mvelazco 549d9374ea tagging response tasks ...

adding the 'Splunk Security Analytics for AWS' tag where appropriate

2021-03-31 18:42:17 -04:00

..

deprecated

renamed in response tasks

2021-02-08 10:19:31 -05:00

playbooks

add products to responses, added new type response, also new checks for product tag and mitre_attack_id in validate

2021-02-04 22:28:19 -05:00

all_backup_logs_for_host.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

amazon_eks_kubernetes_activity_by_src_ip.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_investigate_security_hub_alerts_by_dest.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_investigate_user_activities_by_accesskeyid.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_investigate_user_activities_by_arn.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_network_acl_details_from_id.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_network_interface_details_via_resourceid.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

aws_s3_bucket_details_via_bucketname.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

dns_hijack_enrichment.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

domain_certificate_investigation.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

excessive_account_lockouts_enrichment_and_response.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

gcp_kubernetes_activity_by_src_ip.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_all_aws_activity_from_city.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_all_aws_activity_from_country.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_all_aws_activity_from_ip_address.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_all_aws_activity_from_region.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_backup_logs_for_endpoint.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_certificate_logs_for_a_domain.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_dns_server_history_for_a_host.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_dns_traffic_ratio.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_ec2_instance_details_by_instanceid.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_ec2_launch_details.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

get_email_info.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_emails_from_specific_sender.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_first_occurrence_and_last_occurrence_of_a_mac_address.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_history_of_email_sources.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_logon_rights_modifications_for_endpoint.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_logon_rights_modifications_for_user.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_notable_history.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_outbound_emails_to_hidden_cobra_threat_actors.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_parent_process_info.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_process_file_activity.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_process_info.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_process_information_for_port_activity.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_process_responsible_for_the_dns_traffic.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_sysmon_wmi_activity_for_host.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

get_web_session_information_via_session_id.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_aws_activities_via_region_name.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

investigate_aws_user_activities_by_user_field.yml

tagging response tasks

2021-03-31 18:42:17 -04:00

investigate_failed_logins_for_multiple_destinations.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_network_traffic_from_src_ip.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_okta_activity_by_app.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_okta_activity_by_ip_address.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_pass_the_hash_attempts.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_pass_the_ticket_attempts.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_previous_unseen_user.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_successful_remote_desktop_authentications.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_suspicious_strings_in_http_header.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_user_activities_in_okta.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00

investigate_web_posts_from_src.yml

renamed in response tasks

2021-02-08 10:19:31 -05:00