splunk-security_content

abnormally_high_number_of_cloud_infrastructure_api_calls_filter.yml

Translated detect_spike_in_aws_api_activity.yml to use Change DM

2020-09-09 01:01:16 -05:00

abnormally_high_number_of_cloud_instances_destroyed_filter.yml

changes for mustang

2020-09-02 10:21:52 -06:00

abnormally_high_number_of_cloud_instances_launched_filter.yml

changes for mustang

2020-09-02 10:21:52 -06:00

abnormally_high_number_of_cloud_security_group_api_calls_filter.yml

Translated detections/detect_spike_in_security_group_activity.yml

2020-09-09 01:36:26 -05:00

aws_cloudwatchlogs_eks.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_cross_account_activity_from_previously_unseen_account_filter.yml

text updates and a couple of fixes for mismatched macros

2020-09-23 14:44:00 -06:00

aws_s3_accesslogs.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_securityhub_firehose.yml

new detections for security hub alerts

2020-08-06 14:44:50 -07:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

cisco_networks.yml

Adding macros

2020-08-12 09:17:32 +02:00

clients_connecting_to_multiple_dns_servers.yml

adding definitions

2020-01-23 13:31:43 -08:00

cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml

single and double quote order issue

2020-09-23 17:32:52 -05:00

cloud_compute_instance_created_in_previously_unused_region_filter.yml

latest updates to create in new vendor_region

2020-09-09 16:26:25 -06:00

cloud_compute_instance_created_with_previously_unseen_image_filter.yml

new files for unblocked searches

2020-09-03 11:10:14 -06:00

cloud_compute_instance_created_with_previously_unseen_instance_type_filter.yml

new files for unblocked searches

2020-09-03 11:10:14 -06:00

cloud_instance_modified_by_previously_unseen_user_filter.yml

changes for mustang

2020-09-02 10:21:52 -06:00

cloud_provisioning_from_previously_unseen_city_filter.yml

Created manifests for unseen city, region, and country and updated

2020-08-20 14:07:21 -05:00

cloud_provisioning_from_previously_unseen_country_filter.yml

Created manifests for unseen city, region, and country and updated

2020-08-20 14:07:21 -05:00

cloud_provisioning_from_previously_unseen_ip_address_filter.yml

Manifest cleanup

2020-08-20 13:15:14 -05:00

cloud_provisioning_from_previously_unseen_region_filter.yml

Created manifests for unseen city, region, and country and updated

2020-08-20 14:07:21 -05:00

cloudtrail.yml

new generate script

2020-05-06 17:42:38 +02:00

cloudwatch_eks.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatch_vpc.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatchlogs_vpcflow.yml

new generate script

2020-05-06 17:42:38 +02:00

create_or_delete_windows_shares.yml

testing commented search

2020-01-21 01:58:30 -08:00

detect_arp_poisoning_filter.yml

Now validating?

2020-08-12 23:32:48 +02:00

detect_ipv6_network_infrastructure_threats_filter.yml

Added various Network Infrastructure detections based on the MITRE Network Matrix

2020-10-28 23:14:06 +01:00

detect_new_user_aws_console_login___dm_filter.yml

updating macro filters

2020-06-08 17:12:15 -07:00

detect_port_security_violation_filter.yml

Added various Network Infrastructure detections based on the MITRE Network Matrix

2020-10-28 23:14:06 +01:00

detect_rogue_dhcp_server_filter.yml

Now validating?

2020-08-12 23:32:48 +02:00

detect_software_download_to_network_device_filter.yml

.

2020-10-28 21:14:40 +01:00

detect_traffic_mirroring_filter.yml

Added detection for T1020.001, Traffic Duplication

2020-10-28 21:51:33 +01:00

detect_zerologon_via_zeek_filter.yml

adding macros

2020-09-18 17:36:46 -04:00

dynamic_dns_providers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_excessive_runinstances_mltk_input_filter.yml

[TR-104] add missing input filters.

2020-09-15 22:59:19 -07:00

ec2_excessive_terminateinstances_mltk_input_filter.yml

[TR-104] add missing input filters.

2020-09-15 22:59:19 -07:00

ec2_modification_api_calls.yml

Removed a few API calls that are not really modifications

2020-08-18 13:47:04 -05:00

evilginx_phishlets_0365.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_amazon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_aws.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_facebook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_github.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_google.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_outlook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

f5_bigip_rogue.yml

ymls and updates

2020-08-04 14:04:38 -07:00

filter_rare_process_whitelist.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

google_gcp_pubnet_message.yml

validate script

2020-04-30 16:52:38 +02:00

google_gcp_pubsub_message.yml

new generate script

2020-05-06 17:42:38 +02:00

is_windows_system_file.yml

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_azure_detect_rbac_authorization_by_account.yml

more renames base on upper case

2020-06-29 17:39:38 -04:00

kubernetes_azure_detect_sensitive_object_access.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_azure_detect_sensitive_role_access.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_azure_detect_suspicious_kubectl_calls.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_azure_pod_scan_fingerprint_detection_filter.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_azure.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

netbackup.yml

new generate script

2020-05-06 17:42:38 +02:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

okta.yml

new generate script

2020-05-06 17:42:38 +02:00

previously_seen_cloud_api_calls_per_user_role_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_creations_by_user_input_filter.yml

[TR-104] add missing input filters.

2020-09-15 22:59:19 -07:00

previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_image_input_filter.yml

Fixes

2020-09-21 23:23:57 -05:00

previously_seen_cloud_compute_image_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_images_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_type_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_types_input_filter.yml

Merge branch 'develop' into mustang_beta

2020-10-05 16:20:10 -07:00

previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_instance_modifications_by_user_input_filter.yml

changes for mustang

2020-09-02 10:21:52 -06:00

previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_provisioning_activity_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_region_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_regions_input_filter.yml

[TR-104] add missing input filters.

2020-09-15 22:59:19 -07:00

previously_seen_cloud_regions_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_windows_services_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_windows_services_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_zoom_child_processes_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_zoom_child_processes_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_unseen_cloud_provisioning_activity_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

prohibited_apps_launching_cmd.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_softwares.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

s3_accesslogs.yml

validate script

2020-04-30 16:52:38 +02:00

security_content_ctime.yml

Present times in ISO8601 instead of US style

2020-08-12 23:45:53 +02:00

security_content_summariesonly.yml

this should be false

2020-06-09 17:58:39 -04:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

stream_dns.yml

porting ymls into a newe PR

2020-08-04 12:55:12 -07:00

stream_http.yml

new generate script

2020-05-06 17:42:38 +02:00

stream_tcp.yml

porting ymls into a newe PR

2020-08-04 12:55:12 -07:00

suspicious_email_attachments.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

changed macro

2020-11-05 09:18:37 +01:00

system_network_configuration_discovery_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wineventlog_security.yml

new generate script

2020-05-06 17:42:38 +02:00

wineventlog_system.yml

new generate script

2020-05-06 17:42:38 +02:00

wmi.yml

new generate script

2020-05-06 17:42:38 +02:00

zeek_rpc.yml

adding macros

2020-09-18 17:36:46 -04:00

zeek_ssl.yml

mods

2020-11-06 11:08:38 +11:00