admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • cacc5f03de Merge pull request #221 from splunk/CRL-1490 Jose Enrique Hernandez 2019-10-16 11:12:50 -04:00
  • af66ed5fe3 Changed json to yml Patrick Bareiss 2019-10-16 16:38:05 +02:00
  • 14bfab7338 Fixed typo in distsearch.conf that caused unnecessary bundle replication David Dorsey 2019-10-15 16:28:26 -07:00
  • 009a5b0f37 Bump attrs from 19.2.0 to 19.3.0 dependabot-preview[bot] 2019-10-15 14:44:10 +00:00
  • b5c461abd3 updating error run_detections divious1 2019-10-14 14:06:53 -04:00
  • 6b013d2531 adding dashboard updates bpatel 2019-10-11 14:53:47 -07:00
  • 61990be03f Bump contextlib2 from 0.6.0 to 0.6.0.post1 dependabot-preview[bot] 2019-10-11 06:18:51 +00:00
  • d11440ff37 yeild null results when no detection results found bpatel 2019-10-10 17:58:37 -07:00
  • f97cdc34d7 detection dashboard update bpatel 2019-10-10 17:43:12 -07:00
  • 191c68f106 Merge branch 'run_detections' of https://github.com/splunk/security-content into run_detections bpatel 2019-10-10 17:36:27 -07:00
  • 7fe8328a8d adding a macro to format the detect results bpatel 2019-10-10 17:36:15 -07:00
  • 38d430cfd3 working version of investigate divious1 2019-10-10 16:38:33 -05:00
  • 9755770513 detect checks bpatel 2019-10-10 14:19:35 -07:00
  • 205c078857 search update and adding checks in detect bpatel 2019-10-10 12:39:39 -07:00
  • 09f3fe9cef Bump jsonschema from 3.0.2 to 3.1.1 dependabot-preview[bot] 2019-10-10 06:29:41 +00:00
  • 7deba725eb testing bpatel 2019-10-09 18:33:56 -07:00
  • af0a6cc56b yield results after parsing bpatel 2019-10-09 16:50:04 -07:00
  • 2046082c82 Merge branch 'run_detections' of https://github.com/splunk/security-content into run_detections bpatel 2019-10-09 12:41:43 -07:00
  • 28609911dd dashboard update bpatel 2019-10-09 12:41:35 -07:00
  • c54dccd8e0 updated investigation divious1 2019-10-08 23:43:52 -04:00
  • 19becaaa67 yeilding per search name and sample XML bpatel 2019-10-08 19:48:08 -07:00
  • 7d0a8cfabd Merge pull request #217 from splunk/cloud_cryptominig Jose Enrique Hernandez 2019-10-08 08:48:00 -04:00
  • c08c11cb5e Merge pull request #213 from splunk/dependabot/pip/pathlib2-2.3.5 Jose Enrique Hernandez 2019-10-08 08:47:37 -04:00
  • 733c088621 Merge pull request #211 from splunk/dependabot/pip/contextlib2-0.6.0 Jose Enrique Hernandez 2019-10-08 08:47:16 -04:00
  • 9f0d4e510c Merge pull request #194 from splunk/dependabot/pip/zipp-0.6.0 Jose Enrique Hernandez 2019-10-08 08:46:52 -04:00
  • 00d45d08f0 Merge pull request #191 from splunk/dependabot/pip/typing-3.7.4.1 Jose Enrique Hernandez 2019-10-08 08:42:04 -04:00
  • c9effaf169 Merge branch 'develop' into cloud_cryptominig Jose Enrique Hernandez 2019-10-08 08:40:51 -04:00
  • bfd2f43f16 updated configparser to right version divious1 2019-10-08 08:39:20 -04:00
  • 669ae04242 updating config parser to right version divious1 2019-10-08 08:37:58 -04:00
  • bbf7728798 Merge branch 'run_detections' of github.com:splunk/security-content into run_detections divious1 2019-10-08 08:37:21 -04:00
  • 8a7fe2cb8b generating object works now divious1 2019-10-08 08:37:12 -04:00
  • 10162d5808 Bump contextlib2 from 0.5.5 to 0.6.0 dependabot-preview[bot] 2019-10-08 12:35:35 +00:00
  • accda2a493 Merge pull request #216 from splunk/dependabot/pip/attrs-19.2.0 Jose Enrique Hernandez 2019-10-08 08:34:21 -04:00
  • 9c6c794b81 Merge pull request #215 from splunk/drilldown Jose Enrique Hernandez 2019-10-08 08:32:49 -04:00
  • 2b5f46ab35 Merge pull request #212 from splunk/macros Jose Enrique Hernandez 2019-10-08 08:31:45 -04:00
  • a12fe635c6 Merge branch 'develop' into macros David Dorsey 2019-10-07 22:59:37 -05:00
  • ad20740605 Merge branch 'develop' into drilldown David Dorsey 2019-10-07 22:59:24 -05:00
  • 85a637b149 Merge branch 'develop' into cloud_cryptominig David Dorsey 2019-10-07 22:59:06 -05:00
  • 31b839b028 Actually ignore swap files now (forgot the * at the beginning) David Dorsey 2019-10-07 22:16:50 -05:00
  • 6bc1ce430b Ignore VIM swap files David Dorsey 2019-10-07 22:16:09 -05:00
  • 2a4b29e4c4 New investigation macros Updated validate to check for macro and lookup existence in both baselines and investigation searches David Dorsey 2019-10-07 22:14:12 -05:00
  • 9034599d6f Added in exception handling to cloud compute activity in new region Added a bunch of lookup manifests Added a bunch of macro manifests Updated validate to make sure macros listed in detection search have a macro manifest David Dorsey 2019-10-07 21:50:13 -05:00
  • d5559b03b5 detect small update bpatel 2019-10-07 10:33:51 -07:00
  • adba4a2c59 manifest and search updates bpatel 2019-10-04 15:15:53 -07:00
  • 463ab657a6 adding first and last time the detection resullts fired bpatel 2019-10-03 19:28:47 -07:00
  • fb93597cfc Merge branch 'macros' into cloud_cryptominig David Dorsey 2019-10-03 17:49:45 -07:00
  • 82e8b210a9 Files for new cloud cryptominig story. It's a cloud infrastructure generic version of AWS Cryptomining David Dorsey 2019-10-03 17:42:40 -07:00
  • d11219e54d Updated generate code David Dorsey 2019-10-03 13:45:16 -07:00
  • f354a10c34 investigate KV store update: bpatel 2019-10-03 11:07:26 -07:00
  • 3876690db3 investigate KV store update: bpatel 2019-10-03 11:06:15 -07:00
  • a07fa1ce88 fixed bug with story parsing and added error condition if no results are returned divious1 2019-10-03 13:40:35 -04:00
  • cc6209a08e Started to create Cloud Cryptomining story Added 1 detection, 1 baseline, and 2 investigative searches David Dorsey 2019-10-02 21:05:30 -07:00
  • 1cabe30f28 bug fix in run detect function bpatel 2019-10-02 17:34:00 -07:00
  • a1ac59f593 Merge pull request #210 from splunk/CRL-1624_remove_contexualized Bhavin Patel 2019-10-02 17:27:13 -07:00
  • e71536f638 Merge pull request #214 from splunk/CRL-1627 Jose Enrique Hernandez 2019-10-02 17:22:10 -07:00
  • 98e018be0a kvstore in investigate bpatel 2019-10-02 17:19:58 -07:00
  • 7d0ddc452c cleaned up some functions divious1 2019-10-02 18:25:55 -04:00
  • 24769e88c5 Added lookup to the search specs David Dorsey 2019-10-02 12:01:03 -07:00
  • 9edd3b9c4d Bump attrs from 19.1.0 to 19.2.0 dependabot-preview[bot] 2019-10-02 07:06:42 +00:00
  • 5d0904df7a investigation update bpatel 2019-10-01 21:40:14 -07:00
  • 2a8b470241 Added drilldown search and name to the detection spec. Added these fields to the suspicious wevtutil manifest Updated validate to make sure both entries are there or neither are Updated generate to output those fields if they are there David Dorsey 2019-10-01 17:31:11 -07:00
  • a6add43af8 updating object bpatel 2019-10-01 15:11:29 -07:00
  • aec9dd53f5 Fixed issue inside of where clause David Dorsey 2019-09-30 16:17:29 -07:00
  • 1bda6248ea Added code to validate macros manifest and lookups manifest Lookup manifest validation also checks to make sure either filename or collection is there If a filename is listed, it makes sure the file exists as well David Dorsey 2019-09-30 16:08:54 -07:00
  • 575b766f09 Minor spec change to macro.spec.json David Dorsey 2019-09-30 16:08:08 -07:00
  • e428f473c9 Added lookup files that weren't there David Dorsey 2019-09-30 16:07:44 -07:00
  • 3d25c40bf7 Updated macro definition in detections, investigations, and baselines to just be a list Broke out macros definition into it's own manifest Created macro manifests for all of current macros that we ship Created lookup file manifest Created lookup file manifests for all current lookup files that we ship David Dorsey 2019-09-30 13:53:25 -07:00
  • 1149f8b6a4 Bump pathlib2 from 2.3.4 to 2.3.5 dependabot-preview[bot] 2019-09-30 06:19:03 +00:00
  • 5e5cd80145 Merge branch 'develop' into macros David Dorsey 2019-09-27 15:01:34 -05:00
  • d73299f47e Merge branch 'run_detections' of github.com:splunk/security-content into run_detections divious1 2019-09-26 16:56:27 -07:00
  • 308e6e57c4 investigate is working just missing parsing results divious1 2019-09-26 16:55:32 -07:00
  • 3418ef903f cleaning up bpatel 2019-09-26 16:49:06 -07:00
  • a1837657de updating entities in manifest bpatel 2019-09-26 16:34:12 -07:00
  • 834dda11c5 bug fixes bpatel 2019-09-26 16:32:29 -07:00
  • 348ef43cbf fixing a bug with detect divious1 2019-09-26 13:37:58 -07:00
  • 7651463417 Merge branch 'run_detections' of https://github.com/splunk/security-content into run_detections bpatel 2019-09-26 13:19:07 -07:00
  • 83e36dd298 investigate generations bpatel 2019-09-26 13:18:09 -07:00
  • 62b90633b7 moved complex logic into functions divious1 2019-09-26 11:59:05 -07:00
  • 4d51948eb1 updated detections to a new object type divious1 2019-09-25 17:58:22 -07:00
  • 6ee9d9962c Added entry for macros in baseline, detections, and investigations spec. David Dorsey 2019-09-25 14:36:35 -05:00
  • ae98b5b6f6 removing two fields from entities bpatel 2019-09-19 12:50:37 -07:00
  • 7ea62a91ab remoove risk params and use entities bpatel 2019-09-19 11:03:25 -07:00
  • a3ddc13700 update generate to output entities bpatel 2019-09-19 10:44:18 -07:00
  • ebd92527c3 updated base on feedback from Dave H. divious1 2019-09-19 13:42:54 -04:00
  • 48593b7ff6 Revert "removed contexualized" divious1 2019-09-19 13:36:13 -04:00
  • ce25a3565d updated generate code output v2 conf files v2_generate_conf_files bpatel 2019-09-19 10:32:05 -07:00
  • 85e033d0e2 Merge pull request #209 from splunk/dependabot/pip/importlib-metadata-0.23 Jose Enrique Hernandez 2019-09-19 11:28:39 -04:00
  • 6bc3283ad4 testing ci with only v2 bpatel 2019-09-18 18:00:01 -07:00
  • efb25dc102 ci code update bpatel 2019-09-18 17:49:25 -07:00
  • 859f2bd264 updates to gen bpatel 2019-09-18 17:15:40 -07:00
  • 5ad6534ccd removed contexualized divious1 2019-09-18 18:01:43 -04:00
  • 4178965a66 Bump importlib-metadata from 0.22 to 0.23 dependabot-preview[bot] 2019-09-17 05:43:55 +00:00
  • e1310d2192 adding ss.conf spec and example bpatel 2019-09-12 16:27:11 -07:00
  • 6fdc4ff2bf Merge pull request #208 from splunk/CRL-1617_bug rvaldez617 2019-09-12 11:15:02 -06:00
  • f3cb4bcc2a bumping configparserr bpatel 2019-09-12 10:05:57 -07:00
  • a04729b663 changed process to process name bpatel 2019-09-12 09:55:57 -07:00
  • 66b5cd25ba Merge pull request #202 from splunk/remove_html_tags rvaldez617 2019-09-12 10:41:00 -06:00
  • b783922e62 Merge pull request #196 from splunk/dependabot/pip/identify-1.4.7 Jose Enrique Hernandez 2019-09-12 12:34:58 -04:00
  • 90ef83a474 Merge branch 'develop' into dependabot/pip/typing-3.7.4.1 Jose Enrique Hernandez 2019-09-12 12:31:53 -04:00
  • 1c8e76029b Merge branch 'develop' into dependabot/pip/zipp-0.6.0 Jose Enrique Hernandez 2019-09-12 12:30:21 -04:00