581 Commits

Author	SHA1	Message	Date
patel-bhavin	2beb040928	add risk index macro	2022-12-21 14:12:18 -08:00
patel-bhavin	631daa4ff6	spl update	2022-11-11 13:50:35 -08:00
srv-rr-gh-researchbt	c9624ff0bd	Branch was auto-updated.	2022-11-11 12:29:52 -08:00
patel-bhavin	767e323fc1	spl update	2022-11-11 11:45:47 -08:00
srv-rr-gh-researchbt	a031ca7bcc	Branch was auto-updated.	2022-11-08 13:29:16 -08:00
patel-bhavin	c87d793e48	remove datamodel	2022-11-08 12:56:46 -08:00
mvelazco	b8d9c4c6fd	moving detection to experimental	2022-11-04 13:48:00 -04:00
pyth0n1c	3f6eda261e	Carried over changes from ... external PR to repo	2022-11-04 09:56:25 -07:00
mvelazco	0f5893bd27	updating mitre ids	2022-11-04 12:50:51 -04:00
Bhavin Patel	0f1b6189ab	Merge branch 'develop' into gcp_account_takeover	2022-10-31 12:41:52 -07:00
Bhavin Patel	1c10255e9d	asset type	2022-10-31 12:20:06 -07:00
mvelazco	17ae3f4a2c	updating how to implement	2022-10-20 17:35:27 -04:00
patel-bhavin	0c6193617f	_time in the by clause	2022-10-19 14:45:10 -07:00
patel-bhavin	1e963e553b	yaml cleanup and references	2022-10-18 18:07:50 -07:00
mvelazco	526ca4bd1b	fixing detection	2022-10-18 12:03:20 -04:00
mvelazco	142d52872f	updating detection	2022-10-18 11:36:29 -04:00
mvelazco	e95c7f6937	fixing detection	2022-10-17 12:27:58 -04:00
mvelazco	2afe6af188	fixing yaml issues	2022-10-17 11:44:39 -04:00
patel-bhavin	5b4074dd23	hti update	2022-10-14 15:36:28 -07:00
Bhavin Patel	7ab9b56f72	Update gcp_unusual_number_of_failed_authentications_from_ip.yml	2022-10-14 12:20:52 -07:00
Bhavin Patel	ec4829ad7f	Update gcp_multiple_users_failing_to_authenticate_from_ip.yml	2022-10-14 12:20:23 -07:00
mvelazco	7bada443b3	Merge branch 'gcp_account_takeover' of github.com:splunk/security_content into gcp_account_takeover	2022-10-14 15:03:56 -04:00
mvelazco	744bc50190	adding 4 GCP account takeover detections	2022-10-14 15:03:54 -04:00
patel-bhavin	7ec46bd832	spl updates	2022-10-13 16:33:32 -07:00
patel-bhavin	92f0ff7f5f	gcp_stdev	2022-10-13 15:58:37 -07:00
patel-bhavin	cd70fb50e7	adding gcp configs	2022-10-12 18:09:41 -07:00
patel-bhavin	4daefa51ac	update datasets	2022-10-04 15:02:43 -07:00
patel-bhavin	9c1f8bccc4	new SFA detection	2022-10-04 13:48:48 -07:00
patel-bhavin	47b0525a18	mfa_disabled	2022-10-04 11:50:03 -07:00
patel-bhavin	01260af9ca	Merge branch 'aws_mfa' of github.com:splunk/security_content into aws_mfa	2022-10-03 17:41:52 -07:00
patel-bhavin	ad0e59da0e	yaml error	2022-10-03 17:11:20 -07:00
srv-rr-gh-researchbt	5f93886f62	Branch was auto-updated.	2022-10-03 17:04:07 -07:00
patel-bhavin	089360cee2	mionr	2022-10-03 16:53:35 -07:00
patel-bhavin	73d060d0af	updated metadata	2022-10-03 16:53:18 -07:00
patel-bhavin	07a9ec11c9	new detectoion	2022-10-03 16:48:23 -07:00
patel-bhavin	e39385fb34	new_mfa_Detections	2022-10-03 15:42:16 -07:00
Bhavin Patel	6855e7aea0	Update aws_multiple_users_failing_to_authenticate_from_ip.yml	2022-10-03 13:37:28 -07:00
patel-bhavin	cf08498d1b	update to spl	2022-10-03 12:23:27 -07:00
mvelazco	74f1fe7180	minor changes on SPL	2022-09-27 15:31:24 -04:00
patel-bhavin	f1d93ba5af	format updates	2022-09-26 17:05:51 -05:00
patel-bhavin	84ad82a95f	yml error	2022-09-26 16:52:35 -05:00
patel-bhavin	db9068b4fb	updating azure	2022-09-26 16:50:02 -05:00
patel-bhavin	86c4816f98	nnew detection and multiple searches	2022-09-26 16:25:49 -05:00
patel-bhavin	0c0603e701	password spray detection std dev	2022-09-26 15:56:29 -05:00
pyth0n1c	5cd001e040	Branch was auto-updated.	2022-09-15 09:15:51 -07:00
patel-bhavin	819b016b37	search updaate and remove import	2022-09-14 18:24:59 -05:00
pyth0n1c	da686eb237	Branch was auto-updated.	2022-09-14 09:17:49 -07:00
pyth0n1c	64d3dd2b75	Branch was auto-updated.	2022-09-14 09:17:34 -07:00
patel-bhavin	a1023ca839	rename to account takeover	2022-09-13 19:26:11 -05:00
mvelazco	4810926509	enhancing descriptions	2022-09-06 18:08:16 -04:00