splunk-security_content

abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

abnormally_high_number_of_cloud_security_group_api_calls.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

aws_create_policy_version_to_allow_all_resources.test.yml

search, data and yml updates

2022-05-17 17:36:49 -07:00

aws_createaccesskey.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_createloginprofile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_cross_account_activity_from_previously_unseen_account.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_high.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_low_informational_unknown.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_medium.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_outside_business_hours.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_unknown_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_excessive_security_scanning.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_accessdenied_discovery_events.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_assume_role_policy_brute_force.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_delete_policy.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_failure_group_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_successful_group_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_lambda_updatefunctioncode.test.yml

timewindow

2022-02-28 11:59:42 -08:00

aws_network_access_control_list_created_with_all_open_ports.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_network_access_control_list_deleted.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_saml_access_by_provider_user_and_principal.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_saml_update_identity_provider.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_setdefaultpolicyversion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_updateloginprofile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

azure_active_directory_high_risk_sign_in.test.yml

adding 2 detections

2022-07-11 17:29:18 -04:00

azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml

adding 2 detections

2022-07-11 17:29:18 -04:00

circle_ci_disable_security_job.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

circle_ci_disable_security_step.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_api_calls_from_previously_unseen_user_roles.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_by_previously_unseen_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_in_previously_unused_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_with_previously_unseen_image.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_instance_modified_with_previously_unseen_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_city.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_country.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_ip_address.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_new_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_city.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_country.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_new_open_s3_buckets_over_aws_cli.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_new_open_s3_buckets.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_shared_ec2_snapshot.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_actions_disable_security_workflow.test.yml

github actions detection

2022-04-04 11:08:39 +02:00

github_commit_changes_in_master.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_commit_in_develop.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_dependabot_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_pull_request_from_unknown_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_drive_share_in_external_email.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_attachment.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_subject_with_attachment.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_with_known_abuse_web_service_link.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_outbound_email_with_attachment_to_external_domain.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_suspicious_shared_file_name.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_lfi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_rfi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_scanner_image_pulling.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_add_app_role_assignment_grant_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_added_service_principal.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_bypass_mfa_via_trusted_ip.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_disable_mfa.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_authentication_failures_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_sso_logon_errors.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_new_federated_domain_added.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_pst_export_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_admin_email_forwarding.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_rights_delegation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_user_email_forwarding.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00