admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
d138f4ea8c879c2cfa7b341a57b3a87d4e330191
splunk-security_content/macros
T
History
P4T12ICK 7f8652b85b bug fix
2021-02-03 15:44:56 +01:00
..
aws_cloudwatchlogs_eks.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_s3_accesslogs.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_securityhub_firehose.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
cisco_networks.yml
Adding macros
2020-08-12 09:17:32 +02:00
cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml
single and double quote order issue
2020-09-23 17:32:52 -05:00
cloudtrail.yml
new generate script
2020-05-06 17:42:38 +02:00
cloudwatch_eks.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatch_vpc.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatchlogs_vpcflow.yml
new generate script
2020-05-06 17:42:38 +02:00
dynamic_dns_providers.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_modification_api_calls.yml
Removed a few API calls that are not really modifications
2020-08-18 13:47:04 -05:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
f5_bigip_rogue.yml
ymls and updates
2020-08-04 14:04:38 -07:00
filter_rare_process_allow_list.yml
Changed the language in some of the descriptions
2021-01-21 23:53:47 -06:00
google_gcp_pubnet_message.yml
validate script
2020-04-30 16:52:38 +02:00
google_gcp_pubsub_message.yml
new generate script
2020-05-06 17:42:38 +02:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
kubernetes_azure.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
linux_hosts.yml
duplicating files and experimental
2021-01-28 17:35:25 -08:00
netbackup.yml
new generate script
2020-05-06 17:42:38 +02:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
o365_management_activity.yml
changes
2020-12-15 12:27:16 +01:00
okta.yml
new generate script
2020-05-06 17:42:38 +02:00
osquery_process.yml
duplicating files and experimental
2021-01-28 17:35:25 -08:00
previously_seen_cloud_api_calls_per_user_role_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_compute_images_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_instance_type_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_provisioning_activity_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_region_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_windows_services_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_windows_services_window.yml
bug fix
2021-02-03 15:44:56 +01:00
previously_seen_zoom_child_processes_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_zoom_child_processes_window.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_unseen_cloud_provisioning_activity_window.yml
Macro fixes
2020-09-23 17:22:02 -05:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_softwares.yml
fix_bugs
2020-12-11 10:51:02 +01:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
s3_accesslogs.yml
validate script
2020-04-30 16:52:38 +02:00
security_content_ctime.yml
Present times in ISO8601 instead of US style
2020-08-12 23:45:53 +02:00
security_content_summariesonly.yml
this should be false
2020-06-09 17:58:39 -04:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
stream_dns.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
stream_http.yml
new generate script
2020-05-06 17:42:38 +02:00
stream_tcp.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
changed macro
2020-11-05 09:18:37 +01:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
wineventlog_security.yml
new generate script
2020-05-06 17:42:38 +02:00
wineventlog_system.yml
new generate script
2020-05-06 17:42:38 +02:00
wmi.yml
new generate script
2020-05-06 17:42:38 +02:00
zeek_rpc.yml
adding macros
2020-09-18 17:36:46 -04:00
zeek_ssl.yml
mods
2020-11-06 11:08:38 +11:00