admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
4bd7eae3c8c6cdcd7587a48dcd16d32dcd8760bc
splunk-security_content/lookups
T
History
David Dorsey 1f56396028 Updated search for abnormally high cloud instances. Including 
verifying that enough data is there
2020-09-14 14:11:02 -07:00
..
api_call_by_user_baseline.yml
Update api_call_by_user_baseline.yml
2020-08-18 15:28:54 -07:00
aws_service_accounts.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
aws_service_accounts.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_blocked_outbound_connections.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
baseline_blocked_outbound_connections.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_monitoring.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
brandMonitoring_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
cloud_instances_enough_data.yml
Updated search for abnormally high cloud instances. Including
2020-09-14 14:11:02 -07:00
csc_lookup.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
csc_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
discovered_dns_records.csv
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
discovered_dns_records.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
dynamic_dns_providers_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
dynamic_dns_providers_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
is_suspicious_file_extension_lookup.csv
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_suspicious_file_extension_lookup.yml
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_windows_system_file.csv
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
legit_domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
legit_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_rare_process_whitelist_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_rare_process_whitelist_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
mitre_enrichment.csv
bug fix generate script
2020-07-21 10:12:58 +02:00
network_acl_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
network_acl_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_api_calls_from_user_roles.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_api_calls_from_user_roles.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_cross_account_activity.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_cross_account_activity.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_regions.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_creations_by_user.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_compute_creations_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_images.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_compute_images.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_instance_types.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_compute_instance_types.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_provisioning_activity_sources.yml
Updated baseline searches for cloud provisioning activities.
2020-09-14 14:11:01 -07:00
previously_seen_cloud_regions.csv
Added in exception handling to cloud compute activity in new region
2019-10-07 21:50:13 -05:00
previously_seen_cloud_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cmd_line_arguments.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_cmd_line_arguments.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_modifications_by_user.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_ec2_modifications_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_running_windows_services.csv
Merge branch 'develop' into first_time_windows_service_bug
2020-06-26 08:32:34 -05:00
previously_seen_running_windows_services.yml
Changed running windows service to use kvstore as cache
2020-06-26 08:27:39 -05:00
previously_seen_S3_access_from_remote_ip.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_S3_access_from_remote_ip.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_apps_launching_cmd.csv
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_processes.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
prohibitedProcesses_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
ransomware_notes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
rare_process_whitelist_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
rare_process_whitelist_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
s3_deletion_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
s3_deletion_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_group_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
security_group_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
suspicious_files.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
suspicious_writes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
uncommon_processes_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
zoom_first_time_child_process.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00