Bhavin Patel becdb58b9f Add Secure Access Firewall Detections (#3986) ...

---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2026-04-29 20:41:09 +02:00

..

deprecated

Move Unused Macros to Deprecate Sub-Folder (#3847)

2025-12-22 14:01:09 +01:00

admon.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

amazon_security_lake.yml

new detection

2025-01-08 13:53:03 +01:00

appdynamics_security.yml

adding draft detections

2025-02-04 11:55:10 -08:00

applocker.yml

ESCU Release Branch - v4.30.0

2024-04-17 20:44:56 +00:00

aws_cloudwatchlogs_eks.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_ecr_users_asl.yml

Release Branch - ESCU v4.32.0

2024-05-22 16:47:39 +00:00

aws_ecr_users.yml

container upload aws ecr

2021-08-19 15:51:17 +02:00

aws_s3_accesslogs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_securityhub_finding.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

azure_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

azure_monitor_aad.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

azure_monitor_activity.yml

Uploading new detections

2025-01-06 16:19:32 +10:00

base64decode.yml

Release 4.19.0

2024-01-10 17:21:34 +00:00

bootloader_inventory.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

capi2_operational.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

certificateservices_lifecycle.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

circleci.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cisco_ai_defense.yml

updaing for validate

2025-02-14 13:42:13 -08:00

cisco_asa.yml

move to public

2025-09-25 13:05:25 -07:00

cisco_duo_activity.yml

add macros

2025-07-10 15:45:40 +02:00

cisco_duo_administrator.yml

add macros

2025-07-10 15:45:40 +02:00

cisco_isovalent_allowed_images.yml

Cisco Isovalent - Add first batch of new detections (#3706)

2026-01-06 01:24:39 +01:00

cisco_isovalent_process_connect.yml

Cisco Isovalent - Add first batch of new detections (#3706)

2026-01-06 01:24:39 +01:00

cisco_isovalent_process_exec.yml

Cisco Isovalent - Add first batch of new detections (#3706)

2026-01-06 01:24:39 +01:00

cisco_isovalent.yml

Cisco Isovalent - Add first batch of new detections (#3706)

2026-01-06 01:24:39 +01:00

cisco_network_visibility_module_flowdata.yml

add new detections, story and other cool things

2025-07-01 23:04:48 +02:00

cisco_networks.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cisco_sd_wan_service_proxy_access.yml

More SD-WAN Content (#3944)

2026-03-12 18:16:41 +05:30

cisco_sd_wan_syslog.yml

Add New Analytics - February Batch (#3886)

2026-03-03 18:31:37 +05:30

cisco_secure_firewall_inside_to_outside.yml

Update cisco_secure_firewall_inside_to_outside.yml

2025-04-03 14:28:58 +02:00

cisco_secure_firewall.yml

update macro name

2025-04-03 14:26:51 +02:00

cloudtrail.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cloudwatchlogs_vpcflow.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

crowdstrike_identities.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

crowdstrike_stream.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

crushftp.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

driverinventory.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ec2_modification_api_calls.yml

Removed a few API calls that are not really modifications

2020-08-18 13:47:04 -05:00

esxi_syslog.yml

Initial batch of ESXi content

2025-07-11 11:59:37 -04:00

excluded_cloud_binaries.yml

Cisco Isovalent - Add first batch of new detections (#3706)

2026-01-06 01:24:39 +01:00

executable_extensions.yml

netsupport (#3798)

2025-11-21 13:27:52 -08:00

f5_bigip_rogue.yml

remove index

2024-12-18 13:32:03 -08:00

fillnull_config.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

github_enterprise.yml

improvements

2025-01-15 16:03:42 +01:00

github_organizations.yml

new github detections

2025-01-16 10:36:09 +01:00

google_gcp_pubsub_message.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gsuite_calendar.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gsuite_drive.yml

change to supported sourcetype

2025-06-17 09:08:10 -05:00

gsuite_gmail.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gws_login_mfa_methods.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gws_reports_admin.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gws_reports_login.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

iis_get_webglobalmodule.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

iis_operational_logs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

important_audit_policy_subcategory_guids.yml

feat: add new analytic story and analytic

2025-02-19 11:22:18 +01:00

ivanti_vtm_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kube_allowed_images.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_allowed_locations.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

kube_allowed_user_agents.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_allowed_user_groups.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_allowed_user_names.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kube_container_falco.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kube_objects_events.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kubernetes_container_controller.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kubernetes_metrics.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

linux_auditd.yml

auditd_detection_updates

2025-02-20 13:36:03 +01:00

linux_hosts.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

linux_offsec_tool_processes.yml

Cisco Isovalent - Add first batch of new detections (#3706)

2026-01-06 01:24:39 +01:00

linux_shells.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

m365_copilot_graph_api.yml

Copilot based Detections (#3693)

2025-10-13 12:14:09 -07:00

m365_exported_ediscovery_prompt_logs.yml

Copilot based Detections (#3693)

2025-10-13 12:14:09 -07:00

mcp_server.yml

Add New MCP Related Detections (#3895)

2026-02-17 23:39:01 +01:00

moveit_sftp_logs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ms365_defender_incident_alerts.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ms_defender_atp_alerts.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ms_defender.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

msexchange_management.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

nginx_access_logs.yml

ESCU v4.26.0 Release branch

2024-03-06 19:30:20 +00:00

non_public_ip_blocks.yml

Add Secure Access Firewall Detections (#3986)

2026-04-29 20:41:09 +02:00

normalized_service_binary_field.yml

analytics_enhancement

2025-02-03 18:34:10 +01:00

ntlm_audit.yml

normalize all legacy line endings (#3931)

2026-03-02 23:34:35 +01:00

o365_graph.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

o365_management_activity.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

o365_messagetrace.yml

normalize all legacy line endings (#3931)

2026-03-02 23:34:35 +01:00

o365_suspect_search_terms_regex.yml

normalize all legacy line endings (#3931)

2026-03-02 23:34:35 +01:00

okta.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

oldsummaries_config.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

ollama_server.yml

Ollama TA detections (#3710)

2025-10-13 21:54:37 +02:00

osquery_macro.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

osquery_process.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

papercutng.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

pingid.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

potential_password_in_username_false_positive_reduction.yml

map filter

2022-06-21 12:24:04 -07:00

potentially_malicious_code_on_cmdline_tokenize_score.yml

Editing the macro to put the apply statement into the search query so that it's clear that MLTK is being used

2022-01-26 22:38:13 -05:00

powershell.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

previously_seen_cloud_api_calls_per_user_role_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_images_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_type_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_provisioning_activity_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_region_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_windows_services_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_windows_services_window.yml

bug fix

2021-02-03 15:44:56 +01:00

previously_seen_zoom_child_processes_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_zoom_child_processes_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_unseen_cloud_provisioning_activity_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

printservice.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

process_auditpol.yml

feat: add auditpol macro

2025-02-19 11:22:18 +01:00

process_bitsadmin.yml

macro'd bitsadmin

2021-08-17 15:20:40 -06:00

process_certutil.yml

macro'd certutil

2021-08-17 15:00:51 -06:00

process_cmd.yml

macro'd wmic

2021-08-17 11:44:30 -06:00

process_hh.yml

macro'd hh

2021-08-17 14:29:16 -06:00

process_installutil.yml

InstallUTIL 🍺

2021-11-12 13:05:19 -07:00

process_msbuild.yml

msbuild and microsoftworkflowcompiler

2021-08-19 06:57:11 -06:00

process_mshta.yml

macro'd mshta

2021-08-17 13:38:11 -06:00

process_msiexec.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

process_net.yml

update to analytics using net

2025-01-13 22:20:46 +01:00

process_netsh.yml

macro'd netsh

2021-08-17 15:14:35 -06:00

process_office_products_parent.yml

update office macro

2025-01-14 20:02:52 +01:00

process_office_products.yml

rba changes

2025-01-22 20:18:12 +01:00

process_powershell.yml

Fix Issues - 2nd Round (#3996)

2026-04-16 05:24:43 +00:00

process_reg.yml

macro'd reg cmd

2021-08-17 12:09:31 -06:00

process_regsvr32.yml

macro'd regsvr32

2021-08-17 13:27:48 -06:00

process_rundll32.yml

macrod rundll32

2021-08-17 13:21:24 -06:00

process_sc.yml

update to analytics using net

2025-01-13 22:20:46 +01:00

process_setspn.yml

HaagRoast

2021-10-15 12:31:33 -06:00

process_wmic.yml

Macro'd powershell

2021-08-17 11:15:36 -06:00

process_wscript.yml

update powershell analytics

2025-01-14 19:34:31 +01:00

remote_access_software_usage_exceptions.yml

normalize all legacy line endings (#3931)

2026-03-02 23:34:35 +01:00

remoteconnectionmanager.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

risk_index.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

secureapp_es_field_mappings.yml

updating spl

2025-08-04 14:48:58 -05:00

security_content_ctime.yml

Present times in ISO8601 instead of US style

2020-08-12 23:45:53 +02:00

security_content_summariesonly.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

stream_dns.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

stream_http.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

stream_tcp.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

subjectinterfacepackage.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

summariesonly_config.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

suricata.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

uacbypass_process_name.yml

Release 4.19.0

2024-01-10 17:21:34 +00:00

windows_exchange_iis.yml

update exchange macro

2025-02-19 21:11:52 +01:00

windows_shells.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

wineventlog_application.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_appxdeploymentserver.yml

The Lost Payload: MSIX Resurrection

2025-08-18 11:46:34 -06:00

wineventlog_appxpackaging.yml

The Lost Payload: MSIX Resurrection

2025-08-18 11:46:34 -06:00

wineventlog_rdp.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_security.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_system.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_task_scheduler.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wmi.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

zeek_rpc.yml

remove index

2024-12-18 13:32:03 -08:00

zeek_ssl.yml

remove index

2024-12-18 13:32:03 -08:00

zeek_x509.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

zoom_index.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

zscaler_proxy.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00