admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v5.3.0
splunk-security_content/detections/application
T
History
pyth0n1c 580a0873f2 Merge branch 'develop' into output_normalization_endpoint
2025-03-27 14:53:31 -07:00
..
cisco_ai_defense_security_alerts_by_application_name.yml
add back manual_test
2025-03-27 14:01:20 -07:00
cisco_secure_application_alerts.yml
manual test
2025-02-20 08:52:07 -08:00
crushftp_server_side_template_injection.yml
updating version
2025-01-21 14:34:51 -08:00
detect_distributed_password_spray_attempts.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_html_help_spawn_child_process.yml
update versions
2025-03-14 13:47:44 +01:00
detect_new_login_attempts_to_routers.yml
updating version
2025-01-21 14:34:51 -08:00
detect_password_spray_attempts.yml
update versions
2025-03-14 13:47:44 +01:00
email_attachments_with_lots_of_spaces.yml
notable to finding 2
2025-01-24 17:03:47 -08:00
email_files_written_outside_of_the_outlook_directory.yml
update versions
2025-03-14 13:47:44 +01:00
email_servers_sending_high_volume_traffic_to_hosts.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
ivanti_vtm_new_account_creation.yml
updating version
2025-01-21 14:34:51 -08:00
monitor_email_for_brand_abuse.yml
updating version
2025-01-21 14:34:51 -08:00
no_windows_updates_in_a_time_frame.yml
updating version
2025-01-21 14:34:51 -08:00
okta_authentication_failed_during_mfa_challenge.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
okta_idp_lifecycle_modifications.yml
updating version
2025-01-21 14:34:51 -08:00
okta_mfa_exhaustion_hunt.yml
updating version
2025-01-21 14:34:51 -08:00
okta_mismatch_between_source_and_response_for_verify_push_request.yml
all but one fixes
2025-01-23 09:56:40 -08:00
okta_multi_factor_authentication_disabled.yml
update versions
2025-03-14 13:47:44 +01:00
okta_multiple_accounts_locked_out.yml
update versions
2025-03-14 13:47:44 +01:00
okta_multiple_failed_mfa_requests_for_user.yml
update versions
2025-03-14 13:47:44 +01:00
okta_multiple_failed_requests_to_access_applications.yml
updating version
2025-01-21 14:34:51 -08:00
okta_multiple_users_failing_to_authenticate_from_ip.yml
update versions
2025-03-14 13:47:44 +01:00
okta_new_api_token_created.yml
update versions
2025-03-14 13:47:44 +01:00
okta_new_device_enrolled_on_account.yml
update versions
2025-03-14 13:47:44 +01:00
okta_phishing_detection_with_fastpass_origin_check.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
okta_risk_threshold_exceeded.yml
notable to finding 2
2025-01-24 17:03:47 -08:00
okta_successful_single_factor_authentication.yml
update versions
2025-03-14 13:47:44 +01:00
okta_suspicious_activity_reported.yml
update versions
2025-03-14 13:47:44 +01:00
okta_suspicious_use_of_a_session_cookie.yml
update versions
2025-03-14 13:47:44 +01:00
okta_threatinsight_threat_detected.yml
update versions
2025-03-14 13:47:44 +01:00
okta_unauthorized_access_to_application.yml
update versions
2025-03-14 13:47:44 +01:00
okta_user_logins_from_multiple_cities.yml
updating version
2025-01-21 14:34:51 -08:00
pingid_mismatch_auth_source_and_verification_response.yml
updating versions
2025-02-05 10:49:03 -08:00
pingid_multiple_failed_mfa_requests_for_user.yml
updating version
2025-01-21 14:34:51 -08:00
pingid_new_mfa_method_after_credential_reset.yml
updating version
2025-01-21 14:34:51 -08:00
pingid_new_mfa_method_registered_for_user.yml
updating version
2025-01-21 14:34:51 -08:00
suspicious_email_attachment_extensions.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
suspicious_java_classes.yml
updating version
2025-01-21 14:34:51 -08:00