admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 1ab2f401c7 Updates to simplify escu app generation, removing legacy code that is no longer used. This is progress towards fixing the issue where *.mlmodel files were not included in the detection_testing app generation. pyth0n1c 2022-09-27 10:18:02 -07:00
  • 979f6f6129 Merge branch 'support_multiple_tests_per_detection' of https://github.com/splunk/security_content into support_multiple_tests_per_detection pyth0n1c 2022-09-27 09:20:21 -07:00
  • 2a5807af83 Fix infinite loop when baselines search fails even after tmax time pyth0n1c 2022-09-27 09:20:13 -07:00
  • a1880f5770 data fix Michael Haag 2022-09-27 09:55:53 -06:00
  • 63f679f2fc Office Product Spawning Windows Script Host Michael Haag 2022-09-27 08:00:34 -06:00
  • 5ad56eb838 updating docs and package bits [ci skip] research bot 2022-09-27 13:35:18 +00:00
  • b2617ccb5d fixing make all detection ba specific d1vious 2022-09-26 20:16:22 -04:00
  • 479246a9fa Branch was auto-updated. pyth0n1c 2022-09-26 17:15:21 -07:00
  • c640bd2b53 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:20 -07:00
  • 8976111349 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:19 -07:00
  • 170d89d2f1 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:18 -07:00
  • a21eb4dc05 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:17 -07:00
  • c80d6f6a6c Branch was auto-updated. pyth0n1c 2022-09-26 17:15:16 -07:00
  • 033aaf8fcf Branch was auto-updated. pyth0n1c 2022-09-26 17:15:15 -07:00
  • b162b32d5b Branch was auto-updated. pyth0n1c 2022-09-26 17:15:14 -07:00
  • 3bf0c6d2cf Branch was auto-updated. pyth0n1c 2022-09-26 17:15:13 -07:00
  • b0963aca74 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:13 -07:00
  • 5c0cf5ab00 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:12 -07:00
  • 67a53f12fe Branch was auto-updated. pyth0n1c 2022-09-26 17:15:11 -07:00
  • 7c545cbce4 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:10 -07:00
  • 55023b8d11 Branch was auto-updated. pyth0n1c 2022-09-26 17:15:09 -07:00
  • 081bf9fd77 Merge pull request #2386 from splunk/fixing-winxml-log v3.49.1 Jose Enrique Hernandez 2022-09-26 20:14:53 -04:00
  • 2555556301 Removed extra printout and added a clear success/failure printout pyth0n1c 2022-09-26 17:06:21 -07:00
  • 124bcd1974 Better error detection/collection for baselines. Previously we treated a failed search in a baseline as an exception, but this is not necessarily true. This was causing searches which didn't immediately have a successful baseline to fail, which is obviously not correct - we were not allowing multiple attempts for the data to be ingested before quitting. pyth0n1c 2022-09-26 16:49:05 -07:00
  • f1d93ba5af format updates patel-bhavin 2022-09-26 17:05:51 -05:00
  • 84ad82a95f yml error patel-bhavin 2022-09-26 16:52:35 -05:00
  • db9068b4fb updating azure patel-bhavin 2022-09-26 16:50:02 -05:00
  • 2ba2bc8e53 Update detect_dga_domains_using_pretrained_model_in_dsdl.yml Bhavin Patel 2022-09-26 16:41:32 -05:00
  • 86c4816f98 nnew detection and multiple searches patel-bhavin 2022-09-26 16:25:49 -05:00
  • 0c0603e701 password spray detection std dev patel-bhavin 2022-09-26 15:56:29 -05:00
  • 880691a7c9 Update cisa_aa22_264a.yml Michael Haag 2022-09-26 14:30:26 -06:00
  • 902221712b making changes to how to implement Namratha Sreekanta 2022-09-26 12:26:31 -07:00
  • 94787c626f New content Michael Haag 2022-09-26 13:00:17 -06:00
  • b3a8f13023 update description mvelazco 2022-09-26 11:03:27 -04:00
  • 1557acd7ab Update ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml Jose Enrique Hernandez 2022-09-26 10:16:04 -04:00
  • 2932ebb1fa Adding more feedback Namratha Sreekanta 2022-09-23 16:28:58 -07:00
  • 7b365ddde6 experimental support for local data sources pyth0n1c 2022-09-23 13:32:08 -07:00
  • 27dad59624 migrating detections to XML mvelazco 2022-09-23 15:45:24 -04:00
  • 33d27fbcc5 Merge branch 'support_multiple_tests_per_detection' of https://github.com/splunk/security_content into support_multiple_tests_per_detection pyth0n1c 2022-09-23 12:40:31 -07:00
  • d5b4099798 Removed power_user reference and unused enable_delete functionality. pyth0n1c 2022-09-23 12:37:19 -07:00
  • 23b960f788 Update Windows TA to patched Windows TA to resolve issues with Powershell Script Block logging events, long events greater than 10k characters, events that are not split properly, and events greater than 256 lines. The modified TA contains a number of changes to props.conf. pyth0n1c 2022-09-23 12:29:08 -07:00
  • 56de63cff1 updating macro mvelazco 2022-09-23 11:46:17 -04:00
  • 34b6e08638 Changing README.md instructions Namratha Sreekanta 2022-09-22 16:32:17 -07:00
  • 83eb61820e Changing README.md instructions Namratha Sreekanta 2022-09-22 16:30:31 -07:00
  • 98ddedb20f Merge branch 'dga_detection_dltk' of ssh://github.com/splunk/security_content into dga_detection_dltk Namratha Sreekanta 2022-09-22 14:59:38 -07:00
  • d22e6db5ef minor change in the detection Namratha Sreekanta 2022-09-22 14:57:42 -07:00
  • 1d6dec71f0 Branch was auto-updated. pyth0n1c 2022-09-22 14:01:58 -07:00
  • d7e138a451 Branch was auto-updated. pyth0n1c 2022-09-22 14:01:57 -07:00
  • fbb9ca156c Branch was auto-updated. pyth0n1c 2022-09-22 14:01:56 -07:00
  • a3d4f48bbf Branch was auto-updated. pyth0n1c 2022-09-22 14:01:55 -07:00
  • 9545602c9e Branch was auto-updated. pyth0n1c 2022-09-22 14:01:54 -07:00
  • be37003bb7 Branch was auto-updated. pyth0n1c 2022-09-22 14:01:52 -07:00
  • d569683104 Branch was auto-updated. pyth0n1c 2022-09-22 14:01:51 -07:00
  • 2675c2b30e Branch was auto-updated. pyth0n1c 2022-09-22 14:01:50 -07:00
  • 7de3114478 Branch was auto-updated. pyth0n1c 2022-09-22 14:01:49 -07:00
  • a5c540385b Branch was auto-updated. pyth0n1c 2022-09-22 14:01:48 -07:00
  • 0d4489e42e Branch was auto-updated. pyth0n1c 2022-09-22 14:01:47 -07:00
  • b12d27fefb Branch was auto-updated. pyth0n1c 2022-09-22 14:01:46 -07:00
  • 5ad88e2b7c Branch was auto-updated. pyth0n1c 2022-09-22 14:01:45 -07:00
  • b3ab14e9fe Merge pull request #2382 from splunk/story_name_fix Jose Enrique Hernandez 2022-09-22 17:01:23 -04:00
  • 109bf5e707 modifying existing detections and adding new mvelazco 2022-09-22 15:00:21 -04:00
  • 58d0653161 Merge branch 'develop' into support_multiple_tests_per_detection pyth0n1c 2022-09-22 11:34:25 -07:00
  • bff89c6a92 renaming detections mvelazco 2022-09-22 12:21:11 -04:00
  • 551d3f7cb6 Merge branch 'TR-2326_migrate_password_spraying_xml' of github.com:splunk/security_content into TR-2326_migrate_password_spraying_xml mvelazco 2022-09-22 11:43:24 -04:00
  • fee038e7ff renaming detections mvelazco 2022-09-22 11:43:22 -04:00
  • 98f46d7043 CISA AA22-264A Michael Haag 2022-09-22 09:25:52 -06:00
  • 986716a55f IceID -> IcedID Lou Stella 2022-09-22 09:20:02 -05:00
  • 6678a4ee55 fixing build failure Namratha Sreekanta 2022-09-21 13:35:47 -07:00
  • 055f0a175a adding review comments Namratha Sreekanta 2022-09-21 13:20:47 -07:00
  • 98695e754b Changed from XmlWinEventLog to xmlwineventlog pyth0n1c 2022-09-21 11:48:11 -07:00
  • 2b8a7c8c60 Update SECURITY.md d1vious-patch-1 Jose Enrique Hernandez 2022-09-21 10:24:10 -04:00
  • 30c770fcf5 Update windows_mail_protocol_in_non_common_process_path.yml tccontre 2022-09-21 13:20:01 +02:00
  • 1b74f72760 Update windows_file_transfer_protocol_in_non_common_process_path.yml tccontre 2022-09-21 13:18:09 +02:00
  • 45e7fb8e40 Update office_application_spawn_rundll32_process.yml tccontre 2022-09-21 12:52:00 +02:00
  • 859a79ccf5 Update executables_or_script_creation_in_suspicious_path.yml tccontre 2022-09-21 12:48:16 +02:00
  • 66cb904a18 Update office_application_drop_executable.yml tccontre 2022-09-21 12:46:26 +02:00
  • 2b0a406ed8 Update non_firefox_process_access_firefox_profile_dir.yml tccontre 2022-09-21 12:44:36 +02:00
  • 6d84252308 Update executables_or_script_creation_in_suspicious_path.yml tccontre 2022-09-21 12:42:41 +02:00
  • 28d6d6a529 Update non_chrome_process_accessing_chrome_default_dir.yml tccontre 2022-09-21 12:41:59 +02:00
  • be6c16084a agent-with-tesla-2 tccontre 2022-09-21 11:24:35 +02:00
  • 16d4d226c3 agent-with-tesla-2 tccontre 2022-09-21 10:27:23 +02:00
  • fe0bcd9880 Updating Analytic Story dluxtron 2022-09-21 10:53:23 +10:00
  • dee4f1b672 Updating Analytic Story dluxtron 2022-09-21 09:09:34 +10:00
  • 5f958fa1e5 Updating Analytic Story dluxtron 2022-09-21 09:02:32 +10:00
  • f5fb35ec4c changing README and few fields regarding the search Namratha Sreekanta 2022-09-20 16:00:12 -07:00
  • ab95f8374a Updated the summarization code to work with the new output files pyth0n1c 2022-09-20 14:28:43 -07:00
  • d7278d1239 adding OCSF example Jose Enrique Hernandez 2022-09-20 16:51:26 -04:00
  • 56aea9de22 Adding in Sharad's inputs on descriptioj Namratha Sreekanta 2022-09-20 12:28:53 -07:00
  • 8b68e20e80 Fixed bug where we did not update the result_count after a failed test completed. pyth0n1c 2022-09-20 11:54:46 -07:00
  • 8fa7fffa2a changing the desc to match the detection Namratha Sreekanta 2022-09-20 11:33:06 -07:00
  • 43c213a74c modifying the search and adding a README file Namratha Sreekanta 2022-09-20 11:20:13 -07:00
  • 701bebd0a6 Generate proper output file name in the proper location. Resolve issue with cleanup when a test generates an exception that prevented shutdown from finishing. pyth0n1c 2022-09-20 11:07:09 -07:00
  • 5dbdf3ce38 Fixed logic for handling when a test fails with an uncaught error. Previously, this could get testing stuck in an infinite loop. pyth0n1c 2022-09-20 09:42:54 -07:00
  • 3041fd1e9e updating docs and package bits [ci skip] research bot 2022-09-20 15:17:35 +00:00
  • 99b8b2f4eb Fixed output of files names when running a mock. Handle errors when processing a detection test generates an error. pyth0n1c 2022-09-20 07:46:15 -07:00
  • 091f35ee4a Update to get selected mode working and to force-test everything in GitHub Actions pyth0n1c 2022-09-19 17:01:21 -07:00
  • 6b09b24a5a wait a bit longer to check on ackid pyth0n1c 2022-09-19 16:18:59 -07:00
  • f07ac5187b Must use shutil.rmtree to delete non-empty directory. pyth0n1c 2022-09-19 15:50:54 -07:00
  • 38f135ee81 Remove data after a single detection is tested instead of when all detections have finished testing. pyth0n1c 2022-09-19 15:46:00 -07:00
  • c97c6a3180 Use the proper port for HEC replay on multiple containers. Fast fail if there is an actual error when testing. pyth0n1c 2022-09-19 15:30:52 -07:00