Skip to content

Bump contentctl.yml to 5.22.0 #3894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patel-bhavin merged 5 commits into from
Feb 10, 2026
+3 −3
Merged

Bump contentctl.yml to 5.22.0 #3894

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a96dabe
chore: bump contentctl.yml to 5.22.0
Feb 5, 2026
81ca8c8
remove detections
patel-bhavin Feb 6, 2026
79d3269
Merge branch 'develop' into bump_contentctl_5.22.0
patel-bhavin Feb 6, 2026
0b4bcb2
Merge branch 'develop' into bump_contentctl_5.22.0
patel-bhavin Feb 9, 2026
57ccaa7
Merge branch 'develop' into bump_contentctl_5.22.0
ljstella Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion contentctl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ app:
uid: 3449
title: ES Content Updates
appid: DA-ESS-ContentUpdate
version: 5.21.0
version: 5.22.0
description: Explore the Analytic Stories included with ES Content Updates.
prefix: ESCU
label: ESCU
Expand Down
2 changes: 1 addition & 1 deletion .../deprecated/cobalt_strike_named_pipes.yml → .../detections/cobalt_strike_named_pipes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ id: 5876d429-0240-4709-8b93-ea8330b411b5
version: 13
date: '2025-12-04'
author: Michael Haag, Splunk
status: deprecated
status: removed
type: TTP
description: The following analytic detects the use of default or publicly known named
pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify
Expand Down
2 changes: 1 addition & 1 deletion ...cated/http_suspicious_tool_user_agent.yml → ...tions/http_suspicious_tool_user_agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ id: 1ca76190-4997-4d19-b5bc-9e220b70c7d3
version: 2
date: '2025-10-09'
author: Raven Tait, Splunk
status: deprecated
status: removed
type: Anomaly
description: This Splunk query analyzes web access logs to identify and categorize
non-browser user agents, detecting various types of security tools, scripting languages,
Expand Down