admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
TR-159_linux_rootkits
splunk-security_content/response_tasks
T
History
Jose Enrique Hernandez d5e8a824aa Merge branch 'develop' into TR-159_linux_rootkits
2020-10-08 11:07:51 -04:00
..
all_backup_logs_for_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
amazon_eks_kubernetes_activity_by_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
analyze_malicious_file.yml
Converted all objects to new spec
2020-04-29 13:01:45 +02:00
aws_investigate_security_hub_alerts_by_dest.yml
updated search
2020-06-22 13:34:58 -07:00
aws_investigate_user_activities_by_accesskeyid.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_investigate_user_activities_by_arn.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
aws_investigate_user_activities_by_source_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_network_acl_details_from_id.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_network_interface_details_via_resourceid.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_s3_bucket_details_via_bucketname.yml
bug in generate
2020-05-12 13:53:48 +02:00
dns_hijack_enrichment.yml
WIP
2020-04-30 10:34:18 +02:00
domain_certificate_investigation.yml
WIP
2020-04-30 10:34:18 +02:00
excessive_account_lockouts_enrichment_and_response.yml
WIP
2020-04-30 10:34:18 +02:00
gcp_kubernetes_activity_by_src_ip.yml
new generate script
2020-05-06 17:42:38 +02:00
get_all_aws_activity_from_city.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_country.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_ip_address.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_region.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_authentication_logs_for_endpoint.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
get_backup_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_certificate_logs_for_a_domain.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_dns_server_history_for_a_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_dns_traffic_ratio.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_ec2_instance_details_by_instanceid.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
get_ec2_launch_details.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
get_email_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_emails_from_specific_sender.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_first_occurrence_and_last_occurrence_of_a_mac_address.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_history_of_email_sources.yml
WIP
2020-04-30 10:34:18 +02:00
get_logon_rights_modifications_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_logon_rights_modifications_for_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_notable_history.yml
new story file and updates for existing and new searches to associate with it
2020-06-05 12:25:06 -06:00
get_notable_info.yml
Merge branch 'develop' into TR-159_linux_rootkits
2020-10-08 11:07:51 -04:00
get_outbound_emails_to_hidden_cobra_threat_actors.yml
WIP
2020-04-30 10:34:18 +02:00
get_parent_process_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_process_file_activity.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
get_process_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_process_information_for_port_activity.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_process_registry_activity.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
get_process_responsible_for_the_dns_traffic.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_registry_activities.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_risk_modifiers_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_risk_modifiers_for_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_sysmon_wmi_activity_for_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_update_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_user_information_from_identity_table.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_vulnerability_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_web_session_information_via_session_id.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_aws_activities_via_region_name.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_aws_ecr_container_listing_activity.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_aws_user_activities_by_user_field.yml
new story file and updates for existing and new searches to associate with it
2020-06-05 12:25:06 -06:00
investigate_cloud_compute_instance_activities.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_failed_logins_for_multiple_destinations.yml
bug in generate
2020-05-14 10:00:55 +02:00
investigate_network_traffic_from_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_okta_activity_by_app.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_okta_activity_by_ip_address.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_pass_the_hash_attempts.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_pass_the_ticket_attempts.yml
Updated searches
2020-05-25 11:06:36 +02:00
investigate_previous_unseen_user.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_successful_remote_desktop_authentications.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_suspicious_strings_in_http_header.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_all_cloud_regions.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_okta.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_single_cloud_region.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_activity_from_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_activity_from_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_posts_from_src.yml
bug in generate
2020-05-12 13:53:48 +02:00
malware_hunt_and_contain.yml
WIP
2020-04-30 10:34:18 +02:00
process_chain_analysis.yml
Converted all objects to new spec
2020-04-29 13:01:45 +02:00
quarantaine_infected_host.yml
Converted all objects to new spec
2020-04-29 13:01:45 +02:00
suspicious_email_attachment_investigate_and_delete.yml
WIP
2020-04-30 10:34:18 +02:00