admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,010 Commits 697 Branches 195 Tags
ttp_init_score
Commit Graph

432 Commits

Author SHA1 Message Date
Bhavin Patel 96a4df100d Automated Splunk TA Update 560 (#3938) 
* Updated TAs

* updating app name

* testing TA

* remove comments

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-06 12:26:52 +05:30
Nasreddine Bencherchali f930b525ee Add New Analytics - February Batch (#3886) 
* add percent encoded curl exec

* Fix #3916

* Add other calc process names entries

* apply formatting

* add more color

* add cisco sd-wan stuff

* update tags

* Update cisco_sd_wan___low_frequency_rogue_peer.yml

* add ds and maps it

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-03 18:31:37 +05:30
Bhavin Patel 0fcd63a821 Updated TAs (#3919) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-25 22:21:02 +05:30
Bhavin Patel 91b957d103 Updated TAs (#3918) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-24 22:18:56 +05:30
Bhavin Patel 07d5e7d54d Updated TAs (#3914) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-20 10:49:23 +01:00
Rod Soto 02573684ce Add New MCP Related Detections (#3895) 
---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-02-17 23:39:01 +01:00
Bhavin Patel b29ba95b51 Updated TAs (#3906) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-11 22:18:24 +05:30
Bhavin Patel 91ab062bb4 Updated TAs (#3900) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-02-10 19:52:27 +05:30
bpluta-splunk 7cf9641f5f upodated SPL based on new raw events (#3898) 
* upodated SPL based on new raw events

* updating dataset link and data source file

---------

Co-authored-by: Bhavin Patel <bpatel@splunk.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-02-10 12:59:45 +05:30
Bhavin Patel a43838a3f5 Automated Splunk TA Update 532 (#3891) 
* Updated TAs

* Update Splunk app version and hardcoded path

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-02-06 18:21:07 +05:30
Bhavin Patel c233cf9c04 Updated TAs (#3884) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-31 19:40:56 +01:00
Nasreddine Bencherchali 7941673530 Add Snort/IOS Correlation and Other Things (#3857) 2026-01-12 12:15:11 +01:00
Bhavin Patel 06db914290 Updated TAs (#3858) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-10 14:20:32 +01:00
Bhavin Patel 478ecc0a4b Updated TAs (#3856) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-09 20:23:37 +00:00
Bhavin Patel 0f5eeb8ceb Updated TAs (#3854) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-07 10:17:04 +05:30
Bhavin Patel 6d1b940663 Cisco Isovalent - Add first batch of new detections (#3706) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-06 01:24:39 +01:00
Bhavin Patel cd961cac5b Updated TAs (#3849) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-21 19:20:09 +01:00
Bhavin Patel 4e90912faf Updated TAs (#3845) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-19 21:10:10 +05:30
Bhavin Patel 78d7f8cebd Updated TAs (#3832) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-12 15:06:49 +01:00
Bhavin Patel 378879ae67 Updated TAs (#3826) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-12-09 12:06:36 +01:00
Bhavin Patel 4b60fecd8e Automated Splunk TA Update 473 (#3820) 
* Updated TAs

* Adding ta-ollama

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: ljstella <lstella@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-12-08 16:05:19 +01:00
Nasreddine Bencherchali d8ddca1a2d Merge branch 'develop' into fix_cwd_path_detections 2025-12-03 00:25:40 +01:00
Nasreddine Bencherchali 572a93567f add missing extension 2025-12-02 18:59:42 +01:00
Nasreddine Bencherchali ff4fda6445 update indentations and logic 2025-12-02 18:58:56 +01:00
patel-bhavin 9604770975 Updated TAs 2025-11-27 06:59:55 +00:00
Nasreddine Bencherchali 515d736c62 Add New ASA Analytics (#3794) 
* first batch

* more updates

* update tags and filter

* more fixes

* Update cisco_asa___reconnaissance_command_activity.yml

* Update cisco_asa___reconnaissance_command_activity.yml

* Update cisco_asa___reconnaissance_command_activity.yml

* Update cisco_asa___reconnaissance_command_activity.yml

* update to production

* fixes and updates

* update date and fix typos

* apply suggestion

* Update cisco_asa___reconnaissance_command_activity.yml

* add explicit message ids

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-11-21 14:50:18 -08:00
Br3akp0int 888c2249e8 netsupport (#3798) 
* netsupport

* netsupport

* netsupport

* netsupport

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update data_sources/sysmon_eventid_29.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update data_sources/sysmon_eventid_29.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* netsupport

* netsupport

* netsupport

* netsupport

* updates

* small fixes

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-11-21 13:27:52 -08:00
patel-bhavin 50989c2650 Updated TAs 2025-11-21 06:59:48 +00:00
patel-bhavin 1bd5621d23 Updated TAs 2025-11-20 06:58:48 +00:00
Bhavin Patel 637e44267d Updated TAs (#3782) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-11-13 12:31:49 -08:00
Bhavin Patel e42da6eaf3 Automated Splunk TA Update 440 (#3761) 
* Updated TAs

* Applink

* Fix - Windows Kerberos Local Successful Logon (#3763)

* fixes?

* Update windows_svchost_exe_parent_process_anomaly.yml

revert

* manual test

* unicode

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2025-11-10 12:24:06 -08:00
Bhavin Patel d1a15f9e91 Ollama TA (#3757) 
* updating ta

* updating weird things
 2025-11-05 09:50:50 -08:00
Bhavin Patel d401d3a33b updating raw log (#3756) 2025-11-04 13:17:53 -08:00
Bhavin Patel bd66e7a1d3 remove TA (#3755) 2025-11-04 11:05:19 -08:00
Bhavin Patel 437a5cdf62 revert - Splunk Add-on for Microsoft Security (#3747) 
* revert this app

* revert versions
 2025-10-27 15:38:58 -07:00
Rod Soto 0bcb54b6f9 Ollama TA detections (#3710) 
* commit1oll

* olldet2

* olldet3

* fixeddet3

* fixsp

* olldet4

* olldet5

* detoll6

* olldet7

* olldet8

* datasets

* testfixes

* modifiedtasearch

* lotsofixes

* fixednewta

* addedmorerefs

* fixedatasource

* fixedthreatobject

* fixedetectionandalertmessage

* fixedalermessage

* fixedquotes

* fixedhowtoimp

* fixeddescriptionandhowto

* changedestforuripat

* fixedowasplink

* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_rce_via_model_loading.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* protoexnassuggestions

* mionr

* remove index=*

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 21:54:37 +02:00
Rod Soto 6cf5b0f8f6 Copilot based Detections (#3693) 
* det1

* fixeddt1

* det2

* d3

* det4

* djbk

* d6

* d7

* d8

* addedlnkds

* fixsctype

* pipegone

* fixp

* fixdevices

* jbfix

* datasetfix

* exp

* fixsynthax

* changedstory

* changeprinus

* improvedht

* changedSenderuser

* datas

* fixdoublesearch

* fixedpi

* fixeddescriptionsuser

* fixdatalink

* exportedlogsdatasource

* fixedhowtodatasource

* updating risk stuff

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 12:14:09 -07:00
patel-bhavin 5f36e1ea07 Updated TAs 2025-10-10 06:57:53 +00:00
patel-bhavin 73097a131f Updated TAs 2025-10-09 06:58:04 +00:00
patel-bhavin 50284777f7 Updated TAs 2025-10-08 06:57:56 +00:00
patel-bhavin 96cfc3ee82 Updated TAs 2025-10-07 06:58:20 +00:00
patel-bhavin 807bd7730e Updated TAs 2025-10-06 06:58:11 +00:00
patel-bhavin 4f4485d8bd Updated TAs 2025-10-02 06:58:12 +00:00
Bhavin Patel afb75a6bac Merge branch 'develop' into ctl_515 2025-09-29 12:07:09 -07:00
patel-bhavin b12935d33c Updated TAs 2025-09-29 06:59:13 +00:00
Bhavin Patel 4d7faff280 link for debug logging 2025-09-25 16:35:50 -07:00
Bhavin Patel 6fc52ccd51 updating to text 2025-09-25 16:21:47 -07:00
Bhavin Patel fd9394687e move to public 2025-09-25 13:05:25 -07:00
Bhavin Patel 5727b39bf8 updating rewuired output fields 2025-09-17 15:38:45 -07:00
patel-bhavin 8b3e0ef183 Updated TAs 2025-09-11 06:58:13 +00:00