admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,231 Commits 697 Branches 195 Tags
gitlab_release_testing_2
Commit Graph

98 Commits

Author SHA1 Message Date
P4T12ICK d115bfd4e0 converted ssa detections to ocsf 2023-02-28 12:00:16 +01:00
Lou Stella 85f4f107a3 Changed to anomaly 2022-06-21 14:45:43 -05:00
P4T12ICK 5dd13ea167 fix broken detections 2022-03-14 15:51:05 +01:00
P4T12ICK e6c8254ede Added automaticc generation of finding report 2022-03-14 12:12:48 +01:00
P4T12ICK 6f0ee68913 Refactored security content 2022-03-09 14:43:09 +01:00
Jose Enrique Hernandez d78bb53baa Revert "Refactored security content" 2022-03-04 15:13:04 -05:00
P4T12ICK 4fd8604b9a removed SAAWS and automated_detection_testing flag 2022-01-27 09:50:45 +01:00
P4T12ICK f48f8f5b71 fixed bugs in detections after running new validate 2022-01-17 17:45:12 +01:00
P4T12ICK 98e5af3713 put baselines and investigations into its own folder 2022-01-17 10:56:04 +01:00
Patrick Bareiss d2e82224b0 Converted all objects to new spec 2020-04-29 13:01:45 +02:00
Bhavin Patel 916e54d0ff Merge pull request #429 from splunk/crl-1749ssh 
CRL-1749 Cloud Stories
 2020-04-17 10:36:24 -07:00
bpatel 7a4a584bfe rename src_ip 2020-04-16 16:21:45 -07:00
rvaldez617 ffcf2d9f97 tweaks for field names 2020-04-16 16:57:58 -06:00
rvaldez617 dde1c12961 tweaks - sourceIPs{} may cause issues 2020-04-16 16:43:05 -06:00
bpatel f689b71d18 adding new investigation manifest 2020-04-16 12:06:36 -07:00
bpatel 5fc984f4cc adding new investigation manifest 2020-04-16 11:51:19 -07:00
Rod Soto 46429df8b2 fixedentity 2020-04-13 21:38:00 -04:00
Rod Soto 99039b45bd fixed block errors 2020-04-13 21:33:32 -04:00
Rod Soto b8d27d16a2 fixedinvestigations 2020-04-13 21:21:41 -04:00
Rod Soto be16d2dd86 consolidated 2020-04-13 19:57:13 -04:00
Rico Valdez 4febee85d8 Updates to detection files - still need macros 2020-04-02 13:17:04 -06:00
Rico Valdez 576debf5ec new files for okta story 2020-04-02 12:31:22 -06:00
Rod Soto 542f78b716 fixedssh 2020-03-28 09:25:01 -04:00
divious1 1254634518 fixing pieces missing from manifests 2020-02-26 11:46:08 -08:00
Rod Soto c94c334a0e fixedinvestigationcontainer 2020-02-24 13:46:34 -05:00
Rod Soto 4aa2e28e80 fixedyml 2020-02-20 20:41:26 -05:00
Rod Soto c2a2060c98 story_container 2020-02-20 18:17:54 -05:00
Jason Brewer b85543e0b5 CRL-1717 - Addressing comments by removing unnecessary output_filter macros from investigation searches and removing references to those in the investigation definitions. 2020-01-22 08:40:30 -08:00
bpatel fe8ff90e4e updating how to implement and readme 2019-12-19 11:22:44 -08:00
Patrick Bareiss 4e8427cff4 Worked on the feedback 2019-12-18 10:23:55 +01:00
Patrick Bareiss 2ed8b32696 Merged with develop 2019-12-17 09:13:43 +01:00
Bhavin Patel f0276e9255 Merge branch 'develop' into CRL-1700_ES_macros 2019-12-16 12:40:16 -08:00
Patrick Bareiss 7b4b6a681d Merge branch 'develop' into CRL-1698_new_version_credential_dumping 2019-12-16 10:29:22 +01:00
Patrick Bareiss 6c35f20a55 added investigations to detections 2019-12-12 16:44:26 +01:00
bpatel b379395c3b fixing the files that didnt update the macros correctly 2019-12-11 15:39:14 -08:00
David Dorsey 04bc97cafa Made my changes a string.... 2019-12-11 13:24:04 -08:00
David Dorsey bfff607ed2 Fixed time window errors. 2019-12-11 12:54:56 -08:00
divious1 f8e3113412 added summariesonly and fixed ctime 2019-12-11 15:14:49 -05:00
divious1 f9bdf7e0e4 introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy 2019-12-11 14:59:03 -05:00
David Dorsey 5f30745b7c Fixed issue in CRL-1387 where the check for executionpolicy bypass 
was too broad.
Also, added investigation searches for file and registry activity
while I was here
 2019-11-06 18:39:21 -08:00
Jose Enrique Hernandez 870d6d76eb Merge branch 'develop' into cloud_cryptomining 2019-10-28 13:58:23 -04:00
Rico Valdez 80403c89e7 fixed a typo 2019-10-24 13:34:50 -06:00
Rico Valdez 7fa96a766e updates to propery use cloud_infrastructure 2019-10-24 13:26:55 -06:00
David Dorsey 20e5a75464 Remove _ fields 2019-10-17 10:29:22 -07:00
David Dorsey 8a4a631f3c Module name for DM search was wrong 2019-10-17 08:56:42 -07:00
David Dorsey b19652d35e Added entities to investigative searches 2019-10-16 22:33:20 -07:00
David Dorsey 645ae6a647 Missed the rename of the data model in this file 2019-10-16 17:59:28 -07:00
David Dorsey 1f8fbb9c58 Merge branch 'develop' into cloud_cryptomining 2019-10-16 17:50:40 -07:00
David Dorsey 9e4a2a2413 Used final name of cloud data model 2019-10-16 17:38:10 -07:00
Patrick Bareiss af66ed5fe3 Changed json to yml 2019-10-16 16:38:05 +02:00