3e420d4cf5
Changed object to object_id
2020-09-15 10:30:02 -05:00
9f54f90aee
Merge branch 'develop' into TR-41_aws_ec2_mods
2020-09-14 14:12:25 -07:00
1f56396028
Updated search for abnormally high cloud instances. Including
...
verifying that enough data is there
2020-09-14 14:11:02 -07:00
6fd7b6ef2f
more updates
2020-09-14 14:11:02 -07:00
aedfc4e837
Created manifests for unseen city, region, and country and updated
...
logic to reflect each case
2020-09-14 14:11:02 -07:00
56d0abdc31
Manifest cleanup
2020-09-14 14:11:01 -07:00
2f1f96c804
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-09-14 14:11:01 -07:00
e042b84f82
work in progress file
2020-09-14 14:11:01 -07:00
3c5f75c452
Removed a few API calls that are not really modifications
2020-09-14 14:11:01 -07:00
481fb128c6
new files for translated detections
2020-09-14 14:11:01 -07:00
bb5384564a
new files - not finalized
2020-09-14 14:11:01 -07:00
60456b9e9a
some translated searches for change DM
2020-09-14 14:11:01 -07:00
02ac11cfd8
Merge branch 'develop' into gcpoauth
2020-09-14 13:24:54 -07:00
f1ebf3b8d5
formatting error
2020-09-14 13:23:55 -07:00
52739bc3ab
yml updates
2020-09-14 13:12:51 -07:00
57ee3f98a5
addedref
2020-09-14 15:56:03 -04:00
80e2fd37d6
fixedawsforgcp
2020-09-14 15:33:39 -04:00
9b785919de
validate fixes
2020-09-10 21:22:34 -05:00
3efae7ccef
cron_schedule fixed
2020-09-10 20:52:24 -05:00
97dd7e357b
Small updates
2020-09-10 20:49:00 -05:00
796617a83c
Merge branch 'develop' into fixedawsstsassumerole
2020-09-10 13:26:07 -07:00
ef3fee0a81
Update aws_detect_sts_assume_role_abuse.yml
...
using cloudtrail as input macro
2020-09-10 13:25:39 -07:00
b3eeaef59d
tweaks and updates
2020-09-10 14:19:45 -06:00
2fadf948da
Merge pull request #630 from splunk/TR-82-risk-tagging
...
[TR-82] add in logic for risk tagging after synching with ESCU requirements
2020-09-10 12:23:59 -04:00
8daac1602b
Merge branch 'TR-82-risk-tagging' of github.com:splunk/security-content into TR-82-risk-tagging
2020-09-10 12:17:26 -04:00
9bfc5f9f4e
updated spec docs and also added one more example
2020-09-10 12:17:21 -04:00
c76fc34e3f
Merge branch 'develop' into TR-82-risk-tagging
2020-09-09 23:33:03 -04:00
83015eba59
latest updates to create in new vendor_region
2020-09-09 16:26:25 -06:00
bff7706c74
Merge branch 'develop' into response_phases
2020-09-09 16:07:21 -04:00
ec7dd03c95
loud cloud
2020-09-09 12:25:52 -07:00
7f7d03cf33
adding link to aws secret manager
2020-09-09 10:39:25 -04:00
0fe7693307
add automated detection service code
2020-09-09 16:16:54 +02:00
f76e66d184
Merge pull request #659 from splunk/dependabot/pip/pyrsistent-0.17.2
2020-09-09 09:47:32 +00:00
8d1b7e1395
Bump pyrsistent from 0.17.1 to 0.17.2
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.17.1 to 0.17.2.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.17.1...v0.17.2 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-09 09:42:22 +00:00
9cdc721ad6
Merge pull request #656 from splunk/dependabot/pip/pyrsistent-0.17.1
2020-09-09 07:36:36 +00:00
027b8ce1a1
Bump pyrsistent from 0.17.0 to 0.17.1
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.17.0 to 0.17.1.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.17.0...v0.17.1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-09 07:31:42 +00:00
fc99713981
Translated detections/detect_spike_in_security_group_activity.yml
2020-09-09 01:36:26 -05:00
adf19afe6a
Updated baseline searches to have correct deployment. Which was also created
2020-09-09 01:35:38 -05:00
d588bbc8f6
Translated detect_spike_in_aws_api_activity.yml to use Change DM
2020-09-09 01:01:16 -05:00
0748b5e8ee
bug fixes
2020-09-09 01:00:45 -05:00
3697092a4b
Updated MLTK searches based on Peter's work
2020-09-08 22:49:16 -05:00
3b69af66a7
Adding cloud NACL deletion detection
2020-09-08 14:09:24 -07:00
a0bad4ef74
Revert "Converting ACL deletion detection from Cloudtrail to Change DM"
...
Actually will just add this as a new cloud_ detection and leave the old
one in place for now
This reverts commit 3159472018
2020-09-08 13:49:08 -07:00
3159472018
Converting ACL deletion detection from Cloudtrail to Change DM
2020-09-08 13:44:10 -07:00
83a35dcc65
Merge pull request #655 from splunk/dependabot/pip/pyrsistent-0.17.0
2020-09-08 19:42:40 +00:00
c8a4d57195
Bump pyrsistent from 0.16.0 to 0.17.0
...
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent ) from 0.16.0 to 0.17.0.
- [Release notes](https://github.com/tobgu/pyrsistent/releases )
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt )
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.16.0...v0.17.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-09-08 19:38:00 +00:00
19f3778dda
Merge branch 'develop' into TR-82-risk-tagging
2020-09-08 09:52:12 -07:00
66f74754f6
Merge pull request #646 from splunk/update_test_files
...
updated test files
2020-09-07 13:27:51 +02:00
3e0cfa84cb
updated test files
2020-09-07 13:18:03 +02:00
8400f241ca
Merge pull request #642 from splunk/dependabot/pip/identify-1.5.0
2020-09-05 19:41:11 +00:00
David Dorsey