admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
18,530 Commits 697 Branches 195 Tags
fixDetectionTestingPassFail
Commit Graph

18530 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
David Dorsey 9b785919de validate fixes 2020-09-10 21:22:34 -05:00
David Dorsey 3efae7ccef cron_schedule fixed 2020-09-10 20:52:24 -05:00
David Dorsey 97dd7e357b Small updates 2020-09-10 20:49:00 -05:00
Bhavin Patel 796617a83c Merge branch 'develop' into fixedawsstsassumerole 2020-09-10 13:26:07 -07:00
Bhavin Patel ef3fee0a81 Update aws_detect_sts_assume_role_abuse.yml 
using cloudtrail as input macro
 2020-09-10 13:25:39 -07:00
Rico Valdez b3eeaef59d tweaks and updates 2020-09-10 14:19:45 -06:00
Jose Enrique Hernandez 2fadf948da Merge pull request #630 from splunk/TR-82-risk-tagging 
[TR-82] add in logic for risk tagging after synching with ESCU requirements
 2020-09-10 12:23:59 -04:00
divious1 8daac1602b Merge branch 'TR-82-risk-tagging' of github.com:splunk/security-content into TR-82-risk-tagging 2020-09-10 12:17:26 -04:00
divious1 9bfc5f9f4e updated spec docs and also added one more example 2020-09-10 12:17:21 -04:00
Jose Enrique Hernandez c76fc34e3f Merge branch 'develop' into TR-82-risk-tagging 2020-09-09 23:33:03 -04:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
Jose Enrique Hernandez bff7706c74 Merge branch 'develop' into response_phases 2020-09-09 16:07:21 -04:00
peter-cg ec7dd03c95 loud cloud 2020-09-09 12:25:52 -07:00
Jose Enrique Hernandez 7f7d03cf33 adding link to aws secret manager 2020-09-09 10:39:25 -04:00
P4T12ICK 0fe7693307 add automated detection service code 2020-09-09 16:16:54 +02:00
dependabot-preview[bot] f76e66d184 Merge pull request #659 from splunk/dependabot/pip/pyrsistent-0.17.2 2020-09-09 09:47:32 +00:00
dependabot-preview[bot] 8d1b7e1395 Bump pyrsistent from 0.17.1 to 0.17.2 
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent) from 0.17.1 to 0.17.2.
- [Release notes](https://github.com/tobgu/pyrsistent/releases)
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt)
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.17.1...v0.17.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-09-09 09:42:22 +00:00
dependabot-preview[bot] 9cdc721ad6 Merge pull request #656 from splunk/dependabot/pip/pyrsistent-0.17.1 2020-09-09 07:36:36 +00:00
dependabot-preview[bot] 027b8ce1a1 Bump pyrsistent from 0.17.0 to 0.17.1 
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent) from 0.17.0 to 0.17.1.
- [Release notes](https://github.com/tobgu/pyrsistent/releases)
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt)
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.17.0...v0.17.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-09-09 07:31:42 +00:00
David Dorsey fc99713981 Translated detections/detect_spike_in_security_group_activity.yml 2020-09-09 01:36:26 -05:00
David Dorsey adf19afe6a Updated baseline searches to have correct deployment. Which was also created 2020-09-09 01:35:38 -05:00
David Dorsey d588bbc8f6 Translated detect_spike_in_aws_api_activity.yml to use Change DM 2020-09-09 01:01:16 -05:00
David Dorsey 0748b5e8ee bug fixes 2020-09-09 01:00:45 -05:00
David Dorsey 3697092a4b Updated MLTK searches based on Peter's work 2020-09-08 22:49:16 -05:00
peter-cg 3b69af66a7 Adding cloud NACL deletion detection 2020-09-08 14:09:24 -07:00
peter-cg a0bad4ef74 Revert "Converting ACL deletion detection from Cloudtrail to Change DM" 
Actually will just add this as a new cloud_ detection and leave the old
one in place for now

This reverts commit 3159472018.
 2020-09-08 13:49:08 -07:00
peter-cg 3159472018 Converting ACL deletion detection from Cloudtrail to Change DM 2020-09-08 13:44:10 -07:00
dependabot-preview[bot] 83a35dcc65 Merge pull request #655 from splunk/dependabot/pip/pyrsistent-0.17.0 2020-09-08 19:42:40 +00:00
dependabot-preview[bot] c8a4d57195 Bump pyrsistent from 0.16.0 to 0.17.0 
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent) from 0.16.0 to 0.17.0.
- [Release notes](https://github.com/tobgu/pyrsistent/releases)
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt)
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.16.0...v0.17.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-09-08 19:38:00 +00:00
jzsplunk 19f3778dda Merge branch 'develop' into TR-82-risk-tagging 2020-09-08 09:52:12 -07:00
P4T12ICK 66f74754f6 Merge pull request #646 from splunk/update_test_files 
updated test files
 2020-09-07 13:27:51 +02:00
P4T12ICK 3e0cfa84cb updated test files 2020-09-07 13:18:03 +02:00
dependabot-preview[bot] 8400f241ca Merge pull request #642 from splunk/dependabot/pip/identify-1.5.0 2020-09-05 19:41:11 +00:00
dependabot-preview[bot] e6d5e4eda7 Bump identify from 1.4.30 to 1.5.0 
Bumps [identify](https://github.com/chriskuehl/identify) from 1.4.30 to 1.5.0.
- [Release notes](https://github.com/chriskuehl/identify/releases)
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.30...v1.5.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-09-05 19:34:10 +00:00
dependabot-preview[bot] 8361e993be Merge pull request #641 from splunk/dependabot/pip/attrs-20.2.0 2020-09-05 10:43:31 +00:00
dependabot-preview[bot] 443de49218 Bump attrs from 20.1.0 to 20.2.0 
Bumps [attrs](https://github.com/python-attrs/attrs) from 20.1.0 to 20.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-attrs/attrs/compare/20.1.0...20.2.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-09-05 10:37:59 +00:00
bpatel f9b2c816db minor naming bug 2020-09-04 13:52:49 -07:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
bpatel d12a38e8ff adding new stories to response 2020-09-04 13:38:05 -07:00
bpatel cea3735f1a updates to ymls to make sure validate passes 2020-09-04 13:31:16 -07:00
David Dorsey 7b098cf836 fixed validate issues 2020-09-04 13:13:22 -05:00
David Dorsey dbfecd9e29 New analytic story for suspicious cloud user activities. 2020-09-04 10:30:47 -05:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e8bf1d9e96 updates for mustang 2020-09-03 17:10:02 -06:00
bpatel 637ec487df risk validation 2020-09-03 11:30:09 -07:00
bpatel 20b1130737 Merge branch 'TR-82-risk-tagging' of https://github.com/splunk/security-content into TR-82-risk-tagging 2020-09-03 11:10:26 -07:00
bpatel 11db020423 risk validation 2020-09-03 11:09:52 -07:00
Rico Valdez 8ead727df7 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 
merging in updates
 2020-09-03 11:10:48 -06:00
Rico Valdez e9939cbc98 new files for unblocked searches 2020-09-03 11:10:14 -06:00
David Dorsey d82a74122d Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 2020-09-03 00:32:46 -05:00