cdc2ae5ed2
Update windows_event_log_security_5145.yml
2025-06-02 16:21:05 -07:00
1f74c344ed
Merge pull request #3536 from splunk/aws_to_ttp
...
Update AWS Defense Evasion Impair Security Services to TTP
2025-06-02 14:39:38 -07:00
4cfe72f575
Merge branch 'develop' into aws_to_ttp
2025-06-02 14:24:22 -07:00
cc74c42c4d
Merge pull request #3545 from splunk/fix-issues-june25
...
Fix Issues For v5.7
2025-06-02 13:52:05 -07:00
d3deda8e58
Merge branch 'develop' into aws_to_ttp
2025-06-02 13:41:34 -07:00
b849dd201a
Update windows_sensitive_registry_hive_dump_via_commandline.yml
...
Need extra backslash to escape registry path backslash in SPL
2025-06-02 13:30:46 -07:00
d11917e14d
Update o365_concurrent_sessions_from_different_ips.yml
2025-06-02 22:18:24 +02:00
168bf7e714
Update windows_sensitive_registry_hive_dump_via_commandline.yml
2025-06-02 22:12:47 +02:00
46c079b46b
Merge pull request #3535 from splunk/ftd-cim-update
...
Update Network CIM Analytics With FTD Data
2025-06-02 12:58:18 -07:00
3393446afb
Update internal_horizontal_port_scan_nmap_top_20.yml
...
Chatted with detection author about this update.
Changed risk_object from dest_zone to dest_ports to be more in line with other horizontal scanning detection AND give more meaningful risk object (dest_zone is less meaningful, even if populated)
2025-06-02 12:31:03 -07:00
e7f59f1ffc
update risk object
2025-06-02 11:36:04 +02:00
f40aad92b5
Update protocols_passing_authentication_in_cleartext.yml
2025-06-02 10:34:26 +02:00
5f9fb78212
Merge branch 'develop' into ftd-cim-update
2025-06-02 10:30:52 +02:00
271fd75425
update analytics after review suggestions
2025-06-02 10:30:36 +02:00
88d689fe8a
Merge pull request #3539 from splunk/auto-ta-update-281
...
Automated Splunk TA Update 281
2025-05-30 11:35:49 -05:00
fe7341a874
Merge branch 'develop' into auto-ta-update-281
2025-05-30 11:19:46 -05:00
1e6cc1228e
Merge pull request #3541 from jwindley/patch-2
...
Update detect_remote_access_software_usage_traffic.yml
2025-05-30 11:18:53 -05:00
5cde2f9d01
Update detect_remote_access_software_usage_traffic.yml
2025-05-30 15:19:09 +01:00
133e431bd3
Update detect_remote_access_software_usage_traffic.yml
...
Fix bug with user field
2025-05-30 14:51:56 +01:00
47474d429d
Updated TAs
2025-05-30 06:58:45 +00:00
38cb11c1d6
Merge branch 'develop' into ftd-cim-update
2025-05-28 19:36:24 +02:00
44e6f9a445
Update cisco_secure_firewall___remote_access_software_usage_traffic.yml
2025-05-28 19:35:38 +02:00
67c72b9035
add Cisco Secure Firewall - Remote Access Software Usage Traffic
2025-05-28 19:33:18 +02:00
dc9234a34e
Merge pull request #3538 from splunk/auto-ta-update-279
...
Automated Splunk TA Update 279
2025-05-28 10:31:42 -05:00
a9c0afadf8
update how to implement section
2025-05-28 13:05:49 +02:00
79c7c795b8
Updated TAs
2025-05-28 06:58:43 +00:00
e42a0eba09
Update tor_traffic.yml
2025-05-27 23:48:24 +02:00
bc5c2a3ddd
Update tor_traffic.yml
2025-05-27 23:27:25 +02:00
efbdf32690
Update protocols_passing_authentication_in_cleartext.yml
2025-05-27 17:28:51 +02:00
a09165ffb5
ci fixes
2025-05-27 17:17:34 +02:00
2634983bd1
add missing output fields
2025-05-27 16:54:10 +02:00
0c284e67c2
add drilldowns
2025-05-27 16:35:41 +02:00
4b14d04f85
test more network analytics with ftd
2025-05-27 16:12:12 +02:00
d016157feb
field order update
2025-05-27 10:50:31 +02:00
a182c8c616
updating to TTP
2025-05-22 13:25:53 -07:00
25b2758228
update output fields
2025-05-22 12:46:00 +02:00
9c5983fae2
Merge branch 'develop' into ftd-cim-update
2025-05-22 12:27:48 +02:00
a9b6723417
Merge pull request #3534 from splunk/auto-ta-update-273
...
Automated Splunk TA Update 273
2025-05-22 10:23:01 +02:00
a50fe30d9d
update network cim analytics with ftd data
2025-05-22 10:17:47 +02:00
ea266439e0
Updated TAs
2025-05-22 06:58:09 +00:00
f8356e154b
Merge pull request #3533 from splunk/ctlyaml_5.7.0
...
Contenctl.yml to 5.7.0
2025-05-21 13:13:00 -07:00
5e3f747d42
udpating CIM
2025-05-21 11:50:58 -07:00
b195cc2175
only cim
2025-05-21 11:50:29 -07:00
de4219c68c
updating cim and ESCU for next relesae
2025-05-21 11:49:01 -07:00
d76aa41a5c
Merge pull request #3526 from splunk/captcha
...
CAPTCHA if you Can
2025-05-20 19:43:48 +02:00
f6832c6822
Apply suggestions from code review
2025-05-20 19:28:26 +02:00
4a58ea1605
Merge branch 'develop' into captcha
2025-05-20 09:59:03 -07:00
271f1bc855
Merge pull request #3530 from splunk/auto-ta-update-271
...
Automated Splunk TA Update 271
2025-05-20 09:58:36 -07:00
22640f76b9
Merge branch 'develop' into auto-ta-update-271
2025-05-20 09:55:18 -07:00
f623ca67ea
vers
2025-05-20 10:53:48 -06:00
pyth0n1c