Patrick Bareiss c5e25d7355 generate a mitre enrichment lookup

2020-05-20 14:23:16 +02:00

..

api_call_by_user_baseline.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

api_call_by_user_baseline.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_service_accounts.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

aws_service_accounts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

baseline_blocked_outbound_connections.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

baseline_blocked_outbound_connections.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_monitoring.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

brandMonitoring_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

csc_lookup.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

csc_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

discovered_dns_records.csv

updated fields and added macros and lookup entries

2020-01-19 21:37:45 -05:00

discovered_dns_records.yml

updated fields and added macros and lookup entries

2020-01-19 21:37:45 -05:00

domains.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_providers_default.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

dynamic_dns_providers_default.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_providers_local.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

dynamic_dns_providers_local.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

escu_search_id_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

escu_search_id.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

is_suspicious_file_extension_lookup.csv

changed the file name of the .csv file and updated the associated yml file

2020-02-05 16:27:57 -07:00

is_suspicious_file_extension_lookup.yml

changed the file name of the .csv file and updated the associated yml file

2020-02-05 16:27:57 -07:00

is_windows_system_file.csv

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

is_windows_system_file.yml

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

legit_domains.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

legit_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

lookup_rare_process_whitelist_default.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

lookup_rare_process_whitelist_local.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

lookup_uncommon_processes_default.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

lookup_uncommon_processes_local.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

mitre_enrichment.csv

generate a mitre enrichment lookup

2020-05-20 14:23:16 +02:00

network_acl_activity_baseline.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

network_acl_activity_baseline.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_api_calls_from_user_roles.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_api_calls_from_user_roles.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_aws_cross_account_activity.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_aws_cross_account_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_aws_regions.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_aws_regions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_compute_creations_by_user.csv

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_compute_creations_by_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_compute_images.csv

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_compute_images.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_compute_instance_types.csv

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_compute_instance_types.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_regions.csv

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_regions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cmd_line_arguments.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_cmd_line_arguments.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_ec2_modifications_by_user.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_ec2_modifications_by_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_running_windows_services.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_running_windows_services.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_S3_access_from_remote_ip.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_S3_access_from_remote_ip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_apps_launching_cmd.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

prohibited_apps_launching_cmd.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_processes.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

prohibitedProcesses_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_extensions_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_extensions.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

ransomware_notes_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_notes.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

rare_process_whitelist_default.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

rare_process_whitelist_local.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

s3_deletion_baseline.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

s3_deletion_baseline.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

security_group_activity_baseline.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

security_group_activity_baseline.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

security_services_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

security_services.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

suspicious_files.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

suspicious_writes_lookup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes_default.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

uncommon_processes_local.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00