7d0a8cfabd
Merge pull request #217 from splunk/cloud_cryptominig
...
Cloud cryptominig
2019-10-08 08:48:00 -04:00
c08c11cb5e
Merge pull request #213 from splunk/dependabot/pip/pathlib2-2.3.5
...
Bump pathlib2 from 2.3.4 to 2.3.5
2019-10-08 08:47:37 -04:00
733c088621
Merge pull request #211 from splunk/dependabot/pip/contextlib2-0.6.0
...
Bump contextlib2 from 0.5.5 to 0.6.0
2019-10-08 08:47:16 -04:00
9f0d4e510c
Merge pull request #194 from splunk/dependabot/pip/zipp-0.6.0
...
Bump zipp from 0.5.2 to 0.6.0
2019-10-08 08:46:52 -04:00
00d45d08f0
Merge pull request #191 from splunk/dependabot/pip/typing-3.7.4.1
...
Bump typing from 3.7.4 to 3.7.4.1
2019-10-08 08:42:04 -04:00
c9effaf169
Merge branch 'develop' into cloud_cryptominig
2019-10-08 08:40:51 -04:00
bfd2f43f16
updated configparser to right version
2019-10-08 08:39:20 -04:00
669ae04242
updating config parser to right version
2019-10-08 08:37:58 -04:00
10162d5808
Bump contextlib2 from 0.5.5 to 0.6.0
...
Bumps [contextlib2](https://github.com/jazzband/contextlib2 ) from 0.5.5 to 0.6.0.
- [Release notes](https://github.com/jazzband/contextlib2/releases )
- [Commits](https://github.com/jazzband/contextlib2/compare/v0.5.5...v0.6.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-08 12:35:35 +00:00
accda2a493
Merge pull request #216 from splunk/dependabot/pip/attrs-19.2.0
...
Bump attrs from 19.1.0 to 19.2.0
2019-10-08 08:34:21 -04:00
9c6c794b81
Merge pull request #215 from splunk/drilldown
...
Added drilldown search and name to the detection spec.
2019-10-08 08:32:49 -04:00
2b5f46ab35
Merge pull request #212 from splunk/macros
...
Adding macros for exception handling to spec
2019-10-08 08:31:45 -04:00
a12fe635c6
Merge branch 'develop' into macros
2019-10-07 22:59:37 -05:00
ad20740605
Merge branch 'develop' into drilldown
2019-10-07 22:59:24 -05:00
85a637b149
Merge branch 'develop' into cloud_cryptominig
2019-10-07 22:59:06 -05:00
31b839b028
Actually ignore swap files now (forgot the * at the beginning)
2019-10-07 22:16:50 -05:00
6bc1ce430b
Ignore VIM swap files
2019-10-07 22:16:09 -05:00
2a4b29e4c4
New investigation macros
...
Updated validate to check for macro and lookup existence in both
baselines and investigation searches
2019-10-07 22:14:12 -05:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
fb93597cfc
Merge branch 'macros' into cloud_cryptominig
2019-10-03 17:49:45 -07:00
82e8b210a9
Files for new cloud cryptominig story.
...
It's a cloud infrastructure generic version of AWS Cryptomining
2019-10-03 17:42:40 -07:00
d11219e54d
Updated generate code
2019-10-03 13:45:16 -07:00
cc6209a08e
Started to create Cloud Cryptomining story
...
Added 1 detection, 1 baseline, and 2 investigative searches
2019-10-02 21:05:30 -07:00
a1ac59f593
Merge pull request #210 from splunk/CRL-1624_remove_contexualized
...
cRL-1624 removed contexualized
2019-10-02 17:27:13 -07:00
e71536f638
Merge pull request #214 from splunk/CRL-1627
...
Fixed issue inside of where clause
2019-10-02 17:22:10 -07:00
24769e88c5
Added lookup to the search specs
2019-10-02 12:01:03 -07:00
9edd3b9c4d
Bump attrs from 19.1.0 to 19.2.0
...
Bumps [attrs](https://github.com/python-attrs/attrs ) from 19.1.0 to 19.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases )
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/python-attrs/attrs/compare/19.1.0...19.2.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-02 07:06:42 +00:00
2a8b470241
Added drilldown search and name to the detection spec.
...
Added these fields to the suspicious wevtutil manifest
Updated validate to make sure both entries are there or neither are
Updated generate to output those fields if they are there
2019-10-01 17:31:11 -07:00
aec9dd53f5
Fixed issue inside of where clause
2019-09-30 16:17:29 -07:00
1bda6248ea
Added code to validate macros manifest and lookups manifest
...
Lookup manifest validation also checks to make sure either filename or collection is there
If a filename is listed, it makes sure the file exists as well
2019-09-30 16:08:54 -07:00
575b766f09
Minor spec change to macro.spec.json
2019-09-30 16:08:08 -07:00
e428f473c9
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
1149f8b6a4
Bump pathlib2 from 2.3.4 to 2.3.5
...
Bumps [pathlib2](https://github.com/mcmtroffaes/pathlib2 ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/mcmtroffaes/pathlib2/releases )
- [Changelog](https://github.com/mcmtroffaes/pathlib2/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/mcmtroffaes/pathlib2/compare/2.3.4...2.3.5 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-30 06:19:03 +00:00
5e5cd80145
Merge branch 'develop' into macros
2019-09-27 15:01:34 -05:00
6ee9d9962c
Added entry for macros in baseline, detections, and investigations spec.
2019-09-25 14:36:35 -05:00
ebd92527c3
updated base on feedback from Dave H.
2019-09-19 13:42:54 -04:00
48593b7ff6
Revert "removed contexualized"
...
This reverts commit 5ad6534ccd
2019-09-19 13:36:13 -04:00
85e033d0e2
Merge pull request #209 from splunk/dependabot/pip/importlib-metadata-0.23
...
Bump importlib-metadata from 0.22 to 0.23
2019-09-19 11:28:39 -04:00
5ad6534ccd
removed contexualized
2019-09-18 18:01:43 -04:00
4178965a66
Bump importlib-metadata from 0.22 to 0.23
...
Bumps [importlib-metadata](http://importlib-metadata.readthedocs.io/ ) from 0.22 to 0.23.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-17 05:43:55 +00:00
e1310d2192
adding ss.conf spec and example
2019-09-12 16:27:11 -07:00
6fdc4ff2bf
Merge pull request #208 from splunk/CRL-1617_bug
...
CRL-1617 changed process to process name
2019-09-12 11:15:02 -06:00
f3cb4bcc2a
bumping configparserr
2019-09-12 10:05:57 -07:00
a04729b663
changed process to process name
2019-09-12 09:55:57 -07:00
66b5cd25ba
Merge pull request #202 from splunk/remove_html_tags
...
CRL-1611 Remove html tags
2019-09-12 10:41:00 -06:00
b783922e62
Merge pull request #196 from splunk/dependabot/pip/identify-1.4.7
...
Bump identify from 1.4.6 to 1.4.7
2019-09-12 12:34:58 -04:00
90ef83a474
Merge branch 'develop' into dependabot/pip/typing-3.7.4.1
2019-09-12 12:31:53 -04:00
1c8e76029b
Merge branch 'develop' into dependabot/pip/zipp-0.6.0
2019-09-12 12:30:21 -04:00
235beccb12
Bump typing from 3.7.4 to 3.7.4.1
...
Bumps [typing](https://docs.python.org/3/library/typing.html ) from 3.7.4 to 3.7.4.1.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 16:29:44 +00:00
Jose Enrique Hernandez