admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,257 Commits 697 Branches 195 Tags
update_mapping_code
Commit Graph

2257 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Brianna 26ed92ec76 Various changes for grammar, spelling, punctuation, and flow. And to escape the quotes n stuff. 2019-10-17 17:01:28 -07:00
David Dorsey 20e5a75464 Remove _ fields 2019-10-17 10:29:22 -07:00
David Dorsey 14f3f9b657 Space in tstats caused issue 2019-10-17 10:00:19 -07:00
David Dorsey 90b2a8c487 Added search_window macros to searches 2019-10-17 09:28:41 -07:00
David Dorsey 5bda4d97b2 Fixed ID 2019-10-17 09:12:01 -07:00
David Dorsey 8a4a631f3c Module name for DM search was wrong 2019-10-17 08:56:42 -07:00
David Dorsey 2f388cd6cb Need "s in comments macro 2019-10-17 08:52:05 -07:00
Patrick Bareiss a84d8a3e9f Code refactoring for validate.py 2019-10-17 14:01:17 +02:00
David Dorsey 848f32f408 Removed investigative search 2019-10-17 00:20:47 -07:00
David Dorsey 61c32ba17b Added region as a entity 2019-10-16 22:35:49 -07:00
David Dorsey b19652d35e Added entities to investigative searches 2019-10-16 22:33:20 -07:00
David Dorsey d49e29a9b4 Updated generate 2019-10-16 21:09:23 -07:00
David Dorsey 61c3f18ece Updated generate to output for ASX 
Fixed macros
 2019-10-16 20:54:13 -07:00
David Dorsey 13af78c6d8 Added macro for the time window 2019-10-16 18:42:02 -07:00
David Dorsey 645ae6a647 Missed the rename of the data model in this file 2019-10-16 17:59:28 -07:00
David Dorsey cb7a441885 Renamed data model in spec from Cloud to Cloud_Infrastructure 2019-10-16 17:58:24 -07:00
David Dorsey 1f8fbb9c58 Merge branch 'develop' into cloud_cryptomining 2019-10-16 17:50:40 -07:00
David Dorsey 9e4a2a2413 Used final name of cloud data model 2019-10-16 17:38:10 -07:00
Jose Enrique Hernandez 33970c46fc Merge pull request #222 from splunk/change_json_to_yml 
Changed json to yml
 2019-10-16 12:53:50 -04:00
Jose Enrique Hernandez cacc5f03de Merge pull request #221 from splunk/CRL-1490 
Fixed typo in distsearch.conf that caused unnecessary bundle replication
 2019-10-16 11:12:50 -04:00
Patrick Bareiss af66ed5fe3 Changed json to yml 2019-10-16 16:38:05 +02:00
David Dorsey 14bfab7338 Fixed typo in distsearch.conf that caused unnecessary bundle replication 2019-10-15 16:28:26 -07:00
dependabot-preview[bot] 009a5b0f37 Bump attrs from 19.2.0 to 19.3.0 
Bumps [attrs](https://github.com/python-attrs/attrs) from 19.2.0 to 19.3.0.
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-attrs/attrs/compare/19.2.0...19.3.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-10-15 14:44:10 +00:00
dependabot-preview[bot] 61990be03f Bump contextlib2 from 0.6.0 to 0.6.0.post1 
Bumps [contextlib2](https://github.com/jazzband/contextlib2) from 0.6.0 to 0.6.0.post1.
- [Release notes](https://github.com/jazzband/contextlib2/releases)
- [Commits](https://github.com/jazzband/contextlib2/compare/v0.6.0...v0.6.0.post1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-10-11 06:18:51 +00:00
dependabot-preview[bot] 09f3fe9cef Bump jsonschema from 3.0.2 to 3.1.1 
Bumps [jsonschema](https://github.com/Julian/jsonschema) from 3.0.2 to 3.1.1.
- [Release notes](https://github.com/Julian/jsonschema/releases)
- [Changelog](https://github.com/Julian/jsonschema/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/Julian/jsonschema/compare/v3.0.2...v3.1.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-10-10 06:29:41 +00:00
Jose Enrique Hernandez 7d0a8cfabd Merge pull request #217 from splunk/cloud_cryptominig 
Cloud cryptominig
 2019-10-08 08:48:00 -04:00
Jose Enrique Hernandez c08c11cb5e Merge pull request #213 from splunk/dependabot/pip/pathlib2-2.3.5 
Bump pathlib2 from 2.3.4 to 2.3.5
 2019-10-08 08:47:37 -04:00
Jose Enrique Hernandez 733c088621 Merge pull request #211 from splunk/dependabot/pip/contextlib2-0.6.0 
Bump contextlib2 from 0.5.5 to 0.6.0
 2019-10-08 08:47:16 -04:00
Jose Enrique Hernandez 9f0d4e510c Merge pull request #194 from splunk/dependabot/pip/zipp-0.6.0 
Bump zipp from 0.5.2 to 0.6.0
 2019-10-08 08:46:52 -04:00
Jose Enrique Hernandez 00d45d08f0 Merge pull request #191 from splunk/dependabot/pip/typing-3.7.4.1 
Bump typing from 3.7.4 to 3.7.4.1
 2019-10-08 08:42:04 -04:00
Jose Enrique Hernandez c9effaf169 Merge branch 'develop' into cloud_cryptominig 2019-10-08 08:40:51 -04:00
divious1 bfd2f43f16 updated configparser to right version 2019-10-08 08:39:20 -04:00
divious1 669ae04242 updating config parser to right version 2019-10-08 08:37:58 -04:00
dependabot-preview[bot] 10162d5808 Bump contextlib2 from 0.5.5 to 0.6.0 
Bumps [contextlib2](https://github.com/jazzband/contextlib2) from 0.5.5 to 0.6.0.
- [Release notes](https://github.com/jazzband/contextlib2/releases)
- [Commits](https://github.com/jazzband/contextlib2/compare/v0.5.5...v0.6.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-10-08 12:35:35 +00:00
Jose Enrique Hernandez accda2a493 Merge pull request #216 from splunk/dependabot/pip/attrs-19.2.0 
Bump attrs from 19.1.0 to 19.2.0
 2019-10-08 08:34:21 -04:00
Jose Enrique Hernandez 9c6c794b81 Merge pull request #215 from splunk/drilldown 
Added drilldown search and name to the detection spec.
 2019-10-08 08:32:49 -04:00
Jose Enrique Hernandez 2b5f46ab35 Merge pull request #212 from splunk/macros 
Adding macros for exception handling to spec
 2019-10-08 08:31:45 -04:00
David Dorsey a12fe635c6 Merge branch 'develop' into macros 2019-10-07 22:59:37 -05:00
David Dorsey ad20740605 Merge branch 'develop' into drilldown 2019-10-07 22:59:24 -05:00
David Dorsey 85a637b149 Merge branch 'develop' into cloud_cryptominig 2019-10-07 22:59:06 -05:00
David Dorsey 31b839b028 Actually ignore swap files now (forgot the * at the beginning) 2019-10-07 22:16:50 -05:00
David Dorsey 6bc1ce430b Ignore VIM swap files 2019-10-07 22:16:09 -05:00
David Dorsey 2a4b29e4c4 New investigation macros 
Updated validate to check for macro and lookup existence in both
    baselines and investigation searches
 2019-10-07 22:14:12 -05:00
David Dorsey 9034599d6f Added in exception handling to cloud compute activity in new region 
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
    a macro manifest
 2019-10-07 21:50:13 -05:00
David Dorsey fb93597cfc Merge branch 'macros' into cloud_cryptominig 2019-10-03 17:49:45 -07:00
David Dorsey 82e8b210a9 Files for new cloud cryptominig story. 
It's a cloud infrastructure generic version of AWS Cryptomining
 2019-10-03 17:42:40 -07:00
David Dorsey d11219e54d Updated generate code 2019-10-03 13:45:16 -07:00
David Dorsey cc6209a08e Started to create Cloud Cryptomining story 
Added 1 detection, 1 baseline, and 2 investigative searches
 2019-10-02 21:05:30 -07:00
Bhavin Patel a1ac59f593 Merge pull request #210 from splunk/CRL-1624_remove_contexualized 
cRL-1624 removed contexualized
 2019-10-02 17:27:13 -07:00
Jose Enrique Hernandez e71536f638 Merge pull request #214 from splunk/CRL-1627 
Fixed issue inside of where clause
 2019-10-02 17:22:10 -07:00