92768472e0
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
9e6becda1f
adding definitions
2020-01-23 13:31:43 -08:00
2fd12b9155
Merge pull request #320 from splunk/don_young_bug
...
updating the manifest to reflect correct details
2020-01-22 17:26:54 -08:00
75485ef666
Merge pull request #316 from splunk/CRL-1717_addMacroDefinitionsWhereMissing
...
CRL-1717 - Added "search *" definitions to the macros without them… resolves #292
2020-01-22 14:59:44 -08:00
dd5b1ee344
Merge pull request #319 from splunk/dns_hijack_story_update
...
CRL-1718 updated fields and added macros and lookup entries
2020-01-22 14:58:40 -08:00
38b84113bf
Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion
...
CRL-1495 update share creation and deletion
2020-01-22 09:19:43 -08:00
0cef2e73b1
Merge pull request #315 from splunk/CRL-1716-FixPowerShellObfusc
...
CRL-1716 - Fixing by clause to allow searching Processes.process for …
2020-01-22 09:18:42 -08:00
5d6ef5ce60
renaming files
2020-01-22 09:14:51 -08:00
b85543e0b5
CRL-1717 - Addressing comments by removing unnecessary output_filter macros from investigation searches and removing references to those in the investigation definitions.
2020-01-22 08:40:30 -08:00
b62ce205b8
CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search.
2020-01-22 08:26:16 -08:00
14f54a12e8
removing incorrect macro file
2020-01-21 17:29:55 -08:00
c6a904b36f
Merge pull request #314 from splunk/CRL-1712_netsh_abuse
...
CRL-1712 Disabling Security Tools
2020-01-21 11:42:42 -08:00
7b976f25f7
Update investigate_user_activities_in_all_cloud_region_output_filter.yml
2020-01-21 11:34:38 -08:00
6eed922214
testing commented search
2020-01-21 01:58:30 -08:00
0ac15cb563
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
56e7182720
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
629badf7e7
macros file, still not liking this practice
2020-01-14 15:58:38 -08:00
4a0bf015e8
tested and updates searches for lateral movement story
2020-01-13 11:18:54 +01:00
ce3b152832
WIP: testing lateral movement analytics story
2020-01-10 12:47:12 +01:00
f178e41e12
updated create hidden shares
2020-01-09 16:59:04 -05:00
652d7f3fd0
updating macros to use sourcetype
2019-12-18 17:49:09 -08:00
2701ad2049
remove def key from macro yml
2019-12-18 16:15:51 -08:00
142d74b174
remove def key from macro yml
2019-12-18 14:54:48 -08:00
9afa020d06
empty defs
2019-12-18 14:48:24 -08:00
151be9217b
removing index and keeping source
2019-12-18 14:21:36 -08:00
5c775ec15a
Worked on the feedback
2019-12-18 20:08:10 +01:00
1cdf09802c
Worked on the feedback
2019-12-18 20:03:19 +01:00
be0fc0b66a
Worked on the feedback
2019-12-18 10:29:40 +01:00
fc12a232a1
Merge branch 'develop' into CRL-1698_new_version_credential_dumping
2019-12-18 10:24:52 +01:00
4e8427cff4
Worked on the feedback
2019-12-18 10:23:55 +01:00
3f03c5392c
New version of Credential Dumping Story
2019-12-17 18:08:09 +01:00
761812a675
WIP: Exception Handling test
2019-12-17 13:15:51 +01:00
2ea8d2b020
fixed security_content_ctime macro
2019-12-17 09:33:35 +01:00
2ed8b32696
Merged with develop
2019-12-17 09:13:43 +01:00
8ae3ebdbf5
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
de84f9822c
WIP: liche check disabled
2019-12-16 12:07:40 +01:00
c873fc8363
WIP: pre and post macros
2019-12-16 10:28:47 +01:00
89e8cc1faf
found a bug with how generate was producing the file, needs to be a string
2019-12-11 15:28:26 -05:00
f8e3113412
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
f9bdf7e0e4
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
322e711936
CRL-1645 - Fixing macros for excessive runinstances and terminateinstances to use src_user in description.
2019-11-25 18:17:06 -08:00
95f73c9039
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
2019-11-25 18:06:33 -08:00
b3b4f4e892
CRL-1646 - Implemented : Update Detection for abnormally_high_instances_launched to use MLTK
2019-11-20 14:18:50 -08:00
90b2a8c487
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
61c3f18ece
Updated generate to output for ASX
...
Fixed macros
2019-10-16 20:54:13 -07:00
13af78c6d8
Added macro for the time window
2019-10-16 18:42:02 -07:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
2a4b29e4c4
New investigation macros
...
Updated validate to check for macro and lookup existence in both
baselines and investigation searches
2019-10-07 22:14:12 -05:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
bpatel