652d7f3fd0
updating macros to use sourcetype
2019-12-18 17:49:09 -08:00
2701ad2049
remove def key from macro yml
2019-12-18 16:15:51 -08:00
142d74b174
remove def key from macro yml
2019-12-18 14:54:48 -08:00
9afa020d06
empty defs
2019-12-18 14:48:24 -08:00
151be9217b
removing index and keeping source
2019-12-18 14:21:36 -08:00
5c775ec15a
Worked on the feedback
2019-12-18 20:08:10 +01:00
1cdf09802c
Worked on the feedback
2019-12-18 20:03:19 +01:00
be0fc0b66a
Worked on the feedback
2019-12-18 10:29:40 +01:00
fc12a232a1
Merge branch 'develop' into CRL-1698_new_version_credential_dumping
2019-12-18 10:24:52 +01:00
4e8427cff4
Worked on the feedback
2019-12-18 10:23:55 +01:00
3f03c5392c
New version of Credential Dumping Story
2019-12-17 18:08:09 +01:00
761812a675
WIP: Exception Handling test
2019-12-17 13:15:51 +01:00
2ea8d2b020
fixed security_content_ctime macro
2019-12-17 09:33:35 +01:00
2ed8b32696
Merged with develop
2019-12-17 09:13:43 +01:00
8ae3ebdbf5
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
de84f9822c
WIP: liche check disabled
2019-12-16 12:07:40 +01:00
c873fc8363
WIP: pre and post macros
2019-12-16 10:28:47 +01:00
89e8cc1faf
found a bug with how generate was producing the file, needs to be a string
2019-12-11 15:28:26 -05:00
f8e3113412
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
f9bdf7e0e4
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
322e711936
CRL-1645 - Fixing macros for excessive runinstances and terminateinstances to use src_user in description.
2019-11-25 18:17:06 -08:00
95f73c9039
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
2019-11-25 18:06:33 -08:00
b3b4f4e892
CRL-1646 - Implemented : Update Detection for abnormally_high_instances_launched to use MLTK
2019-11-20 14:18:50 -08:00
90b2a8c487
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
61c3f18ece
Updated generate to output for ASX
...
Fixed macros
2019-10-16 20:54:13 -07:00
13af78c6d8
Added macro for the time window
2019-10-16 18:42:02 -07:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
2a4b29e4c4
New investigation macros
...
Updated validate to check for macro and lookup existence in both
baselines and investigation searches
2019-10-07 22:14:12 -05:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
bpatel