474ea41291
Finishing updates authors, versions,
...
and dates on searches.
2022-08-25 15:09:13 -07:00
8b47ea7b36
Updating the author(s), versions, and
...
dates for searches in PR.
2022-08-25 15:08:46 -07:00
a2f1972d54
Branch was auto-updated.
2022-08-23 13:05:56 -07:00
cfa60f73c5
Branch was auto-updated.
2022-08-22 14:51:16 -07:00
393e7775f1
fixing typo
2022-08-16 12:19:07 -04:00
b2332df9a0
Merge branch 'Update_Azure_Account_Takeover' of github.com:splunk/security_content into Update_Azure_Account_Takeover
2022-08-16 12:13:02 -04:00
d00a4b2ae6
updating detection yaml
2022-08-16 12:13:00 -04:00
7d441871cb
Branch was auto-updated.
2022-08-16 08:40:56 -07:00
6759feccd4
Add Azure AD Multi-Factor Authentication Disabled
2022-08-15 17:22:54 -04:00
1e4b0353f8
search update
2022-08-12 12:46:25 -07:00
6969671bf9
Merge branch 'TR_2329_AWS_Credential_Access' of github.com:splunk/security_content into TR_2329_AWS_Credential_Access
2022-08-12 12:41:19 -07:00
24cd1afcb8
updatesusing datamodel
2022-08-12 12:34:02 -07:00
1952b9773b
Update aws_credential_access_getpassworddata.yml
2022-08-11 12:10:47 -07:00
8d25d3d27a
getpassworddata
2022-08-10 16:03:18 -07:00
5579f1ebdb
adding new detection
2022-08-10 13:34:18 -04:00
8b6df0a600
tagged other detections
2022-08-09 16:25:16 -07:00
758f91deea
Edit file for aws rds password detection
2022-08-08 02:30:59 -04:00
3cc956cd99
Add AWS Credential Access detections
2022-08-08 01:47:33 -04:00
c71b04a866
Updated detection files with recommended TA list.
2022-08-01 18:43:39 +00:00
08107a940e
Quoted strings in severity field. Fixed typo
...
in severity field list from UNKNWON to
UNKOWN. Removed the non-existent
stats field 'user' (username exists) which
was causing the test to fail, returning
no results.
2022-07-31 15:09:35 -07:00
07d72ad142
Fixed a number of detections around anomalous aws
...
console logins from different areas. These include
city, country, and region. They are all built around
the same template and could still use some discussion.
2022-07-29 14:22:50 -07:00
114df09d78
meta updates
2022-07-28 14:18:45 -07:00
1b645a499c
Update azure_ad_successful_single_factor_authentication.yml
2022-07-28 14:12:18 -07:00
95e47b7fd4
Update azure_ad_unusual_number_of_failed_authentications_from_ip.yml
2022-07-28 14:11:40 -07:00
07290ffeb7
Update azure_ad_successful_powershell_authentication.yml
2022-07-28 14:08:32 -07:00
42241b1b2e
Update azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
2022-07-28 14:07:47 -07:00
72d0a37a12
Update azure_ad_authentication_failed_during_mfa_challenge.yml
2022-07-28 14:05:57 -07:00
f22813da22
Update azure_active_directory_high_risk_sign_in.yml
2022-07-28 14:05:14 -07:00
53fb29f36e
Branch was auto-updated.
2022-07-28 13:11:00 -07:00
508424da99
Updates
2022-07-28 12:07:05 -06:00
a78c180836
file update
2022-07-26 17:21:56 -07:00
8672c8d824
security sercvices deleteion activities
2022-07-26 16:54:42 -07:00
7eea768cde
new detection putbucket lifecycle
2022-07-25 16:29:57 -07:00
c55b3ed7e0
Merge pull request #2287 from splunk/TR-2222
...
AWS Defense Evasion Stop Logging Cloudtrail
2022-07-25 10:48:37 -07:00
21172c6ede
update SPL
2022-07-19 15:08:43 -04:00
56364e9e05
Update References
2022-07-19 12:21:01 -04:00
c2decc3b9c
Add AWS defense evasion
...
1. Update Cloudtrail
2. Delete CloudWatch log group
2022-07-19 11:56:41 -04:00
c9b348b06f
Added rename
2022-07-19 08:50:07 -06:00
fee335e73d
renaming analytic story
2022-07-14 16:44:33 -04:00
d6dd5098be
adding new detection
2022-07-14 13:29:55 -04:00
5bf8a69beb
delete cloudtrail
2022-07-13 12:49:43 -07:00
b615728924
fixing file path
2022-07-13 14:38:13 -04:00
f666632017
update description
2022-07-13 14:23:38 -04:00
7807c66f73
adding new detection
2022-07-13 14:16:09 -04:00
0c7efe362c
message
2022-07-12 18:27:39 -07:00
92d6b653bc
mionr
2022-07-12 17:50:38 -07:00
9756e681f7
aws cloudtrail stop logging
2022-07-12 17:47:58 -07:00
18aa9f2e7a
adding new detection
2022-07-12 18:03:26 -04:00
f8e28dde20
adding new detection
2022-07-12 13:54:32 -04:00
797455e17f
updating filter macro
2022-07-12 11:41:45 -04:00
pyth0n1c