admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
334fb25cd0c856eb674f2ad495daaeade5e92efa
splunk-security_content/tests/cloud
T
History
pyth0n1c 97c83a1864 Created Experimental folder in tests, 
as well as cloud, endpoint, and network 
subfolders, and moved some tests into it.
This corresponds with the experimental 
folder in detections.
2021-11-30 09:47:01 -08:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
abnormally_high_number_of_cloud_security_group_api_calls.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
aws_create_policy_version_to_allow_all_resources.test.yml
test time
2021-02-23 10:57:01 -08:00
aws_createaccesskey.test.yml
create access key detection
2021-03-02 16:21:35 -08:00
aws_createloginprofile.test.yml
test files
2021-03-18 12:41:00 -07:00
aws_cross_account_activity_from_previously_unseen_account.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml
update detection
2021-01-11 13:31:02 +01:00
aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml
updated detection and test file
2021-01-11 14:28:14 +01:00
aws_ecr_container_scanning_findings_high.test.yml
aws ecr dataset
2021-08-18 14:53:28 +02:00
aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
aws ecr dataset
2021-08-18 14:53:28 +02:00
aws_ecr_container_scanning_findings_medium.test.yml
aws ecr dataset
2021-08-18 14:53:28 +02:00
aws_ecr_container_upload_outside_business_hours.test.yml
container upload aws ecr
2021-08-19 15:07:12 +02:00
aws_ecr_container_upload_unknown_user.test.yml
container upload aws ecr
2021-08-19 15:51:17 +02:00
aws_excessive_security_scanning.test.yml
New AWS detection
2021-04-13 16:29:09 +02:00
aws_iam_accessdenied_discovery_events.test.yml
AWS Detections
2021-04-14 21:10:46 -06:00
aws_iam_assume_role_policy_brute_force.test.yml
AWS Detections
2021-04-14 21:10:46 -06:00
aws_iam_delete_policy.test.yml
AWS Detections
2021-04-14 21:10:46 -06:00
aws_iam_failure_group_deletion.test.yml
AWS Detections
2021-04-14 21:10:46 -06:00
aws_iam_successful_group_deletion.test.yml
AWS Detections
2021-04-14 21:10:46 -06:00
aws_network_access_control_list_created_with_all_open_ports.test.yml
improved detections and tests
2021-01-12 11:13:17 +01:00
aws_network_access_control_list_deleted.test.yml
improved detections and tests
2021-01-12 11:13:17 +01:00
aws_saml_access_by_provider_user_and_principal.test.yml
added detection tests
2021-02-02 10:13:54 +01:00
aws_saml_update_identity_provider.test.yml
added detection tests
2021-02-02 10:13:54 +01:00
aws_setdefaultpolicyversion.test.yml
second detection
2021-03-02 15:21:52 -08:00
aws_updateloginprofile.test.yml
test files
2021-03-18 12:41:00 -07:00
circle_ci_disable_security_job.test.yml
circle ci detecction
2021-09-02 10:42:01 +02:00
circle_ci_disable_security_step.test.yml
circle ci detecction
2021-09-01 17:54:38 +02:00
cloud_api_calls_from_previously_unseen_user_roles.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_compute_instance_created_by_previously_unseen_user.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_compute_instance_created_in_previously_unused_region.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_compute_instance_created_with_previously_unseen_image.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_instance_modified_with_previously_unseen_user.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_provisioning_from_previously_unseen_city.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_provisioning_from_previously_unseen_country.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_provisioning_from_previously_unseen_ip_address.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
cloud_provisioning_from_previously_unseen_region.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
detect_aws_console_login_by_new_user.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
detect_aws_console_login_by_user_from_new_city.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
detect_aws_console_login_by_user_from_new_country.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
detect_aws_console_login_by_user_from_new_region.test.yml
Changing to the correct baseline paths after restructuring repo
2021-11-29 16:44:40 -08:00
detect_new_open_s3_buckets_over_aws_cli.test.yml
improved detections and tests
2021-01-12 15:38:32 +01:00
detect_new_open_s3_buckets.test.yml
improved detections and tests
2021-01-12 15:38:32 +01:00
detect_shared_ec2_snapshot.test.yml
updates
2021-07-20 15:37:36 -07:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml
test file
2021-01-26 13:54:49 -08:00
github_commit_changes_in_master.test.yml
dev_git
2021-08-27 12:58:41 +02:00
github_commit_in_develop.test.yml
devsec3
2021-09-01 11:13:52 +02:00
github_dependabot_alert.test.yml
github detections
2021-09-01 11:28:05 +02:00
github_pull_request_from_unknown_user.test.yml
github detection
2021-09-01 13:56:23 +02:00
gsuite_drive_share_in_external_email.test.yml
devsec_move
2021-08-23 17:16:50 +02:00
gsuite_email_suspicious_attachment.test.yml
devsec_move
2021-08-23 17:16:50 +02:00
gsuite_email_suspicious_subject_with_attachment.test.yml
dev_sec2
2021-08-23 17:30:20 +02:00
gsuite_email_with_known_abuse_web_service_link.test.yml
dev_sec2
2021-08-23 18:42:24 +02:00
gsuite_outbound_email_with_attachment_to_external_domain.test.yml
devsec_move
2021-08-23 17:16:50 +02:00
gsuite_suspicious_shared_file_name.test.yml
dev_sec2
2021-08-23 17:30:20 +02:00
high_number_of_login_failures_from_a_single_source.test.yml
updating paths
2021-03-12 09:51:51 -07:00
kubernetes_nginx_ingress_lfi.test.yml
new detection rfi k8s
2021-08-24 09:58:47 +02:00
kubernetes_nginx_ingress_rfi.test.yml
new detection rfi k8s
2021-08-24 09:58:47 +02:00
kubernetes_scanner_image_pulling.test.yml
k8s scanner detection
2021-08-24 14:48:31 +02:00
o365_add_app_role_assignment_grant_user.test.yml
added detection tests
2021-02-02 10:13:54 +01:00
o365_added_service_principal.test.yml
added detection tests
2021-02-02 10:13:54 +01:00
o365_bypass_mfa_via_trusted_ip.test.yml
data path update
2021-01-13 18:27:06 -08:00
o365_disable_mfa.test.yml
o365 disable mfa
2020-12-17 11:02:20 +01:00
o365_excessive_authentication_failures_alert.test.yml
bug fix
2020-12-17 12:00:53 +01:00
o365_excessive_sso_logon_errors.test.yml
added detection tests
2021-02-02 10:13:54 +01:00
o365_new_federated_domain_added.test.yml
fix for testing
2021-02-02 15:06:58 +01:00
o365_pst_export_alert.test.yml
bug fix
2020-12-17 11:40:00 +01:00
o365_suspicious_admin_email_forwarding.test.yml
new detections
2020-12-16 14:31:05 +01:00
o365_suspicious_rights_delegation.test.yml
changes
2020-12-15 13:59:33 +01:00
o365_suspicious_user_email_forwarding.test.yml
add data exfil story to detections
2021-05-18 13:01:29 +02:00