Skip to content

Commit 3563fdd

Browse files
author
Patrick Bareiss
committed
Merge branch 'develop' into github_detections_improvement
2 parents d7171f0 + ec7fadd commit 3563fdd

File tree

911 files changed

+5189
-4034
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

911 files changed

+5189
-4034
lines changed

‎.github/labeler.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,8 @@ Lookups:
2222
Datasource:
2323
- changed-files:
2424
- any-glob-to-any-file: data_sources/*
25+
26+
Baselines:
27+
- changed-files:
28+
- any-glob-to-any-file: baselines/*
29+

‎.github/workflows/appinspect.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}"
3535
run: |
3636
echo $APPINSPECTUSERNAME
37-
contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments --enable-metadata-validation --suppress-missing-content-exceptions
37+
contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --enrichments --enable-metadata-validation --suppress-missing-content-exceptions
3838
echo "done appinspect"
3939
mkdir -p artifacts/app_inspect_report
4040
cp -r dist/*.html artifacts/app_inspect_report

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ Please use the [GitHub Issue Tracker](https://github.com/splunk/security_content
138138
If you have questions or need support, you can:
139139

140140
* Post a question to [Splunk Answers](http://answers.splunk.com)
141-
* Join the [#security-research](https://splunk-usergroups.slack.com/archives/C1S5BEF38) room in the [Splunk Slack channel](http://splunk-usergroups.slack.com)
141+
* Join the [#security-research](https://splunkcommunity.slack.com/archives/CDNHXVBGS) channel in the [Splunk Community Slack.](https://splk.it/slack)
142142

143143
## License
144144
Copyright 2022 Splunk Inc.

‎app_template/default/data/ui/views/feedback.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
<html>
77
<p5>You can contact the Splunk Threat Research team at<a href = "mailto:[email protected]">[email protected]</a> to send us support requests, bug reports, and questions.
88
<br>Specify the request type and the title of any related analytic stories, detections analytics where applicable.</br>
9-
You can also find us on the <b>#es-content-updates</b><a href = "http://splunk-usergroups.slack.com/"> Splunk Usergroups Slack channel.</a></p5>
9+
You can also find us on the <b>#es-content-updates</b><a href = "https://splk.it/slack/"> Splunk Community Slack channel.</a></p5>
1010
</html>
1111
</panel>
1212
</row>
13-
</form>
13+
</form>

‎contentctl.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,9 @@ apps:
7777
- uid: 5579
7878
title: Splunk Add-on for CrowdStrike FDR
7979
appid: Splunk_TA_CrowdStrike_FDR
80-
version: 2.0.3
80+
version: 2.0.4
8181
description: description of app
82-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_203.tgz
82+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_204.tgz
8383
- uid: 3185
8484
title: Splunk Add-on for Microsoft IIS
8585
appid: SPLUNK_TA_FOR_IIS

‎data_sources/aws_cloudtrail_consolelogin.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,13 +90,13 @@ fields:
9090
- vendor_product
9191
- vendor_region
9292
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "accountId":
93-
"140429656527", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"},
93+
"111111111111", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"},
9494
"eventTime": "2022-10-19T20:33:38Z", "eventSource": "signin.amazonaws.com", "eventName":
9595
"ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent":
9696
"Go-http-client/1.1", "errorMessage": "No username found in supplied account", "requestParameters":
9797
null, "responseElements": {"ConsoleLogin": "Failure"}, "additionalEventData": {"LoginTo":
9898
"https://console.aws.amazon.com", "MobileVersion": "No", "MFAUsed": "No"}, "eventID":
9999
"9fcfb8c3-3fca-48db-85d2-7b107f9d95d0", "readOnly": false, "eventType": "AwsConsoleSignIn",
100-
"managementEvent": true, "recipientAccountId": "140429656527", "eventCategory":
100+
"managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":
101101
"Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
102102
"clientProvidedHostHeader": "signin.aws.amazon.com"}}'

‎data_sources/aws_cloudtrail_createvirtualmfadevice.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,13 +88,13 @@ fields:
8888
- vendor_product
8989
- vendor_region
9090
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId":
91-
"140429656527", "arn": "arn:aws:iam::140429656527:root", "accountId": "140429656527",
91+
"1111111111111111", "arn": "arn:aws:iam::1111111111111111:root", "accountId": "1111111111111111",
9292
"accessKeyId": "ASIASBMSCQHH2YXNXJBU", "sessionContext": {"sessionIssuer": {}, "webIdFederationData":
9393
{}, "attributes": {"creationDate": "2023-01-30T22:59:36Z", "mfaAuthenticated": "false"}}},
9494
"eventTime": "2023-01-30T23:02:23Z", "eventSource": "iam.amazonaws.com", "eventName":
9595
"CreateVirtualMFADevice", "awsRegion": "us-east-1", "sourceIPAddress": "23.93.193.6",
9696
"userAgent": "AWS Internal", "requestParameters": {"path": "/", "virtualMFADeviceName":
97-
"strt_mfa_2"}, "responseElements": {"virtualMFADevice": {"serialNumber": "arn:aws:iam::140429656527:mfa/strt_mfa_2"}},
97+
"strt_mfa_2"}, "responseElements": {"virtualMFADevice": {"serialNumber": "arn:aws:iam::1111111111111111:mfa/strt_mfa_2"}},
9898
"requestID": "2fbe2074-55f8-4ec6-ad32-0b250803cf46", "eventID": "7e1c493d-c3c3-4f4a-ae4f-8cdd38970027",
9999
"readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId":
100-
"140429656527", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}'
100+
"1111111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}'

‎data_sources/aws_cloudtrail_describeeventaggregates.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ fields:
8484
- vendor_product
8585
- vendor_region
8686
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId":
87-
"140429656527", "arn": "arn:aws:iam::140429656527:root", "accountId": "140429656527",
87+
"1111111111111111", "arn": "arn:aws:iam::1111111111111111:root", "accountId": "1111111111111111",
8888
"accessKeyId": "ASIASBMSCQHHQQ6LB24V", "sessionContext": {"sessionIssuer": {}, "webIdFederationData":
8989
{}, "attributes": {"creationDate": "2023-01-31T21:58:17Z", "mfaAuthenticated": "true"}}},
9090
"eventTime": "2023-02-01T02:52:34Z", "eventSource": "health.amazonaws.com", "eventName":
@@ -93,5 +93,5 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "Root", "princip
9393
"filter": {"eventStatusCodes": ["open", "upcoming"], "startTimes": [{"from": "Jan
9494
25, 2023 2:54:32 AM"}]}}, "responseElements": null, "requestID": "d6adf050-1d7a-4c25-9d48-0319e33f6f9a",
9595
"eventID": "201cee69-61ab-4ffb-80b7-bd31e81e0d82", "readOnly": true, "eventType":
96-
"AwsApiCall", "managementEvent": true, "recipientAccountId": "140429656527", "eventCategory":
96+
"AwsApiCall", "managementEvent": true, "recipientAccountId": "1111111111111111", "eventCategory":
9797
"Management", "sessionCredentialFromConsole": "true"}'

‎data_sources/aws_cloudtrail_modifyimageattribute.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "
101101
"ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2",
102102
"sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters":
103103
{"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId":
104-
"140429656527"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId":
104+
"1111111111111111"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId":
105105
"84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055",
106106
"eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType":
107107
"AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":

‎data_sources/crowdstrike_processrollup2.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ separator: event_simpleName
1010
supported_TA:
1111
- name: Splunk Add-on for CrowdStrike FDR
1212
url: https://splunkbase.splunk.com/app/5579
13-
version: 2.0.3
13+
version: 2.0.4
1414
fields:
1515
- AuthenticationId
1616
- AuthenticationId_meaning

0 commit comments

Comments
 (0)