Lou Stella 9c183fa110 Update Analytics to Support ATT&CK v19 (#4036) ...

---------

Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2026-05-05 17:29:28 +02:00

..

3cx_supply_chain_attack_network_indicators.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_configuration_archive_logging_analysis.yml

Update Analytics to Support ATT&CK v19 (#4036)

2026-05-05 17:29:28 +02:00

cisco_ios_suspicious_privileged_account_creation.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_network_interface_modifications.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_privileged_account_creation_with_http_command_execution.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_privileged_account_creation_with_suspicious_ssh_activity.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_sd_wan___low_frequency_rogue_peer.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_sd_wan___peering_activity.yml

Fix Broken Link, Versions and Pre-Commit (#3956)

2026-03-13 19:17:15 +05:30

cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml

More SD-WAN Content (#3944)

2026-03-12 18:16:41 +05:30

cisco_secure_firewall___binary_file_type_download.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___bits_network_activity.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___blocked_connection.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___communication_over_suspicious_ports.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___connection_to_file_sharing_domain.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___file_download_over_uncommon_port.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___high_eve_threat_confidence.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___high_priority_intrusion_classification.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___intrusion_events_by_threat_activity.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___lumma_stealer_activity.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___lumma_stealer_download_attempt.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___malware_file_downloaded.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___oracle_e_business_suite_correlation.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___oracle_e_business_suite_exploitation.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___possibly_compromised_host.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___potential_data_exfiltration.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___privileged_command_execution_via_http.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___rare_snort_rule_triggered.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___react_server_components_rce_attempt.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___remote_access_software_usage_traffic.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___repeated_blocked_connections.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___repeated_malware_downloads.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___ssh_connection_to_non_standard_port.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___ssh_connection_to_sshd_operns.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___static_tundra_smart_install_abuse.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_secure_firewall___wget_or_curl_download.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_smart_install_oversized_packet_detection.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_smart_install_port_discovery_and_status.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

cisco_snmp_community_string_configuration_changes.yml

Update Analytics to Support ATT&CK v19 (#4036)

2026-05-05 17:29:28 +02:00

cisco_tftp_server_configuration_for_data_exfiltration.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

detect_arp_poisoning.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_dns_query_to_decommissioned_s3_bucket.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

detect_hosts_connecting_to_dynamic_domain_providers.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

detect_ipv6_network_infrastructure_threats.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_large_icmp_traffic.yml

Add Secure Access Firewall Detections (#3986)

2026-04-29 20:41:09 +02:00

detect_outbound_ldap_traffic.yml

Add Secure Access Firewall Detections (#3986)

2026-04-29 20:41:09 +02:00

detect_outbound_smb_traffic.yml

Add Secure Access Firewall Detections (#3986)

2026-04-29 20:41:09 +02:00

detect_port_security_violation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_remote_access_software_usage_dns.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

detect_remote_access_software_usage_traffic.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

detect_rogue_dhcp_server.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_snicat_sni_exfiltration.yml

Fix Issues - 2nd Round (#3996)

2026-04-16 05:24:43 +00:00

detect_software_download_to_network_device.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_traffic_mirroring.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_unauthorized_assets_by_mac_address.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_windows_dns_sigred_via_splunk_stream.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_windows_dns_sigred_via_zeek.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_zerologon_via_zeek.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

dns_kerberos_coercion.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

dns_query_length_with_high_standard_deviation.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

excessive_dns_failures.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

http_c2_framework_user_agent.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

http_malware_user_agent.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

http_pua_user_agent.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

http_rmm_user_agent.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

internal_horizontal_port_scan_nmap_top_20.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

internal_horizontal_port_scan.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

internal_vertical_port_scan.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

internal_vulnerability_scan.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

large_volume_of_dns_any_queries.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ngrok_reverse_proxy_on_network.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

prohibited_network_traffic_allowed.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

protocol_or_port_mismatch.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

protocols_passing_authentication_in_cleartext.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

remote_desktop_network_traffic.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

rundll32_dnsquery.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

smb_traffic_spike.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ssl_certificates_with_punycode.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

suspicious_process_dns_query_known_abuse_web_services.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

suspicious_process_with_discord_dns_query.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

tor_traffic.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

wermgr_process_connecting_to_ip_check_web_services.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

windows_abused_web_services.yml

Add Big Batch of Snap Attack Converted Rules (#4015)

2026-05-05 16:11:18 +02:00

windows_ad_replication_service_traffic.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

windows_ad_rogue_domain_controller_network_activity.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

windows_dns_query_request_by_telegram_bot_api.yml

vip_keylogger (#4024)

2026-04-29 17:55:13 +05:30

windows_gather_victim_network_info_through_ip_check_web_services.yml

vip_keylogger (#4024)

2026-04-29 17:55:13 +05:30

windows_multi_hop_proxy_tor_website_query.yml

updating risk drilldowns (#4016)

2026-04-17 17:28:53 +05:30

windows_remote_desktop_network_bruteforce_attempt.yml

Add Secure Access Firewall Detections (#3986)

2026-04-29 20:41:09 +02:00

windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

Add Analytic Story Tagging for Muddy Water (#3947)

2026-03-12 16:30:09 +00:00

zeek_x509_certificate_with_punycode.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30