admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
d4b28acfd41bceb7eeefe3db7bbf16fd3d010def
splunk-security_content/macros
T
History
divious1 b78035c976 adding macros
2020-09-18 17:36:46 -04:00
..
aws_cloudwatchlogs_eks.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_cross_account_activity_from_previously_unseen_account___dm_filter.yml
updating macro filters
2020-06-08 17:12:15 -07:00
aws_s3_accesslogs.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_securityhub_firehose.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
cisco_networks.yml
Adding macros
2020-08-12 09:17:32 +02:00
clients_connecting_to_multiple_dns_servers.yml
adding definitions
2020-01-23 13:31:43 -08:00
cloudtrail.yml
new generate script
2020-05-06 17:42:38 +02:00
cloudwatch_eks.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatch_vpc.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatchlogs_vpcflow.yml
new generate script
2020-05-06 17:42:38 +02:00
create_or_delete_windows_shares.yml
testing commented search
2020-01-21 01:58:30 -08:00
detect_arp_poisoning_filter.yml
Now validating?
2020-08-12 23:32:48 +02:00
detect_new_user_aws_console_login___dm_filter.yml
updating macro filters
2020-06-08 17:12:15 -07:00
detect_rogue_dhcp_server_filter.yml
Now validating?
2020-08-12 23:32:48 +02:00
detect_zerologon_via_zeek_filter.yml
adding macros
2020-09-18 17:36:46 -04:00
dynamic_dns_providers.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_modification_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
f5_bigip_rogue.yml
ymls and updates
2020-08-04 14:04:38 -07:00
filter_rare_process_whitelist.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
google_gcp_pubnet_message.yml
validate script
2020-04-30 16:52:38 +02:00
google_gcp_pubsub_message.yml
new generate script
2020-05-06 17:42:38 +02:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_rbac_authorization_by_account.yml
more renames base on upper case
2020-06-29 17:39:38 -04:00
kubernetes_azure_detect_sensitive_object_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_sensitive_role_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_pod_scan_fingerprint_detection_filter.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_scan_fingerprint_filter.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
netbackup.yml
new generate script
2020-05-06 17:42:38 +02:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
okta.yml
new generate script
2020-05-06 17:42:38 +02:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Updated generate to output for ASX
2019-10-16 20:54:13 -07:00
previously_seen_windows_services_forget_window.yml
Fixed the first time previously seen windows service search to work
2020-06-25 00:09:30 -05:00
previously_seen_windows_services_window.yml
Fixed the first time previously seen windows service search to work
2020-06-25 00:09:30 -05:00
previously_seen_zoom_child_processes_forget_window.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
previously_seen_zoom_child_processes_window.yml
Fixed the first time previously seen windows service search to work
2020-06-25 00:09:30 -05:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_softwares.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
s3_accesslogs.yml
validate script
2020-04-30 16:52:38 +02:00
security_content_ctime.yml
Present times in ISO8601 instead of US style
2020-08-12 23:45:53 +02:00
security_content_summariesonly.yml
this should be false
2020-06-09 17:58:39 -04:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
stream_dns.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
stream_http.yml
new generate script
2020-05-06 17:42:38 +02:00
stream_tcp.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
new generate script
2020-05-06 17:42:38 +02:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
wineventlog_security.yml
new generate script
2020-05-06 17:42:38 +02:00
wineventlog_system.yml
new generate script
2020-05-06 17:42:38 +02:00
wmi.yml
new generate script
2020-05-06 17:42:38 +02:00
zeek_rpc.yml
adding macros
2020-09-18 17:36:46 -04:00