Rico Valdez 030683cbed created 3 new searches and associated support searches that are mltk versions of existing searches. Also added them to the appropriate stories and fixed the non-capitalized title for an investigative search - updated associated stories for that as well.

2019-05-07 13:57:23 -06:00

..

aws_activity_via_region.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

aws_network_interface_details.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

aws_s3_bucket_details.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

aws_user_activities_by_user_field.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

aws_user_activity_by_accesskeyid.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

aws_user_activity_by_src_user.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

dns_hijack_enrichment.json

updates to name and links

2019-05-06 11:48:35 -07:00

dns_server_history.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

dns_traffic_stats.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

domain_cert_investigation.json

date updates

2019-04-26 11:22:34 -07:00

email_sent_to_hidden_cobra_actors.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

excessive_account_lockouts_enrichment.json

updated validate script, included phantom in generator, fixed some stories to v2

2019-04-18 11:28:26 -04:00

first_occurrence_mac_address.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_acl_details.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_all_aws_activitiy_from_city.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_all_aws_activitiy_from_country.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_all_aws_activitiy_from_region.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_all_aws_activitiy_from_src_ip.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_all_backup_data_for_host.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_authentication_logs_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_backup_logs_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_certificate_for_domain.json

date updates

2019-04-26 11:22:34 -07:00

get_ec2_details_by_instance_id.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_ec2_launch_details.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_email_info.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_emails_from_sender.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_emails_from_source.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_logon_rights_modifications_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_logon_rights_modifications_for_user.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_network_traffic_from_src_ip.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_notable_history_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_notable_info.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_parent_process_info.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_process_creating_dns_traffic.json

created 3 new searches and associated support searches that are mltk versions of existing searches. Also added them to the appropriate stories and fixed the non-capitalized title for an investigative search - updated associated stories for that as well.

2019-05-07 13:57:23 -06:00

get_process_info_for_port.json

Merge branch 'develop' into spec_update

2019-04-19 10:58:47 -04:00

get_process_info.json

Merge branch 'develop' into spec_update

2019-04-19 10:58:47 -04:00

get_rdp_authentications.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_registry_activities.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_risk_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_risk_for_user.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_update_logs_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_user_info_from_identity_table.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_vulnerability_logs_for_endpoint.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_web_activity_by_src_ip.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_web_activity.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_web_posts_by_src.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_web_session_info.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

get_wmi_sysmon_events.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

suspicious_strings_in_HTTP_header.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00

user_activity_via_cloudtrail.json

removed unecessary prefixes

2019-03-27 11:13:11 -04:00