Skip to content

Commit 6c5446c

Browse files
patel-bhavingowthamarajr
patel-bhavin
authored and
gowthamarajr
committed
Release Branch - ESCU v4.32.0
1 parent 1a5f83d commit 6c5446c

File tree

1,891 files changed

+18258
-225170
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,891 files changed

+18258
-225170
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Ignore example files from contentctl tool
22
apps/
3+
dist/
34
test_results/
45
detections/*/.yml.example
56
stories/*.yml.example

‎baselines/previously_seen_running_windows_services___update.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service
1313
service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
1414
as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services
1515
append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
16-
by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`")
16+
by service | where lastTimeSeen > relative_time(now(), `previously_seen_windows_services_forget_window`)
1717
| outputlookup previously_seen_running_windows_services'
1818
how_to_implement: While this search does not require you to adhere to Splunk CIM,
1919
you must be ingesting your Windows security-event logs for it to execute successfully.

‎bin/docker_detection_tester/README.md

Lines changed: 0 additions & 97 deletions
This file was deleted.

‎bin/docker_detection_tester/ansible/attack_replay.yml

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎bin/docker_detection_tester/ansible/update_escu.yml

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎bin/docker_detection_tester/authorize.conf.tar

-2 KB
Binary file not shown.

‎bin/docker_detection_tester/datamodels.conf.tar

-11.5 KB
Binary file not shown.

0 commit comments

Comments
 (0)