tccontre b90326f55c dev_git

2021-08-27 13:28:06 +02:00

..

aws_cloudwatchlogs_eks.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_config.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

aws_description.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

aws_ecr_users.yml

container upload aws ecr

2021-08-19 15:51:17 +02:00

aws_s3_accesslogs.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_securityhub_finding.yml

rename

2021-01-26 19:28:03 -08:00

aws_securityhub_firehose.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

cisco_networks.yml

Adding macros

2020-08-12 09:17:32 +02:00

cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml

single and double quote order issue

2020-09-23 17:32:52 -05:00

cloudtrail.yml

new generate script

2020-05-06 17:42:38 +02:00

cloudwatch_eks.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatch_vpc.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatchlogs_vpcflow.yml

new generate script

2020-05-06 17:42:38 +02:00

dynamic_dns_providers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_modification_api_calls.yml

Removed a few API calls that are not really modifications

2020-08-18 13:47:04 -05:00

evilginx_phishlets_0365.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_amazon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_aws.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_facebook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_github.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_google.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_outlook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

f5_bigip_rogue.yml

ymls and updates

2020-08-04 14:04:38 -07:00

filter_rare_process_allow_list.yml

Changed the language in some of the descriptions

2021-01-21 23:53:47 -06:00

github.yml

dev_git

2021-08-27 13:28:06 +02:00

google_gcp_pubnet_message.yml

validate script

2020-04-30 16:52:38 +02:00

google_gcp_pubsub_message.yml

new generate script

2020-05-06 17:42:38 +02:00

gsuite_drive.yml

dev_ops_uc

2021-08-18 15:58:35 +02:00

gsuite_gmail.yml

dev_ops_uc

2021-08-18 15:58:35 +02:00

is_windows_system_file.yml

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

kube_objects_events.yml

k8s scanner

2021-08-25 10:49:51 +02:00

kubernetes_azure.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_container_controller.yml

new detection

2021-08-23 10:17:40 +02:00

linux_hosts.yml

duplicating files and experimental

2021-01-28 17:35:25 -08:00

netbackup.yml

new generate script

2020-05-06 17:42:38 +02:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

notable.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

o365_management_activity.yml

changes

2020-12-15 12:27:16 +01:00

okta.yml

new generate script

2020-05-06 17:42:38 +02:00

osquery_process.yml

duplicating files and experimental

2021-01-28 17:35:25 -08:00

powershell.yml

PowerShell 4104 copy of Security HIVES

2021-07-21 13:57:10 -06:00

previously_seen_cloud_api_calls_per_user_role_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_image_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_images_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_type_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_provisioning_activity_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_region_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_regions_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_windows_services_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_windows_services_window.yml

bug fix

2021-02-03 15:44:56 +01:00

previously_seen_zoom_child_processes_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_zoom_child_processes_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_unseen_cloud_provisioning_activity_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

printservice.yml

Added a Macro

2021-07-01 12:11:49 -06:00

process_esentutl.yml

Update process_esentutl.yml

2021-08-18 11:14:13 -06:00

prohibited_apps_launching_cmd.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_softwares.yml

fix_bugs

2020-12-11 10:51:02 +01:00

ransomware_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

s3_accesslogs.yml

validate script

2020-04-30 16:52:38 +02:00

security_content_ctime.yml

Present times in ISO8601 instead of US style

2020-08-12 23:45:53 +02:00

security_content_summariesonly.yml

this should be false

2020-06-09 17:58:39 -04:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

stream_dns.yml

porting ymls into a newe PR

2020-08-04 12:55:12 -07:00

stream_http.yml

new generate script

2020-05-06 17:42:38 +02:00

stream_tcp.yml

porting ymls into a newe PR

2020-08-04 12:55:12 -07:00

suspicious_email_attachments.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

changed macro

2020-11-05 09:18:37 +01:00

system_network_configuration_discovery_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wineventlog_security.yml

new generate script

2020-05-06 17:42:38 +02:00

wineventlog_system.yml

new generate script

2020-05-06 17:42:38 +02:00

wmi.yml

new generate script

2020-05-06 17:42:38 +02:00

zeek_rpc.yml

adding macros

2020-09-18 17:36:46 -04:00

zeek_ssl.yml

mods

2020-11-06 11:08:38 +11:00