b7e1a5fe94
adding new detections
2022-08-16 11:30:24 -04:00
cb150c258e
minor edits for yml validation and test file name update
2022-06-23 15:21:30 -07:00
8d568ae416
model to detect risky commands
2022-06-23 22:43:22 +02:00
ad2ae86220
Branch was auto-updated.
2022-06-22 10:19:35 -07:00
67f35bba10
model to detect risky commands
2022-06-22 16:39:33 +02:00
b73ea9e5ae
Added another custom_index to a test
...
file that was failing because it did not
have one.
2022-06-21 16:59:44 -07:00
b5c79b6db8
Added a custom index for a detection test
...
that was created when custom_index
support did not yet exist.
2022-06-21 15:53:26 -07:00
0cf536acd5
fix path error
2022-06-14 20:13:42 -07:00
9a266a78ee
update per review comments
2022-06-13 15:33:12 -07:00
5a34e6c633
add risky command abuse ML detection
2022-06-13 10:53:09 -07:00
d5c65edc6a
Branch was auto-updated.
2022-06-13 10:41:17 -07:00
3369d15d72
rm wrong commit
2022-06-13 10:40:47 -07:00
d5fa5ddc0b
Branch was auto-updated.
2022-06-13 09:51:47 -07:00
6efcbd4b93
add risky command ML detection
2022-06-13 09:50:58 -07:00
c538613139
wrong detection file linked from
...
test file. Fixed.
2022-06-08 16:47:56 -07:00
b87dff2883
Fixing name field in a detection
...
test file
2022-06-08 16:01:21 -07:00
10b2b29122
Adding appropriate custom_index to detection
...
and fixing naming error and file_name error
2022-06-08 12:14:46 -07:00
47cd84d377
Wrong sourcetype declared in one
...
of the test files, causing it to fail.
Fixed missing backticks on some
macros.
2022-06-08 11:46:42 -07:00
e8abbd916b
Added missing _internal custom_indexes
...
to relevant test files. Removed the |
character from searches that use
index and sourcetype macros at the
beginning of the search.
2022-06-08 11:08:21 -07:00
3fb342d4c4
Fixed improperly named macro.
...
Renamed the macro in the tests
that use that macro. Added the
optional field, "custom_index"
to the test files which MUST
upload data into the _audit
index. This branch doesn't
support custom_index yet,
but those changes will be merged
soon from another branch.
2022-06-08 10:31:53 -07:00
926e63649a
delete usage
2022-05-27 14:41:34 -06:00
fb25e4def0
Splunk Command and Scripting Interpreter Risky Commands
2022-05-26 11:38:35 -06:00
21d5a68dd9
Splunk Command and Scripting Interpreter Risky Commands
2022-05-26 11:28:08 -06:00
7d2a728085
anomaly for non TLS forwarders
2022-05-26 12:21:20 -05:00
4b7bfb516a
terge branch 'vj9r' of github.com:splunk/security_content into vj9r
2022-05-26 10:00:24 -07:00
522e569ced
splkselfsigneddetection
2022-05-26 09:58:07 -07:00
92037c5992
deployment server
2022-05-26 11:39:00 -05:00
a766811c56
0602 hunt
2022-05-26 10:32:09 -05:00
39ee01a256
datasetx
2022-05-26 08:04:57 -07:00
f29d6f9920
renamedsearch
2022-05-26 07:44:46 -07:00
b9d79c5ab1
changednameofdetection
2022-05-26 07:25:17 -07:00
7bd8441806
Adding test, random data since irrelevant to detection
2022-05-25 13:55:43 -05:00
b51c088513
Fixing typo
2022-05-25 10:55:42 -05:00
99d314eeea
initialsearchskeleton
2022-05-24 17:29:15 -07:00
6fe602533b
Removed detection
2022-05-02 14:30:43 -05:00
a71f12b921
Merge branch 'TR-1828' of github.com:splunk/security_content into TR-1828
2022-04-29 10:18:39 -07:00
c43dc89bbf
detectionsforlocalprivescpathtraversal
2022-04-29 10:17:14 -07:00
c61f8670f8
CVE-2021-33845
2022-04-29 11:31:33 -05:00
de6ccbbf9c
CVE-2022-27183
2022-04-27 12:44:48 -05:00
86f2dddba4
Updated test
2022-03-28 09:56:00 -05:00
c758275a39
Updates
2022-03-25 13:35:13 -05:00
fb3d9bd32b
Updated test name
2022-03-24 16:17:46 -05:00
86430c55cc
Created Application Dirs
2022-03-24 16:13:36 -05:00
1f6c5070d0
cleaned up cruft from repo
2021-09-28 17:18:51 -04:00
ebffd874e8
fix the 101% detection coverage
2021-04-23 14:11:58 +02:00
495619a78c
Merge branch 'develop' into TR-253
2020-12-14 09:32:55 -08:00
3676b6a77a
fixed links to assertions in test
2020-12-03 10:41:09 -08:00
f04037b065
Basic assertion language
2020-12-03 10:41:09 -08:00
b36ca748cd
updated url links for dataset
2020-12-03 15:03:50 +01:00
13dd351a75
new test file format
2020-11-26 09:48:01 +01:00
d1vious