4bd7eae3c8
Removed unused file
2020-09-15 20:15:27 -07:00
181f810dbb
Updated cloud instances destroyed to change data model
2020-09-15 20:15:23 -07:00
1f56396028
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-09-14 14:11:02 -07:00
6fd7b6ef2f
more updates
2020-09-14 14:11:02 -07:00
aedfc4e837
Created manifests for unseen city, region, and country and updated
...
logic to reflect each case
2020-09-14 14:11:02 -07:00
56d0abdc31
Manifest cleanup
2020-09-14 14:11:01 -07:00
2f1f96c804
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-09-14 14:11:01 -07:00
e042b84f82
work in progress file
2020-09-14 14:11:01 -07:00
3c5f75c452
Removed a few API calls that are not really modifications
2020-09-14 14:11:01 -07:00
481fb128c6
new files for translated detections
2020-09-14 14:11:01 -07:00
bb5384564a
new files - not finalized
2020-09-14 14:11:01 -07:00
60456b9e9a
some translated searches for change DM
2020-09-14 14:11:01 -07:00
2fadf948da
Merge pull request #630 from splunk/TR-82-risk-tagging
...
[TR-82] add in logic for risk tagging after synching with ESCU requirements
2020-09-10 12:23:59 -04:00
8daac1602b
Merge branch 'TR-82-risk-tagging' of github.com:splunk/security-content into TR-82-risk-tagging
2020-09-10 12:17:26 -04:00
9bfc5f9f4e
updated spec docs and also added one more example
2020-09-10 12:17:21 -04:00
c76fc34e3f
Merge branch 'develop' into TR-82-risk-tagging
2020-09-09 23:33:03 -04:00
f76e66d184
Merge pull request #659 from splunk/dependabot/pip/pyrsistent-0.17.2
2020-09-09 09:47:32 +00:00
8d1b7e1395
Bump pyrsistent from 0.17.1 to 0.17.2
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.17.1 to 0.17.2.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.17.1...v0.17.2 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-09 09:42:22 +00:00
9cdc721ad6
Merge pull request #656 from splunk/dependabot/pip/pyrsistent-0.17.1
2020-09-09 07:36:36 +00:00
027b8ce1a1
Bump pyrsistent from 0.17.0 to 0.17.1
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.17.0 to 0.17.1.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.17.0...v0.17.1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-09 07:31:42 +00:00
83a35dcc65
Merge pull request #655 from splunk/dependabot/pip/pyrsistent-0.17.0
2020-09-08 19:42:40 +00:00
c8a4d57195
Bump pyrsistent from 0.16.0 to 0.17.0
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.16.0 to 0.17.0.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.16.0...v0.17.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-08 19:38:00 +00:00
19f3778dda
Merge branch 'develop' into TR-82-risk-tagging
2020-09-08 09:52:12 -07:00
66f74754f6
Merge pull request #646 from splunk/update_test_files
...
updated test files
2020-09-07 13:27:51 +02:00
3e0cfa84cb
updated test files
2020-09-07 13:18:03 +02:00
8400f241ca
Merge pull request #642 from splunk/dependabot/pip/identify-1.5.0
2020-09-05 19:41:11 +00:00
e6d5e4eda7
Bump identify from 1.4.30 to 1.5.0
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.30 to 1.5.0.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.30...v1.5.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-05 19:34:10 +00:00
8361e993be
Merge pull request #641 from splunk/dependabot/pip/attrs-20.2.0
2020-09-05 10:43:31 +00:00
443de49218
Bump attrs from 20.1.0 to 20.2.0
...
Bumps [attrs](https://github.com/python-attrs/attrs ) from 20.1.0 to 20.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases )
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/python-attrs/attrs/compare/20.1.0...20.2.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-05 10:37:59 +00:00
637ec487df
risk validation
2020-09-03 11:30:09 -07:00
20b1130737
Merge branch 'TR-82-risk-tagging' of https://github.com/splunk/security-content into TR-82-risk-tagging
2020-09-03 11:10:26 -07:00
11db020423
risk validation
2020-09-03 11:09:52 -07:00
ee38b1d8cd
[TR-82] reset markdown to whats in develop.
2020-09-02 12:07:14 -07:00
367dd69bd7
generate testing
2020-09-02 11:07:08 -07:00
1fac31b330
[TR-82] reset markdown to whats in develop.
2020-09-02 10:44:22 -07:00
0db46f89dc
[TR-82] first cut of validation logic for risk scoring.
2020-09-01 17:55:14 -07:00
5efea5eb85
Merge branch 'develop' into TR-82-risk-tagging
2020-09-01 17:12:21 -07:00
e3633953d9
Merge pull request #634 from splunk/dependabot/pip/identify-1.4.30
2020-09-01 07:56:09 +00:00
77e2a8e22d
Bump identify from 1.4.29 to 1.4.30
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.29 to 1.4.30.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.29...v1.4.30 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-01 07:51:15 +00:00
6456cb2449
Merge pull request #633 from splunk/dependabot/pip/more-itertools-8.5.0
2020-08-28 18:51:17 +00:00
9d3694b18e
Bump more-itertools from 8.4.0 to 8.5.0
...
Bumps [more-itertools](https://github.com/more-itertools/more-itertools ) from 8.4.0 to 8.5.0.
- [Release notes](https://github.com/more-itertools/more-itertools/releases )
- [Commits](https://github.com/more-itertools/more-itertools/compare/v8.4.0...8.5.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-08-28 18:45:53 +00:00
a2688815db
Merge branch 'develop' into TR-82-risk-tagging
2020-08-27 16:48:15 -04:00
346fcc2a18
updating docs and package bits [ci skip]
2020-08-27 18:42:27 +00:00
2a13216059
Merge pull request #625 from splunk/coverage_update
...
updated both maps fixed errors with coverage
2020-08-25 11:31:23 -07:00
ac69800ab4
Merge branch 'develop' into coverage_update
2020-08-25 11:26:03 -07:00
f58ded02dc
Merge branch 'develop' into TR-82-risk-tagging
2020-08-25 09:44:32 -07:00
463f218ef9
Merge pull request #619 from splunk/PR_609
...
Pr 609
2020-08-25 12:19:00 -04:00
a66740b506
Merge branch 'develop' into PR_609
2020-08-25 12:13:24 -04:00
00653ac542
Merge pull request #623 from splunk/fixawsk8sfailuresrcuser
...
newfixawsdetectpkey
2020-08-24 12:47:10 -07:00
3097f4e692
[TR-82] cleanup spec markdown for new risk params.
2020-08-24 10:34:09 -07:00
David Dorsey