Commit Graph

  • 2f48e04006 Merge branch 'develop' into analytics_enhancement Br3akp0int 2025-02-06 16:58:21 +01:00
  • d7171f0d6e version bump Patrick Bareiss 2025-02-06 15:59:50 +01:00
  • dfe5b0a0ba missing status field Patrick Bareiss 2025-02-06 15:56:30 +01:00
  • b6a28b6dd4 Merge branch 'develop' into github_detections_improvement Patrick Bareiss 2025-02-06 15:53:20 +01:00
  • eead81fa65 new detection yml schema Patrick Bareiss 2025-02-06 15:52:12 +01:00
  • 7e119c82ee Merge branch 'develop' into github_detections_improvement Patrick Bareiss 2025-02-06 15:41:05 +01:00
  • 195547ecb5 azure ad detections output normalization Patrick Bareiss 2025-02-06 15:38:06 +01:00
  • 9658514c13 Update remote_monitoring_and_management_software.yml Steven Dick 2025-02-06 08:24:08 -05:00
  • 30edc65d04 Update remote_monitoring_and_management_software.yml Steven Dick 2025-02-06 08:18:27 -05:00
  • 911ebe61fd Update remote_monitoring_and_management_software.yml Steven Dick 2025-02-06 08:18:05 -05:00
  • ef5eca5bd1 Update detect_remote_access_software_usage_dns.yml Steven Dick 2025-02-06 08:07:31 -05:00
  • f5160eba6f Update detect_remote_access_software_usage_traffic.yml Steven Dick 2025-02-06 08:06:29 -05:00
  • 8d3da80557 Update detect_remote_access_software_usage_dns.yml Steven Dick 2025-02-06 08:05:27 -05:00
  • 41c92476b9 Update detect_remote_access_software_usage_url.yml Steven Dick 2025-02-06 08:04:38 -05:00
  • 0885f557bb Update detect_remote_access_software_usage_file.yml Steven Dick 2025-02-06 08:03:56 -05:00
  • f4a78d9f60 Update detect_remote_access_software_usage_fileinfo.yml Steven Dick 2025-02-06 08:03:25 -05:00
  • b85aacf75f Update detect_remote_access_software_usage_registry.yml Steven Dick 2025-02-06 08:02:38 -05:00
  • 778d7fa7cd Update detect_remote_access_software_usage_process.yml Steven Dick 2025-02-06 08:01:53 -05:00
  • 38af78103f Update detect_remote_access_software_usage_fileinfo.yml Steven Dick 2025-02-06 08:00:27 -05:00
  • dea4448a4f Update detect_remote_access_software_usage_file.yml Steven Dick 2025-02-06 07:58:47 -05:00
  • 7773664924 Update detect_remote_access_software_usage_url.yml Steven Dick 2025-02-06 07:57:46 -05:00
  • 2447329ea9 Update detect_remote_access_software_usage_dns.yml Steven Dick 2025-02-06 07:56:12 -05:00
  • db40375a6b Update detect_remote_access_software_usage_traffic.yml Steven Dick 2025-02-06 07:55:50 -05:00
  • 8b0bf13a10 Update detect_remote_access_software_usage_dns.yml Steven Dick 2025-02-06 07:53:56 -05:00
  • d73c82d75f Add files via upload Steven Dick 2025-02-06 07:53:20 -05:00
  • 988fd0f1e4 Update detect_remote_access_software_usage_dns.yml Steven Dick 2025-02-06 07:52:12 -05:00
  • 08d4492ba2 Updated TAs patel-bhavin 2025-02-06 06:57:53 +00:00
  • 5000d5aa36 Merge branch 'splunk:develop' into nterl0k-t1059-malicious-powershell-strings Steven Dick 2025-02-05 22:58:37 -05:00
  • 588c66f564 Merge branch 'splunk:develop' into nterl0k-t1114-sus-o365-email-actions Steven Dick 2025-02-05 22:45:22 -05:00
  • 84b5c23db3 Merge branch 'splunk:develop' into nterl0k-t1200-sysmon-usb-use-execution Steven Dick 2025-02-05 22:44:40 -05:00
  • 503a3713af Merge branch 'develop' into rdp_brute Bhavin Patel 2025-02-05 15:41:40 -08:00
  • e2868a78b0 Merge branch 'develop' into nterl0k-t1213.002-sus-sharepoint-search Bhavin Patel 2025-02-05 15:31:38 -08:00
  • 5462f1ca72 Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change Bhavin Patel 2025-02-05 14:23:45 -08:00
  • 93f33ccae3 Merge pull request #3268 from nterl0k/nterl0k-t1110-mfasweep-detection Bhavin Patel 2025-02-05 14:22:56 -08:00
  • e4b7d78067 Merge branch 'develop' into nterl0k-t1110-mfasweep-detection Bhavin Patel 2025-02-05 13:45:16 -08:00
  • 284dfc838e Merge pull request #3267 from nterl0k/nterl0k-t1033-query-remote-usage Bhavin Patel 2025-02-05 13:43:43 -08:00
  • cf69152cd5 Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil Nasreddine Bencherchali 2025-02-05 22:03:56 +01:00
  • 25cd13f41c Merge branch 'develop' into nterl0k-t1033-query-remote-usage Nasreddine Bencherchali 2025-02-05 22:02:32 +01:00
  • 7ebb49e63c update logic to avoid duplicate alerting Nasreddine Bencherchali 2025-02-05 22:01:51 +01:00
  • 6133a684c1 Merge pull request #3307 from splunk/auto-ta-update-167 Bhavin Patel 2025-02-05 12:42:33 -08:00
  • dfc98cf162 Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change Bhavin Patel 2025-02-05 12:41:34 -08:00
  • fdec3cb64e Merge branch 'develop' into new-rules Nasreddine Bencherchali 2025-02-05 21:39:05 +01:00
  • 97c0ca1a08 Merge branch 'develop' into other-updates Nasreddine Bencherchali 2025-02-05 21:38:40 +01:00
  • f1c82c2b2e Merge branch 'develop' into nterl0k-t1059-malicious-powershell-strings Bhavin Patel 2025-02-05 12:28:59 -08:00
  • e3d81a7913 Merge branch 'develop' into auto-ta-update-167 Bhavin Patel 2025-02-05 12:21:48 -08:00
  • 318f3eabde Merge branch 'develop' into nterl0k-t1033-query-remote-usage Bhavin Patel 2025-02-05 12:18:27 -08:00
  • 70aa8403f5 Merge pull request #3310 from splunk/build_issue Bhavin Patel 2025-02-05 12:17:56 -08:00
  • 20495d69e9 Merge branch 'develop' into auto-ta-update-167 Bhavin Patel 2025-02-05 12:13:58 -08:00
  • b599f494fc updating if condition research-bot 2025-02-05 12:09:04 -08:00
  • d46de4f487 Merge branch 'develop' into nterl0k-t1110-mfasweep-detection Bhavin Patel 2025-02-05 11:59:44 -08:00
  • 9b8328a26a updating version research-bot 2025-02-05 11:57:50 -08:00
  • 24aef17267 conflits research-bot 2025-02-05 11:50:06 -08:00
  • 2c7c015437 Merge pull request #3309 from splunk/inspect_501 Bhavin Patel 2025-02-05 11:47:20 -08:00
  • c8aabc01db updating yaml research-bot 2025-02-05 11:26:47 -08:00
  • ba8f23593a udpating ctl research-bot 2025-02-05 10:56:37 -08:00
  • 76a9a02c9e updating versions research-bot 2025-02-05 10:49:03 -08:00
  • d313f4bac1 Merge pull request #3308 from splunk/data_source_linux_secure Jose Enrique Hernandez 2025-02-05 12:32:24 -05:00
  • 75617e961d linux secure data source Patrick Bareiss 2025-02-05 09:19:19 +01:00
  • be6b1698a2 Updated TAs patel-bhavin 2025-02-05 06:57:54 +00:00
  • 50517d8ce8 Merge branch 'develop' into nterl0k-t1110-mfasweep-detection Bhavin Patel 2025-02-04 12:45:45 -08:00
  • 3f04de517c updating TA research-bot 2025-02-04 12:34:22 -08:00
  • 785fbd57ec updating contetntctl research-bot 2025-02-04 12:29:00 -08:00
  • 5e3991de7c updating datasiource research-bot 2025-02-04 11:59:58 -08:00
  • 90d0d3bdf1 adding data source research-bot 2025-02-04 11:59:06 -08:00
  • 0544e801b2 adding draft detections research-bot 2025-02-04 11:55:10 -08:00
  • 969ba0fb65 all test passed Patrick Bareiss 2025-02-04 11:47:09 +01:00
  • 4cdaed8c5f Merge pull request #3305 from splunk/to_5.0 pyth0n1c 2025-02-03 13:52:16 -08:00
  • e1ee551a60 udpating to 5 research-bot 2025-02-03 13:50:08 -08:00
  • ed8e3bf842 aws detections Patrick Bareiss 2025-02-03 20:26:34 +01:00
  • 8b3d6685f0 CI fixes Nasreddine Bencherchali 2025-02-03 18:57:08 +01:00
  • 04a6d498dd Merge branch 'analytics_enhancement' of github.com:splunk/security_content into analytics_enhancement tccontre 2025-02-03 18:36:19 +01:00
  • 191f94eb3d analytics_enhancement tccontre 2025-02-03 18:10:20 +01:00
  • f78bd48e7c analytics_enhancement tccontre 2025-01-30 10:53:52 +01:00
  • 756b229e15 analytics_enhancement tccontre 2025-01-27 12:33:50 +01:00
  • 07cc1e4ca0 analytics_enhancement tccontre 2025-01-27 12:17:39 +01:00
  • 37db646b29 analytics_enhancement tccontre 2025-01-23 14:42:01 +01:00
  • a7ee878911 analytics_enhancement tccontre 2025-02-03 18:10:20 +01:00
  • 8b1b30e1e7 bug fix Patrick Bareiss 2025-02-03 13:20:43 +01:00
  • 7d136cbfde Merge branch 'develop' into output_normalization_aws Patrick Bareiss 2025-02-03 10:19:59 +01:00
  • 3349099691 output normlaization Patrick Bareiss 2025-02-03 10:15:07 +01:00
  • d11d2df008 Update o365_sharepoint_suspicious_search_behavior.yml Steven Dick 2025-02-02 12:59:26 -05:00
  • 816bffa538 Merge branch 'splunk:develop' into nterl0k-t1110-mfasweep-detection Steven Dick 2025-02-02 12:57:39 -05:00
  • d831e26801 Merge branch 'splunk:develop' into nterl0k-t1059-malicious-powershell-strings Steven Dick 2025-02-02 12:57:15 -05:00
  • ccd6e94ddf Merge branch 'splunk:develop' into nterl0k-t1200-sysmon-usb-use-execution Steven Dick 2025-02-02 12:56:50 -05:00
  • 93fdd5aac8 Merge branch 'splunk:develop' into nterl0k-t1114.003-o365-transport-rule-change Steven Dick 2025-02-02 12:55:57 -05:00
  • 35590471bc Merge branch 'splunk:develop' into nterl0k-t1213.002-sus-sharepoint-search Steven Dick 2025-02-02 12:55:32 -05:00
  • 41f5366c15 Merge branch 'splunk:develop' into nterl0k-t1114-sus-o365-email-actions Steven Dick 2025-02-02 12:54:51 -05:00
  • 030537a8f4 Merge branch 'splunk:develop' into nterl0k-t1033-query-remote-usage Steven Dick 2025-02-02 12:53:46 -05:00
  • 97b27a672f Update o365_sharepoint_suspicious_search_behavior.yml Steven Dick 2025-02-02 12:52:02 -05:00
  • 5b9b5ab07b Update windows_system_remote_discovery_with_query.yml Steven Dick 2025-02-02 12:49:10 -05:00
  • fab070785c Update o365_multiple_os_vendors_authenticating_from_user.yml Steven Dick 2025-02-02 12:43:45 -05:00
  • b0f6697ec8 Update windows_powershell_script_block_with_malicious_string.yml Steven Dick 2025-02-02 12:40:06 -05:00
  • 7381c9d76d Update windows_powershell_process_with_malicious_string.yml Steven Dick 2025-02-02 12:39:38 -05:00
  • 315c7782ed Update windows_detect_wpdbusenum_registry_key_modification.yml Steven Dick 2025-02-02 12:34:10 -05:00
  • a51cebbf03 Update windows_detect_usbstor_registry_key_modification.yml Steven Dick 2025-02-02 12:33:46 -05:00
  • 42107eeea8 Update windows_detect_process_executed_from_removable_media.yml Steven Dick 2025-02-02 12:33:22 -05:00
  • 1ac26e3bc8 Update o365_exfiltration_via_file_sync_download.yml Steven Dick 2025-02-02 12:31:31 -05:00
  • 84c1a4c5e2 Update o365_exfiltration_via_file_download.yml Steven Dick 2025-02-02 12:31:04 -05:00
  • 9de89087f3 Update o365_exfiltration_via_file_access.yml Steven Dick 2025-02-02 12:30:38 -05:00
  • e05958d04b Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 20:06:31 -05:00