splunk-security_content

abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

abnormally_high_number_of_cloud_security_group_api_calls.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

aws_create_policy_version_to_allow_all_resources.test.yml

search, data and yml updates

2022-05-17 17:36:49 -07:00

aws_createaccesskey.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_createloginprofile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_credential_access_failed_login.test.yml

Add AWS Credential Access detections

2022-08-08 01:47:33 -04:00

aws_credential_access_getpassworddata.test.yml

getpassworddata

2022-08-10 16:03:18 -07:00

aws_credential_access_rds_password_reset.test.yml

Add AWS Credential Access detections

2022-08-08 01:47:33 -04:00

aws_cross_account_activity_from_previously_unseen_account.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

aws_defense_evasion_delete_cloudtrail.test.yml

new detection putbucket lifecycle

2022-07-25 16:29:57 -07:00

aws_defense_evasion_delete_cloudwatch_log_group.test.yml

Add AWS defense evasion

2022-07-19 11:56:41 -04:00

aws_defense_evasion_impair_security_services.test.yml

file update

2022-07-26 17:21:56 -07:00

aws_defense_evasion_putbucketlifecycle.test.yml

new detection putbucket lifecycle

2022-07-25 16:29:57 -07:00

aws_defense_evasion_stop_logging_cloudtrail.test.yml

delete cloudtrail

2022-07-13 12:49:43 -07:00

aws_defense_evasion_update_cloudtrail.test.yml

Add AWS defense evasion

2022-07-19 11:56:41 -04:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_high.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_low_informational_unknown.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_medium.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_outside_business_hours.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_unknown_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_excessive_security_scanning.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_accessdenied_discovery_events.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_assume_role_policy_brute_force.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_delete_policy.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_failure_group_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_successful_group_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_lambda_updatefunctioncode.test.yml

timewindow

2022-02-28 11:59:42 -08:00

aws_network_access_control_list_created_with_all_open_ports.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_network_access_control_list_deleted.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_saml_access_by_provider_user_and_principal.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_saml_update_identity_provider.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_setdefaultpolicyversion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_updateloginprofile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

azure_active_directory_high_risk_sign_in.test.yml

updating test files

2022-07-12 11:22:38 -04:00

azure_ad_authentication_failed_during_mfa_challenge.test.yml

adding new detection

2022-07-14 13:29:55 -04:00

azure_ad_external_guest_user_invited.test.yml

Add detection for "Azure AD External Guest User Invited"

2022-08-19 10:39:07 -04:00

azure_ad_global_administrator_role_assigned.test.yml

Add 2 detections

2022-08-17 18:43:40 -04:00

azure_ad_multi_factor_authentication_disabled.test.yml

updating detection yaml

2022-08-16 12:13:00 -04:00

azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml

adding new detection

2022-07-12 13:54:32 -04:00

azure_ad_service_principal_created.test.yml

Add 2 detections

2022-08-17 18:43:40 -04:00

azure_ad_service_principal_new_client_credentials.test.yml

adding new detection and fixing a few others

2022-08-18 14:50:16 -04:00

azure_ad_successful_powershell_authentication.test.yml

fixing file path

2022-07-13 14:38:13 -04:00

azure_ad_successful_single_factor_authentication.test.yml

adding new detection

2022-07-12 18:03:26 -04:00

azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml

updating test files

2022-07-12 11:22:38 -04:00

azure_automation_account_created.test.yml

fixing detection. adding azure_audit macro

2022-08-22 15:36:25 -04:00

azure_automation_runbook_created.test.yml

adding description. updating dataset url

2022-08-24 11:13:03 -04:00

azure_runbook_webhook_created.test.yml

update detections

2022-08-23 23:40:54 -04:00

circle_ci_disable_security_job.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

circle_ci_disable_security_step.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_api_calls_from_previously_unseen_user_roles.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_by_previously_unseen_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_in_previously_unused_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_with_previously_unseen_image.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_instance_modified_with_previously_unseen_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_city.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_country.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_ip_address.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

cloud_provisioning_from_previously_unseen_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_new_user.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_city.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_country.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_aws_console_login_by_user_from_new_region.test.yml

In a previous update, baselines were moved into the baselines folder, but the path to the baselines was not updated in the test files. All of the paths have now been updated.

2022-03-18 16:10:52 -07:00

detect_new_open_s3_buckets_over_aws_cli.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_new_open_s3_buckets.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_shared_ec2_snapshot.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_actions_disable_security_workflow.test.yml

github actions detection

2022-04-04 11:08:39 +02:00

github_commit_changes_in_master.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_commit_in_develop.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_dependabot_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_pull_request_from_unknown_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_drive_share_in_external_email.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_attachment.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_subject_with_attachment.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_with_known_abuse_web_service_link.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_outbound_email_with_attachment_to_external_domain.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_suspicious_shared_file_name.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_lfi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_rfi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_scanner_image_pulling.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_add_app_role_assignment_grant_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_added_service_principal.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_bypass_mfa_via_trusted_ip.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_disable_mfa.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_authentication_failures_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_sso_logon_errors.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_new_federated_domain_added.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_pst_export_alert.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_admin_email_forwarding.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_rights_delegation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_user_email_forwarding.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00