16903203d0
testing of detection
2020-07-03 16:59:30 +02:00
92648a7cd0
merged with develop
2020-07-01 10:55:53 +02:00
3a82c218bb
incorrect field name
2020-06-26 12:44:43 -07:00
967c1d7974
small change
2020-06-26 17:28:39 +02:00
92d6b66ffd
small change
2020-06-26 16:45:42 +02:00
af09770db1
Merge branch 'develop' into first_time_windows_service_bug
2020-06-26 08:32:34 -05:00
62a14e3217
Merge branch 'first_time_windows_service_bug' of github.com:splunk/security-content into first_time_windows_service_bug
2020-06-26 08:26:58 -05:00
f67734dedd
Fixed SPL issues with detection. SPL syntax was wrong, and lookup was wrong.
2020-06-26 08:24:16 -05:00
836c123569
Update abnormally_high_aws_instances_launched_by_user.yml
2020-06-25 13:57:54 -07:00
b5e4ebff23
Merge branch 'develop' into security_hub_response
2020-06-25 14:45:01 -06:00
957b39837f
Merge branch 'develop' into awsgcpk8s
2020-06-25 13:26:56 -07:00
1cddcfaa25
Merge branch 'develop' into first_time_windows_service_bug
2020-06-25 11:57:22 -07:00
e432a4ab50
fixedservaccounatct
2020-06-25 14:52:41 -04:00
6ea3604481
fixedaddedcondition
2020-06-25 14:36:18 -04:00
c90fcb2e9f
Update how to implement
2020-06-25 00:14:24 -05:00
8438bf71e8
Fixed the first time previously seen windows service search to work
...
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update
Made the default deployment template be -70m@m to -10m@m
Added a new deployment template for hourly baseline caches
2020-06-25 00:09:30 -05:00
e2fa17ebde
Merge branch 'develop' into security_hub_response
2020-06-24 17:22:16 -07:00
c812c56d87
updates with T1530
2020-06-24 17:21:02 -07:00
3c1d9cb416
adding T1098
2020-06-24 17:11:33 -07:00
f955708bfc
adding mitre id
2020-06-24 17:09:27 -07:00
7490418230
fixing errors for validate
2020-06-24 11:06:22 -07:00
06245b9f3d
Merge branch 'develop' into awsgcpk8s
2020-06-24 10:42:26 -07:00
3c9fd3d376
awskubectl
2020-06-23 22:11:05 -04:00
b6737234fe
awsfailureserv
2020-06-23 21:20:37 -04:00
368c72824d
k8sawssensitverole
2020-06-23 19:44:44 -04:00
d7bb41378e
awssentobj
2020-06-23 15:58:11 -04:00
8f89d328d6
RBACAWSsearch
2020-06-23 15:32:12 -04:00
8225616f3d
firstgcpawssearch
2020-06-23 14:51:45 -04:00
8a5017fc3e
update detection for credential dumping
2020-06-23 18:57:03 +02:00
0b1adabe8f
Merge branch 'develop' into aws_cross_account_activity_fix
2020-06-17 16:16:54 -06:00
82c209b539
Merge branch 'develop' into CRL-1771-update-story-windows-service-abuse
2020-06-17 14:25:20 -07:00
e96a91aeb4
removed searches that depend on non-extracted fields
2020-06-16 12:43:48 -06:00
a3022806ce
Merge branch 'develop' into CRL-1766-auth-dm-updates
...
merging in develop
2020-06-16 11:22:02 -06:00
ef9b67ea6d
Merge branch 'CRL-1766-auth-dm-updates' of github.com:splunk/security-content into CRL-1766-auth-dm-updates
...
fixed conflict from merging in develop
2020-06-16 11:12:31 -06:00
e244df84af
replace a rename with dropping the DM - same effect, better solution
2020-06-16 11:10:34 -06:00
560c176d49
adding stats for aggregation
2020-06-16 12:32:20 -04:00
f892cda659
testing and update of story Windows Service Abuse
2020-06-15 14:28:20 +02:00
4f55a18562
renaming detection
2020-06-11 13:19:24 -04:00
18df4931c2
fixed validate errors
2020-06-11 11:28:08 -04:00
31c1e3d497
adding kerbero roasting detection
2020-06-11 11:21:45 -04:00
d8c3ded0da
adding T1525 to mitre
2020-06-10 16:52:19 -07:00
24c1d452ce
updating mitre id and adding response tasks for securityhub events
2020-06-10 16:12:50 -07:00
48dc133d41
minor quotes error in spl
2020-06-10 12:07:06 -07:00
f7ea4f2684
typo
2020-06-09 15:09:40 -07:00
f33b65a085
remove space
2020-06-09 14:51:13 -07:00
36a29c3d6d
text updates for ES and AWS add-on version
2020-06-09 12:15:58 -06:00
37199617b3
updating macro filters
2020-06-08 17:12:15 -07:00
9aafe24e49
yml updates for validate
2020-06-08 16:57:42 -07:00
4f100c251d
Merge branch 'develop' into CRL-1766-auth-dm-updates
2020-06-08 15:40:34 -07:00
32b200fc33
updates for fixes noted by Bhavin
2020-06-08 13:36:06 -06:00
Patrick Bareiss