322697fdd0
more renames base on upper case
2020-06-29 17:39:38 -04:00
8438bf71e8
Fixed the first time previously seen windows service search to work
...
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update
Made the default deployment template be -70m@m to -10m@m
Added a new deployment template for hourly baseline caches
2020-06-25 00:09:30 -05:00
3c8c201add
Merge branch 'develop' into CRL-1766-auth-dm-updates
2020-06-16 10:46:20 -07:00
56ccf11ea0
this should be false
2020-06-09 17:58:39 -04:00
37199617b3
updating macro filters
2020-06-08 17:12:15 -07:00
35c4b110bc
Merge branch 'develop' into azuretest
2020-06-04 11:06:04 -07:00
9f2710bfde
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
72d3ab875e
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
50f3fdbbee
kubectlcalls
2020-05-26 23:42:26 -04:00
46803f5ea0
svacconpodnasp
2020-05-26 23:16:07 -04:00
1bbc7d1728
fixedanemsaddedservaccount
2020-05-26 22:40:16 -04:00
8e44ca15ca
RBACauth
2020-05-26 22:18:16 -04:00
6086fa8e2b
azk8srolesto
2020-05-21 18:41:32 -04:00
2e7d50b6d0
newstoryconfsecazk8s
2020-05-20 19:09:29 -04:00
0748085eca
azpodscandetect
2020-05-20 15:38:53 -04:00
4ac5dc4dff
k8sScan
2020-05-19 17:55:28 -04:00
cda505d8fa
new generate script
2020-05-06 17:42:38 +02:00
cc464c87db
updated content
2020-05-05 12:58:56 +02:00
909806896e
validate script
2020-04-30 16:52:38 +02:00
442a575e1d
WIP validate script
2020-04-30 15:51:16 +02:00
916e54d0ff
Merge pull request #429 from splunk/crl-1749ssh
...
CRL-1749 Cloud Stories
2020-04-17 10:36:24 -07:00
dde27b94d0
Merge pull request #430 from splunk/first_okta_story
...
new files for okta story
2020-04-02 15:20:54 -07:00
500a21e8cc
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
542f78b716
fixedssh
2020-03-28 09:25:01 -04:00
3d5891bb1e
adding macro and updating spl
2020-03-23 11:39:40 -07:00
45ffbde816
Merge branch 'develop' into CRL-1746
2020-03-16 13:23:43 -07:00
9363ded8d0
Merge pull request #385 from splunk/CRL-1733
...
CRL-1733: updating instructions for better clarification
2020-03-16 13:00:23 -06:00
bd439c0a85
Merge pull request #402 from splunk/CRL-1744_macro_fixes
...
fixes for a couple broken macros
2020-03-16 10:18:29 -07:00
1e3299d3f0
updating macro name too
2020-03-11 20:36:49 -04:00
7ee8310efb
macro ymls and detection update
2020-03-09 17:46:47 -07:00
573e8e3aa0
fixes for a couple broken macros
2020-03-04 14:31:37 -07:00
5199a94b31
updating instructions for better clarification
2020-03-02 13:18:54 -08:00
637fdf3c11
Merge pull request #372 from splunk/container_implantation
...
Container implantation
2020-02-27 15:31:47 -08:00
187a00cd71
addedmacros
2020-02-27 17:09:50 -05:00
ef1b56f9ae
new credentia dumping detection
2020-02-21 09:03:15 +01:00
6b2c9e4172
Merge pull request #327 from splunk/supicious_email_updates
...
updating boiler plate, detection not working out of box against T1193…
2020-02-07 10:35:35 -08:00
556efc4a78
Merge pull request #325 from splunk/dns_query_updates
...
Update version info and macros
2020-02-07 10:33:05 -08:00
98195728fc
Merge pull request #324 from splunk/first_time_seen_cmd_updates
...
update version info, add macros for first time seen cmd line detection
2020-02-07 10:07:18 -08:00
0432161688
Merge pull request #326 from splunk/smb_detection_updates
...
update smb related content.
2020-02-07 10:05:44 -08:00
9849b76aff
Merge branch 'develop' into first_time_seen_cmd_updates
2020-02-07 10:02:26 -08:00
92768472e0
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
c92d097eac
updating boiler plate, detection not working out of box against T1193 but this may be due to error loading lookup table for supicious file extensions.
2020-01-27 03:04:55 -08:00
d4aa6bc9ea
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
2020-01-27 02:33:26 -08:00
b762034a4b
update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now
2020-01-27 01:44:53 -08:00
6406cfbc32
update version info, add macros for first time seen cmd line detection
2020-01-27 01:08:53 -08:00
9e6becda1f
adding definitions
2020-01-23 13:31:43 -08:00
2fd12b9155
Merge pull request #320 from splunk/don_young_bug
...
updating the manifest to reflect correct details
2020-01-22 17:26:54 -08:00
75485ef666
Merge pull request #316 from splunk/CRL-1717_addMacroDefinitionsWhereMissing
...
CRL-1717 - Added "search *" definitions to the macros without them… resolves #292
2020-01-22 14:59:44 -08:00
dd5b1ee344
Merge pull request #319 from splunk/dns_hijack_story_update
...
CRL-1718 updated fields and added macros and lookup entries
2020-01-22 14:58:40 -08:00
38b84113bf
Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion
...
CRL-1495 update share creation and deletion
2020-01-22 09:19:43 -08:00
divious1