blue-team-tools

generic

Merge pull request #2148 from SigmaHQ/rule-devel

2021-10-21 19:10:08 +02:00

mitre

…

ala-azure-activitylogs.yml

Create ala-azure-activitylogs.yml

2021-07-08 20:40:03 +05:00

ala-azure-ad_auditlogs.yml

Create ala-azure-ad_auditlogs.yml

2021-07-08 20:40:39 +05:00

ala-azure-aws_cloudtrail.yml

Create ala-azure-aws_cloudtrail.yml

2021-07-15 21:51:41 +05:00

ala-suricata.yml

Create ala-suricata.yml

2021-07-16 23:08:03 +05:00

ala.yml

Add Azure Sentinel backend

2021-08-24 16:01:23 -04:00

arcsight-zeek.yml

feat: adapt logsources for field names without spaces

2021-10-13 14:36:10 +02:00

arcsight.yml

…

athena.yml

Correct for proper output to Splunk and CarbonBlack. Add AWS Athena config/backend support

2021-09-13 14:17:33 -05:00

carbon-black-eedr.yml

Merge pull request #2029 from marcurdy/master

2021-10-16 20:37:59 +02:00

carbon-black.yml

remove bad cb

2021-09-18 15:55:01 +02:00

chronicle.yml

Chronicle Security Backend contributed by SOC Prime.

2021-03-12 12:21:44 +02:00

crowdstrike.yml

removing duplicate mappings due to yamllint

2021-09-13 21:34:52 -05:00

devo-network.yml

master: Added new Devo backend for the sigmac tool. Added three new backend configurations to support the Devo backend. Added a new test suite to cover the Devo backend cases.

2021-06-21 14:06:04 +02:00

devo-web.yml

master: Added new Devo backend for the sigmac tool. Added three new backend configurations to support the Devo backend. Added a new test suite to cover the Devo backend cases.

2021-06-21 14:06:04 +02:00

devo-windows.yml

master: Added new Devo backend for the sigmac tool. Added three new backend configurations to support the Devo backend. Added a new test suite to cover the Devo backend cases.

2021-06-21 14:06:04 +02:00

ecs-auditbeat-modules-enabled.yml

Modify event.provider to event.module

2021-10-21 08:34:41 +02:00

ecs-auditd.yml

fix bad elasticsearch-rule

2021-09-18 15:54:08 +02:00

ecs-azure-activitylogs.yml

Create ecs-azure-activitylogs.yml

2021-07-08 20:37:12 +05:00

ecs-azure-ad_auditlogs.yml

Create ecs-azure-ad_auditlogs.yml

2021-07-08 20:39:05 +05:00

ecs-azure-ad_signinlogs.yml

Update ecs-azure-ad_signinlogs.yml

2021-09-24 19:33:01 -05:00

ecs-cloudtrail.yml

…

ecs-dns.yml

fix bad elasticsearch-rule

2021-09-18 15:54:08 +02:00

ecs-filebeat.yml

fix bad elasticsearch-rule

2021-09-18 15:54:08 +02:00

ecs-ms365_defender.yml

Create ecs-ms365_defender.yml

2021-09-24 20:02:39 -05:00

ecs-okta.yml

Update ecs-okta.yml

2021-09-14 01:52:03 -05:00

ecs-proxy.yml

feat: adapt logsources for field names without spaces

2021-10-13 14:36:10 +02:00

ecs-suricata.yml

Update ecs-suricata.yml

2021-07-17 04:55:46 +05:00

ecs-zeek-corelight.yml

feat: adapt logsources for field names without spaces

2021-10-13 14:36:10 +02:00

ecs-zeek-elastic-beats-implementation.yml

fix bad elasticsearch-rule

2021-09-18 15:54:08 +02:00

elk-defaultindex-filebeat.yml

…

elk-defaultindex-logstash.yml

…

elk-defaultindex.yml

…

elk-linux.yml

…

elk-windows.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

elk-winlogbeat-sp.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

elk-winlogbeat.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

filebeat-defaultindex.yml

…

fireeye-helix.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

helk.yml

…

humio.yml

feat: adapt logsources for field names without spaces

2021-10-13 14:36:10 +02:00

limacharlie.yml

…

logpoint-windows.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

logrhythm_winevent.yml

Add yamllint to GHA

2021-07-26 21:26:16 -04:00

logstash-defaultindex.yml

…

logstash-linux.yml

…

logstash-windows.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

logstash-zeek-default-json.yml

feat: adapt logsources for field names without spaces

2021-10-13 14:36:10 +02:00

netwitness-epl.yml

…

netwitness.yml

…

powershell.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

qradar.yml

…

qualys.yml

…

splunk-windows-index.yml

add splunkdm to Makefile

2021-07-10 22:23:15 +02:00

splunk-windows.yml

fix yml

2021-10-16 22:49:20 +02:00

splunk-zeek.yml

feat: adapt logsources for field names without spaces

2021-10-13 14:36:10 +02:00

stix2.0.yml

…

stix-custom.yml

…

stix-shifter.yml

…

sumologic-cse.yml

…

sumologic.yml

config: add PrintService Operational

2021-07-01 09:55:15 +02:00

thor.yml

fix: indentation

2021-07-22 10:18:03 +02:00

winlogbeat-modules-enabled.yml

Update winlogbeat-modules-enabled.yml

2021-10-20 17:06:55 +03:00

winlogbeat-old.yml

Set powershell_alternate_powershell_hosts.yml more accurate by adding the correct channel for EventID

2021-06-01 10:47:17 +02:00

winlogbeat.yml

Added support for threshold rules

2021-08-18 18:15:18 -07:00