admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
16,959 Commits 697 Branches 195 Tags
149c19a6171c136155c1d72a2fcad2e681b60e21
Commit Graph

490 Commits

Author SHA1 Message Date
patel-bhavin 1e4b0353f8 search update 2022-08-12 12:46:25 -07:00
patel-bhavin 6969671bf9 Merge branch 'TR_2329_AWS_Credential_Access' of github.com:splunk/security_content into TR_2329_AWS_Credential_Access 2022-08-12 12:41:19 -07:00
patel-bhavin 24cd1afcb8 updatesusing datamodel 2022-08-12 12:34:02 -07:00
Bhavin Patel 1952b9773b Update aws_credential_access_getpassworddata.yml 2022-08-11 12:10:47 -07:00
patel-bhavin 8d25d3d27a getpassworddata 2022-08-10 16:03:18 -07:00
patel-bhavin 8b6df0a600 tagged other detections 2022-08-09 16:25:16 -07:00
gowthamarajr 758f91deea Edit file for aws rds password detection 2022-08-08 02:30:59 -04:00
gowthamarajr 3cc956cd99 Add AWS Credential Access detections 2022-08-08 01:47:33 -04:00
root c71b04a866 Updated detection files with recommended TA list. 2022-08-01 18:43:39 +00:00
patel-bhavin 114df09d78 meta updates 2022-07-28 14:18:45 -07:00
Bhavin Patel 1b645a499c Update azure_ad_successful_single_factor_authentication.yml 2022-07-28 14:12:18 -07:00
Bhavin Patel 95e47b7fd4 Update azure_ad_unusual_number_of_failed_authentications_from_ip.yml 2022-07-28 14:11:40 -07:00
Bhavin Patel 07290ffeb7 Update azure_ad_successful_powershell_authentication.yml 2022-07-28 14:08:32 -07:00
Bhavin Patel 42241b1b2e Update azure_ad_multiple_users_failing_to_authenticate_from_ip.yml 2022-07-28 14:07:47 -07:00
Bhavin Patel 72d0a37a12 Update azure_ad_authentication_failed_during_mfa_challenge.yml 2022-07-28 14:05:57 -07:00
Bhavin Patel f22813da22 Update azure_active_directory_high_risk_sign_in.yml 2022-07-28 14:05:14 -07:00
pyth0n1c 53fb29f36e Branch was auto-updated. 2022-07-28 13:11:00 -07:00
Michael Haag 508424da99 Updates 2022-07-28 12:07:05 -06:00
patel-bhavin a78c180836 file update 2022-07-26 17:21:56 -07:00
patel-bhavin 8672c8d824 security sercvices deleteion activities 2022-07-26 16:54:42 -07:00
patel-bhavin 7eea768cde new detection putbucket lifecycle 2022-07-25 16:29:57 -07:00
Bhavin Patel c55b3ed7e0 Merge pull request #2287 from splunk/TR-2222 
AWS Defense Evasion Stop Logging Cloudtrail
 2022-07-25 10:48:37 -07:00
gowthamarajr 21172c6ede update SPL 2022-07-19 15:08:43 -04:00
gowthamarajr 56364e9e05 Update References 2022-07-19 12:21:01 -04:00
gowthamarajr c2decc3b9c Add AWS defense evasion 
1. Update Cloudtrail
2. Delete CloudWatch log group
 2022-07-19 11:56:41 -04:00
Michael Haag c9b348b06f Added rename 2022-07-19 08:50:07 -06:00
mvelazco fee335e73d renaming analytic story 2022-07-14 16:44:33 -04:00
mvelazco d6dd5098be adding new detection 2022-07-14 13:29:55 -04:00
patel-bhavin 5bf8a69beb delete cloudtrail 2022-07-13 12:49:43 -07:00
mvelazco b615728924 fixing file path 2022-07-13 14:38:13 -04:00
mvelazco f666632017 update description 2022-07-13 14:23:38 -04:00
mvelazco 7807c66f73 adding new detection 2022-07-13 14:16:09 -04:00
patel-bhavin 0c7efe362c message 2022-07-12 18:27:39 -07:00
patel-bhavin 92d6b653bc mionr 2022-07-12 17:50:38 -07:00
patel-bhavin 9756e681f7 aws cloudtrail stop logging 2022-07-12 17:47:58 -07:00
mvelazco 18aa9f2e7a adding new detection 2022-07-12 18:03:26 -04:00
mvelazco f8e28dde20 adding new detection 2022-07-12 13:54:32 -04:00
mvelazco 797455e17f updating filter macro 2022-07-12 11:41:45 -04:00
mvelazco 45ee82ff9e fixing macro 2022-07-12 10:26:48 -04:00
mvelazco ba163055eb adding 2 detections 2022-07-11 17:29:18 -04:00
pyth0n1c d40ca09d61 Merged develop into content_changer_improvements to resolve merge conflict. this was making it impossible to merge the PR in the GitHub Interface. 2022-06-23 14:19:17 -07:00
pyth0n1c 35908f5a30 Removed user from the stats call of this search 
since it does not exist and the field userName
does exist.  And it is likely to have captured
the same data.
 2022-06-21 16:25:20 -07:00
pyth0n1c 7816778eae Removed the field "user" from the stats 
line.  It does not appear to exist in the raw
data and is not pulled into any field(s).
However, there is a field called userName
which, presumably, represents the same data.
 2022-06-21 15:45:00 -07:00
pyth0n1c c16ccc1eec Branch was auto-updated. 2022-05-19 21:21:59 -04:00
d1vious 441ddacfb3 adding insider threat, fixing minor display bug 2022-05-19 21:19:35 -04:00
pyth0n1c f47a96e452 Branch was auto-updated. 2022-05-18 15:51:07 -04:00
patel-bhavin aa4499a050 minor grammar fixes 2022-05-18 12:31:41 -07:00
patel-bhavin 4d4a4767d7 search, data and yml updates 2022-05-17 17:36:49 -07:00
pyth0n1c 0591cf421e Branch was auto-updated. 2022-05-16 15:09:33 -04:00
patel-bhavin aa13247897 update detection yml 2022-05-10 15:25:55 -07:00