admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
27,436 Commits 697 Branches 195 Tags
scheduling_experiments
Commit Graph

388 Commits

Author SHA1 Message Date
Nasreddine Bencherchali ad398c0707 small tweaks 2025-07-10 16:43:54 +02:00
Nasreddine Bencherchali 909693a201 update action value to alight with new ta ver 2025-07-10 16:41:49 +02:00
Nasreddine Bencherchali 8ffb683440 Merge branch 'develop' into nvm-batch1 2025-07-07 01:23:13 +02:00
Bhavin Patel e6e3145dc0 updating description 2025-07-03 14:26:07 -07:00
Nasreddine Bencherchali 6527190e18 up version for ci overlords 2025-07-01 23:18:54 +02:00
Nasreddine Bencherchali 75ec47e99a add new detections, story and other cool things 2025-07-01 23:04:48 +02:00
pyth0n1c 60656154e7 Merge branch 'develop' into updates-june 2025-06-17 11:54:36 -07:00
Nasreddine Bencherchali cb45d9d030 quick fixes and updates 2025-06-17 20:32:55 +02:00
Nasreddine Bencherchali c46c948ae4 more fixes 2025-06-17 02:20:37 +02:00
Nasreddine Bencherchali 6c5aa91dbf more updates 2025-06-16 23:38:10 +02:00
Nasreddine Bencherchali 8efe3b11d2 add manual_test tag 2025-06-10 21:25:21 +02:00
Nasreddine Bencherchali 05df61c626 Update detect_outbound_smb_traffic.yml 2025-06-10 20:32:31 +02:00
Nasreddine Bencherchali a62ddcc7b5 add drilldowns to production analytics 2025-06-10 16:26:40 +02:00
Nasreddine Bencherchali d985dc1105 upgrade detection with tests to production 2025-06-10 13:56:06 +02:00
pyth0n1c af3f49a4a1 Merge branch 'develop' into innoloader 2025-06-02 13:07:50 -07:00
pyth0n1c 3393446afb Update internal_horizontal_port_scan_nmap_top_20.yml 
Chatted with detection author about this update.
Changed risk_object from dest_zone to dest_ports to be more in line with other horizontal scanning detection AND give more meaningful risk object (dest_zone is less meaningful, even if populated)
 2025-06-02 12:31:03 -07:00
Nasreddine Bencherchali e7f59f1ffc update risk object 2025-06-02 11:36:04 +02:00
Nasreddine Bencherchali f40aad92b5 Update protocols_passing_authentication_in_cleartext.yml 2025-06-02 10:34:26 +02:00
Nasreddine Bencherchali 5f9fb78212 Merge branch 'develop' into ftd-cim-update 2025-06-02 10:30:52 +02:00
Nasreddine Bencherchali 271fd75425 update analytics after review suggestions 2025-06-02 10:30:36 +02:00
jwindley 5cde2f9d01 Update detect_remote_access_software_usage_traffic.yml 2025-05-30 15:19:09 +01:00
jwindley 133e431bd3 Update detect_remote_access_software_usage_traffic.yml 
Fix bug with user field
 2025-05-30 14:51:56 +01:00
Nasreddine Bencherchali 44e6f9a445 Update cisco_secure_firewall___remote_access_software_usage_traffic.yml 2025-05-28 19:35:38 +02:00
Nasreddine Bencherchali 67c72b9035 add Cisco Secure Firewall - Remote Access Software Usage Traffic 2025-05-28 19:33:18 +02:00
Nasreddine Bencherchali a9c0afadf8 update how to implement section 2025-05-28 13:05:49 +02:00
Nasreddine Bencherchali e42a0eba09 Update tor_traffic.yml 2025-05-27 23:48:24 +02:00
Nasreddine Bencherchali bc5c2a3ddd Update tor_traffic.yml 2025-05-27 23:27:25 +02:00
Nasreddine Bencherchali efbdf32690 Update protocols_passing_authentication_in_cleartext.yml 2025-05-27 17:28:51 +02:00
Nasreddine Bencherchali a09165ffb5 ci fixes 2025-05-27 17:17:34 +02:00
Nasreddine Bencherchali 2634983bd1 add missing output fields 2025-05-27 16:54:10 +02:00
Nasreddine Bencherchali 0c284e67c2 add drilldowns 2025-05-27 16:35:41 +02:00
Nasreddine Bencherchali 4b14d04f85 test more network analytics with ftd 2025-05-27 16:12:12 +02:00
Nasreddine Bencherchali d016157feb field order update 2025-05-27 10:50:31 +02:00
Teoderick Contreras 3c475d25c8 innoloader 2025-05-26 10:28:31 +02:00
Nasreddine Bencherchali 25b2758228 update output fields 2025-05-22 12:46:00 +02:00
Nasreddine Bencherchali a50fe30d9d update network cim analytics with ftd data 2025-05-22 10:17:47 +02:00
Bhavin Patel 301f72f1c6 adding src_ip 2025-05-20 09:13:22 -07:00
Bhavin Patel fa7020a303 Merge branch 'develop' into snort_by_threat_actor 2025-05-19 13:31:28 -07:00
Bhavin Patel 1a23528d7c updating risk and drilldowns 2025-05-19 12:11:35 -07:00
Nasreddine Bencherchali 8330f6bdf1 Apply suggestions from code review 2025-05-15 11:31:17 +02:00
Bhavin Patel e95c2d480d updating code to use udpated names of lookup files 2025-05-14 13:50:22 -07:00
Bhavin Patel 3900c7e5e0 Update detections/network/cisco_secure_firewall___intrusion_events_by_threat_actors.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-05-14 09:58:08 -07:00
Bhavin Patel 1abed8cb5b Update detections/network/cisco_secure_firewall___intrusion_events_by_threat_actors.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-05-14 09:57:51 -07:00
Bhavin Patel 8f445c574a updating lookup content and query 2025-05-13 13:57:44 -07:00
Bhavin Patel dbc1da9bf9 udpate spl 2025-05-13 12:52:53 -07:00
Bhavin Patel 0b0e5114ab adding two lookups and updating query for test 2025-05-13 12:44:30 -07:00
Bhavin Patel a030b577c0 updating how to implement 2025-05-12 16:17:23 -07:00
Bhavin Patel 6731ba38d5 remove csv from search 2025-05-12 15:57:30 -07:00
Bhavin Patel 933ff68b40 Merge branch 'develop' into snort_by_threat_actor 2025-05-12 15:36:31 -07:00
Bhavin Patel 98ca7c70b9 yaml updates 2025-05-12 15:35:58 -07:00