3369d15d72
rm wrong commit
2022-06-13 10:40:47 -07:00
7233cb94d0
Branch was auto-updated.
2022-06-13 09:52:00 -07:00
2512086977
Branch was auto-updated.
2022-06-13 09:51:59 -07:00
d5fa5ddc0b
Branch was auto-updated.
2022-06-13 09:51:47 -07:00
6efcbd4b93
add risky command ML detection
2022-06-13 09:50:58 -07:00
fea6debab2
Branch was auto-updated.
2022-06-09 11:50:11 -07:00
3f5363dcd9
Branch was auto-updated.
2022-06-09 11:50:07 -07:00
1cc17f7394
Branch was auto-updated.
2022-06-09 11:50:05 -07:00
45af1019a7
Merge pull request #2228 from splunk/TR-1790_Failed_Detections
...
TR-1790 - Detection fixes
2022-06-09 14:49:40 -04:00
9baf583f06
Update azorult.yml
2022-06-09 17:46:04 +02:00
357808a69d
Update azorult.yml
2022-06-09 17:44:37 +02:00
9160a479f4
Update firewall_allowed_program_enable.yml
2022-06-09 16:18:54 +02:00
58d8339184
Update azorult.yml
2022-06-09 16:11:51 +02:00
e9479a7c9c
azorult-sfx-package
2022-06-09 16:07:40 +02:00
9cb95cd32d
Branch was auto-updated.
2022-06-08 19:58:40 -07:00
399b08bf9f
Branch was auto-updated.
2022-06-08 19:58:39 -07:00
10e1b51251
Branch was auto-updated.
2022-06-08 19:58:36 -07:00
e27822179b
Merge pull request #2237 from splunk/bugfix/PEX-76-sse-api-fix
2022-06-08 22:58:18 -04:00
c538613139
wrong detection file linked from
...
test file. Fixed.
2022-06-08 16:47:56 -07:00
b87dff2883
Fixing name field in a detection
...
test file
2022-06-08 16:01:21 -07:00
9bcd3dff27
Branch was auto-updated.
2022-06-08 15:58:43 -07:00
d5dcb8b36d
Branch was auto-updated.
2022-06-08 15:58:42 -07:00
66280ea4cb
Branch was auto-updated.
2022-06-08 15:58:40 -07:00
b536c9202e
Branch was auto-updated.
2022-06-08 15:58:39 -07:00
38513551c7
Merge pull request #2241 from splunk/support_custom_indices_in_test
...
Support custom indices in test files
2022-06-08 18:58:23 -04:00
1e9b95542d
Missing parenthesis added
2022-06-08 15:30:49 -07:00
8eb675522e
Moved printout of delete status
...
updates to a better location and
condensed multiple printouts for
multiple indices to 1.
2022-06-08 15:21:54 -07:00
5e36835ce9
Moving default data index
...
definition to splunk_sdk file.
2022-06-08 14:57:33 -07:00
ec0c39c8d5
updating wrong field
2022-06-08 16:24:39 -04:00
fe2713e077
Fixed a detection which was
...
using the wrong macro
2022-06-08 12:40:52 -07:00
41c6cdbfae
fixing wrong field name
2022-06-08 15:34:29 -04:00
10b2b29122
Adding appropriate custom_index to detection
...
and fixing naming error and file_name error
2022-06-08 12:14:46 -07:00
47cd84d377
Wrong sourcetype declared in one
...
of the test files, causing it to fail.
Fixed missing backticks on some
macros.
2022-06-08 11:46:42 -07:00
e8abbd916b
Added missing _internal custom_indexes
...
to relevant test files. Removed the |
character from searches that use
index and sourcetype macros at the
beginning of the search.
2022-06-08 11:08:21 -07:00
3fb342d4c4
Fixed improperly named macro.
...
Renamed the macro in the tests
that use that macro. Added the
optional field, "custom_index"
to the test files which MUST
upload data into the _audit
index. This branch doesn't
support custom_index yet,
but those changes will be merged
soon from another branch.
2022-06-08 10:31:53 -07:00
7c2047e2cf
Unbalanced quote - fixed
2022-06-07 13:05:05 -07:00
9191057b1b
Changed to use a special host field
...
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
2022-06-07 12:55:54 -07:00
d8c3d523b5
touchup
2022-06-07 07:10:27 -06:00
bc57962c0c
more-defense-evasion
2022-06-07 13:13:02 +02:00
7c2dd368cd
more-defense-evasion
2022-06-07 12:53:31 +02:00
066ac9ffb3
more-defense-evasion
2022-06-07 11:50:27 +02:00
aca19c102b
Forgot to include return type from function
2022-06-06 17:15:08 -07:00
8212e22bcb
Forgot to include a break on
...
the forced timeout
2022-06-06 17:03:59 -07:00
7a18850877
Forcing a timeout... certain indexes
...
may continue growing and never have
the same number of events!
2022-06-06 16:53:15 -07:00
d3da287905
Added support for specifying a custom index
...
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
2022-06-06 16:08:06 -07:00
e7c8d2c1f8
Merge branch 'bugfix/PEX-76-sse-api-fix' of github.com:splunk/security_content into bugfix/PEX-76-sse-api-fix
2022-06-06 15:01:49 -07:00
84420a1912
PEX-76: fix the detections obj to include the J2 docs fields
2022-06-06 15:01:26 -07:00
0fc379cbb3
updating docs and package bits [ci skip]
2022-06-06 21:13:55 +00:00
81882aafc6
Branch was auto-updated.
2022-06-06 13:30:44 -07:00
1ac4d22e6c
Branch was auto-updated.
2022-06-06 13:30:42 -07:00
Xiao Lin