07d1fc4a28
Merge branch 'develop' into TR_2410_Domain_Controller_Attacks
2023-03-06 10:19:45 -08:00
2c87b92e01
Updated a few more paths for apps
2023-03-03 11:04:43 -08:00
12315feb53
Update the baseline in validate_args and test_config_github_actions to use the latest versions of all apps. Also include replay fix for windows ta data ingest via hec and upload
2023-03-03 10:23:03 -08:00
55850fe25e
adding custom app
2023-02-22 13:28:41 -05:00
54ec5991d7
Branch was auto-updated.
2023-02-06 16:31:13 -08:00
621fe10dfd
Delete test_config_bak.json
2023-02-03 12:40:01 -05:00
5306030d74
fixes
2023-01-26 16:35:43 -05:00
9f0394613d
updating microsoft cloud services app metadata
2023-01-26 11:13:28 -05:00
957a4644de
Delete test_config_github_actions.json.bak
2022-11-17 14:15:54 -05:00
57811dab57
Branch was auto-updated.
2022-11-15 11:28:05 -08:00
0117d03428
fixing wrong URL
2022-11-15 11:15:49 -08:00
feb1c94d11
add crowdstrike fdr to baseline
2022-11-15 11:11:08 -08:00
5ce1492097
Branch was auto-updated.
2022-10-31 14:21:42 -07:00
0f1b6189ab
Merge branch 'develop' into gcp_account_takeover
2022-10-31 12:41:52 -07:00
6145916174
Branch was auto-updated.
2022-10-18 11:42:33 -07:00
bdaf3ebcf9
updating amazon S3 url
2022-10-17 12:11:19 -04:00
ab378d6705
addo_test
2022-10-13 16:47:29 -07:00
cd70fb50e7
adding gcp configs
2022-10-12 18:09:41 -07:00
c9b12aa911
Update test_config_github_actions.json
2022-10-10 13:30:50 -06:00
8f3fbdfcbf
Update test_config_github_actions.json
2022-10-10 11:33:06 -06:00
9daccac060
Branch was auto-updated.
2022-10-03 17:04:10 -07:00
5cca541cbc
Branch was auto-updated.
2022-09-30 10:40:25 -07:00
da6416a8b7
Branch was auto-updated.
2022-09-30 10:40:16 -07:00
3968693c33
Remove slim as a dependency. Still requires
...
some testing. This will break the contentctl build
functionality as it still requires slim. A user can
install splunk-packaging-toolkit separately,
but it is not currently compatible with Python3.10.
2022-09-30 09:54:19 -07:00
819b016b37
search updaate and remove import
2022-09-14 18:24:59 -05:00
65e996fffe
Adding Privileged User SID History Detection
2022-09-12 21:31:24 +10:00
c314119341
Adding Privileged User SID History Detection
2022-09-12 21:05:45 +10:00
d472fbd0d2
Adding Privileged User SID History Detection
2022-09-12 20:53:56 +10:00
6a1236f059
Adding Privileged User SID History Detection
2022-09-12 20:31:11 +10:00
eaa4ab9265
Adding Privileged User SID History Detection
2022-09-12 18:27:57 +10:00
4ac73c8614
Branch was auto-updated.
2022-08-22 14:51:20 -07:00
b0c3232991
adding microsoft cloud services ta
2022-08-22 17:38:49 -04:00
02930ad974
Change from ResultsReader to
...
JSONResultsReader since
ResultsReader was deprecated
in the latest Splunk SDK.
2022-07-21 12:38:15 -07:00
51edd7950a
Condensed multiple requirements.txt
...
files into single requirements.txt in
the root of security_content.
Removed explicit calls to python3
in CI/CD workflows and inside of
the docker_detection_testing tool.
These are not required and in fact
should not be done since python
interpreters started by the
detection tester inherit the
venv the parent was run under.
2022-07-20 15:53:20 -07:00
d5d7725afe
JSON file contained the words None, which is correctly for Python code, instead of null which is valid JSON
2022-07-19 13:47:05 -07:00
93cf4d1d3f
Merge branch 'develop' into 20220715_app_baseline
2022-07-19 12:57:52 -07:00
9a3302512a
Update Office 365 AddOn to 4.0
2022-07-15 09:13:10 -07:00
ea70270940
Update CIM and MS Sysmon as well
2022-07-15 09:04:21 -07:00
e993ff1dce
Updating baseline to latest apps as of
...
20220715. Apps have already been
uploaded to S3.
2022-07-15 08:48:32 -07:00
bf127dc0c0
Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works.
2022-07-12 08:39:08 -07:00
71b7c5d45c
Forgot to specify the host that data
...
was being uploaded from. This means
that delete does not work as expected,
causing a large number of tests to fail
and slower searches.
2022-07-11 14:06:01 -07:00
1e6f2d79b0
Don't modify the original search variable.
...
This can cause problems if we need to run
the search again.
2022-07-11 12:48:25 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
e818a0d1ed
Fixing print statement that was
...
was not obeying the verbose argument.
2022-06-23 15:35:56 -07:00
050491a1cc
Forgot to include a print statement, causing
...
lines to be jumbled together.
2022-06-23 15:28:24 -07:00
0181c9fd63
Update the docker detection testing code
...
to use the latest contentctl from develop
as well as skip enrichment.
2022-06-23 15:18:56 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
Bhavin Patel