admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ad42cb18cecb21586e2bacbbffead86502d2690c
splunk-security_content/baselines
T
History
pyth0n1c ad42cb18ce fix baselines and investigations
2024-11-06 16:46:09 -08:00
..
deprecated
fix baselines and investigations
2024-11-06 16:46:09 -08:00
baseline_of_blocked_outbound_traffic_from_aws.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
baseline_of_cloud_infrastructure_api_calls_per_user.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
baseline_of_cloud_instances_destroyed.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
baseline_of_cloud_instances_launched.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
baseline_of_cloud_security_group_api_calls_per_user.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
baseline_of_command_line_length___mltk.yml
fix scheduling
2023-04-18 16:38:53 -07:00
baseline_of_dns_query_length___mltk.yml
fix scheduling
2023-04-18 16:38:53 -07:00
baseline_of_kubernetes_container_network_io_ratio.yml
Final round of fixes to fields with
2024-09-24 21:46:38 -07:00
baseline_of_kubernetes_container_network_io.yml
Final round of fixes to fields with
2024-09-24 21:46:38 -07:00
baseline_of_kubernetes_process_resource_ratio.yml
Final round of fixes to fields with
2024-09-24 21:46:38 -07:00
baseline_of_kubernetes_process_resource.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
baseline_of_network_acl_activity_by_arn.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
baseline_of_s3_bucket_deletion_activity_by_arn.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
baseline_of_security_group_activity_by_arn.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
baseline_of_smb_traffic___mltk.yml
A baseline referenced a detection
2024-08-12 11:58:27 -07:00
count_of_assets_by_category.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
count_of_unique_ips_connecting_to_ports.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
create_a_list_of_approved_aws_service_accounts.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
discover_dns_records.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
dnstwist_domain_names.yml
fix baselines and investigations
2024-11-06 16:46:09 -08:00
identify_systems_creating_remote_desktop_traffic.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
identify_systems_receiving_remote_desktop_traffic.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
identify_systems_using_remote_desktop.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
monitor_successful_backups.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
monitor_unsuccessful_backups.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_aws_cross_account_activity___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_aws_cross_account_activity___update.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
previously_seen_aws_cross_account_activity.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_aws_regions.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
previously_seen_cloud_api_calls_per_user_role___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_api_calls_per_user_role___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_compute_creations_by_user___initial.yml
fix scheduling
2023-04-18 16:38:53 -07:00
previously_seen_cloud_compute_creations_by_user___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_compute_images___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_compute_images___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_compute_instance_types___initial.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
previously_seen_cloud_compute_instance_types___update.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
previously_seen_cloud_instance_modifications_by_user___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_instance_modifications_by_user___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_provisioning_activity_sources___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_provisioning_activity_sources___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_regions___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_cloud_regions___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_command_line_arguments.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_ec2_modifications_by_user.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_running_windows_services___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_running_windows_services___update.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
previously_seen_s3_bucket_access_by_remote_ip.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_users_in_cloudtrail___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_users_in_cloudtrail___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_zoom_child_processes___initial.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
previously_seen_zoom_child_processes___update.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
systems_ready_for_spectre_meltdown_windows_patch.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
windows_updates_install_failures.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00
windows_updates_install_successes.yml
add new deployment functionality
2023-01-04 13:37:44 +01:00