ba7d519a70
more app inspect
2020-12-08 16:28:49 -08:00
5be5ec5b53
app inspect failures fixes
2020-12-08 16:28:49 -08:00
0f2056149f
add additional suspicious file extensions
...
chm, vbe, additional media double ext exe's
2020-11-18 16:19:11 -05:00
8895ffddf7
updating macro fields
2020-11-16 17:22:29 -08:00
3aa06e82b6
Merge branch 'develop' into mustang_beta
2020-11-10 09:59:18 -08:00
77af8684bc
ryuk story and detections
2020-11-06 12:32:48 -05:00
0cce001a42
merge with develop
2020-10-19 11:19:41 -07:00
91a8cf9e08
add additional dynamic domains
...
now-dns, other missing domains
2020-10-13 12:44:52 -04:00
abac1c8b62
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
97ac9c5f62
spl updates and kvstore file
2020-10-12 11:49:37 -07:00
d237a2d984
lookup errors and consistency
2020-10-12 11:26:57 -07:00
b70138ed69
creating collections and search updates
2020-09-30 11:25:37 -07:00
9763e75e02
Fixes
2020-09-23 00:07:54 -05:00
83015eba59
latest updates to create in new vendor_region
2020-09-09 16:26:25 -06:00
10a5b76af7
merge with develop
2020-09-04 13:40:15 -07:00
cb5761a251
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
e8bf1d9e96
updates for mustang
2020-09-03 17:10:02 -06:00
b48b40ff76
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-08-25 22:28:59 -05:00
b4ab45f299
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-08-19 10:28:05 -05:00
6de58bce6a
Update api_call_by_user_baseline.yml
...
latestCount is needed in detection search
2020-08-18 15:28:54 -07:00
b748b3ee9c
converted lookup to collection
2020-08-12 17:29:18 -04:00
5ceef308a7
bug fix generate script
2020-07-21 10:12:58 +02:00
af09770db1
Merge branch 'develop' into first_time_windows_service_bug
2020-06-26 08:32:34 -05:00
6369f0f895
Changed running windows service to use kvstore as cache
2020-06-26 08:27:39 -05:00
000b56b0ee
add cron schedule
2020-06-25 18:52:51 +02:00
85f13dd926
new deployment configurations
2020-06-25 09:53:44 +02:00
35c4b110bc
Merge branch 'develop' into azuretest
2020-06-04 11:06:04 -07:00
8c75f502c1
merge with develop
2020-06-03 13:50:46 -07:00
72d3ab875e
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
fd024fb4c0
small bug
2020-05-25 16:46:38 +02:00
052a7d7872
run generate
2020-05-25 10:46:40 +02:00
c5e25d7355
generate a mitre enrichment lookup
2020-05-20 14:23:16 +02:00
537f51434e
Merge branch 'develop' of github.com:splunk/security-content into develop
...
local merge of develop prior to push
2020-02-05 16:28:45 -07:00
ac7bd7cfee
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
92768472e0
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
2fd12b9155
Merge pull request #320 from splunk/don_young_bug
...
updating the manifest to reflect correct details
2020-01-22 17:26:54 -08:00
5d6ef5ce60
renaming files
2020-01-22 09:14:51 -08:00
0ac15cb563
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
8ae3ebdbf5
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
e428f473c9
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
bpatel