Commit Graph

  • 4f6b198e9d Merge branch 'develop' into datasource_enrichment Lou Stella 2025-02-18 15:57:15 -06:00
  • a33941597e Merge pull request #3276 from nterl0k/nterl0k-t1059-malicious-powershell-strings Bhavin Patel 2025-02-18 13:40:10 -08:00
  • f0d6c48267 Merge branch 'develop' into nterl0k-t1059-malicious-powershell-strings Bhavin Patel 2025-02-18 13:20:11 -08:00
  • c77b129fc6 Merge branch 'develop' into new-research-detection-endpoint Jose Enrique Hernandez 2025-02-18 16:01:39 -05:00
  • 9b1c18343b Merge branch 'develop' into auditd_sourcetype_update Lou Stella 2025-02-18 15:00:34 -06:00
  • a8a5ac8a5f Merge branch 'develop' into susmailrule Bhavin Patel 2025-02-18 12:48:04 -08:00
  • ebe37bb3fa Merge pull request #3342 from splunk/show_dashboards_dropdown Bhavin Patel 2025-02-18 11:48:53 -08:00
  • 13faf1ca7e Merge branch 'develop' into show_dashboards_dropdown Bhavin Patel 2025-02-18 10:48:45 -08:00
  • 90d46c5e28 Merge pull request #3303 from splunk/other-updates Bhavin Patel 2025-02-18 10:40:21 -08:00
  • 2c7fd2925f Merge branch 'develop' into other-updates Bhavin Patel 2025-02-18 10:37:45 -08:00
  • b9de911601 Merge branch 'develop' into show_dashboards_dropdown Bhavin Patel 2025-02-18 10:16:40 -08:00
  • 099682f93f Merge pull request #3194 from splunk/data_source_improvements_2 Bhavin Patel 2025-02-18 10:02:21 -08:00
  • 1a7653bb26 fix docs link pyth0n1c 2025-02-18 09:32:59 -08:00
  • 47c2f4fc20 Merge branch 'develop' into other-updates Bhavin Patel 2025-02-18 09:22:56 -08:00
  • e2863ae378 Merge branch 'develop' into github_detections_improvement Bhavin Patel 2025-02-18 09:03:42 -08:00
  • 151bbe05dc Merge branch 'develop' into data_source_improvements_2 Bhavin Patel 2025-02-18 09:02:02 -08:00
  • a11c4b1655 Merge pull request #3306 from splunk/app_dynamics_alerts Bhavin Patel 2025-02-18 08:58:42 -08:00
  • 8902d8c09e fix datasource reference in detection. pyth0n1c 2025-02-18 08:58:19 -08:00
  • ddf3ed0797 adding baseline key to test research-bot 2025-02-18 08:49:59 -08:00
  • 43c999440c updating yamls research-bot 2025-02-18 08:42:18 -08:00
  • 36ee66b286 Merge branch 'develop' into 8_million_requests Bhavin Patel 2025-02-18 08:30:26 -08:00
  • 3a5f6d613e Merge branch 'develop' into app_dynamics_alerts Bhavin Patel 2025-02-18 08:30:01 -08:00
  • 9ae1c7acff kfp Bhavin Patel 2025-02-18 08:13:55 -08:00
  • 44ffd97006 typo Bhavin Patel 2025-02-18 08:05:35 -08:00
  • cfded93af9 version bump Patrick Bareiss 2025-02-18 13:30:23 +01:00
  • c46223df56 version bump Patrick Bareiss 2025-02-18 13:27:02 +01:00
  • 6a5749b8e4 Merge branch 'develop' into output_normalization_o365 Patrick Bareiss 2025-02-18 13:17:41 +01:00
  • d4ccbdba64 version bump Patrick Bareiss 2025-02-18 11:56:15 +01:00
  • 730399e18f bump version Patrick Bareiss 2025-02-18 11:50:09 +01:00
  • ce009931ac Merge branch 'develop' into output_normalization_azure_ad Patrick Bareiss 2025-02-18 11:42:48 +01:00
  • 0d842ad81b version bump Patrick Bareiss 2025-02-18 11:22:10 +01:00
  • 60e55f95c5 version bump Patrick Bareiss 2025-02-18 11:18:15 +01:00
  • e6ec9a99c5 version bump Patrick Bareiss 2025-02-18 11:11:15 +01:00
  • 3efcabd099 Revert "version bump" Patrick Bareiss 2025-02-18 10:25:33 +01:00
  • a75adf9558 Revert "version bump" Patrick Bareiss 2025-02-18 10:18:06 +01:00
  • 0a4e58f9cf version bump Patrick Bareiss 2025-02-18 10:06:29 +01:00
  • 1a3f332ac7 version bump Patrick Bareiss 2025-02-18 09:57:11 +01:00
  • e2bc6c1a66 Merge branch 'develop' into output_normalization_aws Patrick Bareiss 2025-02-18 09:50:28 +01:00
  • 3563fdd417 Merge branch 'develop' into github_detections_improvement Patrick Bareiss 2025-02-18 09:38:19 +01:00
  • d03cb62686 Merge branch 'data_source_improvements_2' of github.com:splunk/security_content into data_source_improvements_2 Patrick Bareiss 2025-02-18 09:13:25 +01:00
  • 9e588b51b9 Merge branch 'develop' into data_source_improvements_2 Patrick Bareiss 2025-02-18 09:08:28 +01:00
  • e044e874ba improvements Patrick Bareiss 2025-02-18 08:55:49 +01:00
  • 7a291fde59 Updated TAs auto-ta-update-180 patel-bhavin 2025-02-18 06:57:44 +00:00
  • f2e7dbfbe7 bump versions and dates on modified detections pyth0n1c 2025-02-17 15:46:23 -08:00
  • eabea79178 Show dashboard objects in dropdown pyth0n1c 2025-02-17 14:37:00 -08:00
  • 4c80dba4de Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name. pyth0n1c 2025-02-17 12:11:35 -08:00
  • 2cb58452c1 Updated TAs auto-ta-update-179 patel-bhavin 2025-02-17 06:58:01 +00:00
  • bed85a2796 Updated TAs auto-ta-update-178 patel-bhavin 2025-02-16 06:57:40 +00:00
  • b96a6b3c6a Updated TAs auto-ta-update-177 patel-bhavin 2025-02-15 06:57:41 +00:00
  • 62e47f57a2 Merge branch 'splunk:develop' into nterl0k-t1114-sus-o365-email-actions Steven Dick 2025-02-14 21:58:16 -05:00
  • 101865e32b Update detections/cloud/o365_email_new_inbox_rule_created.yml Steven Dick 2025-02-14 19:14:16 -05:00
  • 336e6ed387 Merge branch 'develop' into deprecated_mapping pyth0n1c 2025-02-14 15:35:27 -08:00
  • 2933334f4c updaing for validate research-bot 2025-02-14 13:42:13 -08:00
  • 9446ac7782 updating test research-bot 2025-02-14 13:07:47 -08:00
  • 6f2ad99bfd app update research-bot 2025-02-14 13:00:20 -08:00
  • c1a10beef5 drafting a search research-bot 2025-02-14 12:53:18 -08:00
  • 2ba144b959 Update cisco_secure_application_alerts.yml Bhavin Patel 2025-02-14 12:06:20 -08:00
  • e23ed50fc6 O365 Suspicious Mailbox Rule Created 0xC0FFEEEE 2025-02-14 19:53:37 +00:00
  • ec7faddb31 Merge pull request #3335 from splunk/TA-update-176 Bhavin Patel 2025-02-14 10:52:02 -08:00
  • 09050f7b06 Merge branch 'develop' into deprecated_mapping pyth0n1c 2025-02-14 10:24:06 -08:00
  • f1dd70da1e update and pull in all the latest changes from develop branch pyth0n1c 2025-02-14 10:22:46 -08:00
  • ebc1d84058 remove the deprecation_info section that was previously added to detections pyth0n1c 2025-02-14 10:10:20 -08:00
  • 5e0b1d66e4 Update crowdstrike TA ljstella 2025-02-14 10:06:20 -06:00
  • a87f5f2461 fixing regex Michael Haag 2025-02-14 08:10:38 -07:00
  • 0c0167e6ad Merge branch 'splunk:develop' into nterl0k-t1059-malicious-powershell-strings Steven Dick 2025-02-14 09:28:34 -05:00
  • 30eba3111e Update windows_powershell_script_block_with_malicious_string.yml Steven Dick 2025-02-14 09:28:18 -05:00
  • b1ab004b15 Update windows_powershell_process_with_malicious_string.yml Steven Dick 2025-02-14 09:28:00 -05:00
  • c7f56ce3ef Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-02-14 09:27:04 -05:00
  • 3ca62759aa Update o365_email_send_and_hard_delete_suspicious_behavior.yml Steven Dick 2025-02-14 09:26:45 -05:00
  • 7269bbeee1 Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-02-14 09:26:20 -05:00
  • d205b2d69e Update o365_email_receive_and_hard_delete_takeover_behavior.yml Steven Dick 2025-02-14 09:25:51 -05:00
  • b4bfb8c3ad Update o365_email_password_and_payroll_compromise_behavior.yml Steven Dick 2025-02-14 09:25:25 -05:00
  • dd37507e61 Update o365_email_new_inbox_rule_created.yml Steven Dick 2025-02-14 09:24:58 -05:00
  • 600806e9d1 Update o365_email_hard_delete_excessive_volume.yml Steven Dick 2025-02-14 09:24:22 -05:00
  • 8a75b887dd Merge branch 'splunk:develop' into nterl0k-t1114-sus-o365-email-actions Steven Dick 2025-02-14 09:23:48 -05:00
  • 0a2bdd06b1 Merge branch 'splunk:develop' into nterl0k-t1567-o365-sus-file-exfil Steven Dick 2025-02-14 09:23:03 -05:00
  • ae1abc50ed Update windows_service_created_with_suspicious_service_name.yml Steven Dick 2025-02-14 09:18:30 -05:00
  • 0400838214 Merge branch 'splunk:develop' into nterl0k-t1486-bitlocker-sus-commands Steven Dick 2025-02-14 09:14:54 -05:00
  • 319d08ec60 Merge branch 'splunk:develop' into nterl0k-t1569-windows-sus-services-lookup Steven Dick 2025-02-14 09:14:32 -05:00
  • 6824672f57 Merge branch 'splunk:develop' into nterl0k-t1053-suspicious-task-lookups Steven Dick 2025-02-14 09:13:57 -05:00
  • 6055d2605d Update windows_scheduled_task_with_suspicious_name.yml Steven Dick 2025-02-14 09:10:20 -05:00
  • 68f3d88ba2 Update windows_scheduled_task_with_suspicious_command.yml Steven Dick 2025-02-14 09:10:01 -05:00
  • 0ca3c1d5b9 Update and rename winevent_scheduled_task_with_suspicious_name.yml to windows_scheduled_task_with_suspicious_name.yml Steven Dick 2025-02-14 08:59:12 -05:00
  • d1d24fc46c Update and rename winevent_scheduled_task_with_suspicious_command.yml to windows_scheduled_task_with_suspicious_command.yml Steven Dick 2025-02-14 08:58:40 -05:00
  • 29f8305d82 Merge branch 'develop' into new-research-detection-endpoint zake 2025-02-14 20:55:34 +07:00
  • e2ea10c2d2 headless_bee tccontre 2025-02-14 14:15:20 +01:00
  • b52bac9b19 output normalization endpoint Patrick Bareiss 2025-02-14 12:40:57 +01:00
  • f6b8bdc89c Updated TAs auto-ta-update-176 patel-bhavin 2025-02-14 06:57:48 +00:00
  • 87dface713 🍋 Michael Haag 2025-02-13 19:04:27 -07:00
  • d8858731bf comment test research-bot 2025-02-13 17:30:53 -08:00
  • 2d54affae2 updating dummy dataset links research-bot 2025-02-13 17:30:11 -08:00
  • d254729f9b Add files via upload Steven Dick 2025-02-13 19:37:50 -05:00
  • 5270769c3f Update windows_sql_server_configuration_option_hunt.yml Michael Haag 2025-02-13 17:22:22 -07:00
  • 5316038be7 Update windows_sqlservr_spawning_shell.yml Michael Haag 2025-02-13 17:21:49 -07:00
  • f4a5cb9b4d Haag's SQL Server Story Time: Tales of SQLCMD and Suspicious Queries 📚 Michael Haag 2025-02-13 17:14:27 -07:00
  • 3bb8618ac2 updating as per Lou's feedback research-bot 2025-02-13 15:57:49 -08:00
  • 0ec052b8f9 updating yaml to pass build and adding lookup, minor fixes research-bot 2025-02-13 15:36:01 -08:00
  • d83efc4dd1 adding datasets Jose Hernandez 2025-02-13 16:58:01 -05:00
  • fda0c88916 Merge branch 'develop' into 8_million_requests Jose Enrique Hernandez 2025-02-13 16:42:17 -05:00
  • d5f3bf613f Add manual_test flag Bhavin Patel 2025-02-13 12:24:36 -08:00