167 Commits

Author	SHA1	Message	Date
Bhavin Patel	0f1b6189ab	Merge branch 'develop' into gcp_account_takeover	2022-10-31 12:41:52 -07:00
mvelazco	142d52872f	updating detection	2022-10-18 11:36:29 -04:00
mvelazco	2afe6af188	fixing yaml issues	2022-10-17 11:44:39 -04:00
mvelazco	7bada443b3	Merge branch 'gcp_account_takeover' of github.com:splunk/security_content into gcp_account_takeover	2022-10-14 15:03:56 -04:00
mvelazco	744bc50190	adding 4 GCP account takeover detections	2022-10-14 15:03:54 -04:00
patel-bhavin	56abcaeb12	new sourcetype	2022-10-13 18:07:01 -07:00
patel-bhavin	92f0ff7f5f	gcp_stdev	2022-10-13 15:58:37 -07:00
patel-bhavin	cd70fb50e7	adding gcp configs	2022-10-12 18:09:41 -07:00
patel-bhavin	9c1f8bccc4	new SFA detection	2022-10-04 13:48:48 -07:00
patel-bhavin	47b0525a18	mfa_disabled	2022-10-04 11:50:03 -07:00
srv-rr-gh-researchbt	5f93886f62	Branch was auto-updated.	2022-10-03 17:04:07 -07:00
patel-bhavin	07a9ec11c9	new detectoion	2022-10-03 16:48:23 -07:00
patel-bhavin	e39385fb34	new_mfa_Detections	2022-10-03 15:42:16 -07:00
patel-bhavin	86c4816f98	nnew detection and multiple searches	2022-09-26 16:25:49 -05:00
patel-bhavin	0c0603e701	password spray detection std dev	2022-09-26 15:56:29 -05:00
pyth0n1c	da686eb237	Branch was auto-updated.	2022-09-14 09:17:49 -07:00
mvelazco	d8cce69644	adding new detection	2022-09-06 16:08:35 -04:00
mvelazco	3d308b862f	adding new detection	2022-09-02 18:25:34 -04:00
mvelazco	441a1542bd	adding new detection. fixing types. adding line to lookup	2022-09-02 18:03:14 -04:00
mvelazco	9e94c62a6a	adding new detection	2022-08-30 18:25:25 -04:00
mvelazco	927d46a74e	adding new detection	2022-08-30 13:07:41 -04:00
mvelazco	79f7f9c16e	adding new detection	2022-08-29 17:00:05 -04:00
mvelazco	2a0c7a69d1	adding new detection	2022-08-25 16:02:54 -04:00
mvelazco	779ec07f0e	adding description. updating dataset url	2022-08-24 11:13:03 -04:00
mvelazco	f0926a5372	update detections	2022-08-23 23:40:54 -04:00
mvelazco	0a6592b9e2	adding new detection. fixing another	2022-08-23 21:45:22 -04:00
mvelazco	63398504c5	Merge branch 'TR-2361_Azure_AD_Persistence' of github.com:splunk/security_content into TR-2361_Azure_AD_Persistence	2022-08-23 16:28:56 -04:00
mvelazco	63f87f5a12	adding new detection	2022-08-23 16:28:55 -04:00
pyth0n1c	a1b3e4c6f7	Branch was auto-updated.	2022-08-23 13:05:52 -07:00
mvelazco	0a10ef85d6	fixing detection. adding azure_audit macro	2022-08-22 15:36:25 -04:00
gowthamarajr	136cbb1ea8	Add detection for "Azure AD External Guest User Invited"	2022-08-19 10:39:07 -04:00
mvelazco	fae2c64476	adding new detection. other minor changes	2022-08-19 00:16:18 -04:00
mvelazco	38ee247989	Merge branch 'TR-2361_Azure_AD_Persistence' of github.com:splunk/security_content into TR-2361_Azure_AD_Persistence	2022-08-18 14:50:18 -04:00
mvelazco	7b137ad6b9	adding new detection and fixing a few others	2022-08-18 14:50:16 -04:00
gowthamarajr	41a7f4380e	Add 2 detections	2022-08-17 18:43:40 -04:00
mvelazco	b2332df9a0	Merge branch 'Update_Azure_Account_Takeover' of github.com:splunk/security_content into Update_Azure_Account_Takeover	2022-08-16 12:13:02 -04:00
mvelazco	d00a4b2ae6	updating detection yaml	2022-08-16 12:13:00 -04:00
pyth0n1c	7d441871cb	Branch was auto-updated.	2022-08-16 08:40:56 -07:00
gowthamarajr	6759feccd4	Add Azure AD Multi-Factor Authentication Disabled	2022-08-15 17:22:54 -04:00
patel-bhavin	8d25d3d27a	getpassworddata	2022-08-10 16:03:18 -07:00
mvelazco	5579f1ebdb	adding new detection	2022-08-10 13:34:18 -04:00
gowthamarajr	3cc956cd99	Add AWS Credential Access detections	2022-08-08 01:47:33 -04:00
pyth0n1c	53fb29f36e	Branch was auto-updated.	2022-07-28 13:11:00 -07:00
patel-bhavin	a78c180836	file update	2022-07-26 17:21:56 -07:00
patel-bhavin	8672c8d824	security sercvices deleteion activities	2022-07-26 16:54:42 -07:00
patel-bhavin	7eea768cde	new detection putbucket lifecycle	2022-07-25 16:29:57 -07:00
Bhavin Patel	c55b3ed7e0	Merge pull request #2287 from splunk/TR-2222 ... AWS Defense Evasion Stop Logging Cloudtrail	2022-07-25 10:48:37 -07:00
gowthamarajr	c2decc3b9c	Add AWS defense evasion ... 1. Update Cloudtrail 2. Delete CloudWatch log group	2022-07-19 11:56:41 -04:00
mvelazco	d6dd5098be	adding new detection	2022-07-14 13:29:55 -04:00
patel-bhavin	5bf8a69beb	delete cloudtrail	2022-07-13 12:49:43 -07:00