52e21c9907
resetting the md file
2020-08-19 10:24:40 -07:00
b4ab45f299
Updated baseline searches for cloud provisioning activities.
...
Broke them out into an initial search and update search
Updated them to use kv store
Updated Cloud Provisioning from previously unseen ip address to
relfect changes in baseline searches.
Added new fields to make the detection more actionable
Added the lookup manifest and a macro manifest
2020-08-19 10:28:05 -05:00
dd4e61837c
bug updates
2020-08-18 16:33:58 -07:00
fb00fffd3f
work in progress file
2020-08-18 17:01:29 -06:00
0328c2d98f
Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods
...
merging in changes to branch
2020-08-18 17:00:44 -06:00
9302baefaf
new files for translated detections
2020-08-18 16:38:38 -06:00
a0730b0878
new files - not finalized
2020-08-18 16:38:13 -06:00
63abcbf343
Merge pull request #613 from splunk/TR-145_bug
...
converted lookup to collection
2020-08-18 15:34:31 -07:00
32346eef6a
Merge branch 'develop' into TR-145_bug
2020-08-18 15:29:06 -07:00
6de58bce6a
Update api_call_by_user_baseline.yml
...
latestCount is needed in detection search
2020-08-18 15:28:54 -07:00
866212a733
[TR-82] remove hard coded risk parameters in j2 template.
2020-08-18 13:34:25 -07:00
d3b4d65e69
[TR-82] update detection markdown.
2020-08-18 13:30:21 -07:00
45c0efe7ee
[TR-82] code cleanup for generate.py
2020-08-18 13:21:33 -07:00
84283e4123
[TR-82] add logic for updating risk parameters in saved searches.conf
2020-08-18 12:42:10 -07:00
83d8ce47a5
Removed a few API calls that are not really modifications
2020-08-18 13:47:04 -05:00
e6248f0e77
Merge branch 'develop' into mbjerkeland-develop
2020-08-18 15:08:30 +02:00
6ab60c1557
Merge pull request #617 from splunk/dependabot/pip/virtualenv-20.0.31
2020-08-17 15:38:51 +00:00
55639a2e56
Bump virtualenv from 20.0.30 to 20.0.31
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 20.0.30 to 20.0.31.
- [Release notes](https://github.com/pypa/virtualenv/releases )
- [Changelog](https://github.com/pypa/virtualenv/blob/master/docs/changelog.rst )
- [Commits](https://github.com/pypa/virtualenv/compare/20.0.30...20.0.31 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-08-17 15:34:42 +00:00
1786a44a13
Merge branch 'develop' into mbjerkeland-develop
2020-08-17 09:30:14 +02:00
968e73ca98
Merge pull request #616 from splunk/dependabot/pip/identify-1.4.28
2020-08-16 18:46:35 +00:00
d6a5c18bac
Bump identify from 1.4.27 to 1.4.28
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.27 to 1.4.28.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.27...v1.4.28 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-08-16 18:41:34 +00:00
d10bafadf3
Merge pull request #615 from splunk/dependabot/pip/identify-1.4.27
2020-08-16 00:43:08 +00:00
0aafd593c8
Bump identify from 1.4.25 to 1.4.27
...
Bumps [identify](https://github.com/chriskuehl/identify ) from 1.4.25 to 1.4.27.
- [Release notes](https://github.com/chriskuehl/identify/releases )
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.25...v1.4.27 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-08-16 00:39:38 +00:00
4c7cb2488c
Polish
2020-08-14 23:08:02 +02:00
584ef0aff9
Updates
2020-08-14 22:59:11 +02:00
897d25a7f8
Present times in ISO8601 instead of US style
2020-08-12 23:45:53 +02:00
289cec6fde
Now validating?
2020-08-12 23:32:48 +02:00
b748b3ee9c
converted lookup to collection
2020-08-12 17:29:18 -04:00
ff4cf63e3e
Fixed up my mistakes. Should hopefully validate now
2020-08-12 23:26:57 +02:00
cc4d23469c
.
2020-08-12 23:26:26 +02:00
d820c2d914
Retrying
2020-08-12 23:21:43 +02:00
c12f8b2a6e
Added ARP Poisoning Detection for Cisco Devices
2020-08-12 10:55:10 +02:00
dd10e6e3cb
Adding macros
2020-08-12 09:17:32 +02:00
9eb49b723c
Description update
2020-08-11 23:33:57 +02:00
a3e9363271
Added Layer 2 Network Detection to detect Rogue DHCP Servers
2020-08-11 23:29:42 +02:00
516f009492
Merge pull request #610 from splunk/new_CI_testing_pipeline
...
new CI pipeline
2020-08-10 15:17:56 -04:00
1db6e6096d
some translated searches for change DM
2020-08-08 18:04:57 -06:00
7ec2ca7f8b
new CI pipeline
2020-08-07 17:08:21 +02:00
2f04c868e4
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
acb7856bbc
updating docs and package bits [ci skip]
2020-08-04 21:37:21 +00:00
9bff8a38dd
Merge pull request #608 from splunk/F5_TMUI
...
F5 TMUI RCE CVE-2020-5902 - contribution from Shannon ymls and updates
2020-08-04 14:23:59 -07:00
94e5d4dffd
adding a response task
2020-08-04 14:15:14 -07:00
971c2dc696
adding a response task
2020-08-04 14:14:12 -07:00
32e5fc5331
Merge branch 'develop' into F5_TMUI
2020-08-04 17:09:39 -04:00
5b586dcb46
Merge pull request #607 from splunk/SIGRed
...
DNS SIGRed CVE-2020-1350 - Shannon's contribution: porting ymls into a new PR
2020-08-04 17:08:55 -04:00
58f47148b9
ymls and updates
2020-08-04 14:04:38 -07:00
8617674eed
response to new story
2020-08-04 13:23:26 -07:00
63f266629e
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
a1b00860d8
Merge pull request #578 from splunk/relative_path_and_type_consideration
...
Relative path and type consideration - kfondren7
2020-08-04 12:40:23 -07:00
8227b5351f
codec error
2020-08-04 12:33:28 -07:00
bpatel