admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
d2129cb6d2ef594352d5babb4e7402a05207ce94
splunk-security_content/macros
T
History
mhaag-spl bd69016d7e PowerShell 4104 copy of Security HIVES 
Modified macro to capture both XML rendered and non. Issue is, if you renderXML for powershell logging, it will have different fields. Something to be aware of.
2021-07-21 13:57:10 -06:00
..
aws_cloudwatchlogs_eks.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_s3_accesslogs.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_securityhub_finding.yml
rename
2021-01-26 19:28:03 -08:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
cisco_networks.yml
Adding macros
2020-08-12 09:17:32 +02:00
cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml
single and double quote order issue
2020-09-23 17:32:52 -05:00
cloudtrail.yml
new generate script
2020-05-06 17:42:38 +02:00
cloudwatch_eks.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatch_vpc.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatchlogs_vpcflow.yml
new generate script
2020-05-06 17:42:38 +02:00
dynamic_dns_providers.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_modification_api_calls.yml
Removed a few API calls that are not really modifications
2020-08-18 13:47:04 -05:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
f5_bigip_rogue.yml
ymls and updates
2020-08-04 14:04:38 -07:00
filter_rare_process_allow_list.yml
Changed the language in some of the descriptions
2021-01-21 23:53:47 -06:00
google_gcp_pubnet_message.yml
validate script
2020-04-30 16:52:38 +02:00
google_gcp_pubsub_message.yml
new generate script
2020-05-06 17:42:38 +02:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
kubernetes_azure.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
linux_hosts.yml
duplicating files and experimental
2021-01-28 17:35:25 -08:00
netbackup.yml
new generate script
2020-05-06 17:42:38 +02:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
o365_management_activity.yml
changes
2020-12-15 12:27:16 +01:00
okta.yml
new generate script
2020-05-06 17:42:38 +02:00
osquery_process.yml
duplicating files and experimental
2021-01-28 17:35:25 -08:00
powershell.yml
PowerShell 4104 copy of Security HIVES
2021-07-21 13:57:10 -06:00
previously_seen_cloud_api_calls_per_user_role_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_compute_images_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_instance_type_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_provisioning_activity_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_region_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_windows_services_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_windows_services_window.yml
bug fix
2021-02-03 15:44:56 +01:00
previously_seen_zoom_child_processes_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_zoom_child_processes_window.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_unseen_cloud_provisioning_activity_window.yml
Macro fixes
2020-09-23 17:22:02 -05:00
printservice.yml
Added a Macro
2021-07-01 12:11:49 -06:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_softwares.yml
fix_bugs
2020-12-11 10:51:02 +01:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
s3_accesslogs.yml
validate script
2020-04-30 16:52:38 +02:00
security_content_ctime.yml
Present times in ISO8601 instead of US style
2020-08-12 23:45:53 +02:00
security_content_summariesonly.yml
this should be false
2020-06-09 17:58:39 -04:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
stream_dns.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
stream_http.yml
new generate script
2020-05-06 17:42:38 +02:00
stream_tcp.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
changed macro
2020-11-05 09:18:37 +01:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
wineventlog_security.yml
new generate script
2020-05-06 17:42:38 +02:00
wineventlog_system.yml
new generate script
2020-05-06 17:42:38 +02:00
wmi.yml
new generate script
2020-05-06 17:42:38 +02:00
zeek_rpc.yml
adding macros
2020-09-18 17:36:46 -04:00
zeek_ssl.yml
mods
2020-11-06 11:08:38 +11:00