splunk-security_content

all_backup_logs_for_host.yml

Refactored security content

2022-03-09 14:43:09 +01:00

amazon_eks_kubernetes_activity_by_src_ip.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_investigate_security_hub_alerts_by_dest.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_investigate_user_activities_by_accesskeyid.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_investigate_user_activities_by_arn.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

aws_network_acl_details_from_id.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

aws_network_interface_details_via_resourceid.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

aws_s3_bucket_details_via_bucketname.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gcp_kubernetes_activity_by_src_ip.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_all_aws_activity_from_city.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_all_aws_activity_from_country.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_all_aws_activity_from_ip_address.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_all_aws_activity_from_region.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_backup_logs_for_endpoint.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_certificate_logs_for_a_domain.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_dns_server_history_for_a_host.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_dns_traffic_ratio.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_ec2_instance_details_by_instanceid.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_ec2_launch_details.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_email_info.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_emails_from_specific_sender.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_first_occurrence_and_last_occurrence_of_a_mac_address.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_history_of_email_sources.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_logon_rights_modifications_for_endpoint.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_logon_rights_modifications_for_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_notable_history.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_outbound_emails_to_hidden_cobra_threat_actors.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_parent_process_info.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_process_file_activity.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_process_info.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_process_information_for_port_activity.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_process_responsible_for_the_dns_traffic.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

get_sysmon_wmi_activity_for_host.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_web_session_information_via_session_id.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_aws_activities_via_region_name.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_aws_user_activities_by_user_field.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_failed_logins_for_multiple_destinations.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_network_traffic_from_src_ip.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_okta_activity_by_app.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_okta_activity_by_ip_address.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_pass_the_hash_attempts.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_pass_the_ticket_attempts.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_previous_unseen_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_successful_remote_desktop_authentications.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_suspicious_strings_in_http_header.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_user_activities_in_okta.yml

Refactored security content

2022-03-09 14:43:09 +01:00

investigate_web_posts_from_src.yml

Refactored security content

2022-03-09 14:43:09 +01:00