David Dorsey 2a4b29e4c4 New investigation macros ...

Updated validate to check for macro and lookup existence in both
    baselines and investigation searches

2019-10-07 22:14:12 -05:00

..

brand_abuse_dns.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

brand_abuse_email.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

brand_abuse_web.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

dynamic_dns_providers.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

dynamic_dns_web_traffic.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

ec2ModificationAPIs.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_0365.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_amazon.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_aws.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_facebook.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_github.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_google.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

evilginx_phishlets_outlook.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

filter_rare_process_whitelist.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

investigate_cloud_compute_instance_activities_output_filter.json

New investigation macros

2019-10-07 22:14:12 -05:00

investigate_user_activities_in_all_cloud_region_output_filter.json

New investigation macros

2019-10-07 22:14:12 -05:00

investigate_user_activities_in_single_cloud_region_output_filter.json

New investigation macros

2019-10-07 22:14:12 -05:00

isWindowsSystemFile.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

NetworkACLEvents.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

previously_seen_cloud_compute_creations_by_user_input_filter.json

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_compute_image_input_filter.json

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_compute_instance_types_input_filter.json

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

previously_seen_cloud_regions_input_filter.json

Added in exception handling to cloud compute activity in new region

2019-10-07 21:50:13 -05:00

prohibited_apps_launching_cmd.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

prohibited_softwares.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

ransomware_extensions.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

ransomware_notes.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

remove_valid_domains.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

runstory.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

securityGroupAPIs.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

suspicious_email_attachments.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

suspicious_writes.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

system_network_configuration_discovery_tools.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

uncommon_processes.json

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00