admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
0bb0ad9b7ebff8c5e1f345fcbcfd4e82b91e693f
splunk-security_content/baselines
T
History
David Dorsey 2d25205146 Fixes
2020-09-23 11:35:56 -05:00
..
add_prohibited_processes_to_enterprise_security.yml
new generate script
2020-05-06 17:42:38 +02:00
baseline_of_api_calls_per_user_arn.yml
WIP validate script
2020-04-30 15:51:16 +02:00
baseline_of_blocked_outbound_traffic_from_aws.yml
updated content
2020-05-05 12:58:56 +02:00
baseline_of_cloud_infrastructure_api_calls_per_user.yml
Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 20:33:32 -07:00
baseline_of_cloud_instances_destroyed.yml
Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 20:33:32 -07:00
baseline_of_cloud_instances_launched.yml
Merge branch 'TR-41_aws_ec2_mods' of github.com-jzsplunk:splunk/security-content into TR-41_aws_ec2_mods
2020-09-15 20:33:32 -07:00
baseline_of_cloud_security_group_api_calls_per_user.yml
[TR-41] fixing last of merge conflicts.
2020-09-15 20:38:05 -07:00
baseline_of_command_line_length___mltk.yml
Updated searches
2020-05-25 11:06:36 +02:00
baseline_of_dns_query_length___mltk.yml
WIP
2020-04-30 10:34:18 +02:00
baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
Fixing story mappings
2020-09-15 23:58:59 -05:00
baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
WIP validate script
2020-04-30 15:51:16 +02:00
baseline_of_network_acl_activity_by_arn.yml
WIP validate script
2020-04-30 15:51:16 +02:00
baseline_of_s3_bucket_deletion_activity_by_arn.yml
WIP validate script
2020-04-30 15:51:16 +02:00
baseline_of_security_group_activity_by_arn.yml
WIP validate script
2020-04-30 15:51:16 +02:00
baseline_of_smb_traffic___mltk.yml
Updated searches
2020-05-25 11:06:36 +02:00
count_of_assets_by_category.yml
WIP
2020-04-30 10:34:18 +02:00
count_of_unique_ips_connecting_to_ports.yml
WIP
2020-04-30 10:34:18 +02:00
create_a_list_of_approved_aws_service_accounts.yml
updated content
2020-05-05 12:58:56 +02:00
discover_dns_records.yml
WIP
2020-04-30 10:34:18 +02:00
dnstwist_domain_names.yml
Updated searches
2020-05-25 11:06:36 +02:00
identify_systems_creating_remote_desktop_traffic.yml
WIP
2020-04-30 10:34:18 +02:00
identify_systems_receiving_remote_desktop_traffic.yml
WIP
2020-04-30 10:34:18 +02:00
identify_systems_using_remote_desktop.yml
WIP
2020-04-30 10:34:18 +02:00
monitor_successful_backups.yml
updated content
2020-05-05 12:58:56 +02:00
monitor_unsuccessful_backups.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_api_call_per_user_roles_in_cloudtrail.yml
WIP validate script
2020-04-30 15:51:16 +02:00
previously_seen_aws_cross_account_activity_initial.yml
Fixes
2020-09-21 23:23:57 -05:00
previously_seen_aws_cross_account_activity_update.yml
tweaks and updates
2020-09-15 20:19:45 -07:00
previously_seen_aws_cross_account_activity.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_aws_provisioning_activity_sources.yml
Updated searches
2020-05-25 11:06:36 +02:00
previously_seen_aws_regions.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_cloud_api_calls_per_user_role_initial.yml
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
previously_seen_cloud_api_calls_per_user_role_update.yml
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
previously_seen_cloud_compute_creations_by_user_initial.yml
Fixes
2020-09-21 23:23:57 -05:00
previously_seen_cloud_compute_creations_by_user_update.yml
Fixes
2020-09-21 23:23:57 -05:00
previously_seen_cloud_compute_images_initial.yml
Fixes
2020-09-23 11:35:56 -05:00
previously_seen_cloud_compute_images_update.yml
Fixes
2020-09-23 11:35:56 -05:00
previously_seen_cloud_compute_instance_types_initial.yml
Fixes
2020-09-23 11:35:56 -05:00
previously_seen_cloud_compute_instance_types_update.yml
Fixes
2020-09-23 11:35:56 -05:00
previously_seen_cloud_instance_modifications_by_user_initial.yml
fixed validate issues
2020-09-15 20:17:49 -07:00
previously_seen_cloud_instance_modifications_by_user_update.yml
updates to ymls to make sure validate passes
2020-09-15 20:17:49 -07:00
previously_seen_cloud_provisioning_activity_sources_initial.yml
Manifest cleanup
2020-09-14 14:11:01 -07:00
previously_seen_cloud_provisioning_activity_sources_update.yml
Manifest cleanup
2020-09-14 14:11:01 -07:00
previously_seen_cloud_regions_initial.yml
Fixes for cryptomining demo
2020-09-23 00:01:02 -05:00
previously_seen_cloud_regions_update.yml
Fixes
2020-09-23 11:35:56 -05:00
previously_seen_command_line_arguments.yml
Updated searches
2020-05-25 11:06:36 +02:00
previously_seen_ec2_amis.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_ec2_instance_types.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_ec2_launches_by_user.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_ec2_modifications_by_user.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_running_windows_services_update.yml
Updated baseline deployments
2020-06-25 13:49:48 -05:00
previously_seen_running_windows_services.yml
Updated baseline deployments
2020-06-25 13:49:48 -05:00
previously_seen_s3_bucket_access_by_remote_ip.yml
updated content
2020-05-05 12:58:56 +02:00
previously_seen_users_in_cloudtrail_initial.yml
tweaks and updates
2020-09-15 20:19:45 -07:00
previously_seen_users_in_cloudtrail_update.yml
tweaks and updates
2020-09-15 20:19:45 -07:00
previously_seen_users_in_cloudtrail.yml
Updated searches
2020-05-25 11:06:36 +02:00
previously_seen_zoom_child_processes_initial.yml
Updated baseline deployments
2020-06-25 13:49:48 -05:00
previously_seen_zoom_child_processes_update.yml
Updated baseline deployments
2020-06-25 13:49:48 -05:00
systems_ready_for_spectre_meltdown_windows_patch.yml
WIP
2020-04-30 10:34:18 +02:00
update_previously_seen_users_in_cloudtrail.yml
Updated searches
2020-05-25 11:06:36 +02:00
windows_updates_install_failures.yml
WIP
2020-04-30 10:34:18 +02:00
windows_updates_install_successes.yml
WIP
2020-04-30 10:34:18 +02:00