 Patrick Bareiss
|
4e8427cff4
|
Worked on the feedback
|
2019-12-18 10:23:55 +01:00 |
|
|
Patrick Bareiss
|
2ed8b32696
|
Merged with develop
|
2019-12-17 09:13:43 +01:00 |
|
|
divious1
|
1acf708bc3
|
updating bug with samsam docs
|
2019-12-16 10:21:04 -05:00 |
|
|
Patrick Bareiss
|
6c35f20a55
|
added investigations to detections
|
2019-12-12 16:44:26 +01:00 |
|
|
Patrick Bareiss
|
c1a9ba0852
|
added ctime macro to ESCU
|
2019-12-11 14:10:21 +01:00 |
|
|
Patrick Bareiss
|
ab2118a012
|
New version of analytics story credential dumping
|
2019-12-11 13:13:14 +01:00 |
|
|
Patrick Bareiss
|
44f1bb3efb
|
Merge branch 'develop' into CRL-1698_new_version_credential_dumping
|
2019-12-11 12:30:43 +01:00 |
|
|
Patrick Bareiss
|
46ac72ebf6
|
WIP: Credential Dumping Story
|
2019-12-11 12:29:41 +01:00 |
|
|
divious1
|
55f4361f4c
|
fixing broken links in stories
|
2019-12-09 19:59:39 -05:00 |
|
|
Jason Brewer
|
95f73c9039
|
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
|
2019-11-25 18:06:33 -08:00 |
|
|
Jason Brewer
|
951d055cc3
|
CRL-1646 - adding Abnormally High AWS Instances Launched [mltk] to cloud_cryptomining story.
|
2019-11-25 17:01:20 -08:00 |
|
|
Jason Brewer
|
5a901801a0
|
CRL-1646 - Fixing newly broken reference.
|
2019-11-25 16:32:14 -08:00 |
|
|
Jason Brewer
|
38be9ebb26
|
CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.
|
2019-11-25 15:17:32 -08:00 |
|
|
divious1
|
63267cdc5f
|
fixing broken link
|
2019-11-18 13:30:26 -05:00 |
|
|
divious1
|
6196553fd3
|
fixing more broken links
|
2019-11-18 13:17:52 -05:00 |
|
|
divious1
|
75bb363f66
|
fixing broken link, regen docs
|
2019-11-18 13:12:05 -05:00 |
|
|
Jose Enrique Hernandez
|
a62c66b076
|
Merge pull request #251 from splunk/CRL-1401
Added email brand monitoring to suspicious email story
|
2019-11-06 17:56:57 -05:00 |
|
|
David Dorsey
|
4e5721163a
|
Added email brand monitoring to suspicious email story
|
2019-11-06 14:11:25 -08:00 |
|
|
bpatel
|
541b72fd71
|
merge with develop and testing
|
2019-11-05 12:22:01 -08:00 |
|
|
Patrick Bareiss
|
2004017dea
|
Code Refactoring od generate.py
|
2019-10-29 18:35:16 -07:00 |
|
|
David Dorsey
|
efdc411d17
|
Need to escape a '
|
2019-10-22 11:32:37 -07:00 |
|
|
Brianna
|
26ed92ec76
|
Various changes for grammar, spelling, punctuation, and flow. And to escape the quotes n stuff.
|
2019-10-17 17:01:28 -07:00 |
|
|
Patrick Bareiss
|
af66ed5fe3
|
Changed json to yml
|
2019-10-16 16:38:05 +02:00 |
|
|
David Dorsey
|
82e8b210a9
|
Files for new cloud cryptominig story.
It's a cloud infrastructure generic version of AWS Cryptomining
|
2019-10-03 17:42:40 -07:00 |
|
|
David Dorsey
|
cc6209a08e
|
Started to create Cloud Cryptomining story
Added 1 detection, 1 baseline, and 2 investigative searches
|
2019-10-02 21:05:30 -07:00 |
|
|
divious1
|
af1a9d89e7
|
correcting new line char
|
2019-09-11 15:58:02 -04:00 |
|
|
divious1
|
d15531c6fb
|
fixing new line char error
|
2019-09-04 16:44:39 -04:00 |
|
|
divious1
|
dceb4ab5d7
|
fixed issues with new line escaping
|
2019-09-04 15:59:40 -04:00 |
|
|
divious1
|
4849a89daf
|
Fixed listing from markdown
|
2019-09-04 12:33:15 -04:00 |
|
|
divious1
|
fe0b0e1133
|
removing html tags
|
2019-09-04 12:20:27 -04:00 |
|
|
Rico Valdez
|
8eb0084ae0
|
re-applying some fixes for channel. Also, merging in develop broke the spec file, so fixed that.
|
2019-08-06 20:47:35 -06:00 |
|
|
divious1
|
b82eaa7750
|
fixing merge conflicts
|
2019-08-06 17:45:35 -04:00 |
|
|
Rico Valdez
|
5836446617
|
fixed channel in stories, minor tweaks to detections.
Also - updated spec to allow validation to pass for UBA detection, as well as updated validation script
|
2019-08-06 14:58:39 -06:00 |
|
|
Rico Valdez
|
b8711d99be
|
modifications to baselines, investigations as appropriate and added usecase field to stories
|
2019-08-06 13:38:09 -06:00 |
|
|
Rico Valdez
|
a550d79be6
|
fixed duplicate investigations and added new content for latest release
|
2019-07-29 11:53:01 -06:00 |
|
|
Rico Valdez
|
80c6870a8a
|
All manifests converted to spec v2
|
2019-07-25 09:48:06 -06:00 |
|
|
bpatel
|
ddb3d4f6c2
|
story update
|
2019-07-24 15:21:04 -07:00 |
|
|
divious1
|
3813882fae
|
doc generation skeleton
|
2019-06-19 00:03:14 -04:00 |
|
|
bpatel
|
3d39407b64
|
mergeing with develop, include CI changes
|
2019-06-05 14:05:51 -07:00 |
|
|
proyer
|
1436a54ac9
|
Merge branch 'develop' into CRL-1473
|
2019-06-04 09:49:01 -04:00 |
|
|
bpatel
|
6dd4f4dc4b
|
merge and testing the package
|
2019-05-30 15:57:28 -07:00 |
|
|
briannablacet
|
bba977de33
|
Update emotet.json
|
2019-05-24 12:53:00 -07:00 |
|
|
bpatel
|
cb2c30de86
|
bringing the branch upto date with develop
|
2019-05-17 11:50:36 -07:00 |
|
|
Rico Valdez
|
2f1cdca631
|
updated names of the support searches and updates stories accordingly
|
2019-05-15 11:51:39 -06:00 |
|
|
Jason Brewer
|
0e320c6a39
|
CRL-1428 - Updating per code review feedback.
|
2019-05-13 16:05:24 -07:00 |
|
|
bpatel
|
7510af7266
|
files updated to spec2.0 and phantom shell file
|
2019-05-13 12:36:05 -07:00 |
|
|
Rico Valdez
|
2286622900
|
going back to hyphens
|
2019-05-10 14:39:34 -06:00 |
|
|
Rico Valdez
|
ead7741cee
|
testing removing the hyphen from smb traffic spike
|
2019-05-10 14:10:35 -06:00 |
|
|
Rico Valdez
|
97d82b606f
|
fixed title on support searches and updated relevant stories
|
2019-05-10 13:47:54 -06:00 |
|
|
Rico Valdez
|
030683cbed
|
created 3 new searches and associated support searches that are mltk versions of existing searches. Also added them to the appropriate stories and fixed the non-capitalized title for an investigative search - updated associated stories for that as well.
|
2019-05-07 13:57:23 -06:00 |
|