5cc8ae4e9a
Branch was auto-updated.
2022-09-14 09:48:48 -07:00
6de7c63503
Merge pull request #2367 from splunk/TR-2462
...
[TR-2462] _Time after _Time
2022-09-14 11:48:31 -05:00
c3dbf3e9e8
Branch was auto-updated.
2022-09-14 09:38:35 -07:00
56da34ba9f
Branch was auto-updated.
2022-09-14 09:38:18 -07:00
2dff497559
Merge pull request #2364 from splunk/TR-2458_adding_insider_threat_ba
...
tagging ba detection for insider threat
2022-09-14 11:37:37 -05:00
4c630e71c8
Branch was auto-updated.
2022-09-14 09:34:14 -07:00
f7f27b5e25
Branch was auto-updated.
2022-09-14 09:34:09 -07:00
8b12bcdec4
Branch was auto-updated.
2022-09-14 09:33:56 -07:00
2d44cfd223
Merge pull request #2370 from splunk/brute-ratel-1
...
name changes
2022-09-14 11:33:32 -05:00
28c46988f3
name changes
2022-09-14 11:31:40 -05:00
4668cc9367
Branch was auto-updated.
2022-09-14 09:24:44 -07:00
81f587dcb5
Branch was auto-updated.
2022-09-14 09:24:29 -07:00
836447fb09
Branch was auto-updated.
2022-09-14 09:24:22 -07:00
9e1fe81afe
Merge pull request #2340 from splunk/brute-ratel-1
...
brute-ratel-1
2022-09-14 11:23:59 -05:00
8b7db54a68
Update high_process_termination_frequency.yml
2022-09-14 11:18:03 -05:00
6ff76e699f
Branch was auto-updated.
2022-09-14 09:17:51 -07:00
23dd2542eb
Branch was auto-updated.
2022-09-14 09:17:48 -07:00
e5d3be9cc2
Branch was auto-updated.
2022-09-14 09:17:42 -07:00
5af60a2412
Branch was auto-updated.
2022-09-14 09:17:30 -07:00
3002e2e963
Merge pull request #2339 from splunk/TR-2390_Additional_Azure_Detections
...
Update Azure AD Account Takeover Analytic Story
2022-09-14 11:17:05 -05:00
1d4f5c6921
Update windows_gather_victim_identity_sam_info.yml
2022-09-14 14:43:13 +02:00
1093237e08
Branch was auto-updated.
2022-09-13 13:53:08 -07:00
f3e0313032
Branch was auto-updated.
2022-09-13 13:53:04 -07:00
4fe7e81c38
Branch was auto-updated.
2022-09-13 13:53:02 -07:00
f8d4b08af5
Branch was auto-updated.
2022-09-13 13:53:01 -07:00
51ef75aa2d
Branch was auto-updated.
2022-09-13 13:53:00 -07:00
940598b6c2
pass CI testing
2022-09-13 16:52:39 -04:00
8f15e2d351
Branch was auto-updated.
2022-09-13 10:12:28 -07:00
754583e5f5
Branch was auto-updated.
2022-09-13 10:12:27 -07:00
c4f53b7ae4
Branch was auto-updated.
2022-09-13 10:12:26 -07:00
12599b6566
Branch was auto-updated.
2022-09-13 10:12:24 -07:00
d792fcf09d
Branch was auto-updated.
2022-09-13 10:12:17 -07:00
64908593d4
adds RBA to correlation rule titles
2022-09-13 13:11:51 -04:00
6d1fe61568
Adding _time
2022-09-12 12:29:37 -05:00
e9e68ba82d
tagging ba detection for insider threat
2022-09-08 19:00:01 -04:00
7208f63c96
Branch was auto-updated.
2022-09-06 14:07:51 -07:00
e807d51570
Branch was auto-updated.
2022-09-06 14:07:50 -07:00
1be4026031
Branch was auto-updated.
2022-09-06 14:07:47 -07:00
ae92b16c0a
Merge pull request #2351 from splunk/fixdescriptionpt
...
addedwords
2022-09-06 14:07:21 -07:00
73e84a326d
fixedpathlog
2022-09-06 13:40:08 -07:00
385bc45c5d
Update windows_phishing_recent_iso_exec_registry.yml
2022-09-05 10:56:24 +02:00
2dc78584a0
Update windows_phishing_recent_iso_exec_registry.yml
2022-09-05 10:56:01 +02:00
cca076f667
Branch was auto-updated.
2022-09-02 19:15:41 -04:00
3880a4f1cf
Branch was auto-updated.
2022-09-02 19:15:38 -04:00
e701306956
Branch was auto-updated.
2022-09-02 19:15:35 -04:00
9894bf1583
Branch was auto-updated.
2022-09-02 19:15:34 -04:00
95e4eb048c
Merge pull request #2359 from splunk/fix_sourcetype_for_linux_kernel_module_detection
...
Update linux_kernel_module_enumeration.test.yml
Since this is such a small and simple fix, I have merged it myself without review.
Note that this was just an update to a test file, not a modification to the detection itself.
2022-09-02 19:15:12 -04:00
5c4d054652
Update linux_kernel_module_enumeration.test.yml
...
Changing sourcetype from linux_sysmon --> sysmon_linux
2022-09-02 18:50:48 -04:00
d764f48a29
Update windows_input_capture_using_credential_ui_dll.yml
2022-09-01 15:39:08 +02:00
8abf778411
Update windows_gather_victim_identity_sam_info.yml
2022-09-01 15:38:42 +02:00
pyth0n1c