admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,138 Commits 697 Branches 195 Tags
gcppodscandetection
Commit Graph

442 Commits

Author SHA1 Message Date
Rod Soto f2b605fcbc gcppodscan 2020-07-17 21:52:31 -04:00
bpatel 3b1e639db2 rename file 2020-07-13 16:30:28 -07:00
Bhavin Patel da9ecd71fa Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml 2020-07-13 16:12:47 -07:00
Bhavin Patel a8c021a41e Update kubernetes_gcp_detect_RBAC_authorizations_by_account.yml 
typos
 2020-07-13 16:06:17 -07:00
Rod Soto 71032608db Merge branch 'gcpk8plussearches' of github.com:splunk/security-content into gcpk8plussearches 2020-07-13 19:03:08 -04:00
Rod Soto 6dbc996d9c fixbackticks 2020-07-13 19:01:57 -04:00
Bhavin Patel 62ab2b89e9 Merge branch 'develop' into gcpk8plussearches 2020-07-13 15:47:35 -07:00
Rod Soto 57fbe00de0 fixednamesmacros 2020-07-13 18:45:46 -04:00
Rod Soto 7fe2b89386 fixedsrctypewithmacro 2020-07-13 18:20:38 -04:00
Rod Soto b504edb561 fixedsourcetypeissue 2020-07-13 18:19:06 -04:00
Bhavin Patel 186196684d Update processes_launching_netsh.yml 
updated the screen, test screenshot in the comments
 2020-07-13 09:53:43 -07:00
Rod Soto f0fe477413 k8sgcpkubectlcallssarch 2020-07-11 23:38:08 -04:00
Rod Soto c32b00dc7b k8sgcpservaccforbiddenfailure 2020-07-11 22:50:41 -04:00
Rod Soto 4895d18619 k8sgcpsensitiverole 2020-07-11 21:26:00 -04:00
Rod Soto 4935f2a095 k8sgcpsenobjaccess 2020-07-11 20:55:48 -04:00
Rod Soto ce8d85ad06 gcpRBACdetection 2020-07-11 19:40:46 -04:00
divious1 e9cf649460 fixing merge error 2020-07-10 23:10:02 -04:00
jkuepker 6f54e15d91 Changed WHERE clause to fix broken search and renamed values(Processes.process) to Processes.process to match other field names for readability. 2020-07-10 22:11:09 -04:00
Rod Soto 4d9f634adf k8sgcpmactivesabypod 2020-07-10 19:39:21 -04:00
Rod Soto 3f79168731 addedgcpscansearch 2020-07-10 08:35:59 -04:00
jzsplunk 5cc42f10de Merge branch 'develop' into new_testing_file 2020-07-10 00:57:35 -07:00
divious1 04e8a8291e Merge branch 'develop' into T1526detections 2020-07-09 22:55:00 -04:00
Rod Soto e4a0589a4b addedmitretechnique 2020-07-09 22:24:16 -04:00
David Dorsey da9aa3de41 Removed data model module name from output 2020-07-09 11:42:51 -05:00
Patrick Bareiss 37e6f6f7c0 new pass condition handling 2020-07-09 14:29:53 +02:00
Patrick Bareiss 6f77dbd20c new pass condition handling 2020-07-09 14:21:33 +02:00
Patrick Bareiss 49d98cfc45 detection tested 2020-07-08 15:09:05 +02:00
Patrick Bareiss 594e1e1351 Merge branch 'develop' into testing_detections 2020-07-07 16:17:22 +02:00
Patrick Bareiss cd96e40b0b updated detection 2020-07-07 15:45:59 +02:00
Patrick Bareiss 6c36c57f33 tetsing detection 2020-07-06 17:03:00 +02:00
Patrick Bareiss bf51f994ec tested detection 2020-07-06 16:07:49 +02:00
Patrick Bareiss 0584f68059 tested detection 2020-07-06 16:04:47 +02:00
Patrick Bareiss 16903203d0 testing of detection 2020-07-03 16:59:30 +02:00
Patrick Bareiss 92648a7cd0 merged with develop 2020-07-01 10:55:53 +02:00
divious1 322697fdd0 more renames base on upper case 2020-06-29 17:39:38 -04:00
divious1 067e5e7e85 API expects name to be lower case 2020-06-29 15:21:12 -04:00
Bhavin Patel 3a82c218bb incorrect field name 2020-06-26 12:44:43 -07:00
Patrick Bareiss 967c1d7974 small change 2020-06-26 17:28:39 +02:00
Patrick Bareiss 92d6b66ffd small change 2020-06-26 16:45:42 +02:00
David Dorsey af09770db1 Merge branch 'develop' into first_time_windows_service_bug 2020-06-26 08:32:34 -05:00
David Dorsey 62a14e3217 Merge branch 'first_time_windows_service_bug' of github.com:splunk/security-content into first_time_windows_service_bug 2020-06-26 08:26:58 -05:00
David Dorsey f67734dedd Fixed SPL issues with detection. SPL syntax was wrong, and lookup was wrong. 2020-06-26 08:24:16 -05:00
Bhavin Patel 836c123569 Update abnormally_high_aws_instances_launched_by_user.yml 2020-06-25 13:57:54 -07:00
rvaldez617 b5e4ebff23 Merge branch 'develop' into security_hub_response 2020-06-25 14:45:01 -06:00
Bhavin Patel 957b39837f Merge branch 'develop' into awsgcpk8s 2020-06-25 13:26:56 -07:00
Bhavin Patel 1cddcfaa25 Merge branch 'develop' into first_time_windows_service_bug 2020-06-25 11:57:22 -07:00
Rod Soto e432a4ab50 fixedservaccounatct 2020-06-25 14:52:41 -04:00
Rod Soto 6ea3604481 fixedaddedcondition 2020-06-25 14:36:18 -04:00
David Dorsey c90fcb2e9f Update how to implement 2020-06-25 00:14:24 -05:00
David Dorsey 8438bf71e8 Fixed the first time previously seen windows service search to work 
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update

Made the default deployment template be -70m@m to -10m@m

Added a new deployment template for hourly baseline caches
 2020-06-25 00:09:30 -05:00