admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • f74364d7a7 updated to latest cicd release Eric McGinnis 2026-05-19 17:38:59 -07:00
  • 13f06b5e1d Complete porinting of playbooks. Fix references to old, removed detections in playbooks that were previously unvalidated. Add a MANUAL_REVIEW section, which is commented out, for clarity and to allow CICD to run and pass on this content. Renamed an existing playbook because it diverges from the name of that playbook elsewhere. Eric McGinnis 2026-05-19 14:28:53 -07:00
  • e190246023 Merge branch 'escu6_manual_review' into port_playbooks pyth0n1c 2026-05-19 12:22:30 -07:00
  • 621df1dab7 update curl command for latest app download Eric 2026-05-19 12:07:54 -07:00
  • 332f382bd3 update appinspect to diff against most recent release Eric 2026-05-19 12:00:26 -07:00
  • f9533b9608 file name has .spl auto-ta-update-635 Bhavin Patel 2026-05-20 00:29:10 +05:30
  • bb7523c565 Merge branch 'escu6_manual_review' into escu_6_workflow_updates pyth0n1c 2026-05-19 11:49:15 -07:00
  • d7b8c0f0d8 Reordering key ljstella 2026-05-19 14:25:09 -04:00
  • d235c3e7d2 Update detections/web/monitor_web_traffic_for_brand_abuse.yml Lou Stella 2026-05-19 14:22:21 -04:00
  • bc18194661 Reordering keys ljstella 2026-05-19 14:21:30 -04:00
  • 0a8c534612 Update playbooks to new format. Eric McGinnis 2026-05-19 11:12:49 -07:00
  • b196ddcf95 Baseline cleanup ljstella 2026-05-19 12:23:15 -04:00
  • 53565febce message cleanup ljstella 2026-05-19 12:15:48 -04:00
  • 15c349bde3 Multiple user type entities ljstella 2026-05-19 11:45:53 -04:00
  • e52095cb16 Unbalanced $ in message ljstella 2026-05-19 10:35:40 -04:00
  • baf4b85578 Multiple non-user but no user ljstella 2026-05-19 10:34:15 -04:00
  • 7efc90b060 Updated TAs patel-bhavin 2026-05-19 14:31:04 +00:00
  • 9dfb1706f9 Manual Review of correlation searches ljstella 2026-05-19 10:10:45 -04:00
  • 2359fbe544 salat_stealer Teoderick Contreras 2026-05-19 15:41:51 +02:00
  • 21ba5c6e8d salat_stealer Teoderick Contreras 2026-05-19 15:04:34 +02:00
  • d071304178 stage the most recent release to run appinspect metadata validation against Eric 2026-05-18 17:12:31 -07:00
  • b31f1d8c21 Split the build and install action into two different actions, build and install separately. This gives us better control and more reusability over them. Update the unit-testing workflow Eric 2026-05-18 16:54:15 -07:00
  • 88497f86a4 Fix syntax issue with appinspect workflow Eric 2026-05-18 16:24:46 -07:00
  • a139f9ab11 commit new workflows for testing Eric 2026-05-18 16:20:46 -07:00
  • 1b0455b357 commit initial code snippets for faster new content generation Eric 2026-05-18 15:20:34 -07:00
  • ee402e5c2c Fix formatting of searches Raven Tait 2026-05-15 10:12:07 -04:00
  • 81bdcbbc89 deprecated macros were not copied over during PORT operation. Fix that. Eric McGinnis 2026-05-14 07:17:08 -07:00
  • 2b10ef9cd7 remove deployments directory Eric McGinnis 2026-05-13 17:12:15 -07:00
  • 61f71544c4 Macros were missed during the porting copy over. They have now been added. Eric McGinnis 2026-05-13 17:09:31 -07:00
  • 58c7164aa2 Fix schema settings in settings.json as file names and paths had changed since the pr was first opened Eric McGinnis 2026-05-13 14:25:04 -07:00
  • 703bf050e8 Add schema validate vscode or other editor settings. Eric McGinnis 2026-05-13 14:17:30 -07:00
  • 4d7bdebd3f Add auto generated schemas. Note that thare are some pieces of content missing from here - notably content which has a MANUAL_REVIEW flag. This content does not parse until it has been updated, which means it could not be compiled into the schemas. These files will be updated when all content in the repo successfully parses. Eric McGinnis 2026-05-13 14:13:49 -07:00
  • 3bdbc59422 The 5 kvstore lookups referenced in the previous commit that were intentionally moved, but not updated, have now been updated with the new format. Eric McGinnis 2026-05-13 14:04:13 -07:00
  • db8c7c8509 Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit. Eric McGinnis 2026-05-13 14:02:27 -07:00
  • c137ef1f30 Fix test path Raven Tait 2026-05-13 10:52:31 -04:00
  • ba57c5af1c Dirty Frag detections Raven Tait 2026-05-13 10:48:24 -04:00
  • a5fd1fc506 Fix description Raven Tait 2026-05-12 12:01:26 -04:00
  • 29616ca93e Updated TAs (#4079) Bhavin Patel 2026-05-12 21:00:36 +05:30
  • 125429f36a More copy fail detections Raven Tait 2026-05-12 11:10:23 -04:00
  • c1e8695132 Fix tests copyfail Raven Tait 2026-05-12 11:03:48 -04:00
  • 0bf8742bb4 Additional copy fail detections Raven Tait 2026-05-12 10:59:35 -04:00
  • 3ffd317384 Updates per comments Raven Tait 2026-05-12 10:26:13 -04:00
  • 9584988e94 Merge branch 'develop' into push_security push_security Bhavin Patel 2026-05-12 14:12:36 +05:30
  • 719affe56d mitre ID update Bhavin Patel 2026-05-12 11:56:10 +05:30
  • 606194519a Merge branch 'develop' into secure_access_mahamudul Bhavin Patel 2026-05-12 11:51:25 +05:30
  • d37930351c Bump contentctl.yml to 6.0.0 (#4067) Bhavin Patel 2026-05-12 11:19:34 +05:30
  • b9952b9783 detection 2 Bhavin Patel 2026-05-08 16:18:59 +05:30
  • 76dbdce682 Updated TAs (#4069) Bhavin Patel 2026-05-07 19:32:10 +05:30
  • afdfadbeca new secure access DNS detection Bhavin Patel 2026-05-06 17:09:08 +05:30
  • 9c183fa110 Update Analytics to Support ATT&CK v19 (#4036) v5.27.0 Lou Stella 2026-05-05 11:29:28 -04:00
  • 917fe77cc0 Add Big Batch of Snap Attack Converted Rules (#4015) Raven Tait 2026-05-05 10:11:18 -04:00
  • 4d4c7ee091 Add Analytic for Copy Fail (#4063) Raven Tait 2026-05-04 21:13:57 -04:00
  • 4af013ec52 Add detection for copy fail Raven Tait 2026-05-04 10:21:44 -04:00
  • a9aaf494f6 Improved detections based on telemetry data (#4011) p4t12ick 2026-05-04 13:31:26 +02:00
  • ccc7f9bfd0 Updated TAs (#4055) Bhavin Patel 2026-05-02 16:34:05 +05:30
  • 3b76a770f9 Redsun Detections Raven Tait 2026-05-01 12:18:09 -04:00
  • 9335358685 Merge branch 'develop' into push_security Bhavin Patel 2026-04-30 17:05:37 +05:30
  • becdb58b9f Add Secure Access Firewall Detections (#3986) Bhavin Patel 2026-04-30 00:11:09 +05:30
  • 2b1b3fe2e1 Some BlueHammer detections Raven Tait 2026-04-29 13:16:03 -04:00
  • c5e9d4a573 Fixed two detections, and improved macos keychain dumping for more coverage of the technique (#4034) jwindley 2026-04-29 14:20:25 +01:00
  • 9972c09298 vip_keylogger (#4024) Br3akp0int 2026-04-29 14:25:13 +02:00
  • b12fbf3ba0 Merge pull request #4035 from splunk/playbook_update Lou Stella 2026-04-28 13:17:31 -04:00
  • 75a07833e7 Quotes, ugh. ljstella 2026-04-28 11:43:00 -04:00
  • 4c48e608dc Pinning ATT&CK ljstella 2026-04-28 11:40:32 -04:00
  • 7b6dab17f4 SOARHELP-6700 ljstella 2026-04-28 10:47:57 -04:00
  • 1e1748cec6 Updated TAs (#4033) Bhavin Patel 2026-04-28 14:55:21 +05:30
  • 3e040d77b6 yaml failures Bhavin Patel 2026-04-28 11:36:33 +05:30
  • 3c9904cac4 adding 1st detection and files Bhavin Patel 2026-04-28 10:35:06 +05:30
  • a94a743b63 Automated Splunk TA Update 610 (#4029) Bhavin Patel 2026-04-24 14:06:18 +05:30
  • e98b868b8d chore: bump contentctl.yml to 5.27.0 (#4028) Bhavin Patel 2026-04-24 14:04:16 +05:30
  • 0cf94c77fd Updated TAs auto-ta-update-611 patel-bhavin 2026-04-24 07:30:52 +00:00
  • 008e60b8c6 Create a version of the auto-update PR that includes all updates EXCEPT the CIM update. This allows us to isolated the impacted app as we work to mitigate the error auto-ta-update-610-minus-cim-8-5-0 Eric McGinnis 2026-04-23 15:30:56 -07:00
  • 2ede77650f updating CIM Bhavin Patel 2026-04-23 22:44:18 +05:30
  • 6da57d2466 update tgz name Bhavin Patel 2026-04-23 17:43:59 +05:30
  • fd48c398f0 Updated TAs patel-bhavin 2026-04-23 07:26:11 +00:00
  • 063a6fc38b Updated TAs (#4026) Bhavin Patel 2026-04-23 10:16:37 +05:30
  • 8c50bcae82 Merge pull request #4025 from splunk/kbouchard-patch-1 v5.26.0 Lou Stella 2026-04-21 15:29:52 -04:00
  • b27f1889ac Delete response_templates/NIST80061_v2.json kbouchard 2026-04-21 08:11:45 -07:00
  • 6ee1a47e71 Updated TAs (#4022) Bhavin Patel 2026-04-20 15:48:40 +05:30
  • 552cf37386 Updated TAs auto-ta-update-607 patel-bhavin 2026-04-20 07:31:23 +00:00
  • ab0bff139e Updated TAs auto-ta-update-605 patel-bhavin 2026-04-18 07:22:43 +00:00
  • 227c3b5e63 Updated TAs auto-ta-update-604 patel-bhavin 2026-04-17 13:49:23 +00:00
  • 4de7141a2b Merge pull request #4019 from splunk/dependabot_TA_update Lou Stella 2026-04-17 09:36:22 -04:00
  • 3337b9cd55 adding content.yml Bhavin Patel 2026-04-17 18:07:45 +05:30
  • 55f8c51579 update commit paths Bhavin Patel 2026-04-17 18:03:32 +05:30
  • ba59855b1d updating risk drilldowns (#4016) Bhavin Patel 2026-04-17 17:28:53 +05:30
  • ea5bd52238 Fix Issues - 2nd Round (#3996) Nasreddine Bencherchali 2026-04-16 07:24:43 +02:00
  • c6241660c7 Remove missing fields in Windows Event Log Cleared detection (#4001) Andrei Banaru 2026-04-16 07:22:16 +02:00
  • 7c439aeda8 Merge pull request #4018 from splunk/5.25.1_changes_for_develop Lou Stella 2026-04-15 18:23:32 -04:00
  • 3c16b138e6 Merge branch 'develop' into 5.25.1_changes_for_develop pyth0n1c 2026-04-15 15:11:36 -07:00
  • 6a8bfe977c Fix version and date and update contentctl version in prep for release. v5.25.1 5.25.0_detection_fix Eric McGinnis 2026-04-15 12:00:44 -07:00
  • 80b29d6651 New MacOS detections T1016 (#4017) jwindley 2026-04-15 19:06:58 +01:00
  • c90d744007 Duplicate - Microsoft Intune Bulk Wipe Detected (#4014) Bhavin Patel 2026-04-15 23:08:02 +05:30
  • 48698cbc4f updating osquery (#4013) Bhavin Patel 2026-04-15 16:09:38 +05:30
  • 8050483569 Snap Mac Detections (#3935) Raven Tait 2026-04-14 10:18:42 -04:00
  • 0ef51361ad Merge branch 'develop' into risk_dd risk_dd Bhavin Patel 2026-04-14 19:29:43 +05:30
  • 8d2510235b Spelling Fixes (#4002) Lou Stella 2026-04-13 06:38:11 -05:00
  • aa672c674a Pushing deprecations (#4003) Lou Stella 2026-04-09 05:12:20 -05:00
  • 56827470ac Adding script to analyze risk objects on TTP detections risk_object_analysis ljstella 2026-04-07 13:11:59 -04:00
  • 290486b6fe Merge pull request #3994 from splunk/update-template-script-2 Lou Stella 2026-04-07 07:29:09 -05:00