admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 791df3b51c Conditionals if there is no alert actions David Dorsey 2020-09-23 16:40:14 -05:00
  • 8303b2d166 Fixed generate when I don't create notables David Dorsey 2020-09-23 16:25:02 -05:00
  • e1ae7b4350 Merge branch 'TR-41_aws_ec2_mods' of https://github.com/splunk/security-content into TR-41_aws_ec2_mods bpatel 2020-09-23 14:19:09 -07:00
  • c0076b369e fixes for validate and generate bpatel 2020-09-23 14:18:53 -07:00
  • a0f95f6b4b updated risk scores David Dorsey 2020-09-23 16:09:10 -05:00
  • 1c9de39109 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-23 16:07:28 -05:00
  • 359926e89b text updates and a couple of fixes for mismatched macros Rico Valdez 2020-09-23 14:44:00 -06:00
  • 5f48894035 removed the create notable from all searches David Dorsey 2020-09-23 14:38:15 -05:00
  • c1a58c85a6 fix David Dorsey 2020-09-23 14:32:15 -05:00
  • 0bb0ad9b7e Merge branch 'develop' into TR-41_aws_ec2_mods David Dorsey 2020-09-23 14:25:30 -05:00
  • 122fb2510b Merge pull request #683 from splunk/issue_682 trogdorsey 2020-09-23 14:24:21 -05:00
  • 425abb2304 Merge branch 'develop' into issue_682 Bhavin Patel 2020-09-23 12:19:04 -07:00
  • 2d8524815f Updated search David Dorsey 2020-09-23 13:24:21 -05:00
  • e268e9643f Need to ignore the filter check for input filters David Dorsey 2020-09-23 11:46:19 -05:00
  • 65403cc027 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-23 11:36:15 -05:00
  • 2d25205146 Fixes David Dorsey 2020-09-23 11:35:56 -05:00
  • 7bd6f5380e Merge branch 'develop' into TR-41_aws_ec2_mods Jose Enrique Hernandez 2020-09-23 12:09:37 -04:00
  • 9763e75e02 Fixes David Dorsey 2020-09-23 00:07:54 -05:00
  • fcd5f1e9b1 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-23 00:02:16 -05:00
  • 58848e7326 Fixes for cryptomining demo David Dorsey 2020-09-23 00:01:02 -05:00
  • fa654c0c8f Merge pull request #685 from splunk/dependabot/pip/importlib-metadata-2.0.0 dependabot-preview[bot] 2020-09-23 00:08:18 +00:00
  • fd91c3b52b Bump importlib-metadata from 1.7.0 to 2.0.0 dependabot-preview[bot] 2020-09-23 00:04:42 +00:00
  • b9a94effa0 Merge branch 'develop' into automated_detection_service Jose Enrique Hernandez 2020-09-22 14:30:59 -04:00
  • 7509397d3f Merge pull request #681 from splunk/dependabot/pip/identify-1.5.4 dependabot-preview[bot] 2020-09-22 15:53:35 +00:00
  • b3ffdac7e8 Bump identify from 1.5.2 to 1.5.4 dependabot-preview[bot] 2020-09-22 15:49:15 +00:00
  • bc62db083c Merge pull request #684 from splunk/dependabot/pip/zipp-3.2.0 dependabot-preview[bot] 2020-09-22 15:48:00 +00:00
  • 9e5f5fc78f Bump zipp from 3.1.0 to 3.2.0 dependabot-preview[bot] 2020-09-22 15:42:15 +00:00
  • 1fa80b0161 [TR-188] add risk tags to mustang related searches (WIP). jzsplunk 2020-09-21 22:19:09 -07:00
  • 2db3cfe746 [TR-188] add risk tags to mustang related searches (WIP). jzsplunk 2020-09-21 22:18:15 -07:00
  • aaa6e86623 Added output filter back in David Dorsey 2020-09-22 00:00:22 -05:00
  • c1ab637b80 Added risk info David Dorsey 2020-09-21 23:26:13 -05:00
  • 7d2acbe104 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-21 23:24:07 -05:00
  • 17eff649e7 Fixes David Dorsey 2020-09-21 23:23:57 -05:00
  • 9b8b750db4 [TR-41] update risk_object value. jzsplunk 2020-09-21 21:06:41 -07:00
  • d169745ced [TR-41] risk tags for crypto story jzsplunk 2020-09-21 21:04:11 -07:00
  • f411bfa91b File no longer needed David Dorsey 2020-09-21 22:43:06 -05:00
  • b6136c081b Merge branch 'develop' into issue_682 Jose Enrique Hernandez 2020-09-21 21:27:23 -04:00
  • a41f3be4da fixing issue with broken app inspect divious1 2020-09-21 21:17:41 -04:00
  • 7b6b1d5d6c adding a default panel instead of empty bpatel 2020-09-21 15:45:52 -07:00
  • 013649cb6b updating docs and package bits [ci skip] research bot 2020-09-18 23:39:37 +00:00
  • 47accd5266 adding respose since the generate fails otherwise bpatel 2020-09-18 16:23:27 -07:00
  • be932e4381 Merge pull request #680 from splunk/zerologon_CVE-2020-1472 v3.0.7 Rod Soto 2020-09-18 19:22:02 -04:00
  • 4f8b5cd6a9 fixed some issues with panels that are empty failing generate divious1 2020-09-18 19:16:28 -04:00
  • 660135b77a adding 4742 detection divious1 2020-09-18 18:39:50 -04:00
  • 3790193d3b Update linux_rootkits.yml Bhavin Patel 2020-09-18 14:47:54 -07:00
  • b78035c976 adding macros divious1 2020-09-18 17:36:46 -04:00
  • 39f5939bc9 zero logon skeleton divious1 2020-09-18 17:16:25 -04:00
  • 784a0bb691 Merge pull request #632 from splunk/fixedawsstsassumerole Bhavin Patel 2020-09-17 11:11:08 -07:00
  • a156661f6f Merge pull request #672 from splunk/dependabot/pip/identify-1.5.2 dependabot-preview[bot] 2020-09-17 18:08:08 +00:00
  • cc841bbdfb Bump identify from 1.5.0 to 1.5.2 dependabot-preview[bot] 2020-09-17 18:03:05 +00:00
  • 4413638595 Merge pull request #673 from splunk/dependabot/pip/pyrsistent-0.17.3 dependabot-preview[bot] 2020-09-17 18:01:54 +00:00
  • 3d14c802fd Merge branch 'develop' into fixedawsstsassumerole Bhavin Patel 2020-09-17 11:00:31 -07:00
  • 9cf02705dd Bump pyrsistent from 0.17.2 to 0.17.3 dependabot-preview[bot] 2020-09-17 17:56:38 +00:00
  • 8aaa45b698 Merge pull request #669 from splunk/dependabot/pip/taxii2-client-2.2.2 dependabot-preview[bot] 2020-09-17 17:55:15 +00:00
  • ec3e8a9dbd Merge branch 'develop' into fixedawsstsassumerole Bhavin Patel 2020-09-17 10:49:56 -07:00
  • 6f62d4da0a Bump taxii2-client from 2.2.1 to 2.2.2 dependabot-preview[bot] 2020-09-17 17:49:30 +00:00
  • 2c2692eb4f Merge pull request #665 from splunk/gcpoauth Bhavin Patel 2020-09-17 10:48:18 -07:00
  • 997a2714df Merge branch 'develop' into fixedawsstsassumerole Bhavin Patel 2020-09-17 10:27:10 -07:00
  • 2031fcded2 Merge branch 'develop' into gcpoauth Bhavin Patel 2020-09-17 10:26:37 -07:00
  • 9a7739604c Merge branch 'develop' into automated_detection_service P4T12ICK 2020-09-17 09:43:54 +02:00
  • a9916caef1 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_4974 root 2020-09-17 07:03:16 +00:00
  • a52623d565 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-17 07:03:16 +00:00
  • 0f04cbef27 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-17 07:03:16 +00:00
  • 2f78594096 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-17 07:03:16 +00:00
  • d79c2af018 Merge branch 'develop' into TR-41_aws_ec2_mods Jose Enrique Hernandez 2020-09-16 15:02:36 -04:00
  • 7c8dd3519b Merge pull request #677 from splunk/copyright_readme Bhavin Patel 2020-09-16 09:07:27 -07:00
  • 7f6b8595b8 add license to readme P4T12ICK 2020-09-16 17:59:51 +02:00
  • 5b277d6a7c Merge branch 'automated_detection_service' of github.com:splunk/security-content into automated_detection_service P4T12ICK 2020-09-16 15:53:19 +02:00
  • 3bcda0d5bc updated detection service P4T12ICK 2020-09-16 15:51:03 +02:00
  • b517e4b640 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_7317 root 2020-09-16 11:19:43 +00:00
  • 2f400dbc3d Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-16 11:19:43 +00:00
  • f76f48729b Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-16 11:19:43 +00:00
  • a777e1769f Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-16 11:19:43 +00:00
  • c33be23f10 [TR-104] add missing input filters. jzsplunk 2020-09-15 22:59:19 -07:00
  • 7201713de3 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-15 23:59:18 -05:00
  • 7a99d2c4dd Fixing story mappings David Dorsey 2020-09-15 23:58:59 -05:00
  • 7da91f2409 [TR-41] fixing last of merge conflicts. jzsplunk 2020-09-15 20:38:05 -07:00
  • 0a6bafbe36 Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods jzsplunk 2020-09-15 20:33:32 -07:00
  • 7f2f53d0a8 validate fixes David Dorsey 2020-09-10 21:22:34 -05:00
  • bf143f01e2 cron_schedule fixed David Dorsey 2020-09-10 20:52:24 -05:00
  • 7cefe3179d Small updates David Dorsey 2020-09-10 20:49:00 -05:00
  • 182c4116c9 tweaks and updates Rico Valdez 2020-09-10 14:19:45 -06:00
  • 248c3d412c latest updates to create in new vendor_region Rico Valdez 2020-09-09 16:26:25 -06:00
  • 5fb282681b loud cloud peter-cg 2020-09-09 12:25:52 -07:00
  • 934f2ddebc Translated detections/detect_spike_in_security_group_activity.yml David Dorsey 2020-09-09 01:36:26 -05:00
  • adeeab0ee8 Updated baseline searches to have correct deployment. Which was also created David Dorsey 2020-09-09 01:35:38 -05:00
  • 483d492405 Translated detect_spike_in_aws_api_activity.yml to use Change DM David Dorsey 2020-09-09 01:01:16 -05:00
  • b5914eacd9 bug fixes David Dorsey 2020-09-09 01:00:45 -05:00
  • 8ffbe56392 Updated MLTK searches based on Peter's work David Dorsey 2020-09-08 22:49:16 -05:00
  • b62f2a0ba7 Adding cloud NACL deletion detection peter-cg 2020-09-08 14:09:24 -07:00
  • 017738bd5d Revert "Converting ACL deletion detection from Cloudtrail to Change DM" peter-cg 2020-09-08 13:49:08 -07:00
  • 987a843f9d Converting ACL deletion detection from Cloudtrail to Change DM peter-cg 2020-09-08 13:44:10 -07:00
  • 344b61d158 minor naming bug bpatel 2020-09-04 13:52:49 -07:00
  • 212338bcc4 adding new stories to response bpatel 2020-09-04 13:38:05 -07:00
  • 976971526d updates to ymls to make sure validate passes bpatel 2020-09-04 13:31:16 -07:00
  • 9f8418ee85 fixed validate issues David Dorsey 2020-09-04 13:13:22 -05:00
  • 4af9407d8f New analytic story for suspicious cloud user activities. David Dorsey 2020-09-04 10:30:47 -05:00
  • ea3f9165ae Added needed macros and lookups David Dorsey 2020-09-04 09:26:10 -05:00
  • a65c01dedf updates for mustang Rico Valdez 2020-09-03 17:10:02 -06:00
  • a679a094df Updates David Dorsey 2020-09-03 00:32:36 -05:00