admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • f86bbfa4b3 update docs P4T12ICK 2022-03-14 15:53:58 +01:00
  • 5dd13ea167 fix broken detections P4T12ICK 2022-03-14 15:51:05 +01:00
  • 9c1d3dedd8 More_Registry tccontre 2022-03-14 14:01:48 +01:00
  • ae00b4c948 Add pytest as separate CI workflow P4T12ICK 2022-03-14 13:24:29 +01:00
  • eb5609fb3b Add pytest as separate CI workflow P4T12ICK 2022-03-14 13:07:01 +01:00
  • baa03d1c49 Add pytest as separate CI workflow P4T12ICK 2022-03-14 13:04:22 +01:00
  • fbd71a7cd6 Add pytest to CI P4T12ICK 2022-03-14 12:32:33 +01:00
  • ba0cf38514 Add pytest to CI P4T12ICK 2022-03-14 12:27:54 +01:00
  • d45047cff3 Added automaticc generation of finding report P4T12ICK 2022-03-14 12:17:21 +01:00
  • e6c8254ede Added automaticc generation of finding report P4T12ICK 2022-03-14 12:12:48 +01:00
  • bcdff5f486 More_Registry tccontre 2022-03-14 11:51:51 +01:00
  • 2b0a7e101d Updated detection files with recommended TA list. enriched_with_3.36.0 truptilangalia-crest 2022-03-14 12:29:33 +05:50
  • d63cffe883 Updated name of detection and test files. Updated path for data file, which has not been uploaded yet. Updated most of the fields in the detection. pyth0n1c 2022-03-11 18:09:09 -08:00
  • fe02a26698 Updated required fields cleaner to make updates to the dataset if it is missing in the detection or differs between the detection and the test. The test will be used as the ground truth. pyth0n1c 2022-03-11 14:03:32 -08:00
  • c97bade906 Adding fixes to detection files that did not have the correct datasets declared. pyth0n1c 2022-03-11 12:01:18 -08:00
  • f608d91e89 Merge branch 'develop' into FixDatamodelFormat pyth0n1c 2022-03-11 11:56:45 -08:00
  • 4d91df0427 Reverted enrichment commit. pyth0n1c 2022-03-11 11:54:41 -08:00
  • 9dc8da332f Updating more missing datasets FixingWrongDatasets pyth0n1c 2022-03-11 11:49:22 -08:00
  • 99c5547667 Removed quoting around fieldnames from two searches that causes the tool which updates the Datamodel and required_fields portion of the detection YAMLs to fail. pyth0n1c 2022-03-11 11:43:28 -08:00
  • f27dfac839 First pass at updating missing or wrong datasets in detection files. pyth0n1c 2022-03-11 11:16:43 -08:00
  • 92c7bd6d5c Fixed quoting issue in two detections, causing the script that populates the datamodel and required_fields to fail pyth0n1c 2022-03-11 09:16:08 -08:00
  • 6302da697e adding new detection for Kerberos user enumeration mvelazco 2022-03-11 11:11:18 -05:00
  • e4a27e2cca Merge branch 'refactored_security_content_new' of github.com:splunk/security_content into refactored_security_content_new P4T12ICK 2022-03-11 12:23:47 +01:00
  • 10c7fe6490 Refactored security content P4T12ICK 2022-03-11 12:23:20 +01:00
  • 47cc440d9a removing space mvelazco 2022-03-10 14:30:20 -05:00
  • 5c6fbad1c2 Update unknown_process_using_the_kerberos_protocol.test.yml Bhavin Patel 2022-03-10 10:56:30 -08:00
  • eb1e22a7bf Merge branch 'TR_1550_Kerberos_Coverage_2' of github.com:splunk/security_content into TR_1550_Kerberos_Coverage_2 mvelazco 2022-03-10 12:31:33 -05:00
  • 6fc644f493 adding new detection mvelazco 2022-03-10 12:31:31 -05:00
  • e08e7f3e5a syntax Michael Haag 2022-03-10 08:16:21 -07:00
  • ed3524ec34 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:26 -08:00
  • 41d0f27c70 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:25 -08:00
  • 65dffeae1f Branch was auto-updated. pyth0n1c 2022-03-10 07:15:21 -08:00
  • 29a84ec044 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:20 -08:00
  • 14e080df92 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:19 -08:00
  • 101106c217 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:18 -08:00
  • c0efcc76d5 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:18 -08:00
  • 65de98efc7 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:17 -08:00
  • 529603436e Branch was auto-updated. pyth0n1c 2022-03-10 07:15:16 -08:00
  • c34e7bde0a Branch was auto-updated. pyth0n1c 2022-03-10 07:15:09 -08:00
  • 9d8ecd3780 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:05 -08:00
  • 89f44723a6 Branch was auto-updated. pyth0n1c 2022-03-10 07:15:04 -08:00
  • 1fa47120c1 Merge pull request #2071 from splunk/function_updates Lou Stella 2022-03-10 09:14:43 -06:00
  • 10c25b2014 Refactored security content P4T12ICK 2022-03-10 10:27:29 +01:00
  • 5f2c9c271c Updated detection files with recommended TA list. enrich_detection_FixDatamodelFormat truptilangalia-crest 2022-03-10 11:46:19 +05:50
  • 325db37b95 Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search. pyth0n1c 2022-03-09 14:35:48 -08:00
  • d652c93878 Removed All_Changes submodel from two detections which use more than one submodel in Changes. pyth0n1c 2022-03-09 14:29:25 -08:00
  • 02b2a5f85f Moved test file from endpoint to experimental/endpoint. The detection file was already in experimental. pyth0n1c 2022-03-09 14:16:28 -08:00
  • 970648ad69 Large number of changes to the format of datamodels in searches. This is in support of the script to automatically parse searches in order to pull out required fields and datamodels used or not used in a search. pyth0n1c 2022-03-09 14:10:50 -08:00
  • 6f0ee68913 Refactored security content P4T12ICK 2022-03-09 14:43:09 +01:00
  • 376f73587c Refactored security content refactored_security_content P4T12ICK 2022-03-09 11:36:28 +01:00
  • de70b33b58 updattes patel-bhavin 2022-03-08 17:17:13 -08:00
  • 361ae406ee updates to all ymls with error patel-bhavin 2022-03-08 17:08:09 -08:00
  • 461a258f78 name and file changes patel-bhavin 2022-03-08 14:29:48 -08:00
  • 8a4540fec7 small fix mvelazco 2022-03-08 15:50:47 -05:00
  • 9445dd886b validate and yml fixes patel-bhavin 2022-03-08 12:09:16 -08:00
  • f1d03a7f77 small fix mvelazco 2022-03-08 14:53:11 -05:00
  • 94f0d8fb27 adding hew detection for over pass the hash technique mvelazco 2022-03-08 14:41:37 -05:00
  • 4600bd00f7 aduser mhaag-spl 2022-03-08 11:07:16 -07:00
  • f79866dca4 Update aws_updateloginprofile.yml Bhavin Patel 2022-03-08 09:24:18 -08:00
  • e53e25aee4 Update aws_createaccesskey.yml Bhavin Patel 2022-03-08 09:23:58 -08:00
  • 4f6dea53e5 modified path mhaag-spl 2022-03-08 09:55:07 -07:00
  • 0d9e685a4f updated artifact_create CF Lou Stella 2022-03-08 10:42:23 -06:00
  • e7d85cbf1c More_Registry tccontre 2022-03-08 12:42:34 +01:00
  • 3a4ec118b1 More_Registry tccontre 2022-03-08 12:32:39 +01:00
  • 60da2593e7 More_Registry tccontre 2022-03-08 12:14:56 +01:00
  • da885bf1b1 updated enrich detection script for MoreDatamodelUpdates branch arjunkhunti-crest 2022-03-07 18:11:57 +05:30
  • daecf458bc Updated detection files with recommended TA list. enrich_detection_MDU akhunti 2022-03-05 15:09:28 +05:50
  • 44ba1a0201 Updating to a unique uuid pyth0n1c 2022-03-04 17:29:52 -08:00
  • 98f83c7469 First commit of initial detection work. Skeleton detection is good, but may need more details. Still need to work on documentation in detection yaml file and uploading the dataset pyth0n1c 2022-03-04 17:13:18 -08:00
  • 16c6f3af3f Branch was auto-updated. pyth0n1c 2022-03-04 12:21:39 -08:00
  • 0ef77362db Branch was auto-updated. pyth0n1c 2022-03-04 12:21:38 -08:00
  • ee9dc44bc7 Branch was auto-updated. pyth0n1c 2022-03-04 12:21:37 -08:00
  • ab9db217ac Branch was auto-updated. pyth0n1c 2022-03-04 12:21:35 -08:00
  • 30251bd629 Branch was auto-updated. pyth0n1c 2022-03-04 12:21:31 -08:00
  • adb636bc8d Branch was auto-updated. pyth0n1c 2022-03-04 12:21:27 -08:00
  • b2037a2712 Branch was auto-updated. pyth0n1c 2022-03-04 12:21:26 -08:00
  • e889b38788 Branch was auto-updated. pyth0n1c 2022-03-04 12:21:25 -08:00
  • f9cc8cfeaf Merge pull request #2069 from splunk/revert-1954-refactored_security_content Bhavin Patel 2022-03-04 12:21:04 -08:00
  • d78bb53baa Revert "Refactored security content" Jose Enrique Hernandez 2022-03-04 15:13:04 -05:00
  • fb6461acbd playbooks patel-bhavin 2022-03-04 11:57:10 -08:00
  • ffbed88748 quick draft patel-bhavin 2022-03-04 11:27:10 -08:00
  • 19b631aca4 Branch was auto-updated. pyth0n1c 2022-03-04 09:34:03 -08:00
  • 524d329bd9 Branch was auto-updated. pyth0n1c 2022-03-04 09:34:02 -08:00
  • 998204a6a5 Branch was auto-updated. pyth0n1c 2022-03-04 09:33:57 -08:00
  • f21bf8a373 Branch was auto-updated. pyth0n1c 2022-03-04 09:33:52 -08:00
  • 056a5968fb Branch was auto-updated. pyth0n1c 2022-03-04 09:33:51 -08:00
  • be4dea31df Branch was auto-updated. pyth0n1c 2022-03-04 09:33:49 -08:00
  • d077b90a01 Merge pull request #1954 from splunk/refactored_security_content Bhavin Patel 2022-03-04 09:33:27 -08:00
  • 8937a5fec7 MacOS detections P4T12ICK 2022-03-04 16:35:30 +01:00
  • 886da3c92e merged with develop P4T12ICK 2022-03-04 14:35:50 +01:00
  • 33a25e87dc merged with develop P4T12ICK 2022-03-04 14:18:02 +01:00
  • f76df6b741 fixed validate issues P4T12ICK 2022-03-04 14:15:47 +01:00
  • 11021fa0a1 Branch was auto-updated. pyth0n1c 2022-03-03 19:48:12 -08:00
  • db39994177 Branch was auto-updated. pyth0n1c 2022-03-03 19:48:11 -08:00
  • 33433e72d6 Branch was auto-updated. pyth0n1c 2022-03-03 19:48:05 -08:00
  • 677f0a9083 Branch was auto-updated. pyth0n1c 2022-03-03 19:48:02 -08:00
  • a568e5078c Branch was auto-updated. pyth0n1c 2022-03-03 19:47:58 -08:00
  • 597b2aeffe Branch was auto-updated. pyth0n1c 2022-03-03 19:47:55 -08:00
  • 9176a54ca4 Merge pull request #2056 from splunk/wrong_field trogdorsey 2022-03-03 21:47:38 -06:00
  • 513270c8c1 Merge branch 'develop' into wrong_field David Dorsey 2022-03-03 21:41:37 -06:00