admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
47ad12bfacbb79ed5a2a0e2cc3fe667596bf0a58
splunk-security_content/tests/cloud
T
History
patel-bhavin 47ad12bfac updated names
2023-03-23 13:33:39 -05:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
aws_concurrent_sessions_from_different_ips.test.yml
validation error
2023-02-01 17:19:30 -08:00
aws_console_login_failed_during_mfa_challenge.test.yml
new_mfa_Detections
2022-10-03 15:42:16 -07:00
aws_create_policy_version_to_allow_all_resources.test.yml
search, data and yml updates
2022-05-17 17:36:49 -07:00
aws_createaccesskey.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_createloginprofile.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_credential_access_failed_login.test.yml
Add AWS Credential Access detections
2022-08-08 01:47:33 -04:00
aws_credential_access_getpassworddata.test.yml
getpassworddata
2022-08-10 16:03:18 -07:00
aws_credential_access_rds_password_reset.test.yml
Add AWS Credential Access detections
2022-08-08 01:47:33 -04:00
aws_defense_evasion_delete_cloudtrail.test.yml
new detection putbucket lifecycle
2022-07-25 16:29:57 -07:00
aws_defense_evasion_delete_cloudwatch_log_group.test.yml
Add AWS defense evasion
2022-07-19 11:56:41 -04:00
aws_defense_evasion_impair_security_services.test.yml
file update
2022-07-26 17:21:56 -07:00
aws_defense_evasion_putbucketlifecycle.test.yml
new detection putbucket lifecycle
2022-07-25 16:29:57 -07:00
aws_defense_evasion_stop_logging_cloudtrail.test.yml
delete cloudtrail
2022-07-13 12:49:43 -07:00
aws_defense_evasion_update_cloudtrail.test.yml
Add AWS defense evasion
2022-07-19 11:56:41 -04:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ec2_snapshot_shared_externally.test.yml
adding new detection
2023-03-22 17:11:35 -05:00
aws_ecr_container_scanning_findings_high.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_scanning_findings_low_informational_unknown.test.yml
Fix naming of a test
2022-11-11 11:35:01 -08:00
aws_ecr_container_scanning_findings_medium.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_upload_outside_business_hours.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_upload_unknown_user.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_excessive_security_scanning.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_exfiltration_via_ec2_snapshot.test.yml
updated names
2023-03-23 13:33:39 -05:00
aws_high_number_of_failed_authentications_for_user.test.yml
update test file
2023-01-27 17:23:05 -08:00
aws_high_number_of_failed_authentications_from_ip.test.yml
new aws detection
2023-01-30 13:10:13 -08:00
aws_iam_accessdenied_discovery_events.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_assume_role_policy_brute_force.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_delete_policy.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_failure_group_deletion.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_successful_group_deletion.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_lambda_updatefunctioncode.test.yml
timewindow
2022-02-28 11:59:42 -08:00
aws_multi_factor_authentication_disabled.test.yml
mfa_disabled
2022-10-04 11:50:03 -07:00
aws_multiple_failed_mfa_requests_for_user.test.yml
new detectoion
2022-10-03 16:48:23 -07:00
aws_multiple_users_failing_to_authenticate_from_ip.test.yml
nnew detection and multiple searches
2022-09-26 16:25:49 -05:00
aws_network_access_control_list_created_with_all_open_ports.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_network_access_control_list_deleted.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_new_mfa_method_registered_for_user.test.yml
new mfa added aws
2023-01-31 11:34:28 -08:00
aws_password_policy_changes.test.yml
fix the errors
2023-01-30 15:13:56 -08:00
aws_saml_access_by_provider_user_and_principal.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_saml_update_identity_provider.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_setdefaultpolicyversion.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_successful_console_authentication_from_multiple_ips.test.yml
multiple fixes
2023-02-02 18:38:06 -05:00
aws_successful_single_factor_authentication.test.yml
new SFA detection
2022-10-04 13:48:48 -07:00
aws_unusual_number_of_failed_authentications_from_ip.test.yml
password spray detection std dev
2022-09-26 15:56:29 -05:00
aws_updateloginprofile.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
azure_active_directory_high_risk_sign_in.test.yml
updating test files
2022-07-12 11:22:38 -04:00
azure_ad_authentication_failed_during_mfa_challenge.test.yml
adding new detection
2022-07-14 13:29:55 -04:00
azure_ad_concurrent_sessions_from_different_ips.test.yml
adding new detection for azure ad session hijacking
2023-01-24 14:02:06 -05:00
azure_ad_external_guest_user_invited.test.yml
Add detection for "Azure AD External Guest User Invited"
2022-08-19 10:39:07 -04:00
azure_ad_global_administrator_role_assigned.test.yml
Add 2 detections
2022-08-17 18:43:40 -04:00
azure_ad_high_number_of_failed_authentications_for_user.test.yml
fixes
2023-01-26 16:35:43 -05:00
azure_ad_high_number_of_failed_authentications_from_ip.test.yml
fixes
2023-01-26 16:35:43 -05:00
azure_ad_multi_factor_authentication_disabled.test.yml
updating detection yaml
2022-08-16 12:13:00 -04:00
azure_ad_multiple_failed_mfa_requests_for_user.test.yml
adding new detection
2022-08-25 16:02:54 -04:00
azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml
adding new detection
2022-07-12 13:54:32 -04:00
azure_ad_new_custom_domain_added.test.yml
adding new detection
2022-09-02 18:25:34 -04:00
azure_ad_new_federated_domain_added.test.yml
adding new detection. fixing types. adding line to lookup
2022-09-02 18:03:14 -04:00
azure_ad_new_mfa_method_registered_for_user.test.yml
adding new detection
2023-01-30 17:33:25 -05:00
azure_ad_privileged_role_assigned.test.yml
adding new detection
2022-08-29 17:00:05 -04:00
azure_ad_service_principal_created.test.yml
Add 2 detections
2022-08-17 18:43:40 -04:00
azure_ad_service_principal_new_client_credentials.test.yml
adding new detection and fixing a few others
2022-08-18 14:50:16 -04:00
azure_ad_service_principal_owner_added.test.yml
adding new detection
2022-08-30 18:25:25 -04:00
azure_ad_successful_authentication_from_different_ips.test.yml
fix typo
2023-02-02 19:09:32 -05:00
azure_ad_successful_powershell_authentication.test.yml
fixing file path
2022-07-13 14:38:13 -04:00
azure_ad_successful_single_factor_authentication.test.yml
adding new detection
2022-07-12 18:03:26 -04:00
azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml
updating test files
2022-07-12 11:22:38 -04:00
azure_ad_user_enabled_and_password_reset.test.yml
adding new detection
2022-08-30 13:07:41 -04:00
azure_ad_user_immutableid_attribute_updated.test.yml
adding new detection
2022-09-06 16:08:35 -04:00
azure_automation_account_created.test.yml
fixing detection. adding azure_audit macro
2022-08-22 15:36:25 -04:00
azure_automation_runbook_created.test.yml
adding description. updating dataset url
2022-08-24 11:13:03 -04:00
azure_runbook_webhook_created.test.yml
update detections
2022-08-23 23:40:54 -04:00
circle_ci_disable_security_job.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_in_previously_unused_region.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
cloud_compute_instance_created_with_previously_unseen_image.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
cloud_provisioning_from_previously_unseen_city.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
cloud_provisioning_from_previously_unseen_country.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
cloud_provisioning_from_previously_unseen_ip_address.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
cloud_provisioning_from_previously_unseen_region.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
detect_aws_console_login_by_user_from_new_city.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
detect_aws_console_login_by_user_from_new_country.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
detect_aws_console_login_by_user_from_new_region.test.yml
In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.
2022-03-18 16:10:52 -07:00
detect_new_open_s3_buckets_over_aws_cli.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_new_open_s3_buckets.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gcp_authentication_failed_during_mfa_challenge.test.yml
adding 4 GCP account takeover detections
2022-10-14 15:03:54 -04:00
gcp_multi_factor_authentication_disabled.test.yml
adding 4 GCP account takeover detections
2022-10-14 15:03:54 -04:00
gcp_multiple_failed_mfa_requests_for_user.test.yml
updating detection
2022-10-18 11:36:29 -04:00
gcp_multiple_users_failing_to_authenticate_from_ip.test.yml
adding gcp configs
2022-10-12 18:09:41 -07:00
gcp_successful_single_factor_authentication.test.yml
adding 4 GCP account takeover detections
2022-10-14 15:03:54 -04:00
gcp_unusual_number_of_failed_authentications_from_ip.test.yml
fixing yaml issues
2022-10-17 11:44:39 -04:00
github_actions_disable_security_workflow.test.yml
github actions detection
2022-04-04 11:08:39 +02:00
github_commit_changes_in_master.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_commit_in_develop.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_dependabot_alert.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_pull_request_from_unknown_user.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_email_suspicious_attachment.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_email_suspicious_subject_with_attachment.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_email_with_known_abuse_web_service_link.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_outbound_email_with_attachment_to_external_domain.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_suspicious_shared_file_name.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_nginx_ingress_lfi.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_nginx_ingress_rfi.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_scanner_image_pulling.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_add_app_role_assignment_grant_user.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_added_service_principal.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_bypass_mfa_via_trusted_ip.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_disable_mfa.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_excessive_authentication_failures_alert.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_excessive_sso_logon_errors.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_new_federated_domain_added.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_pst_export_alert.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_admin_email_forwarding.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_rights_delegation.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_user_email_forwarding.test.yml
Refactored security content
2022-03-09 14:43:09 +01:00