Code

RBA Migration#3204

Code

Merged

patel-bhavin merged 180 commits intodevelopsplunk/security_content:developfrom rba_migrationsplunk/security_content:rba_migrationCopy head branch name to clipboardJan 21, 2025

+60,272-50,691

Commits

Commits on Nov 13, 2024

• Application detections

  ljstella

  committed
  a0a94f3

  Copy full SHA for a0a94f3

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  4daecb5

  Copy full SHA for 4daecb5

Commits on Nov 14, 2024

• Branch was auto-updated.

  patel-bhavin

  authored
  25523a7

  Copy full SHA for 25523a7

• Branch was auto-updated.

  patel-bhavin

  authored
  c88e375

  Copy full SHA for c88e375

• Branch was auto-updated.

  patel-bhavin

  authored
  b2ac6bd

  Copy full SHA for b2ac6bd

• endpoint first pass

  ljstella

  committed
  92cc97a

  Copy full SHA for 92cc97a

• cloud detections initial translation

  ljstella

  committed
  318311f

  Copy full SHA for 318311f

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  b901a04

  Copy full SHA for b901a04

• Deprecated Detections initial translation

  ljstella

  committed
  6089391

  Copy full SHA for 6089391

Commits on Nov 15, 2024

• network detections initial translation

  ljstella

  committed
  f6587bd

  Copy full SHA for f6587bd

• web detections initial translation

  ljstella

  committed
  c218c03

  Copy full SHA for c218c03

• endpoint detection score fix

  ljstella

  committed
  f88eb16

  Copy full SHA for f88eb16

• cloud detection score fix

  ljstella

  committed
  3b43f75

  Copy full SHA for 3b43f75

• deprecated detection score fix

  ljstella

  committed
  33574d7

  Copy full SHA for 33574d7

• network detections score fix

  ljstella

  committed
  6792bcc

  Copy full SHA for 6792bcc

• web detections score fix

  ljstella

  committed
  c4eb58c

  Copy full SHA for c4eb58c

• application detections score fix

  ljstella

  committed
  c6739f2

  Copy full SHA for c6739f2

• Application detection score field rename

  ljstella

  committed
  d4a93b0

  Copy full SHA for d4a93b0

• endpoint detection score field rename

  ljstella

  committed
  5141230

  Copy full SHA for 5141230

• web detection score field rename

  ljstella

  committed
  a33df66

  Copy full SHA for a33df66

• cloud detection score field rename

  ljstella

  committed
  77e5b9b

  Copy full SHA for 77e5b9b

• deprecated detection score field rename

  ljstella

  committed
  5c299c7

  Copy full SHA for 5c299c7

• network detection score field rename

  ljstella

  committed
  17b942b

  Copy full SHA for 17b942b

• missing types

  ljstella

  committed
  e88b279

  Copy full SHA for e88b279

• endpoint: lowercase rba types

  ljstella

  committed
  c9186e0

  Copy full SHA for c9186e0

• web: lowercase rba types

  ljstella

  committed
  6384bea

  Copy full SHA for 6384bea

• cloud: lowercase rba types

  ljstella

  committed
  a27edb3

  Copy full SHA for a27edb3

• network: lowercase rba types

  ljstella

  committed
  ddbaa75

  Copy full SHA for ddbaa75

• deprecated: lowercase rba types

  ljstella

  committed
  b554c8d

  Copy full SHA for b554c8d

• application: lowercase rba types

  ljstella

  committed
  92ab1d5

  Copy full SHA for 92ab1d5

• web: ip address typefix

  ljstella

  committed
  ce696ff

  Copy full SHA for ce696ff

• endpoint: ip address typefix

  ljstella

  committed
  19a96c0

  Copy full SHA for 19a96c0

• deprecated: ip address typefix

  ljstella

  committed
  e21906f

  Copy full SHA for e21906f

• cloud: ip address typefix

  ljstella

  committed
  bf5d4c1

  Copy full SHA for bf5d4c1

• application: ip address typefix

  ljstella

  committed
  e902ee2

  Copy full SHA for e902ee2

• network: ip address typefix

  ljstella

  committed
  8b73d42

  Copy full SHA for 8b73d42

• application: more typefixes

  ljstella

  committed
  18a44d5

  Copy full SHA for 18a44d5

• endpoint: more typefixes

  ljstella

  committed
  bc14854

  Copy full SHA for bc14854

• cloud: more typefixes

  ljstella

  committed
  d8616d2

  Copy full SHA for d8616d2

• deprecated: more typefixes

  ljstella

  committed
  4b5f5a9

  Copy full SHA for 4b5f5a9

• network: more typefixes

  ljstella

  committed
  f15bde0

  Copy full SHA for f15bde0

• web: more typefixes

  ljstella

  committed
  393c038

  Copy full SHA for 393c038

• artifact of cleanup

  ljstella

  committed
  4369125

  Copy full SHA for 4369125

• application: more typefixes

  ljstella

  committed
  9225593

  Copy full SHA for 9225593

• cloud: more typefixes

  ljstella

  committed
  e3fb34c

  Copy full SHA for e3fb34c

• deprecated: more typefixes

  ljstella

  committed
  911bfd0

  Copy full SHA for 911bfd0

• endpoint: more typefixes

  ljstella

  committed
  8f18a20

  Copy full SHA for 8f18a20

• network: more typefixes

  ljstella

  committed
  1051b93

  Copy full SHA for 1051b93

• web: more typefixes

  ljstella

  committed
  4a3bc66

  Copy full SHA for 4a3bc66

• web: remove rba from hunting

  ljstella

  committed
  8d7aabc

  Copy full SHA for 8d7aabc

• endpoint: remove rba from hunting

  ljstella

  committed
  189cc59

  Copy full SHA for 189cc59

• application: remove rba from hunting

  ljstella

  committed
  c3f94b6

  Copy full SHA for c3f94b6

• cloud: remove rba from hunting

  ljstella

  committed
  91e76c6

  Copy full SHA for 91e76c6

• deprecated: remove rba from hunting

  ljstella

  committed
  9811512

  Copy full SHA for 9811512

• network: remove rba from hunting

  ljstella

  committed
  2f98865

  Copy full SHA for 2f98865

• Cleanup rba

  ljstella

  committed
  1af44a3

  Copy full SHA for 1af44a3

• cloud: more cleanup

  ljstella

  committed
  8b6e0cf

  Copy full SHA for 8b6e0cf

• endpoint: more cleanup

  ljstella

  committed
  5e9af4f

  Copy full SHA for 5e9af4f

• web: more cleanup

  ljstella

  committed
  dfd645f

  Copy full SHA for dfd645f

• application: remove rba config from correlations

  ljstella

  committed
  26e4c85

  Copy full SHA for 26e4c85

• cloud: remove rba config from correlations

  ljstella

  committed
  9398d80

  Copy full SHA for 9398d80

• deprecated: remove rba config from correlations

  ljstella

  committed
  a5850dd

  Copy full SHA for a5850dd

• endpoint: remove rba config from correlations

  ljstella

  committed
  8b2b6bf

  Copy full SHA for 8b2b6bf

• web: remove rba config from correlations

  ljstella

  committed
  b600be3

  Copy full SHA for b600be3

• application: threat object type cleanup

  ljstella

  committed
  67dec1e

  Copy full SHA for 67dec1e

• cloud: threat object type cleanup

  ljstella

  committed
  6805f6d

  Copy full SHA for 6805f6d

• deprecated: threat object type cleanup

  ljstella

  committed
  5d8524d

  Copy full SHA for 5d8524d

• endpoint: threat object type cleanup

  ljstella

  committed
  eb9dfba

  Copy full SHA for eb9dfba

• network: threat object type cleanup

  ljstella

  committed
  4722d10

  Copy full SHA for 4722d10

• web: threat object type cleanup

  ljstella

  committed
  e0718d1

  Copy full SHA for e0718d1

• stragglers cleanup

  ljstella

  committed
  801b8c3

  Copy full SHA for 801b8c3

Commits on Nov 22, 2024

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  88fd263

  Copy full SHA for 88fd263

Commits on Nov 25, 2024

• Updates with develop

  ljstella

  committed
  8014132

  Copy full SHA for 8014132

Commits on Nov 27, 2024

• application: cleanup tbd messages

  ljstella

  committed
  9f14118

  Copy full SHA for 9f14118

• Cloud: cleanup tbd messages

  ljstella

  committed
  33d6fd9

  Copy full SHA for 33d6fd9

• Endpoint: cleanup TBD messages

  ljstella

  committed
  85628e2

  Copy full SHA for 85628e2

• network: cleanup tbd messages

  ljstella

  committed
  67ad9f5

  Copy full SHA for 67ad9f5

• web: cleanup TBD messages

  ljstella

  committed
  9ab5e6a

  Copy full SHA for 9ab5e6a

• deprecated: cleanup TBD messages

  ljstella

  committed
  d2edfa4

  Copy full SHA for d2edfa4

• cloud: cleanup of risk object type other

  ljstella

  committed
  606f42a

  Copy full SHA for 606f42a

• endpoint: cleanup of risk object type other

  ljstella

  committed
  78f39ca

  Copy full SHA for 78f39ca

• cloud: missed one

  ljstella

  committed
  99f9c99

  Copy full SHA for 99f9c99

Commits on Dec 2, 2024

• Branch was auto-updated.

  patel-bhavin

  authored
  46f4e1e

  Copy full SHA for 46f4e1e

• Branch was auto-updated.

  patel-bhavin

  authored
  c7bac21

  Copy full SHA for c7bac21

Commits on Dec 10, 2024

• Merge branch 'develop' into rba_migration

  ljstella

  committed
  6357f18

  Copy full SHA for 6357f18

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  6bc9c2a

  Copy full SHA for 6bc9c2a

• rba conversion

  ljstella

  committed
  3a965a7

  Copy full SHA for 3a965a7

• Branch was auto-updated.

  patel-bhavin

  authored
  14edbda

  Copy full SHA for 14edbda

• small grammar fix

  ljstella

  committed
  d30e04f

  Copy full SHA for d30e04f

Commits on Dec 11, 2024

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  8fefa90

  Copy full SHA for 8fefa90

Commits on Dec 16, 2024

• Branch was auto-updated.

  patel-bhavin

  authored
  ebd4437

  Copy full SHA for ebd4437

• Rename to A&I compatible user field

  ljstella

  committed
  357eb89

  Copy full SHA for 357eb89

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  5adad84

  Copy full SHA for 5adad84

• Merge branch 'develop' into rba_migration

  ljstella

  committed
  51d034c

  Copy full SHA for 51d034c

• Merge branch 'develop' into rba_migration

  ljstella

  committed
  d5328df

  Copy full SHA for d5328df

Commits on Dec 19, 2024

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  0e2e844

  Copy full SHA for 0e2e844

Commits on Dec 23, 2024

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  e1dde45

  Copy full SHA for e1dde45

• first batch of updates to

  Show description for 8b1b3d5
  pyth0n1c

  committed
  8b1b3d5

  Copy full SHA for 8b1b3d5

• Second round of lookup file cleanup

  pyth0n1c

  committed
  27c9cb5

  Copy full SHA for 27c9cb5

• another round of lookup file updates

  pyth0n1c

  committed
  32da5d2

  Copy full SHA for 32da5d2

Commits on Dec 24, 2024

• More cleanup of lookups

  pyth0n1c

  committed
  32fb17c

  Copy full SHA for 32fb17c

Commits on Jan 3, 2025

• more cleanup of lookups to follow new format.

  Show description for 29b2332
  pyth0n1c

  committed
  29b2332

  Copy full SHA for 29b2332

• finish lookup cleanup

  pyth0n1c

  committed
  f4b6770

  Copy full SHA for f4b6770

• removes types from stories

  pyth0n1c

  committed
  79f11c3

  Copy full SHA for 79f11c3

• remove extra fields from baselines and investigations

  pyth0n1c

  committed
  c1b0b64

  Copy full SHA for c1b0b64

• Branch was auto-updated.

  patel-bhavin

  authored
  9c8a019

  Copy full SHA for 9c8a019

• remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

  pyth0n1c

  committed
  8b4ca42

  Copy full SHA for 8b4ca42

• Merge branch 'rba_migration' into strict_yml_from_rba

  pyth0n1c

  committed
  0706bfd

  Copy full SHA for 0706bfd

• Branch was auto-updated.

  patel-bhavin

  authored
  acbe468

  Copy full SHA for acbe468

• remove update_timestamps, confidence, impact,

  Show description for d1442c2
  pyth0n1c

  committed
  d1442c2

  Copy full SHA for d1442c2

• Finish removing extra fields, or renaming

  Show description for fdaa038
  pyth0n1c

  committed
  fdaa038

  Copy full SHA for fdaa038

Commits on Jan 4, 2025

• progress on input/output lookup

  Show description for 3b8e769
  pyth0n1c

  committed
  3b8e769

  Copy full SHA for 3b8e769

Commits on Jan 7, 2025

• Stragglers migration

  ljstella

  committed
  9fb7b90

  Copy full SHA for 9fb7b90

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  f49899a

  Copy full SHA for f49899a

Commits on Jan 8, 2025

• Branch was auto-updated.

  patel-bhavin

  authored
  0e6251e

  Copy full SHA for 0e6251e

Commits on Jan 9, 2025

• Branch was auto-updated.

  patel-bhavin

  authored
  6f3c999

  Copy full SHA for 6f3c999

• Merge branch 'rba_migration' into strict_yml_from_rba

  pyth0n1c

  committed
  3756602

  Copy full SHA for 3756602

• More stragglers

  ljstella

  committed
  ad772ee

  Copy full SHA for ad772ee

• Branch was auto-updated.

  patel-bhavin

  authored
  b9b7a16

  Copy full SHA for b9b7a16

• remove confidence impact message

  pyth0n1c

  committed
  1c4c7bd

  Copy full SHA for 1c4c7bd

• Merge branch 'rba_migration' into strict_yml_from_rba

  pyth0n1c

  committed
  5aafb26

  Copy full SHA for 5aafb26

• Merge branch 'strict_yml_from_rba' of https://github.com/splunk/security_content into strict_yml_from_rba

  pyth0n1c

  committed
  e7d4e0b

  Copy full SHA for e7d4e0b

• Branch was auto-updated.

  patel-bhavin

  authored
  83ecc74

  Copy full SHA for 83ecc74

• Branch was auto-updated.

  patel-bhavin

  authored
  0625624

  Copy full SHA for 0625624

Commits on Jan 10, 2025

• Branch was auto-updated.

  patel-bhavin

  authored
  db1e1bb

  Copy full SHA for db1e1bb

• Branch was auto-updated.

  patel-bhavin

  authored
  963f94f

  Copy full SHA for 963f94f

• New detection conversion

  ljstella

  committed
  6f56a46

  Copy full SHA for 6f56a46

• Branch was auto-updated.

  patel-bhavin

  authored
  5efd265

  Copy full SHA for 5efd265

Commits on Jan 11, 2025

• Merge branch 'rba_migration' into strict_yml_from_rba

  pyth0n1c

  committed
  a642239

  Copy full SHA for a642239

Commits on Jan 14, 2025

• remove extra fields

  pyth0n1c

  committed
  926ca49

  Copy full SHA for 926ca49

• Merge branch 'strict_yml_from_rba' of https://github.com/splunk/security_content into strict_yml_from_rba

  pyth0n1c

  committed
  05f7a6e

  Copy full SHA for 05f7a6e

Commits on Jan 15, 2025

• Uploading new detections

  

  dluxtron

  authored and

  ljstella

  committed
  a0a7dc4

  Copy full SHA for a0a7dc4

• Uploading new detections

  

  dluxtron

  authored and

  ljstella

  committed
  4761a49

  Copy full SHA for 4761a49

• Adding intune detections & updating dataset links

  

  dluxtron

  authored and

  ljstella

  committed
  5ba40b3

  Copy full SHA for 5ba40b3

• fixing syntax & updating macro

  

  dluxtron

  authored and

  ljstella

  committed
  0282aff

  Copy full SHA for 0282aff

• fixing up yamls for testing

  

  patel-bhavin

  authored and

  ljstella

  committed
  71e6dd7

  Copy full SHA for 71e6dd7

• updating risk

  

  patel-bhavin

  authored and

  ljstella

  committed
  dc1672d

  Copy full SHA for dc1672d

• updating macro

  

  patel-bhavin

  authored and

  ljstella

  committed
  dbc1780

  Copy full SHA for dbc1780

• udpating SPL

  

  patel-bhavin

  authored and

  ljstella

  committed
  e06b07f

  Copy full SHA for e06b07f

• reverting macro change

  

  dluxtron

  authored and

  ljstella

  committed
  37f2760

  Copy full SHA for 37f2760

• Update o365_service_principal_privilege_escalation.yml

  

  patel-bhavin

  authored and

  ljstella

  committed
  e013fd8

  Copy full SHA for e013fd8

• updating data sources

  

  patel-bhavin

  authored and

  ljstella

  committed
  437368d

  Copy full SHA for 437368d

• Improved ASL AWS detections

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  56074f2

  Copy full SHA for 56074f2

• bug fixes

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  f727062

  Copy full SHA for f727062

• bug fixes

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  22c3c2d

  Copy full SHA for 22c3c2d

• new asl aws detections

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  ebca301

  Copy full SHA for ebca301

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  8921fd9

  Copy full SHA for 8921fd9

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  a639044

  Copy full SHA for a639044

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  5ae468d

  Copy full SHA for 5ae468d

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  a304f41

  Copy full SHA for a304f41

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  39f28ef

  Copy full SHA for 39f28ef

• bug fix improvements

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  7d061fa

  Copy full SHA for 7d061fa

• updates

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  d3e1be0

  Copy full SHA for d3e1be0

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  d3b40ac

  Copy full SHA for d3b40ac

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  b3a7ff3

  Copy full SHA for b3a7ff3

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  009ca3b

  Copy full SHA for 009ca3b

• new detection

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  d7b526d

  Copy full SHA for d7b526d

• new detection

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  bde1c9d

  Copy full SHA for bde1c9d

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  253c463

  Copy full SHA for 253c463

• new detection

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  2f0c371

  Copy full SHA for 2f0c371

• new detection

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  3786451

  Copy full SHA for 3786451

• bug fix

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  e937232

  Copy full SHA for e937232

• new detection

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  22e401a

  Copy full SHA for 22e401a

• new detections

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  8e0b643

  Copy full SHA for 8e0b643

• change

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  37ec540

  Copy full SHA for 37ec540

• improvements

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  633655d

  Copy full SHA for 633655d

• minor udpates to yaml

  

  patel-bhavin

  authored and

  ljstella

  committed
  2b63765

  Copy full SHA for 2b63765

• Add ASL AWS CloudTrail data source

  

  Patrick Bareiss

  authored and

  ljstella

  committed
  a7d061c

  Copy full SHA for a7d061c

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  9c5b3aa

  Copy full SHA for 9c5b3aa

• Merge branch 'rba_migration' into strict_yml_from_rba

  ljstella

  authored
  1d086b4

  Copy full SHA for 1d086b4

• More migrations: AWS, Azure, O365

  ljstella

  committed
  70861d2

  Copy full SHA for 70861d2

• Branch was auto-updated.

  patel-bhavin

  authored
  9ee2e1d

  Copy full SHA for 9ee2e1d

• Removal of fields from new detections

  ljstella

  committed
  ef2ac2a

  Copy full SHA for ef2ac2a

Commits on Jan 16, 2025

• Merge branch 'develop' into rba_migration

  ljstella

  authored
  8894f2d

  Copy full SHA for 8894f2d

• Fix more errors with missing lookups, baselines, and detections

  pyth0n1c

  committed
  5b6f8ea

  Copy full SHA for 5b6f8ea

• Merge pull request #3269 from splunk/strict_yml_from_rba

  Show description for e526990
  ljstella

  authored
  e526990

  Copy full SHA for e526990

• fix baseline which referenced lookups

  Show description for b49a76d
  pyth0n1c

  committed
  b49a76d

  Copy full SHA for b49a76d

Commits on Jan 18, 2025

• empty commit

  patel-bhavin

  committed
  fc2b5d4

  Copy full SHA for fc2b5d4

• specify ctl version

  patel-bhavin

  committed
  d2726d6

  Copy full SHA for d2726d6

Commits on Jan 21, 2025

• bump to alpha2

  patel-bhavin

  committed
  8bf0425

  Copy full SHA for 8bf0425