splunk-security_content

cisco_ai_defense_security_alerts_by_application_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_duo_admin_login_unusual_browser.yml

feedback review

2025-07-21 09:47:20 +02:00

cisco_duo_admin_login_unusual_country.yml

feedback review

2025-07-21 09:47:20 +02:00

cisco_duo_admin_login_unusual_os.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_bulk_policy_deletion.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_bypass_code_generation.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_allow_devices_without_screen_lock.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_allow_network_bypass_2fa.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_allow_old_flash.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_allow_old_java.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_allow_tampered_devices.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_bypass_2fa.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_deny_access.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_policy_skip_2fa_for_other_countries.yml

remove extraquote

2025-07-21 09:44:10 -07:00

cisco_duo_set_user_status_to_bypass_2fa.yml

remove extraquote

2025-07-21 09:44:10 -07:00

crushftp_server_side_template_injection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_distributed_password_spray_attempts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_html_help_spawn_child_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_new_login_attempts_to_routers.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_password_spray_attempts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

email_attachments_with_lots_of_spaces.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

email_files_written_outside_of_the_outlook_directory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

email_servers_sending_high_volume_traffic_to_hosts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

esxi_account_modified.yml

Add vmware data source

2025-07-16 14:16:23 -04:00

esxi_audit_tampering.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_bulk_vm_termination.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_download_errors.yml

Fix host field

2025-07-18 12:13:00 -04:00

esxi_encryption_settings_modified.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_external_root_login_activity.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_firewall_disabled.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_lockdown_mode_disabled.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_loghost_config_tampering.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_malicious_vib_forced_install.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_reverse_shell_patterns.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_sensitive_files_accessed.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_shared_or_stolen_root_account.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_shell_access_enabled.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_ssh_brute_force.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_ssh_enabled.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_syslog_config_change.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_system_clock_manipulation.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_system_information_discovery.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_user_granted_admin_role.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_vib_acceptance_level_tampering.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_vm_discovery.yml

Change host to dest

2025-07-16 13:55:49 -04:00

esxi_vm_exported_via_remote_tool.yml

Change host to dest

2025-07-16 13:55:49 -04:00

ivanti_vtm_new_account_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

monitor_email_for_brand_abuse.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

no_windows_updates_in_a_time_frame.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_authentication_failed_during_mfa_challenge.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_idp_lifecycle_modifications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_mfa_exhaustion_hunt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_mismatch_between_source_and_response_for_verify_push_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_multi_factor_authentication_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_multiple_accounts_locked_out.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_multiple_failed_mfa_requests_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_multiple_failed_requests_to_access_applications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_multiple_users_failing_to_authenticate_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_new_api_token_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_new_device_enrolled_on_account.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_phishing_detection_with_fastpass_origin_check.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_risk_threshold_exceeded.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_successful_single_factor_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_suspicious_activity_reported.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_suspicious_use_of_a_session_cookie.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_threatinsight_threat_detected.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_unauthorized_access_to_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_user_logins_from_multiple_cities.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

pingid_mismatch_auth_source_and_verification_response.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

pingid_multiple_failed_mfa_requests_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

pingid_new_mfa_method_after_credential_reset.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

pingid_new_mfa_method_registered_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

splunk_appdynamics_secure_application_alerts.yml

updating spl

2025-08-04 14:53:47 -05:00

suspicious_email_attachment_extensions.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_java_classes.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zoom_high_video_latency.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

zoom_rare_audio_devices.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

zoom_rare_input_devices.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

zoom_rare_video_devices.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00