admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
suspicious_zoom_process
splunk-security_content/lookups
T
History
David Dorsey f1f26dce81 Updated to support lookups in collections
2020-05-19 14:06:02 -05:00
..
api_call_by_user_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
api_call_by_user_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
aws_service_accounts.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
aws_service_accounts.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_blocked_outbound_connections.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
baseline_blocked_outbound_connections.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_monitoring.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
brandMonitoring_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
csc_lookup.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
csc_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
discovered_dns_records.csv
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
discovered_dns_records.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
dynamic_dns_providers_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
dynamic_dns_providers_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
is_suspicious_file_extension_lookup.csv
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_suspicious_file_extension_lookup.yml
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_windows_system_file.csv
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
legit_domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
legit_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_rare_process_whitelist_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_rare_process_whitelist_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
network_acl_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
network_acl_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_api_calls_from_user_roles.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_api_calls_from_user_roles.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_cross_account_activity.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_cross_account_activity.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_regions.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_creations_by_user.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_compute_creations_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_images.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_compute_images.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_instance_types.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_compute_instance_types.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_regions.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cmd_line_arguments.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_cmd_line_arguments.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_modifications_by_user.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_ec2_modifications_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_running_windows_services.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_running_windows_services.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_S3_access_from_remote_ip.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_S3_access_from_remote_ip.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_apps_launching_cmd.csv
New story for suspicous zoom activity. Investigative searches not in yet.
2020-05-07 23:00:19 -05:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_processes.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
prohibitedProcesses_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
ransomware_notes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
rare_process_whitelist_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
rare_process_whitelist_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
s3_deletion_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
s3_deletion_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_group_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
security_group_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
suspicious_files.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
suspicious_writes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
uncommon_processes_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
zoom_first_time_child_process.yml
Updated to support lookups in collections
2020-05-19 14:06:02 -05:00