e165bad244
updated ELI5
2020-05-20 12:38:44 -07:00
74cef240c5
manifeft updates
2020-05-20 12:10:40 -07:00
bf80f1cfbf
Updated how to implement
2020-05-19 20:56:43 -05:00
e4339a4259
Took out firstTime in the | table at the end
2020-05-19 20:52:25 -05:00
8751bb4135
Merge branch 'suspicious_zoom_process' of github.com:splunk/security-content into suspicious_zoom_process
2020-05-19 16:06:19 -05:00
a07b2f4858
Bug fixes
2020-05-19 16:05:55 -05:00
66041ce1d1
name and uuid update
2020-05-19 13:36:10 -07:00
35665882d5
name update
2020-05-19 13:21:40 -07:00
0bf2d9041b
name and uuid
2020-05-19 13:19:41 -07:00
f0d00b1bac
Merge branch 'suspicious_zoom_process' of github.com:splunk/security-content into suspicious_zoom_process
2020-05-19 15:04:24 -05:00
334e4a4978
Helps if I use the correct search ID for a detection
2020-05-19 15:03:58 -05:00
950fac7307
minor bug
2020-05-19 13:00:06 -07:00
aabe7dab14
Merge branch 'develop' into suspicious_zoom_process
2020-05-19 12:32:38 -07:00
f1f26dce81
Updated to support lookups in collections
2020-05-19 14:06:02 -05:00
873c46184e
Merge pull request #459 from jwindley-splunk/patch-3
...
Update create_or_delete_network_shares.yml
2020-05-19 11:56:20 -07:00
e3f6752724
Update create_or_delete_network_shares.yml
...
By having process=*share* AND process=*delete* you will miss any creation of shares. If you are just looking for creating OR deleting of shares you just need to look for the word *share*
2020-05-19 10:35:27 +01:00
2e8f9dfee5
Merge pull request #456 from zelienka/patch-1
...
Fixed typo in search, search optimization
2020-05-18 13:07:37 -07:00
f2fcabe907
link update
2020-05-18 12:25:30 -07:00
9f11288073
supress fields updated
2020-05-18 12:23:07 -07:00
eb6039e449
Merge pull request #457 from jwindley-splunk/patch-2
...
Update attrib_to_hide_files.yml
2020-05-18 11:58:04 -07:00
d72c44f626
minor link update
2020-05-18 11:40:04 -07:00
530037ad16
Fixed typo in search, search optimization
...
Changes Processs to Processes.
Moved process search to tstats.
2020-05-18 15:42:03 +02:00
2b0c42b8dc
Update attrib_to_hide_files.yml
...
Adding dest
2020-05-18 12:11:33 +01:00
49a1b45567
Updated investigative searches
2020-05-07 23:10:57 -05:00
359da1b4cb
New story for suspicous zoom activity. Investigative searches not in yet.
2020-05-07 23:00:19 -05:00
e1c6c79e34
Merge pull request #451 from splunk/dependabot/pip/virtualenv-20.0.20
2020-05-04 10:08:04 +00:00
5795a099dc
Bump virtualenv from 20.0.19 to 20.0.20
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 20.0.19 to 20.0.20.
- [Release notes](https://github.com/pypa/virtualenv/releases )
- [Changelog](https://github.com/pypa/virtualenv/blob/master/docs/changelog.rst )
- [Commits](https://github.com/pypa/virtualenv/compare/20.0.19...20.0.20 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-05-04 10:03:50 +00:00
cb26b4da14
Merge pull request #450 from splunk/dependabot/pip/virtualenv-20.0.19
2020-05-03 13:21:15 +00:00
bbf7947533
Bump virtualenv from 20.0.18 to 20.0.19
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 20.0.18 to 20.0.19.
- [Release notes](https://github.com/pypa/virtualenv/releases )
- [Changelog](https://github.com/pypa/virtualenv/blob/20.0.19/docs/changelog.rst )
- [Commits](https://github.com/pypa/virtualenv/compare/20.0.18...20.0.19 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-05-03 13:17:03 +00:00
cdcf8053ea
Merge pull request #446 from splunk/dependabot/pip/semantic-version-2.8.5
2020-04-29 10:12:47 +00:00
0be5dee45f
Bump semantic-version from 2.8.4 to 2.8.5
...
Bumps [semantic-version](https://github.com/rbarrois/python-semanticversion ) from 2.8.4 to 2.8.5.
- [Release notes](https://github.com/rbarrois/python-semanticversion/releases )
- [Changelog](https://github.com/rbarrois/python-semanticversion/blob/master/ChangeLog )
- [Commits](https://github.com/rbarrois/python-semanticversion/compare/2.8.4...2.8.5 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-04-29 10:07:34 +00:00
69be09af98
Merge pull request #436 from splunk/dependabot/pip/virtualenv-20.0.18
2020-04-28 21:13:11 +00:00
78b61942b0
Merge pull request #445 from carroyod/develop
...
Update aws_cloud_provisioning_from_previously_unseen_ip.yml
2020-04-28 11:28:52 -07:00
1ac3cc680b
Update aws_cloud_provisioning_from_previously_unseen_ip.yml
...
Removed iplocation and Country filter, we are lokking IPs here
2020-04-28 13:59:52 +02:00
b2f81ea4b3
Merge pull request #443 from splunk/readme_liche_bug
...
MINOR FIX: Readme liche bug
2020-04-27 19:14:30 -07:00
9a9408558e
update instructions
2020-04-27 18:56:30 -07:00
cbae334bde
readme update
2020-04-27 18:43:07 -07:00
89f2617092
Merge pull request #439 from splunk/point_to_asx
...
points run story button to the ASX app
2020-04-27 11:12:08 -07:00
b1d935c760
Merge pull request #442 from splunk/dependabot/pip/importlib-resources-1.5.0
2020-04-26 21:57:23 +00:00
5e0982c077
Bump importlib-resources from 1.4.0 to 1.5.0
...
Bumps [importlib-resources](http://importlib-resources.readthedocs.io/ ) from 1.4.0 to 1.5.0.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-04-26 21:53:14 +00:00
1ede72cec2
Merge pull request #434 from splunk/dependabot/pip/jinja2-2.11.2
2020-04-23 19:49:42 +00:00
f42f6d6022
Bump jinja2 from 2.11.1 to 2.11.2
...
Bumps [jinja2](https://github.com/pallets/jinja ) from 2.11.1 to 2.11.2.
- [Release notes](https://github.com/pallets/jinja/releases )
- [Changelog](https://github.com/pallets/jinja/blob/master/CHANGES.rst )
- [Commits](https://github.com/pallets/jinja/compare/2.11.1...2.11.2 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-04-23 19:45:16 +00:00
e17dbd0ece
Merge pull request #441 from splunk/dependabot/pip/identify-1.4.15
2020-04-23 19:44:08 +00:00
9a9c21c8f9
Bump identify from 1.4.14 to 1.4.15
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.14 to 1.4.15.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.14...v1.4.15 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-04-23 19:39:17 +00:00
bc1023b50e
Merge pull request #420 from splunk/dependabot/pip/pyrsistent-0.16.0
2020-04-22 21:38:39 +00:00
2870030dc7
Bump pyrsistent from 0.15.7 to 0.16.0
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.15.7 to 0.16.0.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.15.7...v0.16.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-04-22 21:34:06 +00:00
2beecf88fe
Merge pull request #440 from splunk/dependabot/pip/pre-commit-2.3.0
2020-04-22 21:32:51 +00:00
3d2d3c4c3c
Bump pre-commit from 2.2.0 to 2.3.0
...
Bumps [pre-commit](https://github.com/pre-commit/pre-commit ) from 2.2.0 to 2.3.0.
- [Release notes](https://github.com/pre-commit/pre-commit/releases )
- [Changelog](https://github.com/pre-commit/pre-commit/blob/master/CHANGELOG.md )
- [Commits](https://github.com/pre-commit/pre-commit/compare/v2.2.0...v2.3.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-04-22 21:28:29 +00:00
8a5fde37bf
readme instrcutions
2020-04-17 15:53:45 -07:00
e70e12699b
readme instrcutions
2020-04-17 15:52:04 -07:00
bpatel