 bpatel
|
3d39407b64
|
mergeing with develop, include CI changes
|
2019-06-05 14:05:51 -07:00 |
|
|
Jason Brewer
|
5f1c5429db
|
CRL-1428 - Packaging again.
|
2019-06-05 10:36:41 -07:00 |
|
|
Jason Brewer
|
c898cec377
|
CRL-1428 - Updated all detection searches per Bhavin's guidance and generated conf files.
|
2019-06-05 10:15:12 -07:00 |
|
|
Jason Brewer
|
f6c47731e7
|
CRL-1428 - Modifying how to implement notes.
|
2019-06-05 09:38:46 -07:00 |
|
|
proyer
|
ea121f3ff0
|
fix typos in spaces detection
|
2019-06-05 11:27:35 -04:00 |
|
|
briannablacet
|
462f632f7a
|
Update email_attachments_with_spaces.json
A couple teeny changes for grammar and punctuation.
|
2019-06-04 12:00:32 -07:00 |
|
|
proyer
|
719fa45a59
|
Merge branch 'develop' into CRL-1473
|
2019-06-04 14:35:34 -04:00 |
|
|
proyer
|
3d0457d675
|
CRL-1473 link email attachment detections to new playbook
I just published the playbook:
https://my.phantom.us/4.2/playbook/suspicious-email-attachment-
investigate-and-delete/
So now I am linking the analytic story "Suspicious Email" to call that
playbook when triggered.
|
2019-06-04 10:43:57 -04:00 |
|
|
proyer
|
1436a54ac9
|
Merge branch 'develop' into CRL-1473
|
2019-06-04 09:49:01 -04:00 |
|
|
bpatel
|
d7841f1c8e
|
updates to text and search
|
2019-05-29 11:37:25 -07:00 |
|
|
bpatel
|
fda2d4cb66
|
updates to how to implement
|
2019-05-29 11:14:20 -07:00 |
|
|
bpatel
|
fc711f8438
|
updates to how to implement
|
2019-05-29 10:53:54 -07:00 |
|
|
Jose Enrique Hernandez
|
4fc38c667d
|
Merge pull request #75 from splunk/CRL-1474
lame - adding spaces
|
2019-05-29 13:08:35 -04:00 |
|
|
bpatel
|
1d56b24839
|
update to how to implement
|
2019-05-24 14:44:47 -07:00 |
|
|
Rico Valdez
|
2830d24486
|
needed a break in there - formatting
|
2019-05-23 10:36:58 -06:00 |
|
|
Rico Valdez
|
1c6c41da3d
|
added code block to avoid italics, as escaping underscores was a no-go
|
2019-05-23 10:21:43 -06:00 |
|
|
Rico Valdez
|
63dfe45c91
|
fix italics and fixed URL not showing as code
|
2019-05-23 10:16:50 -06:00 |
|
|
Rico Valdez
|
5db76094cb
|
Please enter the commit message for your changes. Lines starting
escaped quotes
|
2019-05-22 18:42:41 -06:00 |
|
|
Rico Valdez
|
43ef842562
|
text updates and removed isOutlier from search output
|
2019-05-22 18:37:44 -06:00 |
|
|
bpatel
|
cb2c30de86
|
bringing the branch upto date with develop
|
2019-05-17 11:50:36 -07:00 |
|
|
Rico Valdez
|
438ac72bda
|
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
|
2019-05-17 11:17:49 -06:00 |
|
|
Rico Valdez
|
25e629b8db
|
fixes for references to renamed searches
|
2019-05-15 13:56:49 -06:00 |
|
|
Jason Brewer
|
a1f2964dc8
|
CLR-1428 - removing comments and "search_type" keys.
|
2019-05-15 10:58:12 -07:00 |
|
|
bpatel
|
c24a20afc6
|
lame - adding spaces
|
2019-05-14 19:07:57 -07:00 |
|
|
Jason Brewer
|
2dcc2fc636
|
CRL-1428 - Removing outputlookup from detection search. It is creating inconsistencies in the lookup.
|
2019-05-14 12:55:09 -07:00 |
|
|
Jason Brewer
|
0e320c6a39
|
CRL-1428 - Updating per code review feedback.
|
2019-05-13 16:05:24 -07:00 |
|
|
bpatel
|
7510af7266
|
files updated to spec2.0 and phantom shell file
|
2019-05-13 12:36:05 -07:00 |
|
|
Rico Valdez
|
98907055ff
|
pushing Brianna edits
|
2019-05-10 09:10:48 -06:00 |
|
|
Rico Valdez
|
bd42f11bb6
|
search tweaks (mostly output formatting) based on discussion with Bhavin
|
2019-05-09 14:18:55 -06:00 |
|
|
Rico Valdez
|
6cdedee427
|
fixed an erronous change to the original spec file
|
2019-05-08 15:57:04 -06:00 |
|
|
Rico Valdez
|
f8fe738bce
|
another typo
|
2019-05-08 15:43:18 -06:00 |
|
|
Rico Valdez
|
37f6e78d6f
|
another typo
|
2019-05-08 15:40:59 -06:00 |
|
|
Rico Valdez
|
0a6beee328
|
fixing typo
|
2019-05-08 15:37:16 -06:00 |
|
|
Rico Valdez
|
be6701df8d
|
fix some hyphen issues
|
2019-05-08 15:33:18 -06:00 |
|
|
Rico Valdez
|
318a41d3c9
|
translated to v1 spec
|
2019-05-08 15:13:20 -06:00 |
|
|
Rico Valdez
|
a78865213d
|
fixing some json structure after Brianna edits
|
2019-05-08 10:25:59 -06:00 |
|
|
bblacet
|
e9df2198d1
|
various changes for grammar, punctuation, and flow
|
2019-05-08 08:47:43 -07:00 |
|
|
bblacet
|
781924aaca
|
Various changes for grammar, punctuation, and flow.
|
2019-05-07 16:52:42 -07:00 |
|
|
Rico Valdez
|
13f7508c46
|
fixes to entities
|
2019-05-07 14:32:04 -06:00 |
|
|
Rico Valdez
|
030683cbed
|
created 3 new searches and associated support searches that are mltk versions of existing searches. Also added them to the appropriate stories and fixed the non-capitalized title for an investigative search - updated associated stories for that as well.
|
2019-05-07 13:57:23 -06:00 |
|
|
bpatel
|
6ec66236dd
|
search and datamodel update
|
2019-05-07 11:18:24 -07:00 |
|
|
bpatel
|
6284acdf37
|
updates to name and links
|
2019-05-06 11:48:35 -07:00 |
|
|
Jason Brewer
|
7950452a95
|
CRL-1428 - Updating relevant searches to spec v2.
|
2019-04-30 17:03:34 -07:00 |
|
|
Jose Enrique Hernandez
|
7a8f2d01a9
|
Merge pull request #59 from splunk/file_writes_fix
fixing broken detection search - suspicious_file_writes
|
2019-04-29 17:13:50 -04:00 |
|
|
Rico Valdez
|
f761e9066c
|
fixing broken detection search - suspicious_file_writes
|
2019-04-29 14:35:27 -06:00 |
|
|
divious1
|
34f4a1ca98
|
typo
|
2019-04-29 15:51:57 -04:00 |
|
|
divious1
|
50fb65a58c
|
minor rendering updates
|
2019-04-29 15:31:44 -04:00 |
|
|
Jose Enrique Hernandez
|
a9b081e97d
|
Merge pull request #57 from splunk/CRL-1391_phishing_payload_detection
Crl 1391 phishing payload detection
|
2019-04-26 15:54:43 -04:00 |
|
|
bpatel
|
f298c52387
|
date updates
|
2019-04-26 11:22:34 -07:00 |
|
|
Jason Brewer
|
ddad8fb162
|
CRL-1428 - Adding new user City, Region, and Country detections and needed baseline changes.
|
2019-04-25 15:59:30 -07:00 |
|