Commit Graph

  • 98118fc533 small change Patrick Bareiss 2020-06-26 15:35:49 +02:00
  • af09770db1 Merge branch 'develop' into first_time_windows_service_bug David Dorsey 2020-06-26 08:32:34 -05:00
  • 6369f0f895 Changed running windows service to use kvstore as cache David Dorsey 2020-06-26 08:27:39 -05:00
  • 62a14e3217 Merge branch 'first_time_windows_service_bug' of github.com:splunk/security-content into first_time_windows_service_bug David Dorsey 2020-06-26 08:26:58 -05:00
  • f67734dedd Fixed SPL issues with detection. SPL syntax was wrong, and lookup was wrong. David Dorsey 2020-06-26 08:24:16 -05:00
  • cd4e80f98c new test Patrick Bareiss 2020-06-26 14:46:35 +02:00
  • b6608488de new test Patrick Bareiss 2020-06-26 14:24:38 +02:00
  • de67ca7fe5 add ssh key to circleci Patrick Bareiss 2020-06-26 13:31:02 +02:00
  • ba07c24280 new test Patrick Bareiss 2020-06-26 12:28:47 +02:00
  • 5f0427b1f1 new test Patrick Bareiss 2020-06-26 11:34:35 +02:00
  • fb45de7b4e new test Patrick Bareiss 2020-06-26 11:14:20 +02:00
  • e1e71e6e90 new test Patrick Bareiss 2020-06-26 11:01:37 +02:00
  • 5675d92013 testing Patrick Bareiss 2020-06-26 10:42:41 +02:00
  • bd6df9e9e2 testing Patrick Bareiss 2020-06-26 10:33:01 +02:00
  • a354a9f1cd testing Patrick Bareiss 2020-06-26 10:10:01 +02:00
  • 8f57b5362f updating docs and package bits [ci skip] research bot 2020-06-25 22:40:24 +00:00
  • 0506f93a4f Merge pull request #520 from splunk/security_hub_response v3.0.3 Bhavin Patel 2020-06-25 14:08:55 -07:00
  • 836c123569 Update abnormally_high_aws_instances_launched_by_user.yml Bhavin Patel 2020-06-25 13:57:54 -07:00
  • b5e4ebff23 Merge branch 'develop' into security_hub_response rvaldez617 2020-06-25 14:45:01 -06:00
  • 0cf88ffdc2 Merge pull request #524 from splunk/awsgcpk8s Bhavin Patel 2020-06-25 13:34:46 -07:00
  • 957b39837f Merge branch 'develop' into awsgcpk8s Bhavin Patel 2020-06-25 13:26:56 -07:00
  • 1cddcfaa25 Merge branch 'develop' into first_time_windows_service_bug Bhavin Patel 2020-06-25 11:57:22 -07:00
  • e432a4ab50 fixedservaccounatct Rod Soto 2020-06-25 14:52:41 -04:00
  • 07ce28f433 Updated baseline deployments David Dorsey 2020-06-25 13:49:48 -05:00
  • 6ea3604481 fixedaddedcondition Rod Soto 2020-06-25 14:36:18 -04:00
  • 000b56b0ee add cron schedule Patrick Bareiss 2020-06-25 18:52:51 +02:00
  • 4b13ddff94 Merge pull request #521 from splunk/awsgcpk8s Bhavin Patel 2020-06-25 09:50:31 -07:00
  • cbcd614236 Merge branch 'develop' into awsgcpk8s Bhavin Patel 2020-06-25 09:39:42 -07:00
  • a433fa15b3 updating region divious1 2020-06-25 12:38:37 -04:00
  • 301bf51a8a Merge branch 'develop' into first_time_windows_service_bug David Dorsey 2020-06-25 11:34:38 -05:00
  • fb3c848285 Merge pull request #522 from splunk/improve_deployment_handling trogdorsey 2020-06-25 11:30:45 -05:00
  • 7a236f3dd0 new deployment configurations Patrick Bareiss 2020-06-25 10:02:36 +02:00
  • 85f13dd926 new deployment configurations Patrick Bareiss 2020-06-25 09:53:44 +02:00
  • c90fcb2e9f Update how to implement David Dorsey 2020-06-25 00:14:24 -05:00
  • 8438bf71e8 Fixed the first time previously seen windows service search to work with the latest Windows TA. Simplified it by adding an hourly baseline cache update David Dorsey 2020-06-25 00:09:30 -05:00
  • e2fa17ebde Merge branch 'develop' into security_hub_response Bhavin Patel 2020-06-24 17:22:16 -07:00
  • c812c56d87 updates with T1530 bpatel 2020-06-24 17:21:02 -07:00
  • 3c1d9cb416 adding T1098 bpatel 2020-06-24 17:11:33 -07:00
  • f955708bfc adding mitre id bpatel 2020-06-24 17:09:27 -07:00
  • 23e86ec9ad Merge pull request #519 from splunk/dependabot/pip/virtualenv-20.0.25 Jose Enrique Hernandez 2020-06-24 16:23:01 -04:00
  • 08386f30d7 Merge branch 'develop' into dependabot/pip/virtualenv-20.0.25 Jose Enrique Hernandez 2020-06-24 15:52:44 -04:00
  • 7490418230 fixing errors for validate bpatel 2020-06-24 11:06:22 -07:00
  • 06245b9f3d Merge branch 'develop' into awsgcpk8s Bhavin Patel 2020-06-24 10:42:26 -07:00
  • 300e56f4dc Merge pull request #518 from splunk/CRL-1787_improvements_credential_dumping Bhavin Patel 2020-06-24 10:36:32 -07:00
  • 3c9fd3d376 awskubectl Rod Soto 2020-06-23 22:11:05 -04:00
  • b6737234fe awsfailureserv Rod Soto 2020-06-23 21:20:37 -04:00
  • 047680d82e untested playbook- remove for now bpatel 2020-06-23 16:59:30 -07:00
  • 368c72824d k8sawssensitverole Rod Soto 2020-06-23 19:44:44 -04:00
  • b734ee908b Merge branch 'develop' into CRL-1787_improvements_credential_dumping Jose Enrique Hernandez 2020-06-23 17:52:22 -04:00
  • d7bb41378e awssentobj Rod Soto 2020-06-23 15:58:11 -04:00
  • 8f89d328d6 RBACAWSsearch Rod Soto 2020-06-23 15:32:12 -04:00
  • 8225616f3d firstgcpawssearch Rod Soto 2020-06-23 14:51:45 -04:00
  • 2f6a4898aa Bump virtualenv from 20.0.23 to 20.0.25 dependabot-preview[bot] 2020-06-23 18:28:23 +00:00
  • e94bbc285d Merge pull request #517 from splunk/remove_dead_links Bhavin Patel 2020-06-23 10:46:29 -07:00
  • 5af4d06843 we can run this manually lets take it off CI, causes too much noise divious1 2020-06-23 12:57:14 -04:00
  • 8a5017fc3e update detection for credential dumping Patrick Bareiss 2020-06-23 18:57:03 +02:00
  • e079f84573 added scheduling for nightly divious1 2020-06-22 23:44:33 -04:00
  • e1a04dc037 fixed spacing to get job to validate divious1 2020-06-22 23:42:41 -04:00
  • c1ccd745a2 updated search bpatel 2020-06-22 13:34:58 -07:00
  • a23a6908b6 Merge pull request #513 from splunk/broken_url_update P4T12ICK 2020-06-22 09:35:03 +02:00
  • a15641cdbb Merge branch 'develop' into broken_url_update Patrick Bareiss 2020-06-22 09:29:14 +02:00
  • 120208df4d Merge pull request #514 from splunk/dependabot/pip/identify-1.4.20 dependabot-preview[bot] 2020-06-21 23:30:07 +00:00
  • c869cf1c93 Bump identify from 1.4.19 to 1.4.20 dependabot-preview[bot] 2020-06-21 23:23:24 +00:00
  • 05022cc657 update broken technet url pointer to netsh. Joseph Zadeh 2020-06-20 18:34:03 -07:00
  • 5112a6ddc3 fix broken attack range link in docs. Joseph Zadeh 2020-06-20 18:32:18 -07:00
  • d2c0389477 Merge pull request #512 from splunk/dependabot/pip/certifi-2020.6.20 dependabot-preview[bot] 2020-06-20 16:29:13 +00:00
  • abfcaf57c1 Bump certifi from 2020.4.5.2 to 2020.6.20 dependabot-preview[bot] 2020-06-20 16:22:36 +00:00
  • 3ea3cee74f updating docs and package bits [ci skip] research bot 2020-06-18 19:55:08 +00:00
  • 605d0c414d Merge pull request #511 from splunk/updating_readme_fixes v3.0.2 rvaldez617 2020-06-18 13:38:27 -06:00
  • 14f99345f3 Merge branch 'develop' into updating_readme_fixes Jose Enrique Hernandez 2020-06-18 13:13:52 -04:00
  • b4664f0f17 Merge pull request #476 from splunk/aws_cross_account_activity_fix Jose Enrique Hernandez 2020-06-18 13:13:30 -04:00
  • 3a96de67c0 clean up of docs divious1 2020-06-17 21:43:18 -04:00
  • 0b1adabe8f Merge branch 'develop' into aws_cross_account_activity_fix rvaldez617 2020-06-17 16:16:54 -06:00
  • 8c4fb32882 Merge pull request #505 from splunk/CRL-1771-update-story-windows-service-abuse Bhavin Patel 2020-06-17 14:48:28 -07:00
  • 82c209b539 Merge branch 'develop' into CRL-1771-update-story-windows-service-abuse Bhavin Patel 2020-06-17 14:25:20 -07:00
  • ee76ea28d9 Merge pull request #509 from splunk/dependabot/pip/requests-2.24.0 dependabot-preview[bot] 2020-06-17 16:48:47 +00:00
  • c27e3c2e91 Bump requests from 2.23.0 to 2.24.0 dependabot-preview[bot] 2020-06-17 16:43:28 +00:00
  • 208090a84d Merge pull request #481 from splunk/CRL-1766-auth-dm-updates Bhavin Patel 2020-06-16 15:36:22 -07:00
  • e96a91aeb4 removed searches that depend on non-extracted fields Rico Valdez 2020-06-16 12:43:48 -06:00
  • 3c8c201add Merge branch 'develop' into CRL-1766-auth-dm-updates Bhavin Patel 2020-06-16 10:46:20 -07:00
  • 8fcbbe639b Merge pull request #498 from splunk/summaries_true Bhavin Patel 2020-06-16 10:36:57 -07:00
  • a3022806ce Merge branch 'develop' into CRL-1766-auth-dm-updates merging in develop Rico Valdez 2020-06-16 11:22:02 -06:00
  • e2686ef561 Merge branch 'develop' into summaries_true Jose Enrique Hernandez 2020-06-16 13:13:37 -04:00
  • ef9b67ea6d Merge branch 'CRL-1766-auth-dm-updates' of github.com:splunk/security-content into CRL-1766-auth-dm-updates Rico Valdez 2020-06-16 11:12:31 -06:00
  • e244df84af replace a rename with dropping the DM - same effect, better solution Rico Valdez 2020-06-16 11:10:34 -06:00
  • 20fe16c7a7 Merge pull request #500 from splunk/kerberoasting Bhavin Patel 2020-06-16 10:04:04 -07:00
  • b74d787f20 Merge branch 'develop' into summaries_true Bhavin Patel 2020-06-16 10:01:37 -07:00
  • 420cddc307 Merge branch 'develop' into kerberoasting Jose Enrique Hernandez 2020-06-16 12:39:11 -04:00
  • 0793d0336b Merge pull request #508 from splunk/develop Jose Enrique Hernandez 2020-06-16 12:38:18 -04:00
  • 560c176d49 adding stats for aggregation divious1 2020-06-16 12:32:20 -04:00
  • 038ce3e27f Merge branch 'master' into develop Bhavin Patel 2020-06-15 17:01:57 -07:00
  • 161a2d4490 Merge branch 'develop' into CRL-1771-update-story-windows-service-abuse Bhavin Patel 2020-06-15 16:45:25 -07:00
  • 0e1f9f004b updating docs and package bits [ci skip] research bot 2020-06-15 23:23:12 +00:00
  • 8688c29975 Merge pull request #506 from splunk/APPCERT-20465 v3.0.1 Bhavin Patel 2020-06-15 14:07:51 -07:00
  • fa9cdbc18b readding tour conf file divious1 2020-06-15 16:48:04 -04:00
  • 358d97b128 removing UI tour divious1 2020-06-15 16:44:08 -04:00
  • f260c27499 removed UI tour reload divious1 2020-06-15 11:40:13 -04:00
  • f892cda659 testing and update of story Windows Service Abuse Patrick Bareiss 2020-06-15 14:28:20 +02:00
  • 3764371a2a Merge pull request #502 from splunk/dependabot/pip/virtualenv-20.0.23 dependabot-preview[bot] 2020-06-14 12:00:23 +00:00
  • 586fa235be Bump virtualenv from 20.0.21 to 20.0.23 dependabot-preview[bot] 2020-06-14 11:54:13 +00:00