74ea79b419
Update windows_powershell_import_applocker_policy.yml
2022-07-11 11:55:12 +02:00
e5d2e9f6f3
Update windows_impair_defense_add_xml_applocker_rules.yml
2022-07-11 11:54:52 +02:00
c0b848d43c
Update windows_remote_access_software_rms_registry.yml
2022-07-11 11:54:20 +02:00
4e730e5ace
Branch was auto-updated.
2022-07-07 17:12:21 -07:00
8f0e5be32d
Merge pull request #2279 from splunk/retry_failed_detections_in_cicd
...
Small changes to CI/CD detection testing system. We merge these in now so that we can examine the results of the nightly scheduled run.
2022-07-07 17:11:56 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
d90dc8100c
Branch was auto-updated.
2022-07-07 17:08:07 -07:00
4bae19f854
Merge pull request #2277 from splunk/contentctl_inmemory_cache_and_bugfix
...
Minor changes that we want to be in effect for tonight's CI/CD Scheduled Run. These changes have been tested locally and look good. If there are any issues, we can roll back this PR.
2022-07-07 17:07:40 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
8ed9372401
On CVESearch API failure, added a
...
brief sleep to allow the API to
begin working again before trying
to resolve it again.
2022-07-07 14:40:39 -07:00
80af56d397
Fixing the rare case where enrichment fails
...
due to CVESearch API failure, causing the
entire workflow to fail. Now, we will retry
enrichment up to a total of 3 times. This should
virtually eliminate all CVE Enrichment failures.
If they do still occur, we will receive a
descriptive message indicating why there was
a failure instead of the cryptic message
that we were getting before.
2022-07-07 14:33:57 -07:00
024a9811a0
Branch was auto-updated.
2022-07-07 09:47:20 -07:00
236ea67d30
Merge pull request #2270 from splunk/TR-2210_Edit_Windows_PowerView_Kerberos_Service_Ticket_Request
...
Edit windows_powerview_kerberos_service_ticket_request detection
2022-07-07 12:47:00 -04:00
eb29bc04f6
Branch was auto-updated.
2022-07-07 08:12:34 -07:00
1f4af38d5e
Branch was auto-updated.
2022-07-07 08:12:33 -07:00
e0f43b02f4
Merge pull request #2274 from splunk/fix-join-issue
...
fix-join-issue
2022-07-07 11:12:09 -04:00
f28fbb6c54
fix-join-issue
2022-07-07 17:01:52 +02:00
169739041d
Branch was auto-updated.
2022-07-07 07:56:45 -07:00
2148b9b053
Branch was auto-updated.
2022-07-07 07:56:43 -07:00
61a698f574
Merge pull request #2273 from splunk/mispelling_in_lookup
...
Update security_services.csv
2022-07-07 10:56:19 -04:00
9cc85a614f
Update security_services.csv
2022-07-07 10:43:17 -04:00
0ed61a57f4
Edit the search SPL
...
Edit the search SPL of windows_powerview_kerberos_service_ticket_request
2022-07-01 17:12:05 -04:00
9689073946
Edit windows_powerview_kerberos_service_ticket_request detection
...
Edit the windows_powerview_kerberos_service_ticket_request detection to support xml logs
2022-07-01 16:24:42 -04:00
aca6fba26f
azorult-bomb2
2022-07-01 10:17:53 +02:00
fd5597767b
azorult-bomb2
2022-07-01 09:59:12 +02:00
52abbc9408
Changing enrichment failures from
...
error prints to error prints AND
failures.
2022-06-30 15:47:29 -07:00
cb1ba3c884
Added slightly more verbose printing
...
to track high-level progress in CICD.
2022-06-30 11:12:50 -07:00
45736b5ed7
Updated CI/CD Workflow and
...
python code in contentctl so that
progress update are not output
when running in CICD environment.
Outputting all of this data
causes thousands of lines of output
logs to be generated in CICD.
This info is only relevant when
running locally in a tty.
2022-06-30 10:52:00 -07:00
790e77e380
azorult-bomb2
2022-06-30 12:41:27 +02:00
d3e6627d26
azorult-bomb2
2022-06-30 12:36:22 +02:00
8b7f7d20eb
in-memory optimization for fetching CVE enrichment and app enrichment, even if skip_enrichment or cached_and_offline are disabled.
2022-06-29 16:53:17 -07:00
aeceacc737
updating docs and package bits [ci skip]
2022-06-29 21:25:28 +00:00
5dd3e34604
Branch was auto-updated.
2022-06-29 12:59:30 -07:00
d060bfd5db
Merge pull request #2192 from splunk/content_changer_improvements
...
Content changer improvements and Stale Reference Updates
2022-06-29 12:59:06 -07:00
83bbfce55a
Branch was auto-updated.
2022-06-29 11:55:55 -07:00
0fd1792d7b
Branch was auto-updated.
2022-06-29 11:55:54 -07:00
73ea092e8d
Merge pull request #2267 from splunk/deprecate_TR-2160_deprecated_complex_test_files
...
removing test files
2022-06-29 11:55:32 -07:00
b75b56b81d
removing test files
2022-06-29 14:18:47 -04:00
0fac306bbc
azorult-bomb2
2022-06-29 11:15:09 +02:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
ea26b98186
Branch was auto-updated.
2022-06-28 15:14:00 -07:00
b9d4ef1b3b
Branch was auto-updated.
2022-06-28 15:13:58 -07:00
1d036b3af5
Merge pull request #2265 from splunk/DM_updates
...
Added Datamodel values
2022-06-28 15:13:30 -07:00
8a79086933
Missed one
2022-06-28 16:01:51 -05:00
9290c8c03d
Updated DM and fields
2022-06-28 14:59:51 -05:00
12b174f7d7
Changed to Network_Traffic, joining on process_id
2022-06-28 14:53:32 -05:00
08dd21f4d8
Branch was auto-updated.
2022-06-28 11:33:24 -07:00
ce7b96b31c
Branch was auto-updated.
2022-06-28 11:33:23 -07:00
a11c62e121
Branch was auto-updated.
2022-06-28 11:33:22 -07:00
tccontre