b19652d35e
Added entities to investigative searches
2019-10-16 22:33:20 -07:00
d49e29a9b4
Updated generate
2019-10-16 21:09:23 -07:00
61c3f18ece
Updated generate to output for ASX
...
Fixed macros
2019-10-16 20:54:13 -07:00
13af78c6d8
Added macro for the time window
2019-10-16 18:42:02 -07:00
645ae6a647
Missed the rename of the data model in this file
2019-10-16 17:59:28 -07:00
cb7a441885
Renamed data model in spec from Cloud to Cloud_Infrastructure
2019-10-16 17:58:24 -07:00
1f8fbb9c58
Merge branch 'develop' into cloud_cryptomining
2019-10-16 17:50:40 -07:00
9e4a2a2413
Used final name of cloud data model
2019-10-16 17:38:10 -07:00
33970c46fc
Merge pull request #222 from splunk/change_json_to_yml
...
Changed json to yml
2019-10-16 12:53:50 -04:00
cacc5f03de
Merge pull request #221 from splunk/CRL-1490
...
Fixed typo in distsearch.conf that caused unnecessary bundle replication
2019-10-16 11:12:50 -04:00
af66ed5fe3
Changed json to yml
2019-10-16 16:38:05 +02:00
14bfab7338
Fixed typo in distsearch.conf that caused unnecessary bundle replication
2019-10-15 16:28:26 -07:00
009a5b0f37
Bump attrs from 19.2.0 to 19.3.0
...
Bumps [attrs](https://github.com/python-attrs/attrs ) from 19.2.0 to 19.3.0.
- [Release notes](https://github.com/python-attrs/attrs/releases )
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/python-attrs/attrs/compare/19.2.0...19.3.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-15 14:44:10 +00:00
61990be03f
Bump contextlib2 from 0.6.0 to 0.6.0.post1
...
Bumps [contextlib2](https://github.com/jazzband/contextlib2 ) from 0.6.0 to 0.6.0.post1.
- [Release notes](https://github.com/jazzband/contextlib2/releases )
- [Commits](https://github.com/jazzband/contextlib2/compare/v0.6.0...v0.6.0.post1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-11 06:18:51 +00:00
09f3fe9cef
Bump jsonschema from 3.0.2 to 3.1.1
...
Bumps [jsonschema](https://github.com/Julian/jsonschema ) from 3.0.2 to 3.1.1.
- [Release notes](https://github.com/Julian/jsonschema/releases )
- [Changelog](https://github.com/Julian/jsonschema/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/Julian/jsonschema/compare/v3.0.2...v3.1.1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-10 06:29:41 +00:00
7d0a8cfabd
Merge pull request #217 from splunk/cloud_cryptominig
...
Cloud cryptominig
2019-10-08 08:48:00 -04:00
c08c11cb5e
Merge pull request #213 from splunk/dependabot/pip/pathlib2-2.3.5
...
Bump pathlib2 from 2.3.4 to 2.3.5
2019-10-08 08:47:37 -04:00
733c088621
Merge pull request #211 from splunk/dependabot/pip/contextlib2-0.6.0
...
Bump contextlib2 from 0.5.5 to 0.6.0
2019-10-08 08:47:16 -04:00
9f0d4e510c
Merge pull request #194 from splunk/dependabot/pip/zipp-0.6.0
...
Bump zipp from 0.5.2 to 0.6.0
2019-10-08 08:46:52 -04:00
00d45d08f0
Merge pull request #191 from splunk/dependabot/pip/typing-3.7.4.1
...
Bump typing from 3.7.4 to 3.7.4.1
2019-10-08 08:42:04 -04:00
c9effaf169
Merge branch 'develop' into cloud_cryptominig
2019-10-08 08:40:51 -04:00
bfd2f43f16
updated configparser to right version
2019-10-08 08:39:20 -04:00
669ae04242
updating config parser to right version
2019-10-08 08:37:58 -04:00
10162d5808
Bump contextlib2 from 0.5.5 to 0.6.0
...
Bumps [contextlib2](https://github.com/jazzband/contextlib2 ) from 0.5.5 to 0.6.0.
- [Release notes](https://github.com/jazzband/contextlib2/releases )
- [Commits](https://github.com/jazzband/contextlib2/compare/v0.5.5...v0.6.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-08 12:35:35 +00:00
accda2a493
Merge pull request #216 from splunk/dependabot/pip/attrs-19.2.0
...
Bump attrs from 19.1.0 to 19.2.0
2019-10-08 08:34:21 -04:00
9c6c794b81
Merge pull request #215 from splunk/drilldown
...
Added drilldown search and name to the detection spec.
2019-10-08 08:32:49 -04:00
2b5f46ab35
Merge pull request #212 from splunk/macros
...
Adding macros for exception handling to spec
2019-10-08 08:31:45 -04:00
a12fe635c6
Merge branch 'develop' into macros
2019-10-07 22:59:37 -05:00
ad20740605
Merge branch 'develop' into drilldown
2019-10-07 22:59:24 -05:00
85a637b149
Merge branch 'develop' into cloud_cryptominig
2019-10-07 22:59:06 -05:00
31b839b028
Actually ignore swap files now (forgot the * at the beginning)
2019-10-07 22:16:50 -05:00
6bc1ce430b
Ignore VIM swap files
2019-10-07 22:16:09 -05:00
2a4b29e4c4
New investigation macros
...
Updated validate to check for macro and lookup existence in both
baselines and investigation searches
2019-10-07 22:14:12 -05:00
9034599d6f
Added in exception handling to cloud compute activity in new region
...
Added a bunch of lookup manifests
Added a bunch of macro manifests
Updated validate to make sure macros listed in detection search have
a macro manifest
2019-10-07 21:50:13 -05:00
fb93597cfc
Merge branch 'macros' into cloud_cryptominig
2019-10-03 17:49:45 -07:00
82e8b210a9
Files for new cloud cryptominig story.
...
It's a cloud infrastructure generic version of AWS Cryptomining
2019-10-03 17:42:40 -07:00
d11219e54d
Updated generate code
2019-10-03 13:45:16 -07:00
cc6209a08e
Started to create Cloud Cryptomining story
...
Added 1 detection, 1 baseline, and 2 investigative searches
2019-10-02 21:05:30 -07:00
a1ac59f593
Merge pull request #210 from splunk/CRL-1624_remove_contexualized
...
cRL-1624 removed contexualized
2019-10-02 17:27:13 -07:00
e71536f638
Merge pull request #214 from splunk/CRL-1627
...
Fixed issue inside of where clause
2019-10-02 17:22:10 -07:00
24769e88c5
Added lookup to the search specs
2019-10-02 12:01:03 -07:00
9edd3b9c4d
Bump attrs from 19.1.0 to 19.2.0
...
Bumps [attrs](https://github.com/python-attrs/attrs ) from 19.1.0 to 19.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases )
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/python-attrs/attrs/compare/19.1.0...19.2.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-10-02 07:06:42 +00:00
2a8b470241
Added drilldown search and name to the detection spec.
...
Added these fields to the suspicious wevtutil manifest
Updated validate to make sure both entries are there or neither are
Updated generate to output those fields if they are there
2019-10-01 17:31:11 -07:00
aec9dd53f5
Fixed issue inside of where clause
2019-09-30 16:17:29 -07:00
1bda6248ea
Added code to validate macros manifest and lookups manifest
...
Lookup manifest validation also checks to make sure either filename or collection is there
If a filename is listed, it makes sure the file exists as well
2019-09-30 16:08:54 -07:00
575b766f09
Minor spec change to macro.spec.json
2019-09-30 16:08:08 -07:00
e428f473c9
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
3d25c40bf7
Updated macro definition in detections, investigations, and baselines to just be a list
...
Broke out macros definition into it's own manifest
Created macro manifests for all of current macros that we ship
Created lookup file manifest
Created lookup file manifests for all current lookup files that we ship
2019-09-30 13:53:25 -07:00
1149f8b6a4
Bump pathlib2 from 2.3.4 to 2.3.5
...
Bumps [pathlib2](https://github.com/mcmtroffaes/pathlib2 ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/mcmtroffaes/pathlib2/releases )
- [Changelog](https://github.com/mcmtroffaes/pathlib2/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/mcmtroffaes/pathlib2/compare/2.3.4...2.3.5 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2019-09-30 06:19:03 +00:00
5e5cd80145
Merge branch 'develop' into macros
2019-09-27 15:01:34 -05:00
David Dorsey