Skip to content

Automated Splunk TA Update 604 #4020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
patel-bhavin wants to merge 1 commit into from
Closed

Automated Splunk TA Update 604 #4020

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions contentctl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,9 @@ apps:
- uid: 7404
title: Cisco Security Cloud
appid: CiscoSecurityCloud
version: 3.6.3
version: 3.6.4
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_363.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_364.tgz
- uid: 6652
title: Add-on for Linux Sysmon
appid: Splunk_TA_linux_sysmon
Expand All @@ -65,9 +65,9 @@ apps:
- uid: 742
title: Splunk Add-on for Microsoft Windows
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS
version: 9.1.2
version: 10.0.0
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-windows_912.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-windows_1000.tgz
- uid: 5709
title: Splunk Add-on for Sysmon
appid: Splunk_TA_microsoft_sysmon
Expand Down Expand Up @@ -161,15 +161,15 @@ apps:
- uid: 3110
title: Splunk Add-on for Microsoft Cloud Services
appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
version: 6.1.0
version: 6.1.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_610.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_611.tgz
- uid: 4055
title: Splunk Add-on for Microsoft Office 365
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
version: 5.1.0
version: 6.0.1
description: description of app
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_510.tgz
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-office-365_601.tgz
- uid: 5518
title: Splunk add on for Microsoft Defender Advanced Hunting
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_DEFENDER_ADVANCED_HUNTING
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
output_fields:
- dest
- user
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: Add app role assignment to service principal
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_add_member_to_role.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: Add member to role
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_add_owner_to_application.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: Add owner to application
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_add_service_principal.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: Add service principal
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_add_unverified_domain.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ separator_value: Add unverified domain
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_consent_to_application.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: Consent to application
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_disable_strong_authentication.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_enable_account.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: Enable account
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_invite_external_user.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Invite external user
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_microsoftgraphactivitylogs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM",
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_noninteractiveusersigninlogs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- action
- additional_details
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_reset_password_(by_admin).yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Reset password (by admin)
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_set_domain_authentication.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Set domain authentication
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_sign_in_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Sign-in activity
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_update_application.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Update application
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_update_authorization_policy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: Update authorization policy
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_update_user.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ separator_value: Update user
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_active_directory_user_registered_security_info.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: User registered security info
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- Level
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_audit_create_or_update_an_azure_automation_account.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation account
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- authorization.action
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- authorization.action
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation webhook
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- _time
- authorization.action
Expand Down
2 changes: 1 addition & 1 deletion data_sources/azure_monitor_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ separator: operationName
supported_TA:
- name: Splunk Add-on for Microsoft Cloud Services
url: https://splunkbase.splunk.com/app/3110
version: 6.1.0
version: 6.1.1
fields:
- column
- action
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_ai_defense_alerts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,5 @@ separator: null
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields: null
2 changes: 1 addition & 1 deletion data_sources/cisco_asa_logs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ separator: null
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- Cisco_ASA_action
- Cisco_ASA_message_id
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_duo_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: null
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- access_device.browser
- access_device.browser_version
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_duo_administrator.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: null
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- action
- actionlabel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_isovalent_process_connect.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ sourcetype: cisco:isovalent:processConnect
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- _time
- app
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_isovalent_process_exec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- _time
- cluster_name
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_isovalent_process_kprobe.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ sourcetype: cisco:isovalent
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- _time
- app
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_secure_firewall_threat_defense_connection_event.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- AC_RuleAction
- action
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_secure_firewall_threat_defense_file_event.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- app
- Application
Expand Down
2 changes: 1 addition & 1 deletion data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
supported_TA:
- name: Cisco Security Cloud
url: https://splunkbase.splunk.com/app/7404
version: 3.6.3
version: 3.6.4
fields:
- Application
- Classification
Expand Down
2 changes: 1 addition & 1 deletion data_sources/m365_copilot_graph_api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ sourcetype: o365:graph:api
supported_TA:
- name: Splunk Add-on for Microsoft Office 365
url: https://splunkbase.splunk.com/app/4055
version: 5.1.0
version: 6.0.1
fields:
- appDisplayName
- appId
Expand Down
2 changes: 1 addition & 1 deletion data_sources/ntlm_operational_8004.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 9.1.2
version: 10.0.0
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/ntlm_operational_8005.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 9.1.2
version: 10.0.0
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/ntlm_operational_8006.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 9.1.2
version: 10.0.0
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/o365.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,4 @@ separator: Operation
supported_TA:
- name: Splunk Add-on for Microsoft Office 365
url: https://splunkbase.splunk.com/app/4055
version: 5.1.0
version: 6.0.1
2 changes: 1 addition & 1 deletion data_sources/o365_add_app_role_assignment_grant_to_user_.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user.
supported_TA:
- name: Splunk Add-on for Microsoft Office 365
url: https://splunkbase.splunk.com/app/4055
version: 5.1.0
version: 6.0.1
fields:
- _time
- ActorContextId
Expand Down
2 changes: 1 addition & 1 deletion data_sources/o365_add_app_role_assignment_to_service_principal_.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: Add app role assignment to service principal.
supported_TA:
- name: Splunk Add-on for Microsoft Office 365
url: https://splunkbase.splunk.com/app/4055
version: 5.1.0
version: 6.0.1
fields:
- _time
- ActorContextId
Expand Down
Loading