cda681eb8b
Merge pull request #2260 from splunk/DetectionFixes
...
Detection fixes
2022-06-22 13:19:16 -04:00
52fa6467a9
Updated per customer feedback
2022-06-22 09:17:14 -05:00
54203d6858
Fixing detection to conform to new sysmon
...
behavior.
2022-06-21 17:21:30 -07:00
b73ea9e5ae
Added another custom_index to a test
...
file that was failing because it did not
have one.
2022-06-21 16:59:44 -07:00
07a13ca16b
Merge pull request #2240 from splunk/more-defense-evasion
...
more-defense-evasion
2022-06-21 16:44:59 -07:00
8d04037125
Update windows_impair_defenses_disable_win_defender_auto_logging.yml
2022-06-21 16:28:05 -07:00
35908f5a30
Removed user from the stats call of this search
...
since it does not exist and the field userName
does exist. And it is likely to have captured
the same data.
2022-06-21 16:25:20 -07:00
62ed8fe817
Branch was auto-updated.
2022-06-21 16:07:16 -07:00
471ee2b8a5
Merge pull request #2220 from splunk/inspired_2194
...
Dupliate: PR 2194
2022-06-21 19:06:53 -04:00
b5c79b6db8
Added a custom index for a detection test
...
that was created when custom_index
support did not yet exist.
2022-06-21 15:53:26 -07:00
88ce513e8e
Branch was auto-updated.
2022-06-21 15:47:24 -07:00
349551a98f
Branch was auto-updated.
2022-06-21 15:47:21 -07:00
7f38d4e78e
Merge pull request #2252 from splunk/fixing_incorrect_story
...
fixing incorrect story pointer
2022-06-21 15:47:05 -07:00
7816778eae
Removed the field "user" from the stats
...
line. It does not appear to exist in the raw
data and is not pulled into any field(s).
However, there is a field called userName
which, presumably, represents the same data.
2022-06-21 15:45:00 -07:00
d671db062d
Branch was auto-updated.
2022-06-21 15:28:41 -07:00
6616463196
Branch was auto-updated.
2022-06-21 15:28:39 -07:00
6cbace8412
Branch was auto-updated.
2022-06-21 15:28:38 -07:00
e470e2b6d8
Merge pull request #2257 from splunk/2253_fix
...
Rundll32 LockWorkstation search
2022-06-21 18:28:11 -04:00
aa228e84be
hunting
2022-06-21 14:55:19 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
de30c530eb
Branch was auto-updated.
2022-06-21 14:46:29 -07:00
88f26544e2
Branch was auto-updated.
2022-06-21 14:46:26 -07:00
c42c8acce2
Branch was auto-updated.
2022-06-21 14:46:22 -07:00
6fc1b95369
Merge pull request #2258 from splunk/properly_detected_failed_attack_data_downloads
...
Properly detected failed attack data downloads
2022-06-21 14:46:03 -07:00
26f6bbfc92
Adding the URL_TOOLBOX app to
...
the application baseline.
2022-06-21 14:29:11 -07:00
6554d4a42b
Moved ssa___ test file from the tests/network directory to the tests/experimental/endpoint directory because that's where the corresponding detection resides.
2022-06-21 13:59:50 -07:00
5762b4e373
Updated the app baseline as well as
...
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
575cd80e01
Updated observable & asset_type
2022-06-21 15:17:25 -05:00
6b06ab718b
Fixing a link to a dataset that has been moved.
2022-06-21 13:13:50 -07:00
e681b766c2
Fixing field name
2022-06-21 14:59:48 -05:00
c98d7b6855
Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest.
2022-06-21 12:52:32 -07:00
85f4f107a3
Changed to anomaly
2022-06-21 14:45:43 -05:00
a92a6f2546
map filter
2022-06-21 12:24:04 -07:00
8ca9ac7b57
adding urltoolbox and spl updates
2022-06-21 12:05:52 -07:00
2ea683be87
Merge branch 'develop' into inspired_2194
2022-06-21 11:04:27 -07:00
53bc5dcda4
fixing incorrect story pointer
2022-06-20 16:33:35 -04:00
7321d6d835
Branch was auto-updated.
2022-06-16 11:35:27 -07:00
fc06b83cf6
Merge pull request #2250 from splunk/fix_cve_tag
...
CVE Tag Fix
2022-06-16 14:35:07 -04:00
dbf1c52864
Update splunk_process_injection_forwarder_bundle_downloads.yml
2022-06-16 13:08:02 -05:00
333039e8ad
Branch was auto-updated.
2022-06-15 12:21:36 -07:00
81180f53ca
Merge pull request #2248 from splunk/exp_unauth_assets_fix
...
Experimental Network search update
2022-06-15 15:21:11 -04:00
863259df93
Updated per #2235
2022-06-15 13:49:56 -05:00
df7ec18786
Branch was auto-updated.
2022-06-14 20:14:11 -07:00
0cf536acd5
fix path error
2022-06-14 20:13:42 -07:00
18a1877373
Branch was auto-updated.
2022-06-14 08:57:07 -07:00
51e6298c9f
Merge pull request #2247 from splunk/research_update
...
update site
2022-06-14 11:56:42 -04:00
72c71bbfcb
update site
2022-06-14 10:38:43 -05:00
3d87d4f704
Branch was auto-updated.
2022-06-14 08:18:34 -07:00
6807c3cc4f
Merge pull request #2246 from splunk/story_fix
...
Update splunk_process_injection_forwarder_bundle_downloads.yml
2022-06-14 10:18:07 -05:00
b392ca9aa5
Update splunk_process_injection_forwarder_bundle_downloads.yml
...
Spelling fix
2022-06-14 09:58:09 -05:00
Jose Enrique Hernandez