admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
f4f86b2aa1cd192d3cbce01dde6a5dbaf69ca7bd
splunk-security_content/response_tasks
T
History
bpatel e94b358a88 blank references
2020-10-20 11:39:00 -07:00
..
accept_and_assign_event.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
all_backup_logs_for_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
amazon_eks_kubernetes_activity_by_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
analyze_domain_indicator_and_reputation.yml
more response task fixes
2020-10-10 12:58:56 -04:00
analyze_email_indicators_and_reputation.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
analyze_host_indicator_and_reputation.yml
more response task fixes
2020-10-10 12:58:56 -04:00
analyze_ip_address_indicator_and_reputation.yml
more response task fixes
2020-10-10 12:58:56 -04:00
analyze_malicious_file.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
analyze_network_indicators_and_reputation.yml
more response task fixes
2020-10-10 12:58:56 -04:00
analyze_precursors_to_the_event.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
analyze_url_indicator_and_reputation.yml
more response task fixes
2020-10-10 12:58:56 -04:00
aws_investigate_security_hub_alerts_by_dest.yml
updated search
2020-06-22 13:34:58 -07:00
aws_investigate_user_activities_by_accesskeyid.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_investigate_user_activities_by_arn.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
aws_investigate_user_activities_by_source_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_network_acl_details_from_id.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_network_interface_details_via_resourceid.yml
bug in generate
2020-05-12 13:53:48 +02:00
aws_s3_bucket_details_via_bucketname.yml
bug in generate
2020-05-12 13:53:48 +02:00
conduct_training.yml
blank references
2020-10-20 11:39:00 -07:00
confirm_incident.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
contain_incident.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
create_follow-up_report.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
determine_if_an_incident_has_occurred.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
determine_incident_prioritization.yml
more response task fixes
2020-10-10 12:58:56 -04:00
dns_hijack_enrichment.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
document_and_notify_of_incident.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
domain_certificate_investigation.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
excessive_account_lockouts_enrichment_and_response.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
gcp_kubernetes_activity_by_src_ip.yml
new generate script
2020-05-06 17:42:38 +02:00
get_all_aws_activity_from_city.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_country.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_ip_address.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_all_aws_activity_from_region.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_authentication_logs_for_endpoint.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
get_backup_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_certificate_logs_for_a_domain.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_dns_server_history_for_a_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_dns_traffic_ratio.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_ec2_instance_details_by_instanceid.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
get_ec2_launch_details.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
get_email_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_emails_from_specific_sender.yml
more response task fixes
2020-10-10 12:58:56 -04:00
get_first_occurrence_and_last_occurrence_of_a_mac_address.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_history_of_email_sources.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
get_logon_rights_modifications_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_logon_rights_modifications_for_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_notable_history.yml
new story file and updates for existing and new searches to associate with it
2020-06-05 12:25:06 -06:00
get_notable_info.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
get_outbound_emails_to_hidden_cobra_threat_actors.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
get_parent_process_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_process_file_activity.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
get_process_info.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_process_information_for_port_activity.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_process_registry_activity.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
get_process_responsible_for_the_dns_traffic.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_registry_activities.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_risk_modifiers_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_risk_modifiers_for_user.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_sysmon_wmi_activity_for_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_update_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_user_information_from_identity_table.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_vulnerability_logs_for_endpoint.yml
bug in generate
2020-05-12 13:53:48 +02:00
get_web_session_information_via_session_id.yml
bug in generate
2020-05-12 13:53:48 +02:00
identify_additional_affected_hosts.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
identify_vunlerabilities.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
implement_additional_monitoring.yml
more response task fixes
2020-10-10 12:58:56 -04:00
implement_recovery_monitoring.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
investigate_aws_activities_via_region_name.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_aws_ecr_container_listing_activity.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_aws_user_activities_by_user_field.yml
new story file and updates for existing and new searches to associate with it
2020-06-05 12:25:06 -06:00
investigate_cloud_compute_instance_activities.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_failed_logins_for_multiple_destinations.yml
bug in generate
2020-05-14 10:00:55 +02:00
investigate_network_traffic_from_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_okta_activity_by_app.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_okta_activity_by_ip_address.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_pass_the_hash_attempts.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_pass_the_ticket_attempts.yml
Updated searches
2020-05-25 11:06:36 +02:00
investigate_previous_unseen_user.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_successful_remote_desktop_authentications.yml
new generate script
2020-05-06 17:42:38 +02:00
investigate_suspicious_strings_in_http_header.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_all_cloud_regions.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_okta.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_user_activities_in_single_cloud_region.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_activity_from_host.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_activity_from_src_ip.yml
bug in generate
2020-05-12 13:53:48 +02:00
investigate_web_posts_from_src.yml
bug in generate
2020-05-12 13:53:48 +02:00
make_personnel_report_suspicious_activity.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
malware_hunt_and_contain.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
mitigate_or_remediate_any_vulnerabilities.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
practice_real_world_events.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
prepare_for_incident_handling.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
preventing_incidents.yml
more response task fixes
2020-10-10 12:58:56 -04:00
process_chain_analysis.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
provide_lessons_learned_tasks_or_changes.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
quarantaine_infected_host.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
raise_personnel_awareness.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
remove_malicious_content.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
restore_systems_to_operational_status.yml
fix a metric ton of validation errors, also updated the specs
2020-10-08 13:27:10 -04:00
suspicious_email_attachment_investigate_and_delete.yml
blank references
2020-10-20 11:39:00 -07:00
validate_hosts_eradicated.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00
validate_restored_hosts.yml
tags and ascii fixes
2020-10-20 11:24:37 -07:00