admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
149c19a6171c136155c1d72a2fcad2e681b60e21
splunk-security_content/playbooks
T
History
Lou Stella d1f890a4e9 Adding hunting playbook
2022-07-29 17:12:35 -05:00
..
custom_functions
Updated indicator_collect CF
2022-03-28 14:26:35 -05:00
activedirectory_reset_password.json
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
activedirectory_reset_password.png
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
activedirectory_reset_password.py
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
activedirectory_reset_password.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
aws_disable_user_accounts.json
AWS Disable User Accounts
2022-02-02 12:13:00 -06:00
aws_disable_user_accounts.png
AWS Disable User Accounts
2022-02-02 12:13:00 -06:00
aws_disable_user_accounts.py
AWS Disable User Accounts
2022-02-02 12:13:00 -06:00
aws_disable_user_accounts.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
aws_find_inactive_users.json
AWS Find Inactive Users
2022-02-01 16:03:04 -06:00
aws_find_inactive_users.png
AWS Find Inactive Users
2022-02-01 16:03:04 -06:00
aws_find_inactive_users.py
AWS Find Inactive Users
2022-02-01 16:03:04 -06:00
aws_find_inactive_users.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
block_indicators.json
Added block_indicators playbook
2022-01-05 12:17:54 -06:00
block_indicators.png
Added block_indicators playbook
2022-01-05 12:17:54 -06:00
block_indicators.py
Added block_indicators playbook
2022-01-05 12:17:54 -06:00
block_indicators.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
crowdstrike_malware_triage.json
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
crowdstrike_malware_triage.png
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
crowdstrike_malware_triage.py
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
crowdstrike_malware_triage.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
delete_detected_files.json
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
delete_detected_files.png
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
delete_detected_files.py
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
delete_detected_files.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
email_notification_for_malware.json
Added email notification for malware playbook
2022-01-05 13:28:38 -06:00
email_notification_for_malware.png
Added email notification for malware playbook
2022-01-05 13:28:38 -06:00
email_notification_for_malware.py
Added email notification for malware playbook
2022-01-05 13:28:38 -06:00
email_notification_for_malware.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
hunting.json
Adding hunting playbook
2022-07-29 17:12:35 -05:00
hunting.png
Adding hunting playbook
2022-07-29 17:12:35 -05:00
hunting.py
Adding hunting playbook
2022-07-29 17:12:35 -05:00
hunting.yml
Adding hunting playbook
2022-07-29 17:12:35 -05:00
internal_host_splunk_investigate_log4j.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_splunk_investigate_log4j.png
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_splunk_investigate_log4j.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_splunk_investigate_log4j.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
internal_host_ssh_investigate.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_investigate.png
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_investigate.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
internal_host_ssh_log4j_investigate.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_investigate.png
... and another one
2021-12-14 18:59:22 -06:00
internal_host_ssh_log4j_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_investigate.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
internal_host_ssh_log4j_respond.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_respond.png
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_respond.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_respond.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
internal_host_winrm_investigate.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_investigate.png
Some playbooks
2021-12-14 18:34:37 -06:00
internal_host_winrm_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_investigate.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
internal_host_winrm_log4j_investigate.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_log4j_investigate.png
Some playbooks
2021-12-14 18:34:37 -06:00
internal_host_winrm_log4j_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_log4j_investigate.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
internal_host_winrm_log4j_respond.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_log4j_respond.png
Some playbooks
2021-12-14 18:34:37 -06:00
internal_host_winrm_log4j_respond.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_log4j_respond.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
log4j_investigate.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
log4j_investigate.png
divorced parent playbook
2021-12-15 15:03:21 -06:00
log4j_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
log4j_investigate.yml
Refactored security content
2022-03-09 14:43:09 +01:00
log4j_respond.json
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
log4j_respond.png
divorced parent playbook
2021-12-15 15:03:21 -06:00
log4j_respond.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
log4j_respond.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malware_hunt_and_contain.json
Added malware hunt and contain playbook
2022-01-05 13:41:59 -06:00
malware_hunt_and_contain.png
Added malware hunt and contain playbook
2022-01-05 13:41:59 -06:00
malware_hunt_and_contain.py
Added malware hunt and contain playbook
2022-01-05 13:41:59 -06:00
malware_hunt_and_contain.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
ransomware_investigate_and_contain.json
Added demo playbook for development
2021-09-16 10:21:27 -05:00
ransomware_investigate_and_contain.png
Added demo playbook for development
2021-09-16 10:21:27 -05:00
ransomware_investigate_and_contain.py
Added demo playbook for development
2021-09-16 10:21:27 -05:00
ransomware_investigate_and_contain.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
risk_notable_block_indicators.json
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_block_indicators.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_block_indicators.py
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_block_indicators.yml
Refactored security content
2022-03-09 14:43:09 +01:00
risk_notable_enrich.json
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_enrich.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_enrich.py
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_enrich.yml
Refactored security content
2022-03-09 14:43:09 +01:00
risk_notable_import_data.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_import_data.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_import_data.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_import_data.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
risk_notable_investigate.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_investigate.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_investigate.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_investigate.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
risk_notable_merge_events.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_merge_events.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_merge_events.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_merge_events.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
risk_notable_mitigate.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_mitigate.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_mitigate.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_mitigate.yml
Refactored security content
2022-03-09 14:43:09 +01:00
risk_notable_preprocess.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_preprocess.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_preprocess.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_preprocess.yml
Refactored security content
2022-03-09 14:43:09 +01:00
risk_notable_protect_assets_and_users.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_protect_assets_and_users.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_protect_assets_and_users.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_protect_assets_and_users.yml
Refactored security content
2022-03-09 14:43:09 +01:00
risk_notable_review_indicators.json
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_review_indicators.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_review_indicators.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_review_indicators.yml
Refactored security content
2022-03-09 14:43:09 +01:00
risk_notable_verdict.json
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_verdict.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_verdict.py
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_verdict.yml
Refactored security content
2022-03-09 14:43:09 +01:00
start_investigation.json
Start Investigation
2022-02-02 15:32:59 -06:00
start_investigation.png
Start Investigation
2022-02-02 15:32:59 -06:00
start_investigation.py
Start Investigation
2022-02-02 15:32:59 -06:00
start_investigation.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
threat_intel_investigate.json
Threat Intel Investigate
2022-02-02 13:24:37 -06:00
threat_intel_investigate.png
Threat Intel Investigate
2022-02-02 13:24:37 -06:00
threat_intel_investigate.py
Threat Intel Investigate
2022-02-02 13:24:37 -06:00
threat_intel_investigate.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00
trustar_enrich_indicators.json
TruSTAR Enrich Indicators
2022-02-02 12:44:35 -06:00
trustar_enrich_indicators.png
TruSTAR Enrich Indicators
2022-02-02 12:44:35 -06:00
trustar_enrich_indicators.py
TruSTAR Enrich Indicators
2022-02-02 12:44:35 -06:00
trustar_enrich_indicators.yml
Added playbook_type field
2022-02-25 14:44:58 -06:00