 Teoderick Contreras
|
7939d2fa83
|
headless_bee
|
2025-02-24 11:52:22 +01:00 |
|
|
Teoderick Contreras
|
f05c6278a2
|
headless_bee
|
2025-02-21 14:04:06 +01:00 |
|
|
Teoderick Contreras
|
265cd83413
|
headless_bee
|
2025-02-21 13:26:44 +01:00 |
|
|
Br3akp0int
|
1eb8731869
|
Update detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-20 18:20:23 +01:00 |
|
|
Br3akp0int
|
2e9bc86983
|
Update detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-20 18:20:13 +01:00 |
|
|
Br3akp0int
|
26cb0921d4
|
Update detections/endpoint/windows_anonymous_pipe_activity.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-20 18:19:42 +01:00 |
|
|
Br3akp0int
|
4e6b095129
|
Update detections/endpoint/executables_or_script_creation_in_temp_path.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-02-20 18:19:32 +01:00 |
|
|
Nasreddine Bencherchali
|
c919c43a3e
|
Merge branch 'develop' into headless_bee
|
2025-02-19 17:40:37 +01:00 |
|
|
Bhavin Patel
|
dbede3bfec
|
Merge pull request #3299 from splunk/tr-3997
TR-3997 - New Content - auditpol and audit policy tampering analytics
|
2025-02-19 08:31:27 -08:00 |
|
|
Nasreddine Bencherchali
|
659a9a8b32
|
remove overlapping tagging
|
2025-02-19 11:26:50 +01:00 |
|
|
Bhavin Patel
|
2ab27cd8c5
|
Update suspicious_event_log_service_behavior.yml
|
2025-02-19 11:22:59 +01:00 |
|
|
Nasreddine Bencherchali
|
6f1d3e6fa6
|
Create windows_audit_policy_disabled_via_legacy_auditpol.yml
|
2025-02-19 11:22:59 +01:00 |
|
|
Nasreddine Bencherchali
|
ae708a0649
|
fix: rename analytic to comply with tests
|
2025-02-19 11:22:59 +01:00 |
|
|
Nasreddine Bencherchali
|
d66f4e00d9
|
Update windows_audit_policy_auditing_option_modified__registry.yml
|
2025-02-19 11:22:58 +01:00 |
|
|
Nasreddine Bencherchali
|
4e22f53684
|
feat: add 2 additional analytics related to auditing option modification
|
2025-02-19 11:22:58 +01:00 |
|
|
Nasreddine Bencherchali
|
c952f7b1a0
|
fix: remove unnecessary tests
|
2025-02-19 11:22:58 +01:00 |
|
|
Nasreddine Bencherchali
|
6b6d45831d
|
Update windows_event_logging_service_has_shutdown.yml
|
2025-02-19 11:22:58 +01:00 |
|
|
Nasreddine Bencherchali
|
9925f0d78c
|
Update windows_audit_policy_tampering.yml
|
2025-02-19 11:22:57 +01:00 |
|
|
Nasreddine Bencherchali
|
abfbe7a3c7
|
Update windows_event_logging_service_has_shutdown.yml
|
2025-02-19 11:22:57 +01:00 |
|
|
Nasreddine Bencherchali
|
1dfb2597c2
|
fix: update titles
|
2025-02-19 11:22:57 +01:00 |
|
|
Nasreddine Bencherchali
|
805d75c84d
|
fix: deprecate 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40
|
2025-02-19 11:22:56 +01:00 |
|
|
Nasreddine Bencherchali
|
ba36467ece
|
feat: add new analytic story and analytic
|
2025-02-19 11:22:18 +01:00 |
|
|
Nasreddine Bencherchali
|
c16e7a1a74
|
feat: add auditpol macro
|
2025-02-19 11:22:18 +01:00 |
|
|
Nasreddine Bencherchali
|
dba521c8e8
|
feat: add new auditpol related analytics
|
2025-02-19 11:22:17 +01:00 |
|
|
Bhavin Patel
|
c2eb1a26c9
|
Merge pull request #3321 from nterl0k/nterl0k-t1486-bitlocker-sus-commands
Nterl0k - T1486 BitLocker Suspicious Commands
|
2025-02-18 17:43:17 -08:00 |
|
|
Bhavin Patel
|
50c22c96c5
|
Merge branch 'develop' into nterl0k-t1486-bitlocker-sus-commands
|
2025-02-18 17:27:06 -08:00 |
|
|
Bhavin Patel
|
e11b63161c
|
Merge pull request #3344 from splunk/fix_dashboard_dropdown_match
change match to two underscores
|
2025-02-18 16:36:57 -08:00 |
|
|
pyth0n1c
|
3782565aa6
|
Merge branch 'develop' into fix_dashboard_dropdown_match
|
2025-02-18 16:30:45 -08:00 |
|
|
pyth0n1c
|
87a2970ca9
|
Merge pull request #3341 from splunk/fix_datasource_typos
Fix data_source fields on some content
|
2025-02-18 16:29:51 -08:00 |
|
|
pyth0n1c
|
2ae421d724
|
Merge branch 'develop' into fix_datasource_typos
|
2025-02-18 16:24:39 -08:00 |
|
|
pyth0n1c
|
41f65e0bc7
|
change match to two underscroes
|
2025-02-18 15:26:17 -08:00 |
|
|
Bhavin Patel
|
a33941597e
|
Merge pull request #3276 from nterl0k/nterl0k-t1059-malicious-powershell-strings
Nterl0k - T1059 - Generic Malicious Powershell Strings + Lookup
|
2025-02-18 13:40:10 -08:00 |
|
|
Bhavin Patel
|
f0d6c48267
|
Merge branch 'develop' into nterl0k-t1059-malicious-powershell-strings
|
2025-02-18 13:20:11 -08:00 |
|
|
Bhavin Patel
|
ebe37bb3fa
|
Merge pull request #3342 from splunk/show_dashboards_dropdown
Show dashboard objects in dropdown
|
2025-02-18 11:48:53 -08:00 |
|
|
Bhavin Patel
|
13faf1ca7e
|
Merge branch 'develop' into show_dashboards_dropdown
|
2025-02-18 10:48:45 -08:00 |
|
|
Bhavin Patel
|
90d46c5e28
|
Merge pull request #3303 from splunk/other-updates
Update Lookups & Windows EventLog Macros
|
2025-02-18 10:40:21 -08:00 |
|
|
Bhavin Patel
|
2c7fd2925f
|
Merge branch 'develop' into other-updates
|
2025-02-18 10:37:45 -08:00 |
|
|
Bhavin Patel
|
b9de911601
|
Merge branch 'develop' into show_dashboards_dropdown
|
2025-02-18 10:16:40 -08:00 |
|
|
Bhavin Patel
|
099682f93f
|
Merge pull request #3194 from splunk/data_source_improvements_2
Data Source mapping improvements
|
2025-02-18 10:02:21 -08:00 |
|
|
pyth0n1c
|
1a7653bb26
|
fix docs link
|
2025-02-18 09:32:59 -08:00 |
|
|
Bhavin Patel
|
47c2f4fc20
|
Merge branch 'develop' into other-updates
|
2025-02-18 09:22:56 -08:00 |
|
|
Bhavin Patel
|
151bbe05dc
|
Merge branch 'develop' into data_source_improvements_2
|
2025-02-18 09:02:02 -08:00 |
|
|
Bhavin Patel
|
a11c4b1655
|
Merge pull request #3306 from splunk/app_dynamics_alerts
Cisco Secure Application Alerts
|
2025-02-18 08:58:42 -08:00 |
|
|
pyth0n1c
|
8902d8c09e
|
fix datasource reference in
detection.
|
2025-02-18 08:58:19 -08:00 |
|
|
Bhavin Patel
|
3a5f6d613e
|
Merge branch 'develop' into app_dynamics_alerts
|
2025-02-18 08:30:01 -08:00 |
|
|
Bhavin Patel
|
9ae1c7acff
|
kfp
|
2025-02-18 08:13:55 -08:00 |
|
|
Patrick Bareiss
|
d03cb62686
|
Merge branch 'data_source_improvements_2' of github.com:splunk/security_content into data_source_improvements_2
|
2025-02-18 09:13:25 +01:00 |
|
|
Patrick Bareiss
|
9e588b51b9
|
Merge branch 'develop' into data_source_improvements_2
|
2025-02-18 09:08:28 +01:00 |
|
|
pyth0n1c
|
f2e7dbfbe7
|
bump versions and dates on modified detections
|
2025-02-17 15:46:23 -08:00 |
|
|
pyth0n1c
|
eabea79178
|
Show dashboard objects in dropdown
|
2025-02-17 14:37:00 -08:00 |
|