admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,542 Commits 697 Branches 195 Tags
workbench_issue_697
Commit Graph

145 Commits

Author SHA1 Message Date
Jose Enrique Hernandez 3c1cfbf4de Merge branch 'develop' into develop 2020-11-18 13:30:38 -05:00
Bhavin Patel 398ee5f947 Merge pull request #843 from splunk/ransomwares3 
Ransomwares3
 2020-11-12 11:51:39 -08:00
Jose Enrique Hernandez 3e9513f4b8 Merge branch 'develop' into develop 2020-11-11 22:04:16 -05:00
Jose Enrique Hernandez 4acc8c3efb Merge branch 'develop' into mbjerkeland-develop 2020-11-11 22:03:44 -05:00
Bhavin Patel e185ca89ba Merge branch 'develop' into ransomwares3 2020-11-11 16:36:34 -08:00
Bhavin Patel 3aa06e82b6 Merge branch 'develop' into mustang_beta 2020-11-10 09:59:18 -08:00
bpatel 64bd08b5ff these macro files are not needed 2020-11-10 09:14:23 -08:00
P4T12ICK 1f3f1ae408 Merge branch 'develop' into mbjerkeland-develop 2020-11-10 09:24:55 +01:00
Shannon Davis 098aa9019a mods 2020-11-06 11:08:38 +11:00
P4T12ICK 8a66f8e175 changed macro 2020-11-05 09:18:37 +01:00
Mikael Bjerkeland 17502e4722 Added various Network Infrastructure detections based on the MITRE Network Matrix 2020-10-28 23:14:06 +01:00
Mikael Bjerkeland 7e068a5267 Added detection for T1020.001, Traffic Duplication 2020-10-28 21:51:33 +01:00
Mikael Bjerkeland d5c6d72361 . 2020-10-28 21:14:40 +01:00
Bhavin Patel 5e62272a68 Merge branch 'develop' into mustang_beta 2020-10-05 16:20:10 -07:00
jzsplunk 3c49885ad6 Merge branch 'develop' into TR-104-missing-input-filters 2020-10-02 08:01:15 -07:00
David Dorsey e30924013c single and double quote order issue 2020-09-23 17:32:52 -05:00
David Dorsey 42549c5776 Macro fixes 2020-09-23 17:22:02 -05:00
David Dorsey b681f5faa4 macro fixes 2020-09-23 17:16:35 -05:00
David Dorsey 5fbc68936b baseline update search fix with macros 2020-09-23 16:58:26 -05:00
Rico Valdez 359926e89b text updates and a couple of fixes for mismatched macros 2020-09-23 14:44:00 -06:00
David Dorsey 65403cc027 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 2020-09-23 11:36:15 -05:00
David Dorsey 2d25205146 Fixes 2020-09-23 11:35:56 -05:00
Jose Enrique Hernandez 7bd6f5380e Merge branch 'develop' into TR-41_aws_ec2_mods 2020-09-23 12:09:37 -04:00
David Dorsey 17eff649e7 Fixes 2020-09-21 23:23:57 -05:00
divious1 b78035c976 adding macros 2020-09-18 17:36:46 -04:00
jzsplunk c33be23f10 [TR-104] add missing input filters. 2020-09-15 22:59:19 -07:00
David Dorsey 9b785919de validate fixes 2020-09-10 21:22:34 -05:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
David Dorsey fc99713981 Translated detections/detect_spike_in_security_group_activity.yml 2020-09-09 01:36:26 -05:00
David Dorsey d588bbc8f6 Translated detect_spike_in_aws_api_activity.yml to use Change DM 2020-09-09 01:01:16 -05:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
David Dorsey 7b098cf836 fixed validate issues 2020-09-04 13:13:22 -05:00
David Dorsey dbfecd9e29 New analytic story for suspicious cloud user activities. 2020-09-04 10:30:47 -05:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e9939cbc98 new files for unblocked searches 2020-09-03 11:10:14 -06:00
Rico Valdez f7498459c8 changes for mustang 2020-09-02 10:21:52 -06:00
Jose Enrique Hernandez 1c1ce46004 Merge branch 'develop' into mbjerkeland-develop 2020-08-24 01:04:40 -04:00
David Dorsey 80860d37f4 Created manifests for unseen city, region, and country and updated 
logic to reflect each case
 2020-08-20 14:07:21 -05:00
David Dorsey 7de781c8f0 Manifest cleanup 2020-08-20 13:15:14 -05:00
David Dorsey b4ab45f299 Updated baseline searches for cloud provisioning activities. 
Broke them out into an initial search and update search
  Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
  relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
 2020-08-19 10:28:05 -05:00
David Dorsey 83d8ce47a5 Removed a few API calls that are not really modifications 2020-08-18 13:47:04 -05:00
Mikael Bjerkeland 897d25a7f8 Present times in ISO8601 instead of US style 2020-08-12 23:45:53 +02:00
Mikael Bjerkeland 289cec6fde Now validating? 2020-08-12 23:32:48 +02:00
Mikael Bjerkeland ff4cf63e3e Fixed up my mistakes. Should hopefully validate now 2020-08-12 23:26:57 +02:00
Mikael Bjerkeland d820c2d914 Retrying 2020-08-12 23:21:43 +02:00
Mikael Bjerkeland c12f8b2a6e Added ARP Poisoning Detection for Cisco Devices 2020-08-12 10:55:10 +02:00
Mikael Bjerkeland dd10e6e3cb Adding macros 2020-08-12 09:17:32 +02:00
bpatel 2f04c868e4 new detections for security hub alerts 2020-08-06 14:44:50 -07:00
Jose Enrique Hernandez 32e5fc5331 Merge branch 'develop' into F5_TMUI 2020-08-04 17:09:39 -04:00
bpatel 58f47148b9 ymls and updates 2020-08-04 14:04:38 -07:00