admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
application_drilldowns
splunk-security_content/investigations
T
History
Bhavin Patel b0eaed8f75 ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
..
all_backup_logs_for_host.yml
Refactored security content
2022-03-09 14:43:09 +01:00
amazon_eks_kubernetes_activity_by_src_ip.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_investigate_security_hub_alerts_by_dest.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
aws_investigate_user_activities_by_accesskeyid.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_investigate_user_activities_by_arn.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
aws_network_acl_details_from_id.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
aws_network_interface_details_via_resourceid.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
aws_s3_bucket_details_via_bucketname.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gcp_kubernetes_activity_by_src_ip.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_all_aws_activity_from_city.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_all_aws_activity_from_country.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_all_aws_activity_from_ip_address.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
get_all_aws_activity_from_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_backup_logs_for_endpoint.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_certificate_logs_for_a_domain.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_dns_server_history_for_a_host.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
get_dns_traffic_ratio.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
get_ec2_instance_details_by_instanceid.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_ec2_launch_details.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_email_info.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_emails_from_specific_sender.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_first_occurrence_and_last_occurrence_of_a_mac_address.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_history_of_email_sources.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_logon_rights_modifications_for_endpoint.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_logon_rights_modifications_for_user.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_notable_history.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_outbound_emails_to_hidden_cobra_threat_actors.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_parent_process_info.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_process_file_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_process_info.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_process_information_for_port_activity.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
get_process_responsible_for_the_dns_traffic.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
get_sysmon_wmi_activity_for_host.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_web_session_information_via_session_id.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_aws_activities_via_region_name.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_aws_user_activities_by_user_field.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_failed_logins_for_multiple_destinations.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_network_traffic_from_src_ip.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
investigate_okta_activity_by_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_okta_activity_by_ip_address.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_pass_the_hash_attempts.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_pass_the_ticket_attempts.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_previous_unseen_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_successful_remote_desktop_authentications.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_suspicious_strings_in_http_header.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_user_activities_in_okta.yml
Refactored security content
2022-03-09 14:43:09 +01:00
investigate_web_posts_from_src.yml
Refactored security content
2022-03-09 14:43:09 +01:00