25967 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
pyth0n1c	fe00a4bbb3	Update windows_cisco_secure_endpoint_related_service_stopped.yml ... add missing "search" keyword which caused unit testing to fail.	2025-02-19 11:52:46 -08:00
Nasreddine Bencherchali	5ff1deea69	Update windows_cisco_secure_endpoint_related_service_stopped.yml	2025-02-19 20:35:33 +01:00
pyth0n1c	58a6e70e77	Merge branch 'develop' into new-rules	2025-02-19 11:33:51 -08:00
Nasreddine Bencherchali	4f0bbc250f	Update windows_cisco_secure_endpoint_related_service_stopped.yml	2025-02-19 20:32:52 +01:00
Nasreddine Bencherchali	c47a2b85af	Update windows_cisco_secure_endpoint_related_service_stopped.yml	2025-02-19 20:31:55 +01:00
Bhavin Patel	292fba5f7f	Merge pull request #3347 from splunk/remove-uncomatible-ds ... Remove Incompatible 4688 Data Sources	2025-02-19 11:17:51 -08:00
Bhavin Patel	b68524f194	Merge branch 'develop' into remove-uncomatible-ds	2025-02-19 11:16:33 -08:00
Bhavin Patel	5182ac3282	Merge pull request #3298 from nterl0k/nterl0k-t1567-o365-sus-file-exfil ... Nterl0k - T1567 - Suspect File Exfiltration Behaviors	2025-02-19 11:10:14 -08:00
Bhavin Patel	7c402fab3d	Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil	2025-02-19 11:05:17 -08:00
pyth0n1c	b3c215afd5	Merge branch 'develop' into new-rules	2025-02-19 10:47:03 -08:00
Bhavin Patel	11ca403c96	Merge pull request #3263 from zake1god/new-research-detection-endpoint ... New Analytic - Telegram API Request Via CommandLine	2025-02-19 10:44:44 -08:00
Nasreddine Bencherchali	f26afe837a	Merge branch 'develop' into remove-uncomatible-ds	2025-02-19 17:47:57 +01:00
Nasreddine Bencherchali	be9873d4a4	remove incompatible data sources	2025-02-19 17:46:22 +01:00
Nasreddine Bencherchali	a75c0c67d8	Merge branch 'develop' into new-rules	2025-02-19 17:40:00 +01:00
Nasreddine Bencherchali	554d02d6b5	Merge branch 'develop' into new-research-detection-endpoint	2025-02-19 17:39:32 +01:00
Bhavin Patel	dbede3bfec	Merge pull request #3299 from splunk/tr-3997 ... TR-3997 - New Content - auditpol and audit policy tampering analytics	2025-02-19 08:31:27 -08:00
Nasreddine Bencherchali	3e93fb912d	Merge branch 'develop' into new-research-detection-endpoint	2025-02-19 14:52:13 +01:00
Nasreddine Bencherchali	de2162b94d	update logic and analytic	2025-02-19 14:50:57 +01:00
Nasreddine Bencherchali	819fc49369	Merge branch 'develop' into new-rules	2025-02-19 11:30:21 +01:00
Nasreddine Bencherchali	659a9a8b32	remove overlapping tagging	2025-02-19 11:26:50 +01:00
Bhavin Patel	2ab27cd8c5	Update suspicious_event_log_service_behavior.yml	2025-02-19 11:22:59 +01:00
Nasreddine Bencherchali	6f1d3e6fa6	Create windows_audit_policy_disabled_via_legacy_auditpol.yml	2025-02-19 11:22:59 +01:00
Nasreddine Bencherchali	ae708a0649	fix: rename analytic to comply with tests	2025-02-19 11:22:59 +01:00
Nasreddine Bencherchali	d66f4e00d9	Update windows_audit_policy_auditing_option_modified__registry.yml	2025-02-19 11:22:58 +01:00
Nasreddine Bencherchali	4e22f53684	feat: add 2 additional analytics related to auditing option modification	2025-02-19 11:22:58 +01:00
Nasreddine Bencherchali	c952f7b1a0	fix: remove unnecessary tests	2025-02-19 11:22:58 +01:00
Nasreddine Bencherchali	6b6d45831d	Update windows_event_logging_service_has_shutdown.yml	2025-02-19 11:22:58 +01:00
Nasreddine Bencherchali	9925f0d78c	Update windows_audit_policy_tampering.yml	2025-02-19 11:22:57 +01:00
Nasreddine Bencherchali	abfbe7a3c7	Update windows_event_logging_service_has_shutdown.yml	2025-02-19 11:22:57 +01:00
Nasreddine Bencherchali	1dfb2597c2	fix: update titles	2025-02-19 11:22:57 +01:00
Nasreddine Bencherchali	805d75c84d	fix: deprecate 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40	2025-02-19 11:22:56 +01:00
Nasreddine Bencherchali	ba36467ece	feat: add new analytic story and analytic	2025-02-19 11:22:18 +01:00
Nasreddine Bencherchali	c16e7a1a74	feat: add auditpol macro	2025-02-19 11:22:18 +01:00
Nasreddine Bencherchali	dba521c8e8	feat: add new auditpol related analytics	2025-02-19 11:22:17 +01:00
Nasreddine Bencherchali	7570a68a13	update logic to account for built-in sfc rare edge case	2025-02-19 11:15:07 +01:00
Bhavin Patel	c2eb1a26c9	Merge pull request #3321 from nterl0k/nterl0k-t1486-bitlocker-sus-commands ... Nterl0k - T1486 BitLocker Suspicious Commands	2025-02-18 17:43:17 -08:00
Bhavin Patel	50c22c96c5	Merge branch 'develop' into nterl0k-t1486-bitlocker-sus-commands	2025-02-18 17:27:06 -08:00
Bhavin Patel	52327020f9	Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil	2025-02-18 17:09:15 -08:00
Bhavin Patel	e11b63161c	Merge pull request #3344 from splunk/fix_dashboard_dropdown_match ... change match to two underscores	2025-02-18 16:36:57 -08:00
pyth0n1c	3782565aa6	Merge branch 'develop' into fix_dashboard_dropdown_match	2025-02-18 16:30:45 -08:00
pyth0n1c	87a2970ca9	Merge pull request #3341 from splunk/fix_datasource_typos ... Fix data_source fields on some content	2025-02-18 16:29:51 -08:00
pyth0n1c	2ae421d724	Merge branch 'develop' into fix_datasource_typos	2025-02-18 16:24:39 -08:00
Bhavin Patel	558f898df4	Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil	2025-02-18 15:46:31 -08:00
pyth0n1c	41f65e0bc7	change match to two underscroes	2025-02-18 15:26:17 -08:00
Nasreddine Bencherchali	c382e4147a	Merge branch 'develop' into new-rules	2025-02-18 23:57:37 +01:00
Bhavin Patel	a33941597e	Merge pull request #3276 from nterl0k/nterl0k-t1059-malicious-powershell-strings ... Nterl0k - T1059 - Generic Malicious Powershell Strings + Lookup	2025-02-18 13:40:10 -08:00
Bhavin Patel	f0d6c48267	Merge branch 'develop' into nterl0k-t1059-malicious-powershell-strings	2025-02-18 13:20:11 -08:00
Jose Enrique Hernandez	c77b129fc6	Merge branch 'develop' into new-research-detection-endpoint	2025-02-18 16:01:39 -05:00
Bhavin Patel	ebe37bb3fa	Merge pull request #3342 from splunk/show_dashboards_dropdown ... Show dashboard objects in dropdown	2025-02-18 11:48:53 -08:00
Bhavin Patel	13faf1ca7e	Merge branch 'develop' into show_dashboards_dropdown	2025-02-18 10:48:45 -08:00