branch	build status
develop
master

security-content

Contains a collection of security stories with their corresponding detection, investigative, contexual and support splunk searches

Consumption

Can be consumed using:

• API (https://api.splunksecuritycontent.com)
• CLI

Structure

stories/ - contains all analytics stories/use cases for ESCU detections/ - splunk, uba and phantom detections that power stories investigations/ - splunk, and phantom investigation content that are used in stories responses/ - automated splunk and phantom responses that are used in stories baselines/ - phantom and Splunk baseline needed to support detections in stories src/ - splunk content app source files, includes lookups, binaries, and defaul config files bin/ - where all binaries to produce, and test content lives spec/ - location of all spec files that describe ESCU content

Developing

For getting pre-commit checks, install the hooks see below for steps:

1. Install circleci CLI Tool
2. create virtualenv and install requirements: virtualenv venv && source venv/bin/activate && pip install -r requirements.txt
3. install pre-commit pre-commit install

To test a local change to CI or build make sure you are running docker and then circleci local execute -e GITHUB_TOKEN=$GITHUB_TOKEN --branch <your branch>