admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bf80f1cfbf96071b2add2dba3f308d77d38abfc2
splunk-security_content/baselines
T
History
David Dorsey a07b2f4858 Bug fixes
2020-05-19 16:05:55 -05:00
..
add_prohibited_processes_to_es.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
approved_aws_service_accounts.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
assets_sorted_by_category.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_api_calls_per_user_arn.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_aws_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_blocked_vpc_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_cloud_compute_regions.yml
updates to propery use cloud_infrastructure
2019-10-24 13:26:55 -06:00
baseline_network_acl_modifications.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
baseline_s3_deletion_by_arn.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_security_group_activity_by_arn.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
brand_abuse_dnstwist_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
discover_dns_records.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
identify_ports_on_network.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
identify_systems_creating_rdp_traffic.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
identify_systems_receiving_rdp_traffic.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
identify_systems_using_remote_desktop.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
monitor_successful_backups.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
monitor_successful_windows_updates.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
monitor_unsuccessful_backups.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
monitor_unsuccessful_windows_updates.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
previously_seen_aws_cross_account_activity.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_users.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
previously_seen_cloud_compute_creations_by_user.yml
updates to propery use cloud_infrastructure
2019-10-24 13:26:55 -06:00
previously_seen_cloud_compute_images.yml
updates to propery use cloud_infrastructure
2019-10-24 13:26:55 -06:00
previously_seen_cloud_compute_instance_types.yml
updates to propery use cloud_infrastructure
2019-10-24 13:26:55 -06:00
previously_seen_cmd_arguments.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
previously_seen_ec2_amis.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
previously_seen_ec2_instance_types.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_launches_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_modifications.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
previously_seen_provisioning_activity_src.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_s3_remote_ip.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_user_roles.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_windows_service_starts.yml
updated search/metadata, tested in attack_range
2020-01-13 12:42:35 -08:00
previously_seen_zoom_child_processes_initial.yml
New story for suspicous zoom activity. Investigative searches not in yet.
2020-05-07 23:00:19 -05:00
previously_seen_zoom_child_processes_update.yml
Bug fixes
2020-05-19 16:05:55 -05:00
systems_ready_for_spectre_meltdown_patch.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
train_dns_query_length.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
train_ec2_excessive_runinstances.yml
CRL-1646 - changing from user to src_user
2019-11-25 15:49:32 -08:00
train_ec2_excessive_terminateinstances.yml
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
2019-11-25 18:06:33 -08:00
train_smb_traffic_spike.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
train_unusually_long_commandlines.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
update_previously_seen_aws_users.yml
fixing reported error
2020-03-04 09:58:52 -05:00