admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 6ba29754a6 Meaningless commit to the release branch so that we can open a PR pyth0n1c 2023-10-06 17:03:13 -07:00
  • 7ff09049e3 Fix the ids associated with a number of playbooks and fix incorrectly named referenced detections. Check with Playbook SME to understand the full implications of these changes. fixes_for_contentctl_migration pyth0n1c 2023-10-06 16:48:52 -07:00
  • 3fce3dff3c contentctl validate throws errors on the following playbooks. the first had an invalid uuid (improper number of characters). The second had unallowed characters in the name (underscores). I will reach out to the devs for this content to understand what implications these changes may have. pyth0n1c 2023-10-06 16:24:38 -07:00
  • 9a67bbd26a Update two detections to use IN() ljstella 2023-10-06 15:54:41 -05:00
  • 1612821676 update for data Bhavin Patel 2023-10-06 13:10:30 -07:00
  • a20f6b726b adding new detection - diamond ticket mvelazco 2023-10-06 15:46:36 -04:00
  • 49d175146f updating files and metadata Bhavin Patel 2023-10-06 10:15:47 -07:00
  • d40d319dfb Reconvert from sigma with new logic ljstella 2023-10-05 16:51:23 -05:00
  • 6fd0f7724f selectively lowercase eval'd fields ljstella 2023-10-05 16:50:34 -05:00
  • c1e0211cfe launch.json config for debugging convert ljstella 2023-10-05 16:48:53 -05:00
  • 5bdc048825 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-05 08:47:40 -07:00
  • 68d62055fc Branch was auto-updated. srv-rr-gh-researchbt 2023-10-05 08:47:39 -07:00
  • 2b140c0b35 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-05 08:47:38 -07:00
  • 8950518828 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-05 08:47:37 -07:00
  • 762d9c6180 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-05 08:47:36 -07:00
  • 694452bc71 Merge pull request #2874 from splunk/conflu Bhavin Patel 2023-10-05 08:47:11 -07:00
  • f512d5dab8 convert sigma values to lowercase Bhavin Patel 2023-10-05 08:16:26 -07:00
  • c668947873 Add lower to evals ljstella 2023-10-04 18:06:19 -05:00
  • e4e5b9141e Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:53:05 -07:00
  • 3535341539 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:53:04 -07:00
  • de995b1288 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:53:03 -07:00
  • 6448a6266e Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:53:02 -07:00
  • 63db0527e0 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:53:00 -07:00
  • 7c756fcbd5 Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag research bot 2023-10-04 22:52:39 +00:00
  • ecd34183a9 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:26:42 -07:00
  • cc66225f64 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:26:41 -07:00
  • dd2b96f046 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:26:40 -07:00
  • 9ca1203ffc Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:26:38 -07:00
  • c0d4524654 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 15:26:37 -07:00
  • 169c3af096 Merge pull request #2876 from splunk/njrat_spell v4.13.0 Bhavin Patel 2023-10-04 15:26:16 -07:00
  • 07518ecaea updates Bhavin Patel 2023-10-04 15:22:26 -07:00
  • 21ab7dfcc2 Merge pull request #2875 from splunk/dependabot/pip/gitpython-3.1.35 dependabot[bot] 2023-10-04 21:38:50 +00:00
  • 5d6e133292 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 14:31:49 -07:00
  • 83a68e822d Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 14:31:48 -07:00
  • ddd9780635 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 14:31:47 -07:00
  • 2575f1b2d7 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 14:31:46 -07:00
  • 7deb416329 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 14:31:45 -07:00
  • 033deb6c1c Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 14:31:42 -07:00
  • acaed15515 Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag research bot 2023-10-04 21:31:21 +00:00
  • 46f1c2484c Bump gitpython from 3.1.33 to 3.1.35 dependabot[bot] 2023-10-04 20:59:26 +00:00
  • 2c2e10e1db Merge pull request #2868 from splunk/dependabot/pip/pytest-7.4.2 dependabot[bot] 2023-10-04 20:58:50 +00:00
  • 0ef217d698 Merge pull request #2867 from splunk/dependabot/pip/jsonschema-4.19.1 dependabot[bot] 2023-10-04 20:58:29 +00:00
  • 0feb6281b3 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:52 -07:00
  • 80514e61c0 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:50 -07:00
  • 1cc51a83a1 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:46 -07:00
  • 11dca03f8f Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:44 -07:00
  • a6d64b7e0d Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:38 -07:00
  • 8efa7b57b1 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:37 -07:00
  • 48f85987cf Branch was auto-updated. srv-rr-gh-researchbt 2023-10-04 13:51:35 -07:00
  • f7dcab2ed4 Merge pull request #2862 from splunk/release_v4.13.0 Bhavin Patel 2023-10-04 13:51:15 -07:00
  • 6a652765f4 CVE-2023-22515 Michael Haag 2023-10-04 14:43:26 -06:00
  • 65c6964cb3 Branch was auto-updated. themebleed_and_cve_2023_29357 srv-rr-gh-researchbt 2023-10-03 17:33:35 -07:00
  • 9f5fdae162 Merge pull request #2873 from splunk/fix_duplicate_uuid pyth0n1c 2023-10-03 17:33:16 -07:00
  • 3d21822873 Update uuid with new one pyth0n1c 2023-10-03 17:31:15 -07:00
  • ba6a44301c Branch was auto-updated. srv-rr-gh-researchbt 2023-10-03 15:25:22 -07:00
  • 393efa390f updating the lolbins to lowercase Bhavin Patel 2023-10-03 15:25:03 -07:00
  • d15ea176a8 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-03 15:22:05 -07:00
  • fe821f3328 Merge pull request #2872 from splunk/add_process_path_to_detection Bhavin Patel 2023-10-03 15:21:46 -07:00
  • ca2a81b55d add process_path to tstats output pyth0n1c 2023-10-03 14:02:04 -07:00
  • 1441547f53 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-03 12:13:22 -07:00
  • b28e03b1c7 enrichment Bhavin Patel 2023-10-03 12:12:57 -07:00
  • 1ebd14a73f Branch was auto-updated. srv-rr-gh-researchbt 2023-10-03 12:06:56 -07:00
  • 54fec22efc Merge pull request #2870 from splunk/new_ba_splv2_detection Bhavin Patel 2023-10-03 12:06:39 -07:00
  • 8f6e67c614 adding new detection Bhavin Patel 2023-10-03 09:43:22 -07:00
  • dbdbaf8c30 Updated logic for SharePoint EOP Michael Haag 2023-10-03 07:50:50 -06:00
  • b867ad2d4a Update ws_ftp_remote_code_execution.yml ws_ftp Michael Haag 2023-10-03 07:42:09 -06:00
  • 87835aded9 Update dev_ssa version of detection as well. pyth0n1c 2023-10-02 16:47:50 -07:00
  • a23eb85f4f Removed printout from python code. Committed detection in dist with status validation. pyth0n1c 2023-10-02 16:45:06 -07:00
  • 95f836d4f6 Support for 'status: validation' to be used ONLY for BA Detections. If this is used with a non-ba detection, an exception will be generated. pyth0n1c 2023-10-02 16:42:39 -07:00
  • fd7f9cfbf3 new_ssa_detection Bhavin Patel 2023-10-02 16:18:51 -07:00
  • 88015b4e65 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-02 14:13:58 -07:00
  • 608438f223 Merge pull request #2860 from splunk/platform_security_20230919 Rod Soto 2023-10-02 14:13:37 -07:00
  • d57b3f1fcf properly format times in risky command search pyth0n1c 2023-10-02 12:56:00 -07:00
  • 96c931eda9 use macro instead of using index and sourcetype directly. pyth0n1c 2023-10-02 12:45:09 -07:00
  • b16a497093 remove source= from search pyth0n1c 2023-10-02 11:54:06 -07:00
  • a00fce83db Update to new search after dynamic testing and refinement. pyth0n1c 2023-10-02 11:49:57 -07:00
  • aa366491e5 Merge branch 'platform_security_20230919' of https://github.com/splunk/security_content into platform_security_20230919 pyth0n1c 2023-10-02 11:37:32 -07:00
  • de281dcdb6 First version of new detection for testing pyth0n1c 2023-10-02 11:36:50 -07:00
  • e6ba0c14b4 adding to SPL Bhavin Patel 2023-10-02 11:33:51 -07:00
  • b8df1501a3 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-02 11:19:55 -07:00
  • a51faed2c5 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-02 11:19:54 -07:00
  • 3223d8fef9 Merge pull request #2864 from splunk/ws_ftp Bhavin Patel 2023-10-02 11:19:36 -07:00
  • 588ef14f0c Added fillnull to improve detection accuracy for all logs. pyth0n1c 2023-10-02 11:03:24 -07:00
  • 05273c0b0e Merge branch 'themebleed_and_cve_2023_29357' of github.com:splunk/security_content into themebleed_and_cve_2023_29357 Gowthamaraj rajendran 2023-10-02 09:58:04 -07:00
  • 4da628ca8a Edit ThemeBleed Gowthamaraj rajendran 2023-10-02 09:58:00 -07:00
  • bc66334e86 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-02 09:12:48 -07:00
  • ab5e3e2cf6 Branch was auto-updated. srv-rr-gh-researchbt 2023-10-02 09:12:47 -07:00
  • c7a52967fe Branch was auto-updated. srv-rr-gh-researchbt 2023-10-02 09:12:45 -07:00
  • 6af27bff01 Merge pull request #2865 from splunk/teamcity Bhavin Patel 2023-10-02 09:12:25 -07:00
  • f3540a2da7 Update message Bhavin Patel 2023-10-02 08:57:56 -07:00
  • ca1758dee7 adding Attacker obs Bhavin Patel 2023-10-02 08:55:43 -07:00
  • 34252303f2 Adding POST Bhavin Patel 2023-10-02 08:52:40 -07:00
  • 5e6fe3400b Bump pytest from 7.4.0 to 7.4.2 dependabot[bot] 2023-10-01 23:33:08 +00:00
  • 70af8f7ea6 Bump jsonschema from 4.19.0 to 4.19.1 dependabot[bot] 2023-10-01 23:33:03 +00:00
  • 315064fcb0 Update Theme bleed Gowthamaraj rajendran 2023-10-01 12:29:46 -07:00
  • 6e0397fc4c Update windows_theme_command_execution.yml Gowthamaraj rajendran 2023-10-01 11:29:58 -07:00
  • f7c411cfa2 Update windows_theme_command_execution.yml Gowthamaraj rajendran 2023-10-01 11:24:18 -07:00
  • 7ac5bba3df Update detections/endpoint/windows_theme_command_execution.yml Gowthamaraj rajendran 2023-10-01 11:22:25 -07:00
  • c3b03f288b Update Gowthamaraj rajendran 2023-10-01 11:17:59 -07:00
  • 36c15130f6 JetBrains TeamCity RCE Michael Haag 2023-10-01 10:59:09 -06:00