Commit Graph

30 Commits

Author SHA1 Message Date
pyth0n1c b24394affd Push a new github_actions test config file 2023-05-15 13:54:53 -07:00
pyth0n1c 9e535bb5f0 Update baseline to include
suricata ta.  TA required 
for testing new detections.
Also, remove some 
duplicates apps from the 
baseline.
2023-05-15 12:49:18 -07:00
Bhavin Patel 07d1fc4a28 Merge branch 'develop' into TR_2410_Domain_Controller_Attacks 2023-03-06 10:19:45 -08:00
pyth0n1c 2c87b92e01 Updated a few more paths for apps 2023-03-03 11:04:43 -08:00
pyth0n1c 12315feb53 Update the baseline in validate_args and test_config_github_actions to use the latest versions of all apps. Also include replay fix for windows ta data ingest via hec and upload 2023-03-03 10:23:03 -08:00
mvelazco 55850fe25e adding custom app 2023-02-22 13:28:41 -05:00
mvelazco 9f0394613d updating microsoft cloud services app metadata 2023-01-26 11:13:28 -05:00
pyth0n1c 0117d03428 fixing wrong URL 2022-11-15 11:15:49 -08:00
pyth0n1c feb1c94d11 add crowdstrike fdr to baseline 2022-11-15 11:11:08 -08:00
Bhavin Patel 0f1b6189ab Merge branch 'develop' into gcp_account_takeover 2022-10-31 12:41:52 -07:00
mvelazco bdaf3ebcf9 updating amazon S3 url 2022-10-17 12:11:19 -04:00
patel-bhavin ab378d6705 addo_test 2022-10-13 16:47:29 -07:00
patel-bhavin cd70fb50e7 adding gcp configs 2022-10-12 18:09:41 -07:00
Michael Haag c9b12aa911 Update test_config_github_actions.json 2022-10-10 13:30:50 -06:00
Michael Haag 8f3fbdfcbf Update test_config_github_actions.json 2022-10-10 11:33:06 -06:00
mvelazco b0c3232991 adding microsoft cloud services ta 2022-08-22 17:38:49 -04:00
pyth0n1c d5d7725afe JSON file contained the words None, which is correctly for Python code, instead of null which is valid JSON 2022-07-19 13:47:05 -07:00
pyth0n1c 93cf4d1d3f Merge branch 'develop' into 20220715_app_baseline 2022-07-19 12:57:52 -07:00
pyth0n1c 9a3302512a Update Office 365 AddOn to 4.0 2022-07-15 09:13:10 -07:00
pyth0n1c ea70270940 Update CIM and MS Sysmon as well 2022-07-15 09:04:21 -07:00
pyth0n1c e993ff1dce Updating baseline to latest apps as of
20220715.  Apps have already been
uploaded to S3.
2022-07-15 08:48:32 -07:00
pyth0n1c 26f6bbfc92 Adding the URL_TOOLBOX app to
the application baseline.
2022-06-21 14:29:11 -07:00
pyth0n1c 5762b4e373 Updated the app baseline as well as
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
pyth0n1c 1e83599449 Update apps to latest version
Updated the following apps to the latest versions:
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
2022-05-27 14:40:56 -07:00
pyth0n1c bc4e55c32a Revert "Updated the following apps:"
This reverts commit 0c74525449.
2022-05-27 14:38:09 -07:00
pyth0n1c 0c74525449 Updated the following apps:
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
2022-05-27 14:33:29 -07:00
pyth0n1c a5f9241650 Added Palo Alto TA in support of CRITICAL CVE 2022-1388 Detection. 2022-05-10 10:31:16 -07:00
Lou Stella 6804803c8b Add application folder to tests & detections 2022-03-28 12:30:57 -05:00
pyth0n1c 2d4032e7a5 A number of changes to support
detection of test.yml files that do
not have a detection .yml file.  
The reverse checking was already
in place.  

Removed an outdated
and unused Python file
new_arguments.py.

Removed the unused option
detections_file from the 
test_config.json - because
detections_list exists, this is
no longer required or usable.
2022-03-23 13:26:00 -07:00
d1vious cff7ba417a cleaning up old CI jobs 2022-03-22 15:37:49 -04:00