67 Commits

Author	SHA1	Message	Date
Eric	d9960562b8	Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.	2025-05-02 14:10:46 -07:00
Patrick Bareiss	1c9debe9a6	update versions	2025-03-14 13:47:44 +01:00
Patrick Bareiss	5089a7fe5f	output normalization endpoint	2025-03-03 15:43:03 +01:00
Patrick Bareiss	6a53921a8c	Merge branch 'develop' into output_normalization_endpoint	2025-02-19 12:09:16 +01:00
Patrick Bareiss	9e588b51b9	Merge branch 'develop' into data_source_improvements_2	2025-02-18 09:08:28 +01:00
Patrick Bareiss	e044e874ba	improvements	2025-02-18 08:55:49 +01:00
pyth0n1c	45599e0b18	Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.	2025-02-10 12:28:22 -08:00
Patrick Bareiss	e0d36949fc	Merge branch 'develop' into data_source_improvements_2	2025-02-07 13:31:21 +01:00
pyth0n1c	fdaa038eab	Finish removing extra fields, or renaming ... misnamed fields, in endpoint detections	2025-01-03 15:47:32 -08:00
ljstella	d5328dfa77	Merge branch 'develop' into rba_migration	2024-12-16 14:53:44 -06:00
Bhavin Patel	c3c88b51fe	Branch was auto-updated.	2024-12-16 12:13:55 -08:00
Nasreddine Bencherchali	9dd74b86ab	update version	2024-12-08 21:46:36 +01:00
Nasreddine Bencherchali	c23dcc3570	enhance batch 1	2024-12-05 21:47:08 +01:00
ljstella	bc14854c55	endpoint: more typefixes	2024-11-15 10:36:13 -06:00
ljstella	c9186e0b7d	endpoint: lowercase rba types	2024-11-15 10:16:37 -06:00
ljstella	514123089d	endpoint detection score field rename	2024-11-15 09:49:53 -06:00
ljstella	f88eb16c6f	endpoint detection score fix	2024-11-15 09:34:59 -06:00
Bhavin Patel	ee05f76a21	Branch was auto-updated.	2024-11-14 15:03:41 -08:00
ljstella	92cc97a5a7	endpoint first pass	2024-11-14 15:44:51 -06:00
research-bot	4bafd07210	udpating version and date	2024-11-14 12:34:36 -08:00
Bhavin Patel	fa907bf82f	Branch was auto-updated.	2024-11-14 11:18:52 -08:00
Patrick Bareiss	313276d294	Update data source for registry detections	2024-11-08 11:59:22 +01:00
research-bot	474bc09525	updating conflicts and test	2024-11-07 11:50:35 -08:00
research-bot	7eafc7cd60	updating sysmon to XML	2024-11-01 13:40:43 -07:00
research-bot	d1c7e1b6e5	udpating sysmon source	2024-10-30 18:42:30 -07:00
Bhavin Patel	0bb378b19b	updating drilldowns	2024-10-24 14:13:05 -07:00
Bhavin Patel	8b03f3d58f	updating all detections with quotes	2024-10-24 14:08:37 -07:00
Bhavin Patel	7bc11be7dc	updating drilldown_formatting	2024-10-23 18:25:39 -07:00
Bhavin Patel	385ac7adc1	remove end hours	2024-10-23 17:52:24 -07:00
tccontre	3930fcb446	fix_some_registry_detections_time	2024-10-04 10:17:08 +02:00
Bhavin Patel	cf169b3de0	adding drilldowns to all	2024-09-30 22:04:57 +05:30
Patrick	9e0d8426c1	improved data source field	2024-07-16 14:06:31 +02:00
Bhavin Patel	22e5ea3f83	Release Branch - ESCU v4.34.0	2024-06-26 14:41:53 +00:00
Bhavin Patel	6c5446cfbc	Release Branch - ESCU v4.32.0	2024-05-22 16:47:39 +00:00
Bhavin Patel	b0eaed8f75	ESCU Release v4.31.0	2024-05-08 16:05:40 +00:00
Bhavin Patel	7fda817c23	Release 4.19.0	2024-01-10 17:21:34 +00:00
Bhavin Patel	775d38c96f	fix another 30 yamls	2023-08-21 13:13:21 -07:00
Michael Haag	95828c9d72	fixed required fields	2023-05-04 10:49:10 -06:00
Michael Haag	eb1bc08eeb	We're going to need a bigger Docker	2023-04-27 22:01:49 -06:00
P4T12ICK	78909f6429	merged with develop	2023-03-03 12:40:16 +01:00
pyth0n1c	6c1ceb1bad	Ported all changes from interlock	2023-01-25 13:31:11 -08:00
P4T12ICK	fd0c8b349f	updated tags	2023-01-09 09:33:30 +01:00
P4T12ICK	5ae53c9368	Migrated all detections to v4	2023-01-03 13:42:10 +01:00
tccontre	81607c596e	add_story_and_minor_fix	2022-03-17 16:41:29 +01:00
P4T12ICK	6f0ee68913	Refactored security content	2022-03-09 14:43:09 +01:00
Jose Enrique Hernandez	d78bb53baa	Revert "Refactored security content"	2022-03-04 15:13:04 -05:00
P4T12ICK	5fbff3630e	merged with develop	2022-02-07 14:55:34 +01:00
research bot	e52d00b53d	updating docs and package bits [ci skip]	2022-01-31 20:04:12 +00:00
tccontre	2fde5a7c08	Update disabling_folderoptions_windows_feature.yml	2022-01-28 10:55:06 +01:00
tccontre	585ef9de39	reg_yml_analytics_updates_3	2022-01-28 10:00:46 +01:00