admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • e7580faf5f Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow. pyth0n1c 2022-05-10 17:08:24 -07:00
  • cdb66ae143 More optimizations in content_ctl. No longer generate ba_factory or factory if they are not needed - only generate the one or ones that are required. Also, provide status printouts for the AttackEnrichment so that the user can monitor progress and be sure something is happening. pyth0n1c 2022-05-10 15:49:45 -07:00
  • aa13247897 update detection yml patel-bhavin 2022-05-10 15:25:55 -07:00
  • b7ea8fc27d kvstore bugs patel-bhavin 2022-05-10 13:42:19 -07:00
  • 6e6c7f5f4a More finishing touches on link validation. Now, failures are printed out at the end after all links have been checked instead of when the tool is running, making it easier to read. Files that referernce the link are also included. pyth0n1c 2022-05-10 13:15:52 -07:00
  • 67a0ed2821 Removed some un needed prints from Link Validator. Added progress indicators to the steps of the factory so that users have feedback on what is going on when contentctl is running. This is helpful since it can run for an extended period of time, especially on a slower or high latency connection, when links are being validated, or when caching is not enabled. pyth0n1c 2022-05-10 12:00:31 -07:00
  • 28118ff54f Branch was auto-updated. pyth0n1c 2022-05-10 13:43:32 -04:00
  • 5e98b98392 Branch was auto-updated. pyth0n1c 2022-05-10 13:43:31 -04:00
  • bdffcc0e8d Branch was auto-updated. pyth0n1c 2022-05-10 13:43:30 -04:00
  • 44000fe75f Branch was auto-updated. pyth0n1c 2022-05-10 13:43:29 -04:00
  • fb9628d3f9 Branch was auto-updated. pyth0n1c 2022-05-10 13:43:29 -04:00
  • 8b83205061 Branch was auto-updated. pyth0n1c 2022-05-10 13:43:27 -04:00
  • c5830c95d5 Merge pull request #2189 from splunk/Add_Palo_Alto_TA pyth0n1c 2022-05-10 13:43:08 -04:00
  • a5f9241650 Added Palo Alto TA in support of CRITICAL CVE 2022-1388 Detection. pyth0n1c 2022-05-10 10:31:16 -07:00
  • 77abe77035 F5 BIG-IP mhaag-spl 2022-05-10 07:20:46 -06:00
  • 0e539fa550 conflicts patel-bhavin 2022-05-06 13:06:37 -07:00
  • e8e9a6ab29 Branch was auto-updated. pyth0n1c 2022-05-06 11:58:10 -07:00
  • 3f61bc121f Branch was auto-updated. pyth0n1c 2022-05-06 11:58:09 -07:00
  • 22ab195234 Branch was auto-updated. pyth0n1c 2022-05-06 11:58:08 -07:00
  • eb42ce331e Branch was auto-updated. pyth0n1c 2022-05-06 11:58:07 -07:00
  • 4297c59980 Merge pull request #2136 from splunk/pwh_xml_2 Bhavin Patel 2022-05-06 11:57:45 -07:00
  • 0b5cedc2fd Branch was auto-updated. pyth0n1c 2022-05-06 11:30:59 -07:00
  • b144519ea6 Branch was auto-updated. pyth0n1c 2022-05-06 11:30:58 -07:00
  • 055dcaa03e Branch was auto-updated. pyth0n1c 2022-05-06 11:30:57 -07:00
  • f425193088 Branch was auto-updated. pyth0n1c 2022-05-06 11:30:56 -07:00
  • 4d1763b572 Branch was auto-updated. pyth0n1c 2022-05-06 11:30:53 -07:00
  • 5559c00638 Merge pull request #2102 from splunk/pwh_xml Bhavin Patel 2022-05-06 11:30:31 -07:00
  • 763e2eed8b Update linux_deletion_of_ssh_key.yml pyth0n1c 2022-05-06 13:58:32 -04:00
  • 00d82f98b2 firstiterationdelsshkfix Rod Soto 2022-05-06 09:03:57 -07:00
  • 7637c4c052 fixes mhaag-spl 2022-05-06 09:25:49 -06:00
  • 1a36d0e75e Renamed escu directory to DA-ESS-ContentUpdate and added lookups fix/update-escu-build akhunti 2022-05-06 16:55:03 +05:30
  • 8c2458a717 Bring back resultCount as well. We will compare this value to eventCount. They are different numbers. IncludeEventCountInResults pyth0n1c 2022-05-05 19:39:10 -07:00
  • 51e707a0a3 Moved a test file from the non-experimental folder to the experimental folder. Its corresponding detection file was already located in the experimental folder. pyth0n1c 2022-05-05 19:25:53 -07:00
  • 9e9ef8d329 Bing back eventCount when running a search. This is important in determining the number of results a search finds and determining which searches, if any, produce a particularly large number of results. These searches may be eligible for improvement. pyth0n1c 2022-05-05 19:16:54 -07:00
  • c1ab5a491b Added check_references passthrough from contentctl to the builders. pyth0n1c 2022-05-04 17:09:36 -07:00
  • d814d4d74a Added link validation to playbooks and performed successful tests against all Stories, Playbooks, Baselines, Detections, and Investigations. Also tested when the check_references or --no-check_references flags are passed successfully! pyth0n1c 2022-05-04 17:08:41 -07:00
  • b60db04b71 Added link validator code to baselines, detections, investigations, and stories. Still some testing to be done. pyth0n1c 2022-05-04 16:50:18 -07:00
  • 54798186a9 Saving changes made to support URL verification which is working - but we have now broken these out into a more robust class link_validator.py pyth0n1c 2022-05-04 16:24:02 -07:00
  • c0dc8541b4 Added a class for validating links. This class performs its own type of caching, similar to functools caching, but keeps additional metrics suitable for dumping when all validation has completed. pyth0n1c 2022-05-04 16:22:40 -07:00
  • 1b881ee6a5 Branch was auto-updated. pyth0n1c 2022-05-03 17:15:21 -07:00
  • b862c418a4 Branch was auto-updated. pyth0n1c 2022-05-03 17:15:20 -07:00
  • 27435e33ef Branch was auto-updated. pyth0n1c 2022-05-03 17:15:19 -07:00
  • b5aa58e148 Branch was auto-updated. pyth0n1c 2022-05-03 17:15:18 -07:00
  • ba7012b9e1 Branch was auto-updated. pyth0n1c 2022-05-03 17:15:17 -07:00
  • 709d2cdb6f Branch was auto-updated. pyth0n1c 2022-05-03 17:15:16 -07:00
  • 31270b7a53 Merge pull request #2185 from splunk/fixtagcyclopsblink Jose Enrique Hernandez 2022-05-03 20:14:52 -04:00
  • 0957d0de03 Updates to the detection ref validator. Still needs a few tweaks. pyth0n1c 2022-05-03 16:24:29 -07:00
  • ee8c0b9bb6 Fixed the remaining broken or outdated references. The remaining references that fail validation cannot be easily validated by requests, due to website requirements, or sometimes return errors or take a long time to load. Becuase they usually work, we will leave them as-is. pyth0n1c 2022-05-03 16:17:41 -07:00
  • bc7a22ae4a Fixed reference links in two more detection YMLs pyth0n1c 2022-05-03 14:21:30 -07:00
  • 5b9febe81a removing all the stuff in bin d1vious 2022-05-03 14:18:22 -04:00
  • 900bd9e7e2 Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time. pyth0n1c 2022-05-03 10:34:10 -07:00
  • 92a782df3c fixedtagcb Rod Soto 2022-05-03 09:45:47 -07:00
  • 646afbf214 A number of small updates to support resolving and verifying all of the reference URLs in detections at scale. Also, fixed a few more HTTP Status Code 301 references in the tests folder. pyth0n1c 2022-05-02 17:15:09 -07:00
  • 578e6bb088 Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links. pyth0n1c 2022-05-02 17:12:50 -07:00
  • e6b180993f updating docs and package bits [ci skip] research bot 2022-05-02 22:30:16 +00:00
  • 289bcc62c3 Branch was auto-updated. pyth0n1c 2022-05-02 13:46:00 -07:00
  • 704a9fcd65 Branch was auto-updated. pyth0n1c 2022-05-02 13:45:59 -07:00
  • aad9eb4994 Branch was auto-updated. pyth0n1c 2022-05-02 13:45:58 -07:00
  • f972993486 Branch was auto-updated. pyth0n1c 2022-05-02 13:45:57 -07:00
  • d9ccaf4e68 Branch was auto-updated. pyth0n1c 2022-05-02 13:45:56 -07:00
  • 0ef71b1414 Merge pull request #2182 from splunk/TR-1828 v3.39.0 Bhavin Patel 2022-05-02 16:45:36 -04:00
  • 9afaf6cb7c Branch was auto-updated. pyth0n1c 2022-05-02 13:27:14 -07:00
  • 90c2cea253 Branch was auto-updated. pyth0n1c 2022-05-02 13:27:12 -07:00
  • 6b6535c249 Branch was auto-updated. pyth0n1c 2022-05-02 13:27:10 -07:00
  • bacc63132d Branch was auto-updated. pyth0n1c 2022-05-02 13:27:09 -07:00
  • 96aa5f168c Branch was auto-updated. pyth0n1c 2022-05-02 13:27:08 -07:00
  • 4bbac58971 Branch was auto-updated. pyth0n1c 2022-05-02 13:27:07 -07:00
  • f9fd5f6ff8 Merge pull request #2179 from splunk/mcduck Bhavin Patel 2022-05-02 16:26:48 -04:00
  • eff1576b4b Required Fields Lou Stella 2022-05-02 15:22:41 -05:00
  • 3f7fdbb0dd Cleaned up search Lou Stella 2022-05-02 15:15:47 -05:00
  • e41589c77c Merge branch 'TR-1828' of https://github.com/splunk/security_content into TR-1828 Lou Stella 2022-05-02 15:08:17 -05:00
  • 24486a0d8d Cleaned up macro Lou Stella 2022-05-02 15:08:10 -05:00
  • 50afedfb6e Branch was auto-updated. pyth0n1c 2022-05-02 13:07:11 -07:00
  • b47d0d60bc Branch was auto-updated. pyth0n1c 2022-05-02 13:07:10 -07:00
  • d9dfa676d9 Branch was auto-updated. pyth0n1c 2022-05-02 13:07:09 -07:00
  • 5a1238c1f0 Branch was auto-updated. pyth0n1c 2022-05-02 13:07:08 -07:00
  • c51b02f1d7 Branch was auto-updated. pyth0n1c 2022-05-02 13:07:07 -07:00
  • d09da59202 Branch was auto-updated. pyth0n1c 2022-05-02 13:07:06 -07:00
  • cde6d216e3 Branch was auto-updated. pyth0n1c 2022-05-02 13:07:05 -07:00
  • b40470a812 Merge pull request #2180 from splunk/cyclopsblink_fix Bhavin Patel 2022-05-02 16:06:44 -04:00
  • 6c150078d9 Update detect_mimikatz_with_powershell_script_block_logging.test.yml mhaag-spl 2022-05-02 14:00:54 -06:00
  • 03035d1c78 Enhancement to use threaded detection construction, which really speeds up verification of URLS. Also, got the cache working and the force cache argument passed all the way through to the detection builder. Please note that this will take much longer to run the first time, because the cache has not been populated. Subsequent runs will be slower. If data exists in this cache, it is NOT updated and will become stale if the web resource is updated. This is only suitable for development purposes and offline environments. pyth0n1c 2022-05-02 12:59:28 -07:00
  • b8a9323e6b reflect mhaag-spl 2022-05-02 13:48:02 -06:00
  • 5127dc01ff rmdir mhaag-spl 2022-05-02 13:45:02 -06:00
  • ee22b528e8 dsuser mhaag-spl 2022-05-02 13:41:01 -06:00
  • dcc707ce36 stream mhaag-spl 2022-05-02 13:38:30 -06:00
  • 657678b29c smb1 mhaag-spl 2022-05-02 13:35:11 -06:00
  • 9fb1439059 Adding node.exe as an app not allowed to spawn cmd.exe Lou Stella 2022-05-02 14:34:06 -05:00
  • e2f90a30f0 enum mhaag-spl 2022-05-02 13:32:55 -06:00
  • 6fe602533b Removed detection Lou Stella 2022-05-02 14:30:43 -05:00
  • b7f47677e6 Update serviceprincipalnames_discovery_with_powershell.test.yml mhaag-spl 2022-05-02 13:30:16 -06:00
  • 86ef111278 domaintrust mhaag-spl 2022-05-02 13:29:09 -06:00
  • b420befa57 spnpwsh mhaag-spl 2022-05-02 13:27:03 -06:00
  • ef7f385fca object mhaag-spl 2022-05-02 13:25:01 -06:00
  • f382a79f04 getdomaingr mhaag-spl 2022-05-02 13:22:20 -06:00
  • 25b61fe888 hunt mhaag-spl 2022-05-02 13:19:54 -06:00
  • e1c4b45c90 ds_com mhaag-spl 2022-05-02 13:17:47 -06:00
  • 05aef331c8 policy+dc mhaag-spl 2022-05-02 13:14:49 -06:00
  • 32fb175794 domainpoilicy mhaag-spl 2022-05-02 13:12:26 -06:00
  • 4df5ba9c6b wmiob mhaag-spl 2022-05-02 12:54:16 -06:00