mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
0c3e5887e8
* chore: bump contentctl.yml and build.yml to 6.1.0 * move to removed * status is removed --------- Co-authored-by: research bot <research@splunk.com>
52 lines
1.9 KiB
YAML
52 lines
1.9 KiB
YAML
# The contents of this YML mirror the build.yml and legacy contentctl.yml that
|
|
# are used for building ESCU. This is used during the PORT test workflow
|
|
# While the app_version here is hardcoded, it is overwritten with the version
|
|
# of the app contained in contentctl.yml during the PORT github action
|
|
# with an awk/sed command. This app_version MUST be correct, since the
|
|
# version of the app is highly relevant when validating deprecated/removed
|
|
# content (to ensure that it has been removed at the correct version)
|
|
author: Splunk Threat Research Team
|
|
author_email: research@splunk.com
|
|
content_prefix: ESCU
|
|
label: ES Content Updates
|
|
app_version: 6.1.0
|
|
description: Explore the Analytic Stories included with ES Content Updates.
|
|
id: DA-ESS-ContentUpdate
|
|
external_app_content:
|
|
- app_name: Splunk Common Information Model
|
|
macros:
|
|
- drop_dm_object_name
|
|
lookups:
|
|
- cim_corporate_email_domain_lookup
|
|
- cim_corporate_web_domain_lookup
|
|
- identity_lookup_expanded
|
|
- cim_cloud_domain_lookup
|
|
- app_name: Enterprise Security
|
|
macros:
|
|
- get_asset
|
|
lookups:
|
|
- interesting_ports_lookup
|
|
- alexa_lookup_by_str
|
|
- asset_lookup_by_str
|
|
- app_name: >-
|
|
false positive edge case in detections/web/exploit_public_facing_application_via_apache_commons_text.yml.
|
|
This detections evals a field named 'lookup' which creates an issue when parsing the search field for references to lookups.
|
|
macros: []
|
|
lookups:
|
|
- other_lookups
|
|
- app_name: URL Toolbox
|
|
macros: []
|
|
lookups:
|
|
- ut_shannon_lookup
|
|
- app_name: SA-admon
|
|
macros: []
|
|
lookups:
|
|
- admon_groups_def
|
|
- app_name: Splunk Enterprise Security
|
|
macros:
|
|
- globedistance
|
|
lookups:
|
|
- known_devices_public_ip_filter
|
|
- mitre_attack_lookup
|
|
- asn_lookup_by_cidr
|