splunk-security_content

baseline_of_dns_query_length___mltk.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

baseline_of_smb_traffic___mltk.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

count_of_unique_ips_connecting_to_ports.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

detect_outbound_ldap_traffic.yml

updating docs and package bits [ci skip]

2021-12-15 02:58:27 +00:00

discover_dns_records.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

dns_query_length_with_high_standard_deviation.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

get_certificate_logs_for_a_domain.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

get_dns_server_history_for_a_host.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

get_dns_traffic_ratio.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

get_email_info.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

get_emails_from_specific_sender.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

get_first_occurrence_and_last_occurrence_of_a_mac_address.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

get_history_of_email_sources.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

get_outbound_emails_to_hidden_cobra_threat_actors.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

get_web_session_information_via_session_id.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

identify_systems_creating_remote_desktop_traffic.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

identify_systems_receiving_remote_desktop_traffic.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

investigate_network_traffic_from_src_ip.yml

updating docs and package bits [ci skip]

2021-10-28 19:55:37 +00:00

investigate_suspicious_strings_in_http_header.yml

updating docs and package bits [ci skip]

2021-08-18 16:56:31 +00:00

investigate_web_posts_from_src.yml

Updated a large number of searches which uses datamodels from 'datamodel=datamodel' to 'datamodel=datamodel.submodel'. This is more explicit and allows us to better enumerate and check required_fields and declared datamodels

2022-01-10 12:52:16 -08:00

multiple_archive_files_http_post_traffic.yml

CARS_UPDATE_MITRE_ID_B8

2021-10-15 10:22:43 +02:00

plain_http_post_exfiltrated_data.yml

CARS_UPDATE_MITRE_ID_B8

2021-10-15 10:22:43 +02:00