42dd0ae6ed
Forgot to change a path in test file
2023-02-14 09:06:16 -08:00
eb124998c7
fixed name
2023-02-14 08:46:33 -08:00
7679202115
fixing bad dataset link
2023-02-14 08:38:07 -08:00
9d595cf451
added dataset links
2023-02-14 08:21:48 -08:00
e6c5fbd101
added all detections for release, still need to update dataset links
2023-02-14 06:46:13 -08:00
8583fe64f8
Branch was auto-updated.
2023-02-06 15:57:35 -08:00
60ea283f53
Moving failing tests to experimental
2023-02-02 16:32:24 -08:00
5c81a87b51
fixedsourcetype
2023-02-01 17:08:13 -08:00
2fafe9c0f4
fixedtestfilesourcetype
2023-02-01 16:57:19 -08:00
4351d385d0
Moved detection and test files from production to experimental
2022-11-02 10:02:17 -07:00
f5eaa40534
Changed media.githubusercontent
...
to raw.githubusercontent links
2022-11-02 09:02:30 -07:00
689277d6ee
Added a number of macros, tests, and detections in support of release of Splunk vulnerabilities and patches.
2022-11-01 08:12:14 -07:00
73e84a326d
fixedpathlog
2022-09-06 13:40:08 -07:00
19f3a3b982
fixing on all places
2022-08-16 15:01:56 -04:00
b7e1a5fe94
adding new detections
2022-08-16 11:30:24 -04:00
cb150c258e
minor edits for yml validation and test file name update
2022-06-23 15:21:30 -07:00
8d568ae416
model to detect risky commands
2022-06-23 22:43:22 +02:00
ad2ae86220
Branch was auto-updated.
2022-06-22 10:19:35 -07:00
67f35bba10
model to detect risky commands
2022-06-22 16:39:33 +02:00
b73ea9e5ae
Added another custom_index to a test
...
file that was failing because it did not
have one.
2022-06-21 16:59:44 -07:00
b5c79b6db8
Added a custom index for a detection test
...
that was created when custom_index
support did not yet exist.
2022-06-21 15:53:26 -07:00
0cf536acd5
fix path error
2022-06-14 20:13:42 -07:00
9a266a78ee
update per review comments
2022-06-13 15:33:12 -07:00
5a34e6c633
add risky command abuse ML detection
2022-06-13 10:53:09 -07:00
d5c65edc6a
Branch was auto-updated.
2022-06-13 10:41:17 -07:00
3369d15d72
rm wrong commit
2022-06-13 10:40:47 -07:00
d5fa5ddc0b
Branch was auto-updated.
2022-06-13 09:51:47 -07:00
6efcbd4b93
add risky command ML detection
2022-06-13 09:50:58 -07:00
c538613139
wrong detection file linked from
...
test file. Fixed.
2022-06-08 16:47:56 -07:00
b87dff2883
Fixing name field in a detection
...
test file
2022-06-08 16:01:21 -07:00
10b2b29122
Adding appropriate custom_index to detection
...
and fixing naming error and file_name error
2022-06-08 12:14:46 -07:00
47cd84d377
Wrong sourcetype declared in one
...
of the test files, causing it to fail.
Fixed missing backticks on some
macros.
2022-06-08 11:46:42 -07:00
e8abbd916b
Added missing _internal custom_indexes
...
to relevant test files. Removed the |
character from searches that use
index and sourcetype macros at the
beginning of the search.
2022-06-08 11:08:21 -07:00
3fb342d4c4
Fixed improperly named macro.
...
Renamed the macro in the tests
that use that macro. Added the
optional field, "custom_index"
to the test files which MUST
upload data into the _audit
index. This branch doesn't
support custom_index yet,
but those changes will be merged
soon from another branch.
2022-06-08 10:31:53 -07:00
926e63649a
delete usage
2022-05-27 14:41:34 -06:00
fb25e4def0
Splunk Command and Scripting Interpreter Risky Commands
2022-05-26 11:38:35 -06:00
21d5a68dd9
Splunk Command and Scripting Interpreter Risky Commands
2022-05-26 11:28:08 -06:00
7d2a728085
anomaly for non TLS forwarders
2022-05-26 12:21:20 -05:00
4b7bfb516a
terge branch 'vj9r' of github.com:splunk/security_content into vj9r
2022-05-26 10:00:24 -07:00
522e569ced
splkselfsigneddetection
2022-05-26 09:58:07 -07:00
92037c5992
deployment server
2022-05-26 11:39:00 -05:00
a766811c56
0602 hunt
2022-05-26 10:32:09 -05:00
39ee01a256
datasetx
2022-05-26 08:04:57 -07:00
f29d6f9920
renamedsearch
2022-05-26 07:44:46 -07:00
b9d79c5ab1
changednameofdetection
2022-05-26 07:25:17 -07:00
7bd8441806
Adding test, random data since irrelevant to detection
2022-05-25 13:55:43 -05:00
b51c088513
Fixing typo
2022-05-25 10:55:42 -05:00
99d314eeea
initialsearchskeleton
2022-05-24 17:29:15 -07:00
6fe602533b
Removed detection
2022-05-02 14:30:43 -05:00
a71f12b921
Merge branch 'TR-1828' of github.com:splunk/security_content into TR-1828
2022-04-29 10:18:39 -07:00
pyth0n1c