20cb4400dc
Haag Story 3: Attack Analytics to the Rescue
...
"There's a snake in my Tomcat!"
When malicious serialized objects started showing up at Sunnyside Server Farm, Security Sheriff Haag rounded up a posse of new detections to keep the web applications safe.
This PR delivers:
- Two new best friends: tomcat_session_file_upload_attempt and tomcat_session_deserialization_attempt
- A brand new playset: "Apache Tomcat Session Deserialization Attacks" analytic story
- No more crying when the bad toys try to upload .session files
- The claw of justice comes down when suspicious JSESSIONID cookies appear
Remember what Security Ranger Haag always says: "To HTTP response codes and beyond!"
2025-03-25 14:08:02 -06:00
b186cc921e
Merge pull request #3409 from splunk/auto-ta-update-210
...
Automated Splunk TA Update 210
2025-03-24 15:03:24 -07:00
753cf9e3f5
Update linux_secure.yml
2025-03-20 09:42:10 -07:00
d3f6dc856d
Updated TAs
2025-03-20 06:58:09 +00:00
45838649b8
Merge pull request #3366 from splunk/remove_detections
...
Remove 151 Deprecated detections, stories, baselines, investigations - Github
2025-03-18 16:14:36 -07:00
011b33cb5b
Merge branch 'remove_detections' of https://github.com/splunk/security_content into remove_detections
2025-03-18 15:42:04 -07:00
58aca7db99
Update the deprecation_info.csv file, manually generated with a version of contentctl that has not yet been merged or released in main branch.
2025-03-18 15:41:21 -07:00
59b9657e4a
Merge branch 'develop' into remove_detections
2025-03-18 15:32:53 -07:00
7ba4dc0a4d
Merge pull request #3405 from splunk/risk_message
...
update spl
2025-03-18 15:22:18 -07:00
2f128036c1
Merge branch 'develop' into risk_message
2025-03-18 15:08:01 -07:00
df44136390
Merge pull request #3287 from delgado-jacob/datasource_enrichment
...
Add descriptions and Mitre components to data sources
2025-03-18 15:07:51 -07:00
ea3fa4daf6
updating search
2025-03-18 14:52:30 -07:00
4b70500f07
Merge remote-tracking branch 'origin/datasource_enrichment' into datasource_enrichment
2025-03-18 14:29:50 -07:00
6488af7c57
Add Zeek TA, fix detection source list
2025-03-18 14:29:30 -07:00
f096d77d6f
Changed the names of some fields due to the use of both deprecated and removed to refer to content in different stages of removal
2025-03-18 14:25:56 -07:00
b1d1ae90d9
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
0d2d727083
updating replace
2025-03-18 13:39:46 -07:00
ebe5db35ae
Merge branch 'develop' into datasource_enrichment
2025-03-18 12:55:17 -07:00
ad55d26fe4
add 'status: removed' instead of 'status: deprecated' to removed detections
2025-03-18 12:33:06 -07:00
5e0d59e186
bump version in prep for release
...
and so that deprecation stuff
works properly.
2025-03-18 12:07:47 -07:00
da5c9b9bbd
fix separator_value field
2025-03-18 11:37:35 -07:00
86e7863669
updating file name
2025-03-18 11:16:32 -07:00
6a53b8c61b
adding 2 splunk detections
2025-03-18 10:52:47 -07:00
030b038245
Merge branch 'develop' into remove_detections
2025-03-18 10:33:41 -07:00
505c176c62
Merge pull request #3403 from splunk/aws_output_improvements
...
output improvements
2025-03-18 09:13:01 -07:00
81e0801829
rerun CI
2025-03-18 13:55:20 +01:00
3122cbbc8b
output improvements
2025-03-18 12:56:30 +01:00
2d498dd311
Merge pull request #3401 from splunk/moar_5.2.0_fixes
...
integration fixes for 5.2.0
2025-03-18 08:03:18 +01:00
f04362d709
sort
2025-03-17 19:41:07 -07:00
3819c6864d
updating detections
2025-03-17 19:14:58 -07:00
ca86201823
adding 2 deprecated baselines
2025-03-17 18:28:42 -07:00
4d4a1c6649
adding cross account stuff
2025-03-17 18:19:56 -07:00
99a4b6fa4b
adding missing baselines
2025-03-17 18:09:42 -07:00
c345f920ed
adding gitkeep for empty folders
2025-03-17 18:04:26 -07:00
f672cb55c0
updating missing detections
2025-03-17 17:55:30 -07:00
1ad53e770f
Merge branch 'develop' into remove_detections
2025-03-17 17:29:49 -07:00
218ee15dcd
Merge pull request #3368 from nterl0k/nterl0k-T1552-sus-o365-searches
...
Nterl0k - T1552 Suspect o365 Searches
2025-03-17 17:29:33 -07:00
53b1928512
normalize quotes
2025-03-17 17:07:03 -07:00
bb134be861
Merge remote-tracking branch 'upstream/develop' into datasource_enrichment
2025-03-17 17:04:08 -07:00
276d45b485
Merge branch 'develop' into nterl0k-T1552-sus-o365-searches
2025-03-17 16:47:27 -07:00
77dfe52b89
Update macro
2025-03-17 16:44:09 -07:00
990b544271
Fixed spacing in improperly formatted YML file
2025-03-17 16:41:52 -07:00
f262a36557
Merge pull request #3363 from splunk/deprecated_mapping_update
...
Proposed format update for deprecation file
2025-03-17 16:06:01 -07:00
5dcad4a631
remove deprecated_date and
...
replacement_content if there is
no content defined
2025-03-17 15:35:21 -07:00
a24a2f0a1b
updating next batch to 5.4.0
2025-03-17 15:30:39 -07:00
89cc1aca90
replacement stories
2025-03-17 15:12:39 -07:00
7f3276c872
Merge branch 'develop' into remove_detections
2025-03-17 14:38:06 -07:00
81a16341a3
Revert "version updates"
...
This reverts commit 58d7d6052c
2025-03-17 14:28:53 -07:00
58d7d6052c
version updates
2025-03-17 13:25:49 -06:00
1b65d10a98
Merge pull request #3391 from splunk/auto-ta-update-204
...
Automated Splunk TA Update 204
2025-03-17 11:45:00 -07:00
Michael Haag