5e62272a68
Merge branch 'develop' into mustang_beta
2020-10-05 16:20:10 -07:00
3c49885ad6
Merge branch 'develop' into TR-104-missing-input-filters
2020-10-02 08:01:15 -07:00
e30924013c
single and double quote order issue
2020-09-23 17:32:52 -05:00
42549c5776
Macro fixes
2020-09-23 17:22:02 -05:00
b681f5faa4
macro fixes
2020-09-23 17:16:35 -05:00
5fbc68936b
baseline update search fix with macros
2020-09-23 16:58:26 -05:00
359926e89b
text updates and a couple of fixes for mismatched macros
2020-09-23 14:44:00 -06:00
65403cc027
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
2020-09-23 11:36:15 -05:00
2d25205146
Fixes
2020-09-23 11:35:56 -05:00
7bd6f5380e
Merge branch 'develop' into TR-41_aws_ec2_mods
2020-09-23 12:09:37 -04:00
17eff649e7
Fixes
2020-09-21 23:23:57 -05:00
b78035c976
adding macros
2020-09-18 17:36:46 -04:00
c33be23f10
[TR-104] add missing input filters.
2020-09-15 22:59:19 -07:00
9b785919de
validate fixes
2020-09-10 21:22:34 -05:00
83015eba59
latest updates to create in new vendor_region
2020-09-09 16:26:25 -06:00
fc99713981
Translated detections/detect_spike_in_security_group_activity.yml
2020-09-09 01:36:26 -05:00
d588bbc8f6
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-09 01:01:16 -05:00
10a5b76af7
merge with develop
2020-09-04 13:40:15 -07:00
7b098cf836
fixed validate issues
2020-09-04 13:13:22 -05:00
dbfecd9e29
New analytic story for suspicious cloud user activities.
2020-09-04 10:30:47 -05:00
cb5761a251
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
e9939cbc98
new files for unblocked searches
2020-09-03 11:10:14 -06:00
f7498459c8
changes for mustang
2020-09-02 10:21:52 -06:00
1c1ce46004
Merge branch 'develop' into mbjerkeland-develop
2020-08-24 01:04:40 -04:00
80860d37f4
Created manifests for unseen city, region, and country and updated
...
logic to reflect each case
2020-08-20 14:07:21 -05:00
7de781c8f0
Manifest cleanup
2020-08-20 13:15:14 -05:00
b4ab45f299
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-08-19 10:28:05 -05:00
83d8ce47a5
Removed a few API calls that are not really modifications
2020-08-18 13:47:04 -05:00
897d25a7f8
Present times in ISO8601 instead of US style
2020-08-12 23:45:53 +02:00
289cec6fde
Now validating?
2020-08-12 23:32:48 +02:00
ff4cf63e3e
Fixed up my mistakes. Should hopefully validate now
2020-08-12 23:26:57 +02:00
d820c2d914
Retrying
2020-08-12 23:21:43 +02:00
c12f8b2a6e
Added ARP Poisoning Detection for Cisco Devices
2020-08-12 10:55:10 +02:00
dd10e6e3cb
Adding macros
2020-08-12 09:17:32 +02:00
2f04c868e4
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
32e5fc5331
Merge branch 'develop' into F5_TMUI
2020-08-04 17:09:39 -04:00
58f47148b9
ymls and updates
2020-08-04 14:04:38 -07:00
63f266629e
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
322697fdd0
more renames base on upper case
2020-06-29 17:39:38 -04:00
8438bf71e8
Fixed the first time previously seen windows service search to work
...
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update
Made the default deployment template be -70m@m to -10m@m
Added a new deployment template for hourly baseline caches
2020-06-25 00:09:30 -05:00
3c8c201add
Merge branch 'develop' into CRL-1766-auth-dm-updates
2020-06-16 10:46:20 -07:00
56ccf11ea0
this should be false
2020-06-09 17:58:39 -04:00
37199617b3
updating macro filters
2020-06-08 17:12:15 -07:00
35c4b110bc
Merge branch 'develop' into azuretest
2020-06-04 11:06:04 -07:00
9f2710bfde
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
72d3ab875e
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
50f3fdbbee
kubectlcalls
2020-05-26 23:42:26 -04:00
46803f5ea0
svacconpodnasp
2020-05-26 23:16:07 -04:00
1bbc7d1728
fixedanemsaddedservaccount
2020-05-26 22:40:16 -04:00
8e44ca15ca
RBACauth
2020-05-26 22:18:16 -04:00
Bhavin Patel