admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
runstory
splunk-security_content/baselines
T
History
Rico Valdez 438ac72bda changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
2019-05-17 11:17:49 -06:00
..
add_prohibited_processes_to_es.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
approved_aws_service_accounts.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
assets_sorted_by_category.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
baseline_api_calls_per_user_arn.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
baseline_aws_regions.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
baseline_blocked_vpc_traffic.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
baseline_network_acl_modifications.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
baseline_s3_deletion_by_arn.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
baseline_security_group_activity_by_arn.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
brand_abuse_dnstwist_domains.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
discover_dns_records.json
fixes, run the genenrate code and validate
2019-04-18 17:05:55 -07:00
identify_ports_on_network.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
identify_systems_creating_rdp_traffic.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
identify_systems_receiving_rdp_traffic.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
identify_systems_using_remote_desktop.json
Merge branch 'develop' into spec_update
2019-04-19 10:58:47 -04:00
monitor_successful_backups.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
monitor_successful_windows_updates.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
monitor_unsuccessful_backups.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
monitor_unsuccessful_windows_updates.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_aws_cross_account_activity.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_cmd_arguments.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_ec2_amis.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_ec2_instance_types.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_ec2_launches_by_user.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_ec2_modifications.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_provisioning_activity_src.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_s3_remote_ip.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_user_roles.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_users.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
previously_seen_windows_service_starts.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
systems_ready_for_spectre_meltdown_patch.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
train_dns_query_length.json
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
2019-05-17 11:17:49 -06:00
train_smb_traffic_spike.json
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
2019-05-17 11:17:49 -06:00
train_unusually_long_commandlines.json
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
2019-05-17 11:17:49 -06:00