Commit Graph

  • e182e32f51 quote the file Henry Yu 2026-04-06 21:04:14 -07:00
  • e791773e97 unquote the file Henry Yu 2026-04-06 20:44:11 -07:00
  • 6e75fc6407 Merge pull request #3991 from splunk/update-template-script Lou Stella 2026-04-06 17:05:24 -05:00
  • 806f6bdd32 Merge branch 'develop' into update-template-script Lou Stella 2026-04-06 17:03:05 -05:00
  • 95b35f77c1 Merge pull request #3990 from splunk/kbouchard-patch-1 Lou Stella 2026-04-06 17:02:40 -05:00
  • 93cb3bedd9 Merge branch 'develop' into kbouchard-patch-1 Lou Stella 2026-04-06 16:59:28 -05:00
  • 9b5c9aa7b9 remove the ignore . file change Henry Yu 2026-04-06 14:47:08 -07:00
  • 924a89e249 add validation for unique name, version pair Henry Yu 2026-04-02 13:06:15 -07:00
  • 9bc34d412f group by actual template names instead of file name Henry Yu 2026-04-02 12:38:37 -07:00
  • 7293d75700 Tagged Analytics Covering the Axios Compromise Post-Exploitation Activity (#3982) Br3akp0int 2026-04-02 18:07:20 +02:00
  • f416da59fe Add Filter for VMware Tools (#3983) Raven Tait 2026-04-02 12:06:04 -04:00
  • 116ab57d18 Remove AITK/MLTK TAs references from Contentctl.yml (#3911) Bhavin Patel 2026-04-02 21:17:55 +05:30
  • 8c6453e0ea Bump contentctl.yml to 5.26.0 (#3989) Bhavin Patel 2026-04-02 21:11:06 +05:30
  • fc1596e371 had to remove 8.5 from the name of response plans kbouchard 2026-04-01 20:55:54 -07:00
  • 90536d0e5a Palo Alto Ta 3.0.0 was pulled from Splukbase. (#3985) v5.25.0 pyth0n1c 2026-03-31 10:12:26 -07:00
  • fd53a2186b Fix Broken RBA Message (#3984) Nasreddine Bencherchali 2026-03-31 17:34:07 +02:00
  • d0a41f979b updating drilldown risk Bhavin Patel 2026-03-31 12:24:17 +05:30
  • c3b3676693 Fix message in detection feature/CIM-1504-test-cim-8.5 Xiaonan Qi 2026-03-30 13:09:41 -07:00
  • 39849c0179 Merge pull request #3980 from splunk/sched_task_rba_message Lou Stella 2026-03-30 14:51:23 -05:00
  • d38d8e1519 First pass of RBA message fix ljstella 2026-03-30 15:09:36 -04:00
  • ff78e2d159 gh0st (#3973) Br3akp0int 2026-03-30 16:16:33 +02:00
  • 2f931a3386 udpating spl and configs drilldown_update Bhavin Patel 2026-03-30 15:26:57 +05:30
  • bc1b413923 Fix Reported Issues - April Batch (#3962) Nasreddine Bencherchali 2026-03-30 11:04:11 +02:00
  • 8ed14b0ed4 Comment out Suricata TA for testing Xiaonan Qi 2026-03-28 13:48:22 -07:00
  • b87507b551 Update Suricata TA and Related Analytics (#3974) Nasreddine Bencherchali 2026-03-28 11:09:22 +01:00
  • 35e6ee2e97 Add files via upload (#3975) kbouchard 2026-03-28 03:07:40 -07:00
  • 89391cf877 Tune detections based on Athena FPs (#3972) Bhavin Patel 2026-03-27 21:28:41 +05:30
  • fa45863186 Merge pull request #3971 from splunk/detections_improvement p4t12ick 2026-03-27 13:20:26 +01:00
  • 30e0c54198 Update ryuk_wake_on_lan_command.yml nasbench 2026-03-27 12:21:22 +01:00
  • 44f3125d35 bug fix P4T12ICK 2026-03-27 10:13:56 +01:00
  • 0b219a6b1e bug fix P4T12ICK 2026-03-27 08:28:10 +01:00
  • 8be3693cf3 changed back to Anomaly P4T12ICK 2026-03-27 08:00:36 +01:00
  • c40b390d3f updated suggestions P4T12ICK 2026-03-27 07:58:29 +01:00
  • b4c002efb5 Update detections/endpoint/windows_account_access_removal_via_logoff_exec.yml p4t12ick 2026-03-26 16:45:57 +01:00
  • 3c1d41e219 Update detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml p4t12ick 2026-03-26 16:45:40 +01:00
  • 4912e09184 Update detections/endpoint/system_user_discovery_with_whoami.yml p4t12ick 2026-03-26 16:44:53 +01:00
  • b4c800deb2 Update detections/endpoint/conti_common_exec_parameter.yml p4t12ick 2026-03-26 16:43:29 +01:00
  • 6d5d970ee6 Update detections/endpoint/anomalous_usage_of_7zip.yml p4t12ick 2026-03-26 16:43:13 +01:00
  • 520bfc060c bug fix P4T12ICK 2026-03-26 10:19:11 +01:00
  • dc3f50b24b bug fix P4T12ICK 2026-03-26 10:13:15 +01:00
  • 106a9ba5ca bug fixes P4T12ICK 2026-03-26 09:28:52 +01:00
  • fee2237a5f bug fix P4T12ICK 2026-03-26 08:44:26 +01:00
  • 90efd9a8ef bumped version numbers and dates P4T12ICK 2026-03-26 08:01:41 +01:00
  • e86354e45b bug fix P4T12ICK 2026-03-26 07:55:10 +01:00
  • 1e0096296b bug fix P4T12ICK 2026-03-26 07:52:19 +01:00
  • eb0cb46f71 Merge branch 'develop' into detections_improvement p4t12ick 2026-03-26 07:51:05 +01:00
  • e556cac279 Improved detections based on telemetry. P4T12ICK 2026-03-26 07:46:49 +01:00
  • 4aedd91a80 Add placeholder to all files missing mitre_attack_id section, or which declared mitre_attack_id: [] but did not dynamically calculate mitre_attack_id. This should cause failures in contentctl validate until all content is fixed. add_missing_mitre_attack_id_tag Eric 2026-03-23 13:32:37 -07:00
  • 697a77cd08 Add Tagging and Analytic Story for Void Manticore (#3959) Br3akp0int 2026-03-23 17:19:07 +01:00
  • 0f08a8b884 Tweaking attack_data links (#3966) Lou Stella 2026-03-23 08:38:28 -05:00
  • 37c9344ca0 chore: bump contentctl.yml to 5.25.0 (#3968) Bhavin Patel 2026-03-23 17:52:55 +05:30
  • 45134af4ea Updated TAs (#3965) v5.24.0 Bhavin Patel 2026-03-19 00:13:23 +05:30
  • afccbee627 Changing parameter to hopefully fix TA "dependabot" (#3964) Lou Stella 2026-03-18 13:11:40 -05:00
  • c5506fa1f9 Merge pull request #3963 from splunk/bump_okta_ta Lou Stella 2026-03-18 12:57:29 -05:00
  • fbf8bcbd40 bump okta ta. 5.0.0 was yanked from splunkbase pyth0n1c 2026-03-18 10:42:14 -07:00
  • 709e57e129 Test- Integration failure fixes (#3960) Bhavin Patel 2026-03-18 02:30:04 +05:30
  • 27aeb7d95d Add BlankGrabber Stealer Related Analytics and Tagging (#3943) Br3akp0int 2026-03-16 18:09:57 +01:00
  • 9c7ef33e81 Fix Issue #3950 (#3957) Br3akp0int 2026-03-16 16:18:01 +01:00
  • 98ef843af8 Fix Windows AD Domain Replication ACL Addition (#3958) Bhavin Patel 2026-03-16 20:38:55 +05:30
  • 4aeba4c377 Add Lotus Blossom Related Analytics and Tagging (#3953) Michael Haag 2026-03-16 08:47:02 -06:00
  • b3fed38275 Deprecate MLTK detections (#3922) Bhavin Patel 2026-03-16 19:29:40 +05:30
  • 3208147d4d Add Coverage For QuietVault (#3952) Br3akp0int 2026-03-14 01:11:44 +01:00
  • 29113be7a7 Fix Broken Link, Versions and Pre-Commit (#3956) Nasreddine Bencherchali 2026-03-13 14:47:15 +01:00
  • d1d4883e18 fix: replace src with src_user (#3955) Andrei Banaru 2026-03-13 12:59:46 +01:00
  • d376b5d76f Merge branch 'develop' into feature/lotus-blossom-chrysalis-2026-02-02 feature/lotus-blossom-chrysalis-2026-02-02 Bhavin Patel 2026-03-13 17:10:11 +05:30
  • a0059cf72c Adding dynamic information to static rba messages (#3951) Emil 2026-03-13 06:57:18 +01:00
  • de62304785 Add Analytic Story Tagging for Muddy Water (#3947) Br3akp0int 2026-03-12 17:30:09 +01:00
  • 14a2a96f71 Merge pull request #3949 from splunk/dependabot/pre_commit/https-/github.com/pre-commit/pre-commit-hooks-6.0.0 Lou Stella 2026-03-12 10:53:14 -05:00
  • 1e8aa4c728 Merge branch 'develop' into dependabot/pre_commit/https-/github.com/pre-commit/pre-commit-hooks-6.0.0 Lou Stella 2026-03-12 10:51:02 -05:00
  • 9a297e963a Merge branch 'develop' into feature/lotus-blossom-chrysalis-2026-02-02 Michael Haag 2026-03-12 09:45:14 -06:00
  • c741a8c2b3 Merge origin/develop: resolve conflicts in system_information_discovery, system_user_discovery_with_whoami, windows_wmic_systeminfo_discovery MHaggis 2026-03-12 09:42:26 -06:00
  • f05ed6d237 Merge branch 'feature/lotus-blossom-chrysalis-2026-02-02' of https://github.com/splunk/security_content into feature/lotus-blossom-chrysalis-2026-02-02 MHaggis 2026-03-12 08:50:50 -06:00
  • 639d57fc60 fixes i hope MHaggis 2026-03-12 08:50:48 -06:00
  • ed5884f607 More SD-WAN Content (#3944) Nasreddine Bencherchali 2026-03-12 13:46:41 +01:00
  • f17bc8df6d Not every system has a python, but they should all have a python3 ljstella 2026-03-11 10:39:42 -04:00
  • f0aadf7c81 Remove two hooks ljstella 2026-03-11 10:35:32 -04:00
  • 8231be2295 Bump https://github.com/pre-commit/pre-commit-hooks from v4.6.0 to 6.0.0 dependabot[bot] 2026-03-11 14:29:04 +00:00
  • e8f5e6453a Adding pre-commit to dependabot (#3948) Lou Stella 2026-03-11 09:28:11 -05:00
  • 3da4f7958a anomaly_standard_init_score (#3946) Br3akp0int 2026-03-10 09:49:08 +01:00
  • 2e2f6fc649 ttp_standard_init_score (#3945) Br3akp0int 2026-03-10 09:40:37 +01:00
  • 88f318923e Merge branch 'develop' into ttp_init_score ttp_init_score Br3akp0int 2026-03-10 09:15:23 +01:00
  • b1425aadfa Split and tweak of linux_docker_privilege_escalation (#3929) Emil 2026-03-10 08:16:59 +01:00
  • 96a4df100d Automated Splunk TA Update 560 (#3938) Bhavin Patel 2026-03-06 12:26:52 +05:30
  • ca62917636 Merge branch 'develop' into ctlbump ctlbump pyth0n1c 2026-03-05 10:16:21 -08:00
  • 22953496b2 Merge pull request #3937 from splunk/bump_contentctl_5.24.0 Lou Stella 2026-03-05 12:14:22 -06:00
  • 6044eb6a0d updating req Bhavin Patel 2026-03-05 23:23:09 +05:30
  • ba6f9b948d Bumping requirements.txt ljstella 2026-03-05 12:28:06 -05:00
  • 8f80f086b3 Actually remove the detection ljstella 2026-03-05 09:15:43 -05:00
  • 5440317966 Removed detection for v5.24.0 ljstella 2026-03-05 09:12:44 -05:00
  • 1eaa1a12d2 chore: bump contentctl.yml to 5.24.0 research bot 2026-03-04 19:11:57 +00:00
  • a511b1bc90 Updated TAs auto-ta-update-559 patel-bhavin 2026-03-04 07:10:44 +00:00
  • 261b5fee45 Bump aws-actions/configure-aws-credentials from 5 to 6 (#3933) v5.23.0 dependabot[bot] 2026-03-03 20:47:16 +00:00
  • 2f600e1214 Bump actions/upload-artifact from 6 to 7 (#3932) dependabot[bot] 2026-03-03 20:46:02 +00:00
  • 7217019457 fix rba message (#3934) Bhavin Patel 2026-03-04 02:10:57 +05:30
  • f930b525ee Add New Analytics - February Batch (#3886) Nasreddine Bencherchali 2026-03-03 14:01:37 +01:00
  • 34be5c0b0c normalize all legacy line endings (#3931) pyth0n1c 2026-03-02 14:34:35 -08:00
  • cb067903a3 Merge pull request #3930 from splunk/remove_extra_fields pyth0n1c 2026-03-02 13:39:11 -08:00
  • 997eb76be6 Remove EXTRA fields that are not part of the models from yml files pyth0n1c 2026-03-02 12:28:07 -08:00
  • b6888c5e86 Merge pull request #3927 from splunk/ta_update_script p4t12ick 2026-02-26 15:14:38 +01:00
  • 773343a116 Merge branch 'develop' into ta_update_script p4t12ick 2026-02-26 15:10:58 +01:00