admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 5f00114818 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:19 -08:00
  • a6a7028bfa Branch was auto-updated. pyth0n1c 2022-01-10 13:06:18 -08:00
  • 43e2b40935 Merge pull request #1907 from splunk/linux_persist_priv_batch_2 Bhavin Patel 2022-01-10 13:05:56 -08:00
  • 3362c243ae Update linux_setuid_using_setcap_utility.yml Bhavin Patel 2022-01-10 12:59:21 -08:00
  • 26f945c52a Update linux_setuid_using_setcap_utility.yml Bhavin Patel 2022-01-10 12:56:56 -08:00
  • d9ed887036 Fixed a bad submodel name in one of the datamodels for a search. pyth0n1c 2022-01-10 12:56:29 -08:00
  • fabd820804 Update linux_setuid_using_chmod_utility.yml Bhavin Patel 2022-01-10 12:55:51 -08:00
  • 795ef776ef Moved old baseline search to experimental. It is also using a datamodel that is included in Enterprise Security, but is not present in Splunk_CIM. That was causing some issues/warning in validation of datamodels/submodels/fields. pyth0n1c 2022-01-10 12:54:44 -08:00
  • 19d907da37 Update linux_service_started_or_enabled.yml Bhavin Patel 2022-01-10 12:53:45 -08:00
  • a505181149 Update linux_service_restarted.yml Bhavin Patel 2022-01-10 12:52:25 -08:00
  • 4a34f4445d Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels pyth0n1c 2022-01-10 12:52:16 -08:00
  • 8bd5c20eac Update linux_file_creation_in_profile_directory.yml Bhavin Patel 2022-01-10 12:46:34 -08:00
  • 4a08f745b2 Update linux_service_file_created_in_systemd_directory.yml Bhavin Patel 2022-01-10 12:41:02 -08:00
  • 527d8103b8 Update linux_file_creation_in_profile_directory.yml Bhavin Patel 2022-01-10 12:33:47 -08:00
  • 2944d1690b Update linux_file_creation_in_init_boot_directory.yml Bhavin Patel 2022-01-10 12:32:10 -08:00
  • b60f4a2b5a Update linux_file_creation_in_init_boot_directory.yml Bhavin Patel 2022-01-10 12:30:55 -08:00
  • 6edaa90519 updated generate to match javiers feedback d1vious 2022-01-10 15:12:30 -05:00
  • ff6b6c4397 Branch was auto-updated. pyth0n1c 2022-01-10 12:11:52 -08:00
  • 273bf8a809 Branch was auto-updated. pyth0n1c 2022-01-10 12:11:51 -08:00
  • 4e81a8f541 Branch was auto-updated. pyth0n1c 2022-01-10 12:11:49 -08:00
  • aa4f1a8cbc Branch was auto-updated. pyth0n1c 2022-01-10 12:11:48 -08:00
  • f1c16ea6c9 Branch was auto-updated. pyth0n1c 2022-01-10 12:11:47 -08:00
  • ef018cd9cb Branch was auto-updated. pyth0n1c 2022-01-10 12:11:45 -08:00
  • 20cfa5d7db Branch was auto-updated. pyth0n1c 2022-01-10 12:11:37 -08:00
  • 10e575a793 Branch was auto-updated. pyth0n1c 2022-01-10 12:11:36 -08:00
  • 787a5afd99 Branch was auto-updated. pyth0n1c 2022-01-10 12:11:34 -08:00
  • 0bdcacd7b3 Merge pull request #1869 from splunk/T1059 Bhavin Patel 2022-01-10 12:11:15 -08:00
  • 871a66ebae changed to use srs and complex division d1vious 2022-01-10 14:59:29 -05:00
  • af3c38d10b Progress towards matching tokens with datamodels. still a number of false positive misses that we need to work through. pyth0n1c 2022-01-10 10:09:42 -08:00
  • 856635f601 linux_persist_priv_batch_4 tccontre 2022-01-10 12:51:04 +01:00
  • ef99a8c8bc Update linux_sudoers_tmp_file_creation.yml tccontre 2022-01-10 12:36:33 +01:00
  • f48713b301 Update linux_possible_append_command_to_at_allow_config_file.yml tccontre 2022-01-10 09:46:50 +01:00
  • 265a1f0494 Update linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml tccontre 2022-01-10 09:44:05 +01:00
  • 72859e63e8 Update linux_possible_append_command_to_at_allow_config_file.yml tccontre 2022-01-10 09:43:33 +01:00
  • 067b6e5bbe cleaning up detections d1vious 2022-01-07 16:04:51 -05:00
  • 20c0196d7f moving things around d1vious 2022-01-07 16:04:21 -05:00
  • b90c99bc5d Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2022-01-07 09:53:32 -08:00
  • fb91aaaa68 Progress on cleaning up the required fields. We can now pull out the datamodel fields, but it includes the datamodel itself too. pyth0n1c 2022-01-06 17:48:30 -08:00
  • 6d206d9646 Merge pull request #1922 from splunk/doc_gen_remcos Jose Enrique Hernandez 2022-01-06 17:45:27 -05:00
  • a8e2af5782 Update docs for upcoming blog Lou Stella 2022-01-06 16:38:33 -06:00
  • b7597fc509 Merge pull request #1919 from splunk/playbook_mig_remcos Jose Enrique Hernandez 2022-01-06 17:08:37 -05:00
  • 988f5d157a Created test dataset & moved detection out of experimental Lou Stella 2022-01-06 16:08:08 -06:00
  • 1ca0ffa3ea Update datamodel=MODEL fields to datamodel=Model.Submodel pyth0n1c 2022-01-06 13:45:29 -08:00
  • 049482c74c Fixed casing per request Lou Stella 2022-01-06 15:16:52 -06:00
  • 89f37444f4 Update msi_module_loaded_by_non_system_binary.yml mhaag-spl 2022-01-06 10:06:40 -07:00
  • c0613d0e36 add example files for newcontent playbook template start-playbook-yml-generator Philip Royer 2022-01-06 09:24:22 -07:00
  • a984441576 extract playbook metadata from json Philip Royer 2022-01-06 09:22:54 -07:00
  • 1dea66d75c Added authorize.conf.tar to make it possible to delete data from completed searches properly. pyth0n1c 2022-01-05 15:26:43 -08:00
  • 64abbe4458 Significant changes. Most importantly, instead of a hard-coded wait time after uploading data, we poll to make sure that all the data has been indexed. When this is complete, we move ahead with the test. While this costs extra in terms of CPU and Disk access, it usually allows us to go much faster since wait time is usually just a few seconds. Better tracking of time per test and time estimation. pyth0n1c 2022-01-05 14:39:13 -08:00
  • 334fb25cd0 Added malware hunt and contain playbook Lou Stella 2022-01-05 13:41:59 -06:00
  • 6819bb1be7 Added email notification for malware playbook Lou Stella 2022-01-05 13:28:38 -06:00
  • e396a3b9d4 Added block_indicators playbook Lou Stella 2022-01-05 12:17:54 -06:00
  • 9bcad3d21b Added detection testing service results inLinux Change File Owner To Root root 2022-01-05 16:34:58 +00:00
  • cebc5ac4fd Update linux_edit_cron_table_parameter.yml tccontre 2022-01-05 16:38:48 +01:00
  • 204670cbe1 Update linux_at_allow_config_file_creation.yml tccontre 2022-01-05 16:33:43 +01:00
  • 2e9f51cca4 Added detection testing service results inLinux File Created In Kernel Driver Directory root 2022-01-05 14:34:31 +00:00
  • 64dfd4a621 Added detection testing service results inLinux Install Kernel Module Using Modprobe Utility root 2022-01-05 13:08:14 +00:00
  • a1a6087bcd Added detection testing service results inLinux Sudoers Tmp File Creation root 2022-01-05 12:38:46 +00:00
  • 06ffa22394 Update linux_sudoers_tmp_file_creation.yml tccontre 2022-01-05 13:20:37 +01:00
  • ab844e062f linux_persist_priv_batch_3 tccontre 2022-01-05 13:17:08 +01:00
  • fb306cb79b Added detection testing service results inLinux Visudo Utility Execution root 2022-01-05 12:12:09 +00:00
  • 14534c2f53 Merge branch 'linux_persist_priv_batch_3' of github.com:splunk/security_content into linux_persist_priv_batch_3 tccontre 2022-01-05 12:48:02 +01:00
  • 377a4822f7 linux_persist_priv_batch_3 tccontre 2022-01-05 12:47:45 +01:00
  • 78e61e8ee4 Added detection testing service results inLinux Change File Owner To Root root 2022-01-05 11:42:47 +00:00
  • 37185f3e0d linux_persist_priv_batch_3 tccontre 2022-01-05 11:34:57 +01:00
  • fa843067da Merge pull request #1917 from splunk/remocs_desc_update tccontre 2022-01-05 09:41:08 +01:00
  • 78732dfe2d Update linux_file_creation_in_profile_directory.yml tccontre 2022-01-04 18:00:42 +01:00
  • e8cde0b1f6 Update linux_file_creation_in_init_boot_directory.yml tccontre 2022-01-04 17:59:26 +01:00
  • e10f55348c Updated Detection Text pyth0n1c 2022-01-04 08:47:13 -08:00
  • 8891384376 Small Text Update pyth0n1c 2022-01-04 08:42:39 -08:00
  • 7420f730d4 Update suspicious_process_dns_query_known_abuse_web_services.yml tccontre 2022-01-04 17:39:17 +01:00
  • 249c784daf Small Text Updates pyth0n1c 2022-01-04 08:38:05 -08:00
  • 5702bf9c7d Minor Text Updates pyth0n1c 2022-01-04 08:36:46 -08:00
  • 54e6931e48 Minor Text Updates pyth0n1c 2022-01-04 08:31:04 -08:00
  • cff1c5dd74 Update Text of Detection pyth0n1c 2022-01-04 08:23:36 -08:00
  • 3c6c0dc575 Minor Text Update pyth0n1c 2022-01-04 08:21:15 -08:00
  • 7fab0d38e0 test: git token variable name update Detection Testing Service 2021-12-30 20:48:04 +05:30
  • 79808deea1 Merge branch 'linux_persist_priv_batch_2' of https://github.com/splunk/security_content into linux_persist_priv_batch_2 Detection Testing Service 2022-01-04 11:36:48 +00:00
  • 4c40ac8961 Added detection testing service results inLinux Setuid Using Chmod Utility root 2022-01-04 11:36:47 +00:00
  • 1be58f55d2 Added detection testing service results inLinux Service Restarted root 2022-01-04 11:35:23 +00:00
  • ff3172c7c0 linux_persist_priv_batch_2 tccontre 2022-01-04 12:15:50 +01:00
  • 74dcbf5bbe linux_persist_priv_batch_2 tccontre 2022-01-04 11:47:11 +01:00
  • 472519cac0 Added detection testing service results inLinux File Creation In Init Boot Directory root 2022-01-04 10:32:49 +00:00
  • f96aa5fbe3 Update linux_file_creation_in_init_boot_directory.yml tccontre 2022-01-04 11:11:14 +01:00
  • 9c96e69754 remcos_desc_update tccontre 2022-01-04 10:25:11 +01:00
  • 5737d697c0 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2022-01-03 16:10:55 -08:00
  • 94f903d685 Merge pull request #1916 from splunk/adding_not_supported Lou Stella 2022-01-03 13:46:45 -06:00
  • 060ddd9516 add initial script for extracting playbook JSON metadata into YAML Philip Royer 2022-01-03 13:41:48 -06:00
  • 8f0518b5af spelling fix d1vious 2022-01-03 14:39:48 -05:00
  • 7c1025425a fixed spelling d1vious 2022-01-03 14:35:49 -05:00
  • 50ba793358 fixing formatting d1vious 2022-01-03 12:20:42 -05:00
  • 1e731ee7af modify experimental detections to say not supported d1vious 2022-01-03 12:03:34 -05:00
  • 74b0691d7a Update linux_setuid_using_chmod_utility.yml tccontre 2022-01-03 15:52:31 +01:00
  • b20d3fed32 Update linux_file_creation_in_init_boot_directory.test.yml tccontre 2022-01-03 15:43:18 +01:00
  • cfe4b7148e Merge branch 'linux_persist_priv_batch_2' of https://github.com/splunk/security_content into linux_persist_priv_batch_2 Detection Testing Service 2022-01-03 13:06:52 +00:00
  • 943802aec6 Added detection testing service results inLinux File Creation In Profile Directory root 2022-01-03 13:06:51 +00:00
  • 7c2874bb1e linux_persist_priv_batch_2 tccontre 2022-01-03 13:57:17 +01:00
  • 5ea972280c Added detection testing service results inLinux Service File Created In Systemd Directory root 2022-01-03 12:38:40 +00:00
  • 0140a5a99b Update linux_setuid_using_chmod_utility.yml tccontre 2022-01-03 12:54:55 +01:00
  • f85658f1a0 linux_persist_priv_batch_2 tccontre 2022-01-03 12:25:08 +01:00