admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 2f684c5680 Branch was auto-updated. pyth0n1c 2022-07-28 06:13:23 -07:00
  • cc74cea07f Branch was auto-updated. pyth0n1c 2022-07-28 06:13:22 -07:00
  • 17f4c812d5 Branch was auto-updated. fix-git-issue-req pyth0n1c 2022-07-28 06:13:20 -07:00
  • ebc9de0c2f Branch was auto-updated. pyth0n1c 2022-07-28 06:13:19 -07:00
  • c12e0b636d Branch was auto-updated. pyth0n1c 2022-07-28 06:13:18 -07:00
  • 84352e2511 Delete CNAME Jose Enrique Hernandez 2022-07-28 09:12:54 -04:00
  • 521fedf58a dcrat-analytics2 tccontre 2022-07-28 10:11:52 +02:00
  • 330f8e74e0 Update linux_persistence_and_privilege_escalation_risk_behavior.yml Michael Haag 2022-07-27 17:39:34 -06:00
  • 79f7fdd204 ssh and updated correlation Michael Haag 2022-07-27 16:25:56 -06:00
  • 6374fc8bf5 Update linux_obfuscated_files_or_information_base64_decode.yml Michael Haag 2022-07-27 15:38:25 -06:00
  • 55bc63720d auth key Michael Haag 2022-07-27 15:30:48 -06:00
  • f3ca7540f4 Update linux_decode_base64_to_shell.yml Michael Haag 2022-07-27 15:19:24 -06:00
  • 4c04be8f8a linux base64 decode Michael Haag 2022-07-27 15:08:05 -06:00
  • d3422d591f Fixed nested quoting issue pyth0n1c 2022-07-27 13:28:42 -07:00
  • 661dd7c658 Branch was auto-updated. pyth0n1c 2022-07-27 13:16:42 -07:00
  • edab9eae44 Branch was auto-updated. pyth0n1c 2022-07-27 13:16:41 -07:00
  • a36efff74b Branch was auto-updated. pyth0n1c 2022-07-27 13:16:40 -07:00
  • a84530b15b Branch was auto-updated. pyth0n1c 2022-07-27 13:16:39 -07:00
  • 95fa28a3e8 Branch was auto-updated. pyth0n1c 2022-07-27 13:16:38 -07:00
  • 0077178971 Branch was auto-updated. pyth0n1c 2022-07-27 13:16:37 -07:00
  • 8aba655c36 Merge pull request #2304 from splunk/dcrat-analytics Bhavin Patel 2022-07-27 13:16:18 -07:00
  • c7355566c2 Updated a couple more detections pyth0n1c 2022-07-27 13:14:35 -07:00
  • eeafbe7260 Update linux_kernel_module_enumeration.yml Michael Haag 2022-07-27 13:58:17 -06:00
  • e2408b8c1a kmod list Michael Haag 2022-07-27 13:54:30 -06:00
  • 998d33c557 First cut at quoting all the fields that need to be quoted. Surely we have missed a few and made some typos. pyth0n1c 2022-07-27 12:45:49 -07:00
  • 28c51d38ee More help in validating when a field exists in multiple potential datamodels. pyth0n1c 2022-07-27 10:29:59 -07:00
  • 4d84254970 Analytic Stories + Tagging Michael Haag 2022-07-27 10:29:47 -06:00
  • 37ad5a8675 dcrat-analytics2 tccontre 2022-07-27 15:41:43 +02:00
  • 2697fc4116 dcrat-analytics2 tccontre 2022-07-27 15:39:18 +02:00
  • b33f2bdee5 Update windows_system_shutdown_commandline.yml tccontre 2022-07-27 15:27:35 +02:00
  • 815df629ce Update windows_system_shutdown_commandline.yml tccontre 2022-07-27 15:27:10 +02:00
  • 07157ba511 dcrat-analytics2 tccontre 2022-07-27 15:23:34 +02:00
  • cf1f54c758 dcrat-analytics2 tccontre 2022-07-27 15:19:30 +02:00
  • a1369c71fc add crowdstrike data P4T12ICK 2022-07-27 12:59:12 +02:00
  • 119d998440 Merge branch 'update_detection_crwodstrike_data' of github.com:splunk/security_content into update_detection_crwodstrike_data P4T12ICK 2022-07-27 11:09:26 +02:00
  • 812819551e add crowdstrike data P4T12ICK 2022-07-27 11:08:52 +02:00
  • a78c180836 file update patel-bhavin 2022-07-26 17:21:56 -07:00
  • 8672c8d824 security sercvices deleteion activities patel-bhavin 2022-07-26 16:54:42 -07:00
  • 3c6d829e56 Added logic to make sure that the extracted field is actually found in one of the decalred datamodels. pyth0n1c 2022-07-26 15:57:24 -07:00
  • da30ab13bb Add the initial cut at datamodel and yaml parser. Include all of the datamodels, with the Risk.json and EUBA.json models as well. pyth0n1c 2022-07-26 15:38:29 -07:00
  • 2dd87d6d33 dcrat-analytics dcrat-analytics tccontre 2022-07-26 12:02:35 +02:00
  • 1ad91bcf32 add crowdstrike data P4T12ICK 2022-07-26 09:51:16 +02:00
  • 7eea768cde new detection putbucket lifecycle patel-bhavin 2022-07-25 16:29:57 -07:00
  • c55b3ed7e0 Merge pull request #2287 from splunk/TR-2222 Bhavin Patel 2022-07-25 10:48:37 -07:00
  • 51e7e64ca3 Updated lots of detections to have the correct datamodel. Still missing the required_fields, though but we will get to that. Update_Detections_to_Work_with_Required_Fields_Scanner pyth0n1c 2022-07-22 13:59:53 -07:00
  • e433c8fc3c Revert investigations as well UpdateRequiredFields pyth0n1c 2022-07-22 13:12:17 -07:00
  • 72f7731c6b Restored all the detections to the versions in develop. pyth0n1c 2022-07-22 13:07:44 -07:00
  • 89fb987623 Merge latest from develop, taking all of their changes pyth0n1c 2022-07-22 12:58:35 -07:00
  • 8aca2707da Typo when merging latest changes from develop caused failure during contentctl. Fixed - contentctl passes locally and should pass in GitHub too. pyth0n1c 2022-07-22 12:44:40 -07:00
  • c39c7fff56 merge of develop to get all the latest changes. pyth0n1c 2022-07-22 12:40:26 -07:00
  • 609d151e16 removing venv pyth0n1c 2022-07-22 11:45:02 -07:00
  • 0e1e6a2798 trying to use pip cache and auto install of requirements pyth0n1c 2022-07-22 11:42:45 -07:00
  • cfe4839136 typo in contentctl pyth0n1c 2022-07-22 11:31:37 -07:00
  • c2141acaf1 Forgot to activate virtualenv in next step after installing requirements. pyth0n1c 2022-07-22 11:29:50 -07:00
  • a219628235 Disable fail-fast behavior pyth0n1c 2022-07-22 11:22:24 -07:00
  • ba5e73e6a7 Updated name for 3.11 to 3.11-dev pyth0n1c 2022-07-22 11:20:30 -07:00
  • 0856357154 Need to quote python versions. Also added 3.11 because why not. pyth0n1c 2022-07-22 11:16:46 -07:00
  • 21adea0c76 Job to test contentctl and slim on different platforms with different python versions. pyth0n1c 2022-07-22 11:14:34 -07:00
  • b720ecd702 Branch was auto-updated. pyth0n1c 2022-07-21 14:39:27 -07:00
  • 7834ca8e88 Branch was auto-updated. pyth0n1c 2022-07-21 14:39:26 -07:00
  • a9aab00921 Branch was auto-updated. pyth0n1c 2022-07-21 14:39:25 -07:00
  • d65f58a985 Branch was auto-updated. pyth0n1c 2022-07-21 14:39:23 -07:00
  • 52c6b37787 Branch was auto-updated. pyth0n1c 2022-07-21 14:39:22 -07:00
  • b83185ebc4 Branch was auto-updated. pyth0n1c 2022-07-21 14:39:20 -07:00
  • 1247e88692 Merge pull request #2295 from splunk/dependabot/bundler/docs/nokogiri-1.13.7 Bhavin Patel 2022-07-21 14:38:58 -07:00
  • 02930ad974 Change from ResultsReader to JSONResultsReader since ResultsReader was deprecated in the latest Splunk SDK. pyth0n1c 2022-07-21 12:38:15 -07:00
  • 6e1c5f5c89 Update linux_persistence_and_privilege_escalation_risk_behavior.yml Michael Haag 2022-07-21 12:50:01 -06:00
  • d6a707bc09 Linux Correlation Michael Haag 2022-07-21 10:31:52 -06:00
  • 51edd7950a Condensed multiple requirements.txt files into single requirements.txt in the root of security_content. Removed explicit calls to python3 in CI/CD workflows and inside of the docker_detection_testing tool. These are not required and in fact should not be done since python interpreters started by the detection tester inherit the venv the parent was run under. pyth0n1c 2022-07-20 15:53:20 -07:00
  • 3d34352b9a Branch was auto-updated. pyth0n1c 2022-07-20 15:21:25 -07:00
  • b7fd7fb2b1 Branch was auto-updated. pyth0n1c 2022-07-20 15:21:24 -07:00
  • ae474fbefb Branch was auto-updated. pyth0n1c 2022-07-20 15:21:23 -07:00
  • 62c2b01d6f Branch was auto-updated. pyth0n1c 2022-07-20 15:21:22 -07:00
  • 5dbbf22cce Branch was auto-updated. pyth0n1c 2022-07-20 15:21:19 -07:00
  • 8b029edbef Branch was auto-updated. pyth0n1c 2022-07-20 15:21:18 -07:00
  • 13ffea7801 Merge pull request #2300 from splunk/deprecate_container_implantation_monitoring_and_investigation_story Bhavin Patel 2022-07-20 15:20:59 -07:00
  • 48271e8878 moving to deprecated d1vious 2022-07-20 17:52:11 -04:00
  • dce7b86179 add crowdstrike data to detection P4T12ICK 2022-07-20 14:58:23 +02:00
  • cad5215f3e add crowdstrike data to detection P4T12ICK 2022-07-20 12:36:41 +02:00
  • 2a2fd8b6f5 fix-git-issue-req tccontre 2022-07-20 11:10:15 +02:00
  • b21d754be3 attack_data_helper tccontre 2022-07-20 10:54:59 +02:00
  • 7f80da5894 updating docs and package bits [ci skip] research bot 2022-07-19 21:35:47 +00:00
  • 71d3996d4c Branch was auto-updated. pyth0n1c 2022-07-19 14:15:34 -07:00
  • 90c454b327 Branch was auto-updated. pyth0n1c 2022-07-19 14:15:33 -07:00
  • 04ebd3367c Branch was auto-updated. pyth0n1c 2022-07-19 14:15:32 -07:00
  • 01c769f54d Branch was auto-updated. pyth0n1c 2022-07-19 14:15:31 -07:00
  • 1e3d207675 Merge pull request #2285 from splunk/ProtoHaag v3.45.0 Bhavin Patel 2022-07-19 14:15:09 -07:00
  • 89f750135f Update windows_identify_protocol_handlers.yml Bhavin Patel 2022-07-19 14:12:15 -07:00
  • f9e2978db9 Branch was auto-updated. pyth0n1c 2022-07-19 13:50:54 -07:00
  • eb12371edf Branch was auto-updated. pyth0n1c 2022-07-19 13:50:53 -07:00
  • 6a0e563fc5 Branch was auto-updated. pyth0n1c 2022-07-19 13:50:52 -07:00
  • f347d26d39 Branch was auto-updated. pyth0n1c 2022-07-19 13:50:51 -07:00
  • e075a1a183 Branch was auto-updated. pyth0n1c 2022-07-19 13:50:50 -07:00
  • d166d1080a Merge pull request #2296 from splunk/Fix_GitHub_Actions_Test_Config_Syntax_Error Bhavin Patel 2022-07-19 13:50:29 -07:00
  • d5d7725afe JSON file contained the words None, which is correctly for Python code, instead of null which is valid JSON pyth0n1c 2022-07-19 13:47:05 -07:00
  • 8e2afd3b9b Branch was auto-updated. pyth0n1c 2022-07-19 13:27:49 -07:00
  • 62b5a31d7b Branch was auto-updated. pyth0n1c 2022-07-19 13:27:47 -07:00
  • 3ed49f35b9 Branch was auto-updated. pyth0n1c 2022-07-19 13:27:46 -07:00
  • d09d549e2b Branch was auto-updated. pyth0n1c 2022-07-19 13:27:44 -07:00
  • bac44ba666 Branch was auto-updated. pyth0n1c 2022-07-19 13:27:41 -07:00