Branch was auto-updated.

splunk · May 22, 2024 · 2b63fad · 2b63fad
2 parents c6ecdd3 + 62f5b37
commit 2b63fad
Show file tree

Hide file tree

Showing 1,731 changed files with 18,944 additions and 11,532 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,6 @@
 # Ignore example files from contentctl tool
 apps/
+dist/
 test_results/
 detections/*/.yml.example
 stories/*.yml.example

diff --git a/baselines/previously_seen_running_windows_services___update.yml b/baselines/previously_seen_running_windows_services___update.yml
@@ -13,7 +13,7 @@ search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service
   service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time)
   as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services
   append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen
-  by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`")
+  by service | where lastTimeSeen > relative_time(now(), `previously_seen_windows_services_forget_window`)
   | outputlookup previously_seen_running_windows_services'
 how_to_implement: While this search does not require you to adhere to Splunk CIM,
   you must be ingesting your Windows security-event logs for it to execute successfully.

diff --git a/bin/docker_detection_tester/README.md b/bin/docker_detection_tester/README.md
diff --git a/bin/docker_detection_tester/ansible/attack_replay.yml b/bin/docker_detection_tester/ansible/attack_replay.yml
diff --git a/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml
diff --git a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml
diff --git a/bin/docker_detection_tester/ansible/update_escu.yml b/bin/docker_detection_tester/ansible/update_escu.yml
diff --git a/bin/docker_detection_tester/authorize.conf.tar b/bin/docker_detection_tester/authorize.conf.tar
diff --git a/bin/docker_detection_tester/datamodels.conf.tar b/bin/docker_detection_tester/datamodels.conf.tar