73f04bcc9c
test
2022-06-30 16:28:31 -07:00
aeceacc737
updating docs and package bits [ci skip]
2022-06-29 21:25:28 +00:00
d060bfd5db
Merge pull request #2192 from splunk/content_changer_improvements
...
Content changer improvements and Stale Reference Updates
2022-06-29 12:59:06 -07:00
83bbfce55a
Branch was auto-updated.
2022-06-29 11:55:55 -07:00
73ea092e8d
Merge pull request #2267 from splunk/deprecate_TR-2160_deprecated_complex_test_files
...
removing test files
2022-06-29 11:55:32 -07:00
b75b56b81d
removing test files
2022-06-29 14:18:47 -04:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
ea26b98186
Branch was auto-updated.
2022-06-28 15:14:00 -07:00
1d036b3af5
Merge pull request #2265 from splunk/DM_updates
...
Added Datamodel values
2022-06-28 15:13:30 -07:00
8a79086933
Missed one
2022-06-28 16:01:51 -05:00
9290c8c03d
Updated DM and fields
2022-06-28 14:59:51 -05:00
12b174f7d7
Changed to Network_Traffic, joining on process_id
2022-06-28 14:53:32 -05:00
ce7b96b31c
Branch was auto-updated.
2022-06-28 11:33:23 -07:00
a11c62e121
Branch was auto-updated.
2022-06-28 11:33:22 -07:00
c29b61b0d7
Merge pull request #2266 from splunk/TR-2160_deprecated_complex
...
moving complex pipelines to deprecated
2022-06-28 14:33:01 -04:00
3bd6477ec7
moving complex pipelines to deprecated
2022-06-28 14:13:38 -04:00
27417d7cb6
Suppress more output for
...
performance test
2022-06-28 11:10:46 -07:00
f75b406a2f
Suppress output of contentctl in CI/CD
...
to test runtime constraints.
2022-06-28 11:08:27 -07:00
cf86f899b6
Added Datamodel values
2022-06-28 12:03:12 -05:00
f5ec4b0500
Branch was auto-updated.
2022-06-24 10:16:00 -07:00
73a76ac59a
Merge pull request #2262 from splunk/TR-2113_New_Kerberoasting_detections
...
Adding new kerberoasting detections
2022-06-24 13:13:52 -04:00
0df3dc5e51
updating fields
2022-06-24 12:50:43 -04:00
757e6b92b8
updating field name to use ScriptBlockText
2022-06-24 11:18:28 -04:00
2637c12014
updating sourcetype to xmlwineventlog
2022-06-24 11:05:02 -04:00
fd78ddcb6f
Merge branch 'TR-2113_New_Kerberoasting_detections' of https://github.com/splunk/security_content into TR-2113_New_Kerberoasting_detections
2022-06-24 10:17:56 -04:00
0f23640526
Updating test file for PowerView SPN detection
2022-06-24 10:17:52 -04:00
e818a0d1ed
Fixing print statement that was
...
was not obeying the verbose argument.
2022-06-23 15:35:56 -07:00
050491a1cc
Forgot to include a print statement, causing
...
lines to be jumbled together.
2022-06-23 15:28:24 -07:00
0181c9fd63
Update the docker detection testing code
...
to use the latest contentctl from develop
as well as skip enrichment.
2022-06-23 15:18:56 -07:00
4931458ff9
Updated one broken reference link.
2022-06-23 15:02:26 -07:00
d40ca09d61
Merged develop into content_changer_improvements to resolve merge conflict. this was making it impossible to merge the PR in the GitHub Interface.
2022-06-23 14:19:17 -07:00
a133549d6c
Fixing a call to content_ctl
...
generate. This passes initial
testing using nektos act on
my own system!
2022-06-23 13:58:13 -07:00
6f30962fd6
Branch was auto-updated.
2022-06-23 13:55:27 -07:00
1272dc827a
Merge pull request #2251 from splunk/exec-the-msi
...
T1218.007 - MSIExec
2022-06-23 13:55:03 -07:00
b7955f84b9
Typo naming new variable
...
in workflow.
2022-06-23 13:51:56 -07:00
82af76d67f
Added ability to add or remove
...
the --skip_enrichment argument
to content_ctl based on whether
or not we are running CI/CD workflow
on a tagged release
2022-06-23 13:50:15 -07:00
056b07a686
remove detection
2022-06-23 11:09:07 -06:00
d858cd6875
included the --skip_enrichment flag
2022-06-22 16:06:29 -07:00
4f6d30dc51
Fixes to needs dependencies
...
after updating job names
2022-06-22 15:58:21 -07:00
130f5e3c99
Simplified the build-and-validate
...
workflow, collapsing several jobs into
one.
2022-06-22 15:49:56 -07:00
28eefb325d
adding 2 new detections for kerberoasting
2022-06-22 17:35:37 -04:00
a74ebee88f
Added the --skip_enrichment option to the
...
contentctl tool. This can save a huge amount
of time when generating an app. Also
added a progress meter when the documentation
is being generated. Finally, correctly initialized
the default values of some class member fields
in order to get all the contentctl steps working.
2022-06-22 13:44:17 -07:00
7ef25a98ec
updating docs and package bits [ci skip]
2022-06-22 17:56:19 +00:00
e53e9cf232
Branch was auto-updated.
2022-06-22 10:19:36 -07:00
cda681eb8b
Merge pull request #2260 from splunk/DetectionFixes
...
Detection fixes
2022-06-22 13:19:16 -04:00
0de66753a1
Branch was auto-updated.
2022-06-22 07:17:51 -07:00
52fa6467a9
Updated per customer feedback
2022-06-22 09:17:14 -05:00
54203d6858
Fixing detection to conform to new sysmon
...
behavior.
2022-06-21 17:21:30 -07:00
b73ea9e5ae
Added another custom_index to a test
...
file that was failing because it did not
have one.
2022-06-21 16:59:44 -07:00
ff0a57e526
Branch was auto-updated.
2022-06-21 16:45:18 -07:00
Xiao Lin