admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,378 Commits 697 Branches 195 Tags
97dd7e357be367bfcd76e0136abc50d728c6d4c0
Commit Graph

2378 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
David Dorsey 97dd7e357b Small updates 2020-09-10 20:49:00 -05:00
Rico Valdez b3eeaef59d tweaks and updates 2020-09-10 14:19:45 -06:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
peter-cg ec7dd03c95 loud cloud 2020-09-09 12:25:52 -07:00
David Dorsey fc99713981 Translated detections/detect_spike_in_security_group_activity.yml 2020-09-09 01:36:26 -05:00
David Dorsey adf19afe6a Updated baseline searches to have correct deployment. Which was also created 2020-09-09 01:35:38 -05:00
David Dorsey d588bbc8f6 Translated detect_spike_in_aws_api_activity.yml to use Change DM 2020-09-09 01:01:16 -05:00
David Dorsey 0748b5e8ee bug fixes 2020-09-09 01:00:45 -05:00
David Dorsey 3697092a4b Updated MLTK searches based on Peter's work 2020-09-08 22:49:16 -05:00
peter-cg 3b69af66a7 Adding cloud NACL deletion detection 2020-09-08 14:09:24 -07:00
peter-cg a0bad4ef74 Revert "Converting ACL deletion detection from Cloudtrail to Change DM" 
Actually will just add this as a new cloud_ detection and leave the old
one in place for now

This reverts commit 3159472018.
 2020-09-08 13:49:08 -07:00
peter-cg 3159472018 Converting ACL deletion detection from Cloudtrail to Change DM 2020-09-08 13:44:10 -07:00
bpatel f9b2c816db minor naming bug 2020-09-04 13:52:49 -07:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
bpatel d12a38e8ff adding new stories to response 2020-09-04 13:38:05 -07:00
bpatel cea3735f1a updates to ymls to make sure validate passes 2020-09-04 13:31:16 -07:00
David Dorsey 7b098cf836 fixed validate issues 2020-09-04 13:13:22 -05:00
David Dorsey dbfecd9e29 New analytic story for suspicious cloud user activities. 2020-09-04 10:30:47 -05:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e8bf1d9e96 updates for mustang 2020-09-03 17:10:02 -06:00
Rico Valdez 8ead727df7 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 
merging in updates
 2020-09-03 11:10:48 -06:00
Rico Valdez e9939cbc98 new files for unblocked searches 2020-09-03 11:10:14 -06:00
David Dorsey d82a74122d Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 2020-09-03 00:32:46 -05:00
David Dorsey ffbd700110 Updates 2020-09-03 00:32:36 -05:00
Rico Valdez a75e4fcc85 detection - may still change name 2020-09-02 10:31:50 -06:00
Rico Valdez f7498459c8 changes for mustang 2020-09-02 10:21:52 -06:00
dependabot-preview[bot] e3633953d9 Merge pull request #634 from splunk/dependabot/pip/identify-1.4.30 2020-09-01 07:56:09 +00:00
dependabot-preview[bot] 77e2a8e22d Bump identify from 1.4.29 to 1.4.30 
Bumps [identify](https://github.com/chriskuehl/identify) from 1.4.29 to 1.4.30.
- [Release notes](https://github.com/chriskuehl/identify/releases)
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.29...v1.4.30)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-09-01 07:51:15 +00:00
dependabot-preview[bot] 6456cb2449 Merge pull request #633 from splunk/dependabot/pip/more-itertools-8.5.0 2020-08-28 18:51:17 +00:00
dependabot-preview[bot] 9d3694b18e Bump more-itertools from 8.4.0 to 8.5.0 
Bumps [more-itertools](https://github.com/more-itertools/more-itertools) from 8.4.0 to 8.5.0.
- [Release notes](https://github.com/more-itertools/more-itertools/releases)
- [Commits](https://github.com/more-itertools/more-itertools/compare/v8.4.0...8.5.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-08-28 18:45:53 +00:00
Rico Valdez bda59e0708 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods 
merging in Dorsey's changes
 2020-08-28 10:18:40 -06:00
Rico Valdez 662d680870 more updates 2020-08-28 10:12:55 -06:00
research bot 346fcc2a18 updating docs and package bits [ci skip] 2020-08-27 18:42:27 +00:00
David Dorsey 0b9dd4ca9b Fixed validate script errors 2020-08-26 23:50:25 -05:00
David Dorsey 0c7efecd12 Fixed errors found by validate script 2020-08-26 23:47:26 -05:00
David Dorsey e2f786ef0a Fixed a horrible bug that Patrick introduced in the validate script 2020-08-26 23:42:50 -05:00
David Dorsey d662b0538d Removed unused file 2020-08-26 23:17:03 -05:00
David Dorsey 0a47f73352 Updated cloud instances destroyed to change data model 2020-08-26 22:57:45 -05:00
David Dorsey b48b40ff76 Updated search for abnormally high cloud instances. Including 
verifying that enough data is there
 2020-08-25 22:28:59 -05:00
Bhavin Patel 2a13216059 Merge pull request #625 from splunk/coverage_update 
updated both maps fixed errors with coverage
v3.0.6 		2020-08-25 11:31:23 -07:00
Bhavin Patel ac69800ab4 Merge branch 'develop' into coverage_update 2020-08-25 11:26:03 -07:00
Jose Enrique Hernandez 463f218ef9 Merge pull request #619 from splunk/PR_609 
Pr 609
 2020-08-25 12:19:00 -04:00
Jose Enrique Hernandez a66740b506 Merge branch 'develop' into PR_609 2020-08-25 12:13:24 -04:00
Bhavin Patel 00653ac542 Merge pull request #623 from splunk/fixawsk8sfailuresrcuser 
newfixawsdetectpkey
 2020-08-24 12:47:10 -07:00
Jose Enrique Hernandez 5eb6c522c6 Merge branch 'develop' into PR_609 2020-08-24 12:50:54 -04:00
Jose Enrique Hernandez f97c0c6d83 Merge pull request #612 from inspired/mbjerkeland-develop 
Layer 2 Cisco Network detections
 2020-08-24 12:50:38 -04:00
Jose Enrique Hernandez d140413a50 Merge branch 'develop' into PR_609 2020-08-24 12:42:12 -04:00
Jose Enrique Hernandez 98e2127d89 Merge branch 'develop' into mbjerkeland-develop 2020-08-24 12:41:57 -04:00
Jose Enrique Hernandez 27cbc9136b Merge branch 'develop' into coverage_update 2020-08-24 12:41:43 -04:00
dependabot-preview[bot] a5193dc9c6 Merge pull request #629 from splunk/dependabot/pip/identify-1.4.29 2020-08-24 16:31:30 +00:00