Skip to content

Commit

Permalink
Branch was auto-updated.
Browse files Browse the repository at this point in the history
  • Loading branch information
srv-rr-gh-researchbt authored May 22, 2024
2 parents c6ecdd3 + 62f5b37 commit 2b63fad
Show file tree
Hide file tree
Showing 1,731 changed files with 18,944 additions and 11,532 deletions.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Ignore example files from contentctl tool
apps/
dist/
test_results/
detections/*/.yml.example
stories/*.yml.example
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service
service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services
append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`")
by service | where lastTimeSeen > relative_time(now(), `previously_seen_windows_services_forget_window`)
| outputlookup previously_seen_running_windows_services'
how_to_implement: While this search does not require you to adhere to Splunk CIM,
you must be ingesting your Windows security-event logs for it to execute successfully.
Expand Down
97 changes: 0 additions & 97 deletions bin/docker_detection_tester/README.md

This file was deleted.

6 changes: 0 additions & 6 deletions bin/docker_detection_tester/ansible/attack_replay.yml

This file was deleted.

This file was deleted.

This file was deleted.

4 changes: 0 additions & 4 deletions bin/docker_detection_tester/ansible/update_escu.yml

This file was deleted.

Binary file removed bin/docker_detection_tester/authorize.conf.tar
Binary file not shown.
Binary file removed bin/docker_detection_tester/datamodels.conf.tar
Binary file not shown.
Loading

0 comments on commit 2b63fad

Please sign in to comment.