admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dp42_test
splunk-security_content/response_tasks
T
History
Bhavin Patel 5b8932056f Merge branch 'develop' into update_appinspect
2020-12-09 13:12:29 -08:00
..
deprecated
organizing dirs in response tasks
2020-12-09 12:49:22 -08:00
playbooks
organizing dirs in response tasks
2020-12-09 12:49:22 -08:00
all_backup_logs_for_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
amazon_eks_kubernetes_activity_by_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_investigate_security_hub_alerts_by_dest.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
aws_investigate_user_activities_by_accesskeyid.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
aws_investigate_user_activities_by_arn.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
aws_network_acl_details_from_id.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_network_interface_details_via_resourceid.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_s3_bucket_details_via_bucketname.yml
bug in generate
2020-05-12 13:53:48 +02:00
dns_hijack_enrichment.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
domain_certificate_investigation.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
excessive_account_lockouts_enrichment_and_response.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
gcp_kubernetes_activity_by_src_ip.yml
new generate script
2020-05-06 17:42:38 +02:00
get_all_aws_activity_from_city.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_country.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_ip_address.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
get_all_aws_activity_from_region.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_backup_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_certificate_logs_for_a_domain.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_dns_server_history_for_a_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_dns_traffic_ratio.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_ec2_instance_details_by_instanceid.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
get_ec2_launch_details.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
get_email_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_emails_from_specific_sender.yml
more response task fixes
2020-10-10 12:58:56 -04:00
get_first_occurrence_and_last_occurrence_of_a_mac_address.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_history_of_email_sources.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
get_logon_rights_modifications_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_logon_rights_modifications_for_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_notable_history.yml
adding all stories to notable histroy
2020-12-07 17:16:30 -08:00
get_outbound_emails_to_hidden_cobra_threat_actors.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
get_parent_process_info.yml
remove duplicate response files
2020-12-03 16:14:58 -08:00
get_process_file_activity.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
get_process_info.yml
remove duplicate response files
2020-12-03 16:14:58 -08:00
get_process_information_for_port_activity.yml
another response update
2020-12-08 10:36:06 -08:00
get_process_responsible_for_the_dns_traffic.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
get_sysmon_wmi_activity_for_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_web_session_information_via_session_id.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
investigate_aws_activities_via_region_name.yml
prilimary updates to response searches
2020-12-03 17:58:49 -08:00
investigate_aws_ecr_container_listing_activity.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_aws_user_activities_by_user_field.yml
new story file and updates for existing and new searches to associate with it
2020-06-05 12:25:06 -06:00
investigate_failed_logins_for_multiple_destinations.yml
bug in generate
2020-05-14 10:00:55 +02:00
investigate_network_traffic_from_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_okta_activity_by_app.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_okta_activity_by_ip_address.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_pass_the_hash_attempts.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_pass_the_ticket_attempts.yml
Updated searches
2020-05-25 11:06:36 +02:00
investigate_previous_unseen_user.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_successful_remote_desktop_authentications.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_suspicious_strings_in_http_header.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_okta.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_posts_from_src.yml
bug in generate
2020-05-12 13:53:48 +02:00