splunk-security_content

aws_activity_via_region.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_network_interface_details.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_s3_bucket_details.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_user_activities_by_user_field.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_user_activity_by_accesskeyid.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_user_activity_by_src_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_hijack_enrichment.yml

Made my changes a string....

2019-12-11 13:24:04 -08:00

dns_server_history.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_traffic_stats.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

domain_cert_investigation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

email_sent_to_hidden_cobra_actors.yml

introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy

2019-12-11 14:59:03 -05:00

excessive_account_lockouts_enrichment.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

first_occurrence_mac_address.yml

fixing the files that didnt update the macros correctly

2019-12-11 15:39:14 -08:00

get_acl_details.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_all_aws_activitiy_from_city.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_all_aws_activitiy_from_country.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_all_aws_activitiy_from_region.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_all_aws_activitiy_from_src_ip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_all_backup_data_for_host.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_authentication_logs_for_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_backup_logs_for_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_certificate_for_domain.yml

Merge branch 'develop' into CRL-1700_ES_macros

2019-12-16 12:40:16 -08:00

get_ec2_details_by_instance_id.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_ec2_launch_details.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_email_info.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_emails_from_sender.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_emails_from_source.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_logon_rights_modifications_for_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_logon_rights_modifications_for_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_network_traffic_from_src_ip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_notable_history_for_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_notable_info.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_parent_process_info.yml

Merge branch 'develop' into CRL-1700_ES_macros

2019-12-16 12:40:16 -08:00

get_process_creating_dns_traffic.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_process_file_activity.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_process_info_for_port.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_process_info.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_process_registry_activity.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_rdp_authentications.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_registry_activities.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_risk_for_endpoint.yml

introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy

2019-12-11 14:59:03 -05:00

get_risk_for_user.yml

introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy

2019-12-11 14:59:03 -05:00

get_update_logs_for_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_user_info_from_identity_table.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_vulnerability_logs_for_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_web_activity_by_src_ip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_web_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_web_posts_by_src.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

get_web_session_info.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

get_wmi_sysmon_events.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

investigate_cloud_compute_instance_activities.yml

fixed a typo

2019-10-24 13:34:50 -06:00

investigate_failed_logins_for_multiple_destinations.yml

added investigations to detections

2019-12-12 16:44:26 +01:00

investigate_pass_the_hash_attempts.yml

updating how to implement and readme

2019-12-19 11:22:44 -08:00

investigate_pass_the_ticket_attempts.yml

updating how to implement and readme

2019-12-19 11:22:44 -08:00

investigate_previous_unseen_user.yml

added investigations to detections

2019-12-12 16:44:26 +01:00

investigate_user_activities_in_all_cloud_regions.yml

Made my changes a string....

2019-12-11 13:24:04 -08:00

investigate_user_activities_in_single_cloud_region.yml

Made my changes a string....

2019-12-11 13:24:04 -08:00

suspicious_email_attachment_investigate_and_delete.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_strings_in_HTTP_header.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

user_activity_via_cloudtrail.yml

Made my changes a string....

2019-12-11 13:24:04 -08:00