admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,526 Commits 697 Branches 195 Tags
0bb0ad9b7ebff8c5e1f345fcbcfd4e82b91e693f
Commit Graph

124 Commits

Author SHA1 Message Date
David Dorsey 65403cc027 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 2020-09-23 11:36:15 -05:00
David Dorsey 2d25205146 Fixes 2020-09-23 11:35:56 -05:00
Jose Enrique Hernandez 7bd6f5380e Merge branch 'develop' into TR-41_aws_ec2_mods 2020-09-23 12:09:37 -04:00
David Dorsey 17eff649e7 Fixes 2020-09-21 23:23:57 -05:00
divious1 b78035c976 adding macros 2020-09-18 17:36:46 -04:00
David Dorsey 9b785919de validate fixes 2020-09-10 21:22:34 -05:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
David Dorsey fc99713981 Translated detections/detect_spike_in_security_group_activity.yml 2020-09-09 01:36:26 -05:00
David Dorsey d588bbc8f6 Translated detect_spike_in_aws_api_activity.yml to use Change DM 2020-09-09 01:01:16 -05:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
David Dorsey 7b098cf836 fixed validate issues 2020-09-04 13:13:22 -05:00
David Dorsey dbfecd9e29 New analytic story for suspicious cloud user activities. 2020-09-04 10:30:47 -05:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e9939cbc98 new files for unblocked searches 2020-09-03 11:10:14 -06:00
Rico Valdez f7498459c8 changes for mustang 2020-09-02 10:21:52 -06:00
Jose Enrique Hernandez 1c1ce46004 Merge branch 'develop' into mbjerkeland-develop 2020-08-24 01:04:40 -04:00
David Dorsey 80860d37f4 Created manifests for unseen city, region, and country and updated 
logic to reflect each case
 2020-08-20 14:07:21 -05:00
David Dorsey 7de781c8f0 Manifest cleanup 2020-08-20 13:15:14 -05:00
David Dorsey b4ab45f299 Updated baseline searches for cloud provisioning activities. 
Broke them out into an initial search and update search
  Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
  relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
 2020-08-19 10:28:05 -05:00
David Dorsey 83d8ce47a5 Removed a few API calls that are not really modifications 2020-08-18 13:47:04 -05:00
Mikael Bjerkeland 897d25a7f8 Present times in ISO8601 instead of US style 2020-08-12 23:45:53 +02:00
Mikael Bjerkeland 289cec6fde Now validating? 2020-08-12 23:32:48 +02:00
Mikael Bjerkeland ff4cf63e3e Fixed up my mistakes. Should hopefully validate now 2020-08-12 23:26:57 +02:00
Mikael Bjerkeland d820c2d914 Retrying 2020-08-12 23:21:43 +02:00
Mikael Bjerkeland c12f8b2a6e Added ARP Poisoning Detection for Cisco Devices 2020-08-12 10:55:10 +02:00
Mikael Bjerkeland dd10e6e3cb Adding macros 2020-08-12 09:17:32 +02:00
bpatel 2f04c868e4 new detections for security hub alerts 2020-08-06 14:44:50 -07:00
Jose Enrique Hernandez 32e5fc5331 Merge branch 'develop' into F5_TMUI 2020-08-04 17:09:39 -04:00
bpatel 58f47148b9 ymls and updates 2020-08-04 14:04:38 -07:00
bpatel 63f266629e porting ymls into a newe PR 2020-08-04 12:55:12 -07:00
divious1 322697fdd0 more renames base on upper case 2020-06-29 17:39:38 -04:00
David Dorsey 8438bf71e8 Fixed the first time previously seen windows service search to work 
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update

Made the default deployment template be -70m@m to -10m@m

Added a new deployment template for hourly baseline caches
 2020-06-25 00:09:30 -05:00
Bhavin Patel 3c8c201add Merge branch 'develop' into CRL-1766-auth-dm-updates 2020-06-16 10:46:20 -07:00
divious1 56ccf11ea0 this should be false 2020-06-09 17:58:39 -04:00
bpatel 37199617b3 updating macro filters 2020-06-08 17:12:15 -07:00
bpatel 35c4b110bc Merge branch 'develop' into azuretest 2020-06-04 11:06:04 -07:00
bpatel 9f2710bfde updating files to make sure validate passes 2020-06-03 13:10:30 -07:00
bpatel 72d3ab875e converted to spec3 and other updates 2020-05-28 13:31:49 -07:00
Rod Soto 50f3fdbbee kubectlcalls 2020-05-26 23:42:26 -04:00
Rod Soto 46803f5ea0 svacconpodnasp 2020-05-26 23:16:07 -04:00
Rod Soto 1bbc7d1728 fixedanemsaddedservaccount 2020-05-26 22:40:16 -04:00
Rod Soto 8e44ca15ca RBACauth 2020-05-26 22:18:16 -04:00
Rod Soto 6086fa8e2b azk8srolesto 2020-05-21 18:41:32 -04:00
Rod Soto 2e7d50b6d0 newstoryconfsecazk8s 2020-05-20 19:09:29 -04:00
Rod Soto 0748085eca azpodscandetect 2020-05-20 15:38:53 -04:00
Rod Soto 4ac5dc4dff k8sScan 2020-05-19 17:55:28 -04:00
Patrick Bareiss cda505d8fa new generate script 2020-05-06 17:42:38 +02:00
Patrick Bareiss cc464c87db updated content 2020-05-05 12:58:56 +02:00
Patrick Bareiss 909806896e validate script 2020-04-30 16:52:38 +02:00
Patrick Bareiss 442a575e1d WIP validate script 2020-04-30 15:51:16 +02:00