mvelazco 549d9374ea tagging response tasks ...

adding the 'Splunk Security Analytics for AWS' tag where appropriate

2021-03-31 18:42:17 -04:00

..

deprecated

…

playbooks

…

all_backup_logs_for_host.yml

…

amazon_eks_kubernetes_activity_by_src_ip.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_investigate_security_hub_alerts_by_dest.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_investigate_user_activities_by_accesskeyid.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_investigate_user_activities_by_arn.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_network_acl_details_from_id.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_network_interface_details_via_resourceid.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_s3_bucket_details_via_bucketname.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

dns_hijack_enrichment.yml

…

domain_certificate_investigation.yml

…

excessive_account_lockouts_enrichment_and_response.yml

…

gcp_kubernetes_activity_by_src_ip.yml

…

get_all_aws_activity_from_city.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_all_aws_activity_from_country.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_all_aws_activity_from_ip_address.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_all_aws_activity_from_region.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_backup_logs_for_endpoint.yml

…

get_certificate_logs_for_a_domain.yml

…

get_dns_server_history_for_a_host.yml

…

get_dns_traffic_ratio.yml

…

get_ec2_instance_details_by_instanceid.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_ec2_launch_details.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_email_info.yml

…

get_emails_from_specific_sender.yml

…

get_first_occurrence_and_last_occurrence_of_a_mac_address.yml

…

get_history_of_email_sources.yml

…

get_logon_rights_modifications_for_endpoint.yml

…

get_logon_rights_modifications_for_user.yml

…

get_notable_history.yml

…

get_outbound_emails_to_hidden_cobra_threat_actors.yml

…

get_parent_process_info.yml

…

get_process_file_activity.yml

…

get_process_info.yml

…

get_process_information_for_port_activity.yml

…

get_process_responsible_for_the_dns_traffic.yml

…

get_sysmon_wmi_activity_for_host.yml

…

get_web_session_information_via_session_id.yml

…

investigate_aws_activities_via_region_name.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

investigate_aws_user_activities_by_user_field.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

investigate_failed_logins_for_multiple_destinations.yml

…

investigate_network_traffic_from_src_ip.yml

…

investigate_okta_activity_by_app.yml

…

investigate_okta_activity_by_ip_address.yml

…

investigate_pass_the_hash_attempts.yml

…

investigate_pass_the_ticket_attempts.yml

…

investigate_previous_unseen_user.yml

…

investigate_successful_remote_desktop_authentications.yml

…

investigate_suspicious_strings_in_http_header.yml

…

investigate_user_activities_in_okta.yml

…

investigate_web_posts_from_src.yml

…