Commit Graph

  • 7f9bf8a61a Updated TAs auto-ta-update-231 patel-bhavin 2025-04-10 06:57:52 +00:00
  • c79c1f63ba updating version Bhavin Patel 2025-04-09 16:31:51 -07:00
  • 1cbf9d3d2d updating and testing aws detections Bhavin Patel 2025-04-09 16:06:07 -07:00
  • b6b55499db Merge branch 'develop' into aws_bedrock Bhavin Patel 2025-04-09 14:38:00 -07:00
  • 2b758d876a Updating issue templates with types ljstella 2025-04-09 12:18:36 -05:00
  • 953c8d59da Merge branch 'develop' into csftd_first_batch Nasreddine Bencherchali 2025-04-09 16:34:47 +02:00
  • ddaea9b0b7 add new rules and fix filter macro Nasreddine Bencherchali 2025-04-09 13:11:56 +02:00
  • 901b2b2b2c fix ci error again Nasreddine Bencherchali 2025-04-09 12:47:06 +02:00
  • 3069c54188 Update cisco_secure_firewall___binary_file_type_download.yml Nasreddine Bencherchali 2025-04-09 12:41:25 +02:00
  • ae9090517d fix ci errors Nasreddine Bencherchali 2025-04-09 12:39:07 +02:00
  • e9caa0de7c cisco secure firewall detections - second batch Nasreddine Bencherchali 2025-04-09 12:33:51 +02:00
  • 6efe13ff96 Updated TAs auto-ta-update-230 patel-bhavin 2025-04-09 06:58:12 +00:00
  • 2392ffd68d Update cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml Nasreddine Bencherchali 2025-04-08 17:12:31 +02:00
  • 95e44bfb81 Updated TAs auto-ta-update-229 patel-bhavin 2025-04-08 06:57:50 +00:00
  • bb24d7b433 Updated TAs auto-ta-update-228 patel-bhavin 2025-04-07 06:57:50 +00:00
  • da2beda495 Updated TAs auto-ta-update-227 patel-bhavin 2025-04-06 06:58:03 +00:00
  • 99deb8e861 Updated TAs auto-ta-update-226 patel-bhavin 2025-04-05 06:57:49 +00:00
  • 31deacc6bd Merge pull request #3445 from sventec/patch-1 v5.3.0 Bhavin Patel 2025-04-04 12:50:44 -07:00
  • 86a0f199ba Merge branch 'develop' into patch-1 Bhavin Patel 2025-04-04 12:36:23 -07:00
  • 028045bd49 Merge pull request #3427 from splunk/jp_paranoid Bhavin Patel 2025-04-04 10:00:52 -07:00
  • 889c08ebbf chore: update lookup date and version sventec 2025-04-04 11:32:45 -04:00
  • 5f1d8f6b3f fix: addtl remote_utility typo in remote_access_software.csv sventec 2025-04-04 11:32:32 -04:00
  • 66889be8a6 fix: remote_utility typo in remote_access_software.csv sventec 2025-04-04 11:20:21 -04:00
  • b22a91792f Updated TAs auto-ta-update-225 patel-bhavin 2025-04-04 06:57:54 +00:00
  • d28418800b fix with validate Bhavin Patel 2025-04-03 17:13:18 -07:00
  • 032dbfda68 adding kb detection Bhavin Patel 2025-04-03 16:55:45 -07:00
  • 89ea90a820 Merge branch 'develop' into jp_paranoid Bhavin Patel 2025-04-03 12:52:41 -07:00
  • e7263c96a7 Merge pull request #3411 from splunk/firewall_win_events Bhavin Patel 2025-04-03 12:52:23 -07:00
  • 39ce057227 fix dd Bhavin Patel 2025-04-03 12:18:53 -07:00
  • 1b2f69d137 adding new detection file Bhavin Patel 2025-04-03 12:13:43 -07:00
  • 53e3105db8 Merge branch 'develop' into csftd_first_batch Nasreddine Bencherchali 2025-04-03 20:59:14 +02:00
  • f1561e6173 Merge branch 'develop' into jp_paranoid Bhavin Patel 2025-04-03 10:46:23 -07:00
  • 49d75bbc36 Merge branch 'develop' into firewall_win_events Bhavin Patel 2025-04-03 10:44:21 -07:00
  • 39850effa7 Merge pull request #3392 from splunk/medusa_ransomware Bhavin Patel 2025-04-03 10:43:13 -07:00
  • 6b1ad9369a revert powershell change and use fillnull Bhavin Patel 2025-04-03 09:10:34 -07:00
  • 25dae36d17 Update cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml Nasreddine Bencherchali 2025-04-03 17:19:17 +02:00
  • d2a7f6faf8 fix typo in count Nasreddine Bencherchali 2025-04-03 16:28:27 +02:00
  • 2d5a194803 remove filter error Nasreddine Bencherchali 2025-04-03 15:04:12 +02:00
  • 20275c2f10 rename files Nasreddine Bencherchali 2025-04-03 15:02:45 +02:00
  • a8c4f40a9a update attack data source Nasreddine Bencherchali 2025-04-03 14:58:26 +02:00
  • cbe3aa7923 update rba and filter macros Nasreddine Bencherchali 2025-04-03 14:47:30 +02:00
  • 9c8db54662 Update cisco_secure_firewall_threat_defense_connection_event.yml Nasreddine Bencherchali 2025-04-03 14:36:11 +02:00
  • d2337f07c8 Update cisco_secure_firewall_inside_to_outside.yml Nasreddine Bencherchali 2025-04-03 14:28:58 +02:00
  • c156e2bb8d update macro name Nasreddine Bencherchali 2025-04-03 14:26:51 +02:00
  • 0f084c4fb7 update lookup name Nasreddine Bencherchali 2025-04-03 14:24:53 +02:00
  • f39a6d9a50 cisco secure firewall detections - first batch Nasreddine Bencherchali 2025-04-03 14:21:27 +02:00
  • 8d497b0b91 Updated TAs auto-ta-update-224 patel-bhavin 2025-04-03 06:57:46 +00:00
  • 0212a445f6 Merge branch 'develop' into jp_paranoid Bhavin Patel 2025-04-02 15:04:07 -07:00
  • 50ad208b2c Merge branch 'develop' into cactus Bhavin Patel 2025-04-02 14:50:43 -07:00
  • ae45debc8b Merge branch 'develop' into firewall_win_events Bhavin Patel 2025-04-02 14:47:40 -07:00
  • 43abc9471f Merge branch 'develop' into medusa_ransomware Bhavin Patel 2025-04-02 14:28:10 -07:00
  • af9c381948 Merge pull request #3407 from splunk/renamed_earth_erties Bhavin Patel 2025-04-02 14:22:52 -07:00
  • 70a04d7ca0 Merge branch 'develop' into firewall_win_events Bhavin Patel 2025-04-02 13:23:42 -07:00
  • 0d93ce9c0b updating conflicts Bhavin Patel 2025-04-02 13:18:06 -07:00
  • 3bf27db466 updating data source and search since Path is not availble in this dataset Bhavin Patel 2025-04-02 12:58:26 -07:00
  • 23219463dc Merge branch 'develop' into jp_paranoid Bhavin Patel 2025-04-02 12:07:51 -07:00
  • 010f2f7edd required fields added to detection Bhavin Patel 2025-04-02 11:50:59 -07:00
  • 0d831661a6 updating detections with conflicts Bhavin Patel 2025-04-02 11:41:46 -07:00
  • f8d1d71db9 Merge branch 'develop' into medusa_ransomware Bhavin Patel 2025-04-02 11:22:19 -07:00
  • 90ab68ee3e Merge pull request #3400 from splunk/rceattack Bhavin Patel 2025-04-02 11:21:16 -07:00
  • 7dabc2680f Merge branch 'develop' into rceattack Bhavin Patel 2025-04-02 11:06:00 -07:00
  • 9493465161 adding new required fields to the new detections and fixing conflicts Bhavin Patel 2025-04-02 11:03:34 -07:00
  • e141238eaf Merge pull request #3346 from splunk/output_normalization_endpoint Bhavin Patel 2025-04-02 10:20:18 -07:00
  • b5a7ce9852 Merge branch 'develop' into cactus Michael Haag 2025-04-02 10:16:35 -06:00
  • 132c21c77a Updated TAs auto-ta-update-223 patel-bhavin 2025-04-02 06:57:51 +00:00
  • f03979077a Merge branch 'develop' into rceattack Bhavin Patel 2025-04-01 15:47:23 -07:00
  • c407bb8aa0 Merge branch 'develop' into jp_paranoid Bhavin Patel 2025-04-01 15:46:14 -07:00
  • a679c2e510 Merge branch 'develop' into medusa_ransomware Bhavin Patel 2025-04-01 14:52:23 -07:00
  • e6db474205 two new Mike detection fixes Bhavin Patel 2025-04-01 14:51:22 -07:00
  • 00253f3c6e Merge branch 'develop' into output_normalization_endpoint Bhavin Patel 2025-04-01 14:45:19 -07:00
  • 2c2e127a88 Merge pull request #3440 from splunk/integration_fixes_endpoint Bhavin Patel 2025-04-01 14:45:03 -07:00
  • 041054cf08 Merge pull request #3417 from splunk/ZDI-CAN-25373 Bhavin Patel 2025-04-01 14:43:34 -07:00
  • 72e2438196 Merge branch 'develop' into rceattack Bhavin Patel 2025-04-01 14:34:38 -07:00
  • deb9ca1eba Merge branch 'develop' into ZDI-CAN-25373 Bhavin Patel 2025-04-01 14:22:38 -07:00
  • 783b77f66f Merge branch 'develop' into jp_paranoid Bhavin Patel 2025-04-01 14:19:53 -07:00
  • 452411530f Merge pull request #3421 from splunk/sunnyside Bhavin Patel 2025-04-01 14:19:39 -07:00
  • 7168e32ea6 Merge branch 'develop' into sunnyside Bhavin Patel 2025-04-01 14:05:53 -07:00
  • 6c40990600 fixes Michael Haag 2025-04-01 15:05:10 -06:00
  • 1201ccae64 udpating spl tick Bhavin Patel 2025-04-01 14:01:43 -07:00
  • 1c60954e30 download attack data cache for testing and validation purposes Eric 2025-04-01 13:57:44 -07:00
  • 7666d3793f Merge branch 'develop' into cactus Michael Haag 2025-04-01 14:56:49 -06:00
  • e393aaad5c done Michael Haag 2025-04-01 14:53:17 -06:00
  • 7c4ef721c2 donez Michael Haag 2025-04-01 14:52:17 -06:00
  • 6077b83638 done Michael Haag 2025-04-01 14:50:29 -06:00
  • 09e184389b Merge branch 'develop' into ZDI-CAN-25373 Michael Haag 2025-04-01 14:49:25 -06:00
  • 55b5bc77d2 fixagai Michael Haag 2025-04-01 14:48:54 -06:00
  • 452378b283 fixor Michael Haag 2025-04-01 14:37:35 -06:00
  • f435240b83 fixes Michael Haag 2025-04-01 14:34:18 -06:00
  • e00a0b2ed1 fix dataset links for more detections. Note that one of the searches actually does not have a valid dataset - it pointed to one that does not exist. that dataset also did not exist in the git history for attack_data. Eric 2025-04-01 13:08:15 -07:00
  • 488debfe2b fixing failed detections Bhavin Patel 2025-04-01 12:55:52 -07:00
  • 70174e8318 update detection Bhavin Patel 2025-04-01 12:45:27 -07:00
  • c85370b142 Merge branch 'develop' into firewall_win_events Bhavin Patel 2025-04-01 12:44:49 -07:00
  • 7ae5e1a2fe Merge pull request #3439 from splunk/output_normalization_endpoint_fixes Bhavin Patel 2025-04-01 09:15:00 -07:00
  • b31f246793 medusa_ransomware Teoderick Contreras 2025-04-01 12:54:03 +02:00
  • 414b521cc4 medusa_ransomware Teoderick Contreras 2025-04-01 10:47:44 +02:00
  • 10710c8675 medusa_ransomware Teoderick Contreras 2025-04-01 10:17:06 +02:00
  • e993b67c0e medusa_ransomware Teoderick Contreras 2025-04-01 10:08:00 +02:00
  • 62f5e451d3 Integration Testing bug fixes Patrick Bareiss 2025-04-01 09:58:17 +02:00
  • 0fd302beb5 firewall_win_events Teoderick Contreras 2025-04-01 09:50:11 +02:00
  • 03859564c8 rebase with develop Patrick Bareiss 2025-04-01 09:42:07 +02:00