adeeab0ee8
Updated baseline searches to have correct deployment. Which was also created
2020-09-15 20:19:45 -07:00
483d492405
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-15 20:19:45 -07:00
b5914eacd9
bug fixes
2020-09-15 20:19:45 -07:00
8ffbe56392
Updated MLTK searches based on Peter's work
2020-09-15 20:19:45 -07:00
976971526d
updates to ymls to make sure validate passes
2020-09-15 20:17:49 -07:00
9f8418ee85
fixed validate issues
2020-09-15 20:17:49 -07:00
4af9407d8f
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
a65c01dedf
updates for mustang
2020-09-15 20:17:49 -07:00
c341614465
new files for unblocked searches
2020-09-15 20:17:49 -07:00
03245f6372
changes for mustang
2020-09-15 20:17:49 -07:00
4bd7eae3c8
Removed unused file
2020-09-15 20:15:27 -07:00
181f810dbb
Updated cloud instances destroyed to change data model
2020-09-15 20:15:23 -07:00
7d35bc9947
Remove show_options
2020-09-15 09:45:45 -07:00
1f56396028
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-09-14 14:11:02 -07:00
6fd7b6ef2f
more updates
2020-09-14 14:11:02 -07:00
56d0abdc31
Manifest cleanup
2020-09-14 14:11:01 -07:00
2f1f96c804
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-09-14 14:11:01 -07:00
481fb128c6
new files for translated detections
2020-09-14 14:11:01 -07:00
bb5384564a
new files - not finalized
2020-09-14 14:11:01 -07:00
60456b9e9a
some translated searches for change DM
2020-09-14 14:11:01 -07:00
9b785919de
validate fixes
2020-09-10 21:22:34 -05:00
b3eeaef59d
tweaks and updates
2020-09-10 14:19:45 -06:00
83015eba59
latest updates to create in new vendor_region
2020-09-09 16:26:25 -06:00
adf19afe6a
Updated baseline searches to have correct deployment. Which was also created
2020-09-09 01:35:38 -05:00
d588bbc8f6
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-09 01:01:16 -05:00
0748b5e8ee
bug fixes
2020-09-09 01:00:45 -05:00
3697092a4b
Updated MLTK searches based on Peter's work
2020-09-08 22:49:16 -05:00
cea3735f1a
updates to ymls to make sure validate passes
2020-09-04 13:31:16 -07:00
7b098cf836
fixed validate issues
2020-09-04 13:13:22 -05:00
dbfecd9e29
New analytic story for suspicious cloud user activities.
2020-09-04 10:30:47 -05:00
e8bf1d9e96
updates for mustang
2020-09-03 17:10:02 -06:00
e9939cbc98
new files for unblocked searches
2020-09-03 11:10:14 -06:00
f7498459c8
changes for mustang
2020-09-02 10:21:52 -06:00
bda59e0708
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
...
merging in Dorsey's changes
2020-08-28 10:18:40 -06:00
662d680870
more updates
2020-08-28 10:12:55 -06:00
d662b0538d
Removed unused file
2020-08-26 23:17:03 -05:00
0a47f73352
Updated cloud instances destroyed to change data model
2020-08-26 22:57:45 -05:00
b48b40ff76
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-08-25 22:28:59 -05:00
7de781c8f0
Manifest cleanup
2020-08-20 13:15:14 -05:00
b4ab45f299
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-08-19 10:28:05 -05:00
9302baefaf
new files for translated detections
2020-08-18 16:38:38 -06:00
a0730b0878
new files - not finalized
2020-08-18 16:38:13 -06:00
1db6e6096d
some translated searches for change DM
2020-08-08 18:04:57 -06:00
07ce28f433
Updated baseline deployments
2020-06-25 13:49:48 -05:00
8438bf71e8
Fixed the first time previously seen windows service search to work
...
with the latest Windows TA. Simplified it by adding an hourly baseline
cache update
Made the default deployment template be -70m@m to -10m@m
Added a new deployment template for hourly baseline caches
2020-06-25 00:09:30 -05:00
82c209b539
Merge branch 'develop' into CRL-1771-update-story-windows-service-abuse
2020-06-17 14:25:20 -07:00
e96a91aeb4
removed searches that depend on non-extracted fields
2020-06-16 12:43:48 -06:00
f892cda659
testing and update of story Windows Service Abuse
2020-06-15 14:28:20 +02:00
36a29c3d6d
text updates for ES and AWS add-on version
2020-06-09 12:15:58 -06:00
f4bc32f336
rename search names
2020-06-08 18:57:50 -07:00
David Dorsey