admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
gen_splunk_docs
splunk-security_content/investigations
T
History
bpatel 3d39407b64 mergeing with develop, include CI changes
2019-06-05 14:05:51 -07:00
..
aws_activity_via_region.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_network_interface_details.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_s3_bucket_details.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_user_activities_by_user_field.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_user_activity_by_accesskeyid.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_user_activity_by_src_user.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
dns_hijack_enrichment.json
updates to name and links
2019-05-06 11:48:35 -07:00
dns_server_history.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
dns_traffic_stats.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
domain_cert_investigation.json
date updates
2019-04-26 11:22:34 -07:00
email_sent_to_hidden_cobra_actors.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
excessive_account_lockouts_enrichment.json
updated validate script, included phantom in generator, fixed some stories to v2
2019-04-18 11:28:26 -04:00
first_occurrence_mac_address.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_acl_details.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_all_aws_activitiy_from_city.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_all_aws_activitiy_from_country.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_all_aws_activitiy_from_region.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_all_aws_activitiy_from_src_ip.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_all_backup_data_for_host.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_authentication_logs_for_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_backup_logs_for_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_certificate_for_domain.json
date updates
2019-04-26 11:22:34 -07:00
get_ec2_details_by_instance_id.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_ec2_launch_details.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_email_info.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_emails_from_sender.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_emails_from_source.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_logon_rights_modifications_for_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_logon_rights_modifications_for_user.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_network_traffic_from_src_ip.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_notable_history_for_endpoint.json
CRL-1428 - Reverting investigative searches.
2019-05-17 10:58:25 -07:00
get_notable_info.json
CRL-1428 - Reverting investigative searches.
2019-05-17 10:58:25 -07:00
get_parent_process_info.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_process_creating_dns_traffic.json
created 3 new searches and associated support searches that are mltk versions of existing searches. Also added them to the appropriate stories and fixed the non-capitalized title for an investigative search - updated associated stories for that as well.
2019-05-07 13:57:23 -06:00
get_process_info_for_port.json
Merge branch 'develop' into spec_update
2019-04-19 10:58:47 -04:00
get_process_info.json
Merge branch 'develop' into spec_update
2019-04-19 10:58:47 -04:00
get_rdp_authentications.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_registry_activities.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_risk_for_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_risk_for_user.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_update_logs_for_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_user_info_from_identity_table.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_vulnerability_logs_for_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_web_activity_by_src_ip.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_web_activity.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_web_posts_by_src.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_web_session_info.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
get_wmi_sysmon_events.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
suspicious_email_attachment_investigate_and_delete.json
match name of splunk providing technology
2019-06-05 11:46:15 -04:00
suspicious_strings_in_HTTP_header.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
user_activity_via_cloudtrail.json
arn to user
2019-05-17 12:12:46 -07:00