splunk-security_content

abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

abnormally_high_number_of_cloud_security_group_api_calls.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

aws_console_login_failed_during_mfa_challenge.test.yml

new_mfa_Detections

2022-10-03 15:42:16 -07:00

aws_console_logins_from_multiple_ips.test.yml

timeframe in test

2023-01-27 17:10:02 -08:00

aws_create_policy_version_to_allow_all_resources.test.yml

search, data and yml updates

2022-05-17 17:36:49 -07:00

aws_createaccesskey.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_createloginprofile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_credential_access_failed_login.test.yml

Add AWS Credential Access detections

2022-08-08 01:47:33 -04:00

aws_credential_access_getpassworddata.test.yml

getpassworddata

2022-08-10 16:03:18 -07:00

aws_credential_access_rds_password_reset.test.yml

Add AWS Credential Access detections

2022-08-08 01:47:33 -04:00

aws_cross_account_activity_from_previously_unseen_account.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

aws_defense_evasion_delete_cloudtrail.test.yml

new detection putbucket lifecycle

2022-07-25 16:29:57 -07:00

aws_defense_evasion_delete_cloudwatch_log_group.test.yml

Add AWS defense evasion

2022-07-19 11:56:41 -04:00

aws_defense_evasion_impair_security_services.test.yml

file update

2022-07-26 17:21:56 -07:00

aws_defense_evasion_putbucketlifecycle.test.yml

new detection putbucket lifecycle

2022-07-25 16:29:57 -07:00

aws_defense_evasion_stop_logging_cloudtrail.test.yml

delete cloudtrail

2022-07-13 12:49:43 -07:00

aws_defense_evasion_update_cloudtrail.test.yml

Add AWS defense evasion

2022-07-19 11:56:41 -04:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_high.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_low_informational_unknown.test.yml

Fix naming of a test

2022-11-11 11:35:01 -08:00

aws_ecr_container_scanning_findings_medium.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_outside_business_hours.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_unknown_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_excessive_security_scanning.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_high_number_of_failed_authentications_for_user.test.yml

update test file

2023-01-27 17:23:05 -08:00

aws_high_number_of_failed_authentications_from_ip.test.yml

new aws detection

2023-01-30 13:10:13 -08:00

aws_iam_accessdenied_discovery_events.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_assume_role_policy_brute_force.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_delete_policy.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_failure_group_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_successful_group_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_lambda_updatefunctioncode.test.yml

timewindow

2022-02-28 11:59:42 -08:00

aws_multi_factor_authentication_disabled.test.yml

mfa_disabled

2022-10-04 11:50:03 -07:00

aws_multiple_failed_mfa_requests_for_user.test.yml

new detectoion

2022-10-03 16:48:23 -07:00

aws_multiple_users_failing_to_authenticate_from_ip.test.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

aws_network_access_control_list_created_with_all_open_ports.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_network_access_control_list_deleted.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_password_policy_changes.test.yml

new line remove

2023-01-27 17:11:53 -08:00

aws_saml_access_by_provider_user_and_principal.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_saml_update_identity_provider.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_setdefaultpolicyversion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_successful_single_factor_authentication.test.yml

new SFA detection

2022-10-04 13:48:48 -07:00

aws_unusual_number_of_failed_authentications_from_ip.test.yml

password spray detection std dev

2022-09-26 15:56:29 -05:00

aws_updateloginprofile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

azure_active_directory_high_risk_sign_in.test.yml

updating test files

2022-07-12 11:22:38 -04:00

azure_ad_authentication_failed_during_mfa_challenge.test.yml

adding new detection

2022-07-14 13:29:55 -04:00

azure_ad_concurrent_sessions_from_different_ips.test.yml

adding new detection for azure ad session hijacking

2023-01-24 14:02:06 -05:00

azure_ad_external_guest_user_invited.test.yml

Add detection for "Azure AD External Guest User Invited"

2022-08-19 10:39:07 -04:00

azure_ad_global_administrator_role_assigned.test.yml

Add 2 detections

2022-08-17 18:43:40 -04:00

azure_ad_high_number_of_failed_authentications_for_user.test.yml

fixes

2023-01-26 16:35:43 -05:00

azure_ad_high_number_of_failed_authentications_from_ip.test.yml

fixes

2023-01-26 16:35:43 -05:00

azure_ad_multi_factor_authentication_disabled.test.yml

updating detection yaml

2022-08-16 12:13:00 -04:00

azure_ad_multiple_failed_mfa_requests_for_user.test.yml

adding new detection

2022-08-25 16:02:54 -04:00

azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml

adding new detection

2022-07-12 13:54:32 -04:00

azure_ad_new_custom_domain_added.test.yml

adding new detection

2022-09-02 18:25:34 -04:00

azure_ad_new_federated_domain_added.test.yml

adding new detection. fixing types. adding line to lookup

2022-09-02 18:03:14 -04:00

azure_ad_privileged_role_assigned.test.yml

adding new detection

2022-08-29 17:00:05 -04:00

azure_ad_service_principal_created.test.yml

Add 2 detections

2022-08-17 18:43:40 -04:00

azure_ad_service_principal_new_client_credentials.test.yml

adding new detection and fixing a few others

2022-08-18 14:50:16 -04:00

azure_ad_service_principal_owner_added.test.yml

adding new detection

2022-08-30 18:25:25 -04:00

azure_ad_succesful_authentication_from_different_ips.test.yml

adding new detection

2023-01-24 18:50:51 -05:00

azure_ad_successful_powershell_authentication.test.yml

fixing file path

2022-07-13 14:38:13 -04:00

azure_ad_successful_single_factor_authentication.test.yml

adding new detection

2022-07-12 18:03:26 -04:00

azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml

updating test files

2022-07-12 11:22:38 -04:00

azure_ad_user_enabled_and_password_reset.test.yml

adding new detection

2022-08-30 13:07:41 -04:00

azure_ad_user_immutableid_attribute_updated.test.yml

adding new detection

2022-09-06 16:08:35 -04:00

azure_automation_account_created.test.yml

fixing detection. adding azure_audit macro

2022-08-22 15:36:25 -04:00

azure_automation_runbook_created.test.yml

adding description. updating dataset url

2022-08-24 11:13:03 -04:00

azure_runbook_webhook_created.test.yml

update detections

2022-08-23 23:40:54 -04:00

circle_ci_disable_security_job.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

circle_ci_disable_security_step.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_api_calls_from_previously_unseen_user_roles.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_by_previously_unseen_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_in_previously_unused_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_with_previously_unseen_image.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_instance_modified_with_previously_unseen_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_city.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_country.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_ip_address.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_city.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_country.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_new_open_s3_buckets_over_aws_cli.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_new_open_s3_buckets.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_shared_ec2_snapshot.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gcp_authentication_failed_during_mfa_challenge.test.yml

adding 4 GCP account takeover detections

2022-10-14 15:03:54 -04:00

gcp_multi_factor_authentication_disabled.test.yml

adding 4 GCP account takeover detections

2022-10-14 15:03:54 -04:00

gcp_multiple_failed_mfa_requests_for_user.test.yml

updating detection

2022-10-18 11:36:29 -04:00

gcp_multiple_users_failing_to_authenticate_from_ip.test.yml

adding gcp configs

2022-10-12 18:09:41 -07:00

gcp_successful_single_factor_authentication.test.yml

adding 4 GCP account takeover detections

2022-10-14 15:03:54 -04:00

gcp_unusual_number_of_failed_authentications_from_ip.test.yml

fixing yaml issues

2022-10-17 11:44:39 -04:00

github_actions_disable_security_workflow.test.yml

github actions detection

2022-04-04 11:08:39 +02:00

github_commit_changes_in_master.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_commit_in_develop.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_dependabot_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_pull_request_from_unknown_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_drive_share_in_external_email.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_attachment.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_subject_with_attachment.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_with_known_abuse_web_service_link.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_outbound_email_with_attachment_to_external_domain.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_suspicious_shared_file_name.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_lfi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_rfi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_scanner_image_pulling.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_add_app_role_assignment_grant_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_added_service_principal.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_bypass_mfa_via_trusted_ip.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_disable_mfa.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_authentication_failures_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_sso_logon_errors.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_new_federated_domain_added.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_pst_export_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_admin_email_forwarding.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_rights_delegation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_user_email_forwarding.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00