 bpatel
|
54c9bc9c38
|
updated search/metadata, tested in attack_range
|
2020-01-13 12:42:35 -08:00 |
|
|
bpatel
|
8ae3ebdbf5
|
naming updates, jinja macros updates
|
2019-12-16 13:05:17 -08:00 |
|
|
bpatel
|
b379395c3b
|
fixing the files that didnt update the macros correctly
|
2019-12-11 15:39:14 -08:00 |
|
|
divious1
|
f8e3113412
|
added summariesonly and fixed ctime
|
2019-12-11 15:14:49 -05:00 |
|
|
divious1
|
f9bdf7e0e4
|
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
|
2019-12-11 14:59:03 -05:00 |
|
|
Jason Brewer
|
95f73c9039
|
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
|
2019-11-25 18:06:33 -08:00 |
|
|
Jason Brewer
|
604e2ecc11
|
CRL-1646 - changing from user to src_user
|
2019-11-25 15:49:32 -08:00 |
|
|
Jason Brewer
|
38be9ebb26
|
CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.
|
2019-11-25 15:17:32 -08:00 |
|
|
Jason Brewer
|
12d6587e4a
|
CRL-1646 - Adjusting how to implement to quote the string and escape the newlines to soothe our tool chain.
|
2019-11-22 10:21:29 -08:00 |
|
|
Jason Brewer
|
37cdeab391
|
CRL-1646 - fixing stats.
|
2019-11-21 15:33:02 -08:00 |
|
|
Jason Brewer
|
3d1846cd2e
|
CRL-1646 - Updating to add input_filter macro to searches and to reference baseline search from detection search.
|
2019-11-21 14:01:14 -08:00 |
|
|
Jason Brewer
|
f21db84f76
|
CRL-1646 - Modifying search to see if my yml is wrong for a multiline object with pipes.
|
2019-11-20 15:50:39 -08:00 |
|
|
Jason Brewer
|
b3b4f4e892
|
CRL-1646 - Implemented : Update Detection for abnormally_high_instances_launched to use MLTK
|
2019-11-20 14:18:50 -08:00 |
|
|
Rico Valdez
|
7fa96a766e
|
updates to propery use cloud_infrastructure
|
2019-10-24 13:26:55 -06:00 |
|
|
Patrick Bareiss
|
af66ed5fe3
|
Changed json to yml
|
2019-10-16 16:38:05 +02:00 |
|
|
David Dorsey
|
85a637b149
|
Merge branch 'develop' into cloud_cryptominig
|
2019-10-07 22:59:06 -05:00 |
|
|
David Dorsey
|
82e8b210a9
|
Files for new cloud cryptominig story.
It's a cloud infrastructure generic version of AWS Cryptomining
|
2019-10-03 17:42:40 -07:00 |
|
|
David Dorsey
|
cc6209a08e
|
Started to create Cloud Cryptomining story
Added 1 detection, 1 baseline, and 2 investigative searches
|
2019-10-02 21:05:30 -07:00 |
|
|
David Dorsey
|
aec9dd53f5
|
Fixed issue inside of where clause
|
2019-09-30 16:17:29 -07:00 |
|
|
divious1
|
fe0b0e1133
|
removing html tags
|
2019-09-04 12:20:27 -04:00 |
|
|
Rico Valdez
|
80c6870a8a
|
All manifests converted to spec v2
|
2019-07-25 09:48:06 -06:00 |
|
|
divious1
|
06f5aa70fb
|
fixing stories that are using product_type
|
2019-07-18 12:35:45 -04:00 |
|
|
bpatel
|
6dd4f4dc4b
|
merge and testing the package
|
2019-05-30 15:57:28 -07:00 |
|
|
Rico Valdez
|
43ef842562
|
text updates and removed isOutlier from search output
|
2019-05-22 18:37:44 -06:00 |
|
|
bpatel
|
4616971e38
|
removing datamodel
|
2019-05-17 12:03:31 -07:00 |
|
|
bpatel
|
cb2c30de86
|
bringing the branch upto date with develop
|
2019-05-17 11:50:36 -07:00 |
|
|
Rico Valdez
|
438ac72bda
|
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
|
2019-05-17 11:17:49 -06:00 |
|
|
Rico Valdez
|
2f1cdca631
|
updated names of the support searches and updates stories accordingly
|
2019-05-15 11:51:39 -06:00 |
|
|
Jason Brewer
|
c40a264da5
|
Updating baseines/update_previously_seen_aws_users.json to use sourcetype search in sync with previously_seen_aws_users.json syntax.
|
2019-05-14 11:42:49 -07:00 |
|
|
Jason Brewer
|
0e320c6a39
|
CRL-1428 - Updating per code review feedback.
|
2019-05-13 16:05:24 -07:00 |
|
|
Rico Valdez
|
2286622900
|
going back to hyphens
|
2019-05-10 14:39:34 -06:00 |
|
|
Rico Valdez
|
ead7741cee
|
testing removing the hyphen from smb traffic spike
|
2019-05-10 14:10:35 -06:00 |
|
|
Rico Valdez
|
97d82b606f
|
fixed title on support searches and updated relevant stories
|
2019-05-10 13:47:54 -06:00 |
|
|
Rico Valdez
|
98907055ff
|
pushing Brianna edits
|
2019-05-10 09:10:48 -06:00 |
|
|
Rico Valdez
|
bd42f11bb6
|
search tweaks (mostly output formatting) based on discussion with Bhavin
|
2019-05-09 14:18:55 -06:00 |
|
|
Rico Valdez
|
22100df132
|
fixed a non-ascii char that got in there
|
2019-05-09 11:43:49 -06:00 |
|
|
Rico Valdez
|
d8aac902fb
|
Slight search tweak and another text updates
|
2019-05-09 10:54:36 -06:00 |
|
|
Rico Valdez
|
12be9cdacc
|
added a line to the how-to-implement for the model building manifests
|
2019-05-09 09:53:43 -06:00 |
|
|
Rico Valdez
|
318a41d3c9
|
translated to v1 spec
|
2019-05-08 15:13:20 -06:00 |
|
|
bblacet
|
781924aaca
|
Various changes for grammar, punctuation, and flow.
|
2019-05-07 16:52:42 -07:00 |
|
|
Rico Valdez
|
39a8489a84
|
added a null cron_schedule to try to fix validation on baseline searches
|
2019-05-07 14:46:05 -06:00 |
|
|
Rico Valdez
|
13f7508c46
|
fixes to entities
|
2019-05-07 14:32:04 -06:00 |
|
|
Rico Valdez
|
030683cbed
|
created 3 new searches and associated support searches that are mltk versions of existing searches. Also added them to the appropriate stories and fixed the non-capitalized title for an investigative search - updated associated stories for that as well.
|
2019-05-07 13:57:23 -06:00 |
|
|
Jason Brewer
|
7950452a95
|
CRL-1428 - Updating relevant searches to spec v2.
|
2019-04-30 17:03:34 -07:00 |
|
|
Jason Brewer
|
ddad8fb162
|
CRL-1428 - Adding new user City, Region, and Country detections and needed baseline changes.
|
2019-04-25 15:59:30 -07:00 |
|
|
divious1
|
fa3e66bf07
|
Merge branch 'spec_update' of github.com:splunk/security-content into spec_update
|
2019-04-19 10:59:41 -04:00 |
|
|
divious1
|
a4efc519f9
|
Merge branch 'develop' into spec_update
|
2019-04-19 10:58:47 -04:00 |
|
|
bpatel
|
7e8f267b81
|
fixes, run the genenrate code and validate
|
2019-04-18 17:05:55 -07:00 |
|
|
bpatel
|
4e17ca4774
|
Revert "cron update"
This reverts commit 746878cab9.
|
2019-04-18 16:15:24 -07:00 |
|
|
bpatel
|
746878cab9
|
cron update
|
2019-04-18 15:03:35 -07:00 |
|