admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v3.0.3
splunk-security_content/macros
T
History
Bhavin Patel 3c8c201add Merge branch 'develop' into CRL-1766-auth-dm-updates
2020-06-16 10:46:20 -07:00
..
aws_cloudwatchlogs_eks.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_cross_account_activity_from_previously_unseen_account___dm_filter.yml
updating macro filters
2020-06-08 17:12:15 -07:00
aws_s3_accesslogs.yml
new generate script
2020-05-06 17:42:38 +02:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
clients_connecting_to_multiple_dns_servers.yml
adding definitions
2020-01-23 13:31:43 -08:00
cloudtrail.yml
new generate script
2020-05-06 17:42:38 +02:00
cloudwatch_eks.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatch_vpc.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatchlogs_vpcflow.yml
new generate script
2020-05-06 17:42:38 +02:00
create_or_delete_windows_shares.yml
testing commented search
2020-01-21 01:58:30 -08:00
detect_new_user_aws_console_login___dm_filter.yml
updating macro filters
2020-06-08 17:12:15 -07:00
dynamic_dns_providers.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_modification_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
filter_rare_process_whitelist.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
google_gcp_pubnet_message.yml
validate script
2020-04-30 16:52:38 +02:00
google_gcp_pubsub_message.yml
new generate script
2020-05-06 17:42:38 +02:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_RBAC_authorization_by_account.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_sensitive_object_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_sensitive_role_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_pod_scan_fingerprint_detection_filter.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_scan_fingerprint_filter.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
netbackup.yml
new generate script
2020-05-06 17:42:38 +02:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
okta.yml
new generate script
2020-05-06 17:42:38 +02:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Updated generate to output for ASX
2019-10-16 20:54:13 -07:00
previously_seen_zoom_child_processes_forget_window.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
previously_seen_zoom_child_processes_window.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_softwares.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
s3_accesslogs.yml
validate script
2020-04-30 16:52:38 +02:00
security_content_ctime.yml
fixed security_content_ctime macro
2019-12-17 09:33:35 +01:00
security_content_summariesonly.yml
this should be false
2020-06-09 17:58:39 -04:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
stream_http.yml
new generate script
2020-05-06 17:42:38 +02:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
new generate script
2020-05-06 17:42:38 +02:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
wineventlog_security.yml
new generate script
2020-05-06 17:42:38 +02:00
wineventlog_system.yml
new generate script
2020-05-06 17:42:38 +02:00
wmi.yml
new generate script
2020-05-06 17:42:38 +02:00