15 15:52:05 -08:00
ab3eb94c83
Branch was auto-updated.
2021-12-15 15:52:04 -08:00
7431dabd65
Merge pull request #1896 from splunk/doc_updates
...
Docs Update for playbook changes
2021-12-15 15:51:51 -08:00
2f8de77b7c
Docs Update for playbook changes
2021-12-15 17:42:47 -06:00
72a04655d0
Branch was auto-updated.
2021-12-15 15:20:37 -08:00
ae3484780a
Branch was auto-updated.
2021-12-15 15:20:36 -08:00
9c21e7f869
Merge pull request #1895 from splunk/The_Day_After_The_Day_After_log4shell
...
The Day After The Day After log4shell
2021-12-15 17:20:18 -06:00
01bc5757b6
removed married parent playbook
2021-12-15 17:06:02 -06:00
fbf15c3424
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
872ea4b55c
Standardized type
2021-12-15 15:52:40 -06:00
496f97a0ee
Added detection testing service results inOutbound Network Connection from Java Using Default Ports
2021-12-15 21:19:25 +00:00
ca0aaa46c5
divorced parent playbook
2021-12-15 15:03:21 -06:00
3bb9712286
updating detection to use data models
2021-12-15 15:53:06 -05:00
337e077224
Merge pull request #1892 from splunk/bug_with_playbook_detection
...
bug with playbooks detection page
2021-12-15 14:16:09 -06:00
0df62338c9
bug with playbooks detection page
2021-12-15 15:01:27 -05:00
9eea4ded41
It's Raining Haags
2021-12-15 13:01:04 -07:00
8566c56a0e
Merge pull request #1889 from splunk/minor_api_gen_bug
...
fixes a logic bug with the api that caused ci to fail
2021-12-15 14:56:09 -05:00
974d1bfc40
Branch was auto-updated.
2021-12-15 11:47:08 -08:00
589aa6e233
Merge pull request #1891 from splunk/bug_with_playbook_detections
...
fixing bug with dead links
2021-12-15 14:46:51 -05:00
2862f68474
fixing bug with dead links
2021-12-15 14:35:04 -05:00
b341343435
Updated friendly name
2021-12-15 11:30:26 -06:00
c8cc65bf3d
updated api
2021-12-15 11:18:17 -05:00
028863eea9
Updated screenshot
2021-12-15 10:15:39 -06:00
be760c4171
test:conflict resolved
2021-12-15 21:21:45 +05:30
a2b6fff739
test:updated ymls
2021-12-15 21:15:02 +05:30
8ef6a460ab
added story and story tags entities
2021-12-15 13:39:24 +01:00
6f2a298788
fixes a logic bug with the api that caused ci to fail
2021-12-14 22:52:18 -05:00
Bhavin Patel