security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,511 Commits 1 Branch 57 Tags
e91fc4486e57fc40e30d12253694de4c80a9e4ea
Commit Graph

568 Commits

Author SHA1 Message Date
Austin Songer 4d58194dab Update okta_user_account_mfa_bypass_attempt.yml 2021-09-12 19:41:38 -05:00
Austin Songer 30823b72b2 Update okta_policy_rule_modified_or_deleted.yml 2021-09-12 19:41:14 -05:00
Austin Songer 31ccf89dcc Update okta_network_zone_deactivated_or_deleted.yml 2021-09-12 19:41:00 -05:00
Austin Songer 08e79bb22e Update okta_application_modified_or_deleted.yml 2021-09-12 19:40:49 -05:00
Austin Songer 8b0756bd32 Create okta_unauthorized_access_to_app.yml 2021-09-12 19:39:24 -05:00
Austin Songer 8607af29e0 Create okta_user_account_lockout.yml 2021-09-12 19:35:19 -05:00
Austin Songer 12e5eeac9e Update okta_policy_modified_or_deleted.yml 2021-09-12 19:30:03 -05:00
Austin Songer 1af9120f37 Rename okta_account_mfa_reset.yml to okta_user_account_mfa_reset.yml 2021-09-12 19:25:11 -05:00
Austin Songer d5653cbfd0 Create okta_user_account_mfa_bypass_attempt.yml 2021-09-12 19:24:57 -05:00
Austin Songer c51e1db228 Create okta_network_zone_deactivated_or_deleted.yml 2021-09-12 19:22:15 -05:00
Austin Songer fefb856471 Create okta_account_mfa_reset.yml 2021-09-12 19:20:54 -05:00
Austin Songer 76d78c274a Create okta_policy_rule_modified_or_deleted.yml 2021-09-12 19:17:25 -05:00
Austin Songer ebd120a165 Create okta_application_modified_or_deleted.yml 2021-09-12 19:17:00 -05:00
Austin Songer 0d51178174 Create okta_policy_modified_or_deleted.yml 2021-09-12 19:13:15 -05:00
frack113 0288f5b626 fix condition operator case 2021-09-10 13:51:52 +02:00
Rachel Rice be5351947c Unset date update 
Signed-off-by: Rachel Rice <rachel.rice@lacework.net>
 2021-09-07 16:36:59 +01:00
Rachel Rice eef6e71e2e Update AWS Update Login Profile Rule fields 
Missed updating field from `responseElements.accessKey.userName` to `requestParameters.userName` on last update.
 2021-09-07 12:39:56 +01:00
Austin Songer 0de95e355a Update azure_federation_modified.yml 2021-09-06 11:31:52 -05:00
Austin Songer e6e3fc2eec Update azure_federation_modified.yml 2021-09-06 11:16:35 -05:00
Austin Songer 6025df63ee Create azure_federation_modified.yml 2021-09-06 11:06:58 -05:00
Austin Songer e7c5827776 Update azure_service_principal_removed.yml 2021-09-03 22:43:11 -05:00
Austin Songer 0612ea7f6e Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:42:26 -05:00
Austin Songer c420a17e05 Update azure_service_principal_removed.yml 2021-09-03 22:29:21 -05:00
Austin Songer fda1e3362e Update azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:29:12 -05:00
Austin Songer 9d26116d27 Update azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:29:02 -05:00
Austin Songer 8fe7bfc452 Update azure_application_deleted.yml 2021-09-03 22:28:53 -05:00
Austin Songer c021ae9e7c Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml 2021-09-03 22:28:35 -05:00
Austin Songer 6744fb7f2e Create azure_application_deleted.yml 2021-09-03 22:25:34 -05:00
Austin Songer 70ac0104cf Create azure_service_principal_removed.yml 2021-09-03 22:25:01 -05:00
Austin Songer 6e15618c75 Create azure_device_or_configuration_deleted.yml 2021-09-03 22:24:32 -05:00
Austin Songer b478132769 Create azure_owner_removed_from_application_or_service_principal.yml 2021-09-03 22:23:59 -05:00
Austin Songer c0bdc3fb1b Create azure_device_no_longer_managed_or_compliant.yml 2021-09-03 22:23:21 -05:00
frack113 89562273cc Merge pull request #1984 from austinsonger/azure_app_credential_modification.yml 
azure_app_credential_modification.yml
 2021-09-03 08:17:55 +02:00
frack113 88389f945d Merge pull request #1983 from austinsonger/azure_service_principal_created.yml 
azure_service_principal_created.yml
 2021-09-03 08:14:47 +02:00
frack113 d40cdec062 Merge pull request #1982 from austinsonger/azure_network_firewall_policy_modified_or_deleted.yml 
azure_network_firewall_policy_modified_or_deleted.yml
 2021-09-03 08:13:30 +02:00
frack113 bd1b4c0d70 Merge pull request #1978 from rachelrice/update_aws_login 
Update AWS Update Login Profile rule
 2021-09-03 08:12:28 +02:00
Austin Songer 775c0e8e7f Update azure_app_credential_modification.yml 2021-09-02 21:00:21 -05:00
Austin Songer 643ec0abe3 Update azure_service_principal_created.yml 2021-09-02 21:00:02 -05:00
Austin Songer 10af7bbdb1 Create azure_app_credential_modification.yml 2021-09-02 20:53:32 -05:00
Austin Songer d25fd420d6 Create azure_service_principal_created.yml 2021-09-02 20:48:35 -05:00
Austin Songer 1272c76ae7 Create azure_network_firewall_policy_modified_or_deleted.yml 2021-09-02 20:31:27 -05:00
Rachel Rice 78d3fa4795 Update AWS STS AssumeRole Misuse rule 
Update selection criteria for AWS STS AssumeRole Misuse rule for any event by an AssumedRole userIdentity.
Closes SigmaHQ/sigma#1963.
 2021-09-02 17:40:35 +01:00
Rachel Rice 7ccb773b20 Update AWS Update Login Profile rule 
Update selection criteria for AWS Update Login Profile rule to check for mismatch between userIdentity.arn and requestParameters.userName.
Closes SigmaHQ/sigma#1966.
 2021-09-02 17:37:41 +01:00
frack113 772fe06e10 fix Backend does not support map values of type <class 'bool'> (57) 2021-08-29 09:10:30 +02:00
frack113 0de795b0a2 Merge pull request #1936 from austinsonger/gworkspace_application_remove.yml 
add gworkspace_application_remove.yml
 2021-08-27 06:25:15 +02:00
frack113 00cceb7be8 Merge pull request #1935 from austinsonger/gworkspace_mfa_disabled.yml 
add gworkspace_mfa_disabled.yml
 2021-08-27 06:24:26 +02:00
Austin Songer 72485a5619 Update gworkspace_application_removed.yml 2021-08-26 21:16:21 -05:00
Austin Songer 62cefcc028 Rename gworkspace_application_remove.dyml to gworkspace_application_removed.yml 2021-08-26 21:15:56 -05:00
Austin Songer bc246ff59d Rename gworkspace_application_remove.yml to gworkspace_application_remove.dyml 2021-08-26 20:58:22 -05:00
Austin Songer 55f5ff3d89 Application Removed 2021-08-26 20:55:07 -05:00