24769e88c5
Added lookup to the search specs
2019-10-02 12:01:03 -07:00
9edd3b9c4d
Bump attrs from 19.1.0 to 19.2.0
...
Bumps [attrs](https://github.com/python-attrs/attrs ) from 19.1.0 to 19.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases )
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/python-attrs/attrs/compare/19.1.0...19.2.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-02 07:06:42 +00:00
2a8b470241
Added drilldown search and name to the detection spec.
...
Added these fields to the suspicious wevtutil manifest
Updated validate to make sure both entries are there or neither are
Updated generate to output those fields if they are there
2019-10-01 17:31:11 -07:00
aec9dd53f5
Fixed issue inside of where clause
2019-09-30 16:17:29 -07:00
1bda6248ea
Added code to validate macros manifest and lookups manifest
...
Lookup manifest validation also checks to make sure either filename or collection is there
If a filename is listed, it makes sure the file exists as well
2019-09-30 16:08:54 -07:00
575b766f09
Minor spec change to macro.spec.json
2019-09-30 16:08:08 -07:00
e428f473c9
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
1149f8b6a4
Bump pathlib2 from 2.3.4 to 2.3.5
...
Bumps [pathlib2](https://github.com/mcmtroffaes/pathlib2 ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/mcmtroffaes/pathlib2/releases )
- [Changelog](https://github.com/mcmtroffaes/pathlib2/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/mcmtroffaes/pathlib2/compare/2.3.4...2.3.5 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-30 06:19:03 +00:00
5e5cd80145
Merge branch 'develop' into macros
2019-09-27 15:01:34 -05:00
6ee9d9962c
Added entry for macros in baseline, detections, and investigations spec.
2019-09-25 14:36:35 -05:00
ebd92527c3
updated base on feedback from Dave H.
2019-09-19 13:42:54 -04:00
48593b7ff6
Revert "removed contexualized"
...
This reverts commit 5ad6534ccd
2019-09-19 13:36:13 -04:00
85e033d0e2
Merge pull request #209 from splunk/dependabot/pip/importlib-metadata-0.23
...
Bump importlib-metadata from 0.22 to 0.23
2019-09-19 11:28:39 -04:00
5ad6534ccd
removed contexualized
2019-09-18 18:01:43 -04:00
4178965a66
Bump importlib-metadata from 0.22 to 0.23
...
Bumps [importlib-metadata](http://importlib-metadata.readthedocs.io/ ) from 0.22 to 0.23.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-17 05:43:55 +00:00
e1310d2192
adding ss.conf spec and example
2019-09-12 16:27:11 -07:00
6fdc4ff2bf
Merge pull request #208 from splunk/CRL-1617_bug
...
CRL-1617 changed process to process name
2019-09-12 11:15:02 -06:00
f3cb4bcc2a
bumping configparserr
2019-09-12 10:05:57 -07:00
a04729b663
changed process to process name
2019-09-12 09:55:57 -07:00
66b5cd25ba
Merge pull request #202 from splunk/remove_html_tags
...
CRL-1611 Remove html tags
2019-09-12 10:41:00 -06:00
b783922e62
Merge pull request #196 from splunk/dependabot/pip/identify-1.4.7
...
Bump identify from 1.4.6 to 1.4.7
2019-09-12 12:34:58 -04:00
90ef83a474
Merge branch 'develop' into dependabot/pip/typing-3.7.4.1
2019-09-12 12:31:53 -04:00
1c8e76029b
Merge branch 'develop' into dependabot/pip/zipp-0.6.0
2019-09-12 12:30:21 -04:00
235beccb12
Bump typing from 3.7.4 to 3.7.4.1
...
Bumps [typing](https://docs.python.org/3/library/typing.html ) from 3.7.4 to 3.7.4.1.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 16:29:44 +00:00
ca109f84db
Merge pull request #201 from splunk/dependabot/pip/virtualenv-16.7.5
...
Bump virtualenv from 16.7.2 to 16.7.5
2019-09-12 12:29:34 -04:00
e5a67a7145
Merge pull request #197 from splunk/dependabot/pip/pre-commit-1.18.3
...
Bump pre-commit from 1.18.1 to 1.18.3
2019-09-12 12:29:03 -04:00
d5d03995d0
Bump identify from 1.4.6 to 1.4.7
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.6 to 1.4.7.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.6...v1.4.7 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 16:28:42 +00:00
c6e5e85581
Merge pull request #203 from splunk/dependabot/pip/semantic-version-2.8.2
...
Bump semantic-version from 2.6.0 to 2.8.2
2019-09-12 12:28:38 -04:00
9a2575b771
Merge pull request #204 from splunk/dependabot/pip/configparser-4.0.1
...
Bump configparser from 3.8.1 to 4.0.1
2019-09-12 12:27:55 -04:00
54819dbe80
Merge pull request #207 from splunk/dependabot/pip/importlib-metadata-0.22
...
Bump importlib-metadata from 0.19 to 0.22
2019-09-12 12:27:27 -04:00
295a8587ea
Bump importlib-metadata from 0.19 to 0.22
...
Bumps [importlib-metadata](http://importlib-metadata.readthedocs.io/ ) from 0.19 to 0.22.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-12 05:39:52 +00:00
64a8d8990d
static method error
2019-09-11 18:37:19 -07:00
6061aec7f8
adding detection results to KV store
2019-09-11 17:05:57 -07:00
af1a9d89e7
correcting new line char
2019-09-11 15:58:02 -04:00
6a38c841ee
Bump configparser from 3.8.1 to 4.0.1
...
Bumps [configparser](https://github.com/jaraco/configparser ) from 3.8.1 to 4.0.1.
- [Release notes](https://github.com/jaraco/configparser/releases )
- [Changelog](https://github.com/jaraco/configparser/blob/master/CHANGES.rst )
- [Commits](https://github.com/jaraco/configparser/compare/3.8.1...v4.0.1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-10 05:46:23 +00:00
8caf104960
Bump semantic-version from 2.6.0 to 2.8.2
...
Bumps [semantic-version](https://github.com/rbarrois/python-semanticversion ) from 2.6.0 to 2.8.2.
- [Release notes](https://github.com/rbarrois/python-semanticversion/releases )
- [Changelog](https://github.com/rbarrois/python-semanticversion/blob/master/ChangeLog )
- [Commits](https://github.com/rbarrois/python-semanticversion/compare/v2.6.0...2.8.2 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-09 06:08:29 +00:00
4d221f5d18
added entities field and updated spec files
2019-09-04 16:36:08 -07:00
c1208b0fb2
adding investigate.py
2019-09-04 16:16:10 -07:00
d15531c6fb
fixing new line char error
2019-09-04 16:44:39 -04:00
dceb4ab5d7
fixed issues with new line escaping
2019-09-04 15:59:40 -04:00
4fdf20ce0d
Merge branch 'develop' into run_detections
2019-09-04 10:32:54 -07:00
bb0a440b62
removing example repo as all content is now v2
2019-09-04 12:44:43 -04:00
979938f707
cleaned up markdown logic from scripts
2019-09-04 12:42:58 -04:00
4849a89daf
Fixed listing from markdown
2019-09-04 12:33:15 -04:00
fe0b0e1133
removing html tags
2019-09-04 12:20:27 -04:00
75e50cb544
Bump virtualenv from 16.7.2 to 16.7.5
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 16.7.2 to 16.7.5.
- [Release notes](https://github.com/pypa/virtualenv/releases )
- [Changelog](https://github.com/pypa/virtualenv/blob/master/docs/changes.rst )
- [Commits](https://github.com/pypa/virtualenv/compare/16.7.2...16.7.5 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-04 05:40:13 +00:00
0a9d6cbc8e
Bump pre-commit from 1.18.1 to 1.18.3
...
Bumps [pre-commit](https://github.com/pre-commit/pre-commit ) from 1.18.1 to 1.18.3.
- [Release notes](https://github.com/pre-commit/pre-commit/releases )
- [Changelog](https://github.com/pre-commit/pre-commit/blob/master/CHANGELOG.md )
- [Commits](https://github.com/pre-commit/pre-commit/compare/v1.18.1...v1.18.3 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-08-28 10:32:30 +00:00
6a2216b974
updating docs and package bits [ci skip]
2019-08-27 22:45:42 +00:00
621f26301b
Merge pull request #192 from splunk/CRL-1607-Fix-Weird-Italics
...
CRL-1608 Update dyn_dns_queries.json
2019-08-27 16:53:52 -04:00
David Dorsey