Commits

Branch selector

 master

User selector

All users

All time

Commit History

Commits on May 31, 2021

• v3.1.2 which is Splunk 8.2+ compatible and includes various improvements.

  

  Trusted Subject

  committed
  bc82b56

  Copy full SHA for bc82b56

Commits on May 30, 2021

• Merge branch 'master' of https://github.com/doksu/splunk_auditd

  

  Trusted Subject

  committed
  cceeaa6

  Copy full SHA for cceeaa6

• removal of app.manifest

  

  Trusted Subject

  committed
  dcb5736

  Copy full SHA for dcb5736

Commits on Nov 19, 2019

• Merge pull request #27 from rafadvega/patch-1

  Show description for 7d4cb28
  doksu

  authored
  7d4cb28

  Copy full SHA for 7d4cb28

Commits on Nov 13, 2019

• Proctitle space encode correction Added

  rafadvega

  authored
  3dfe044

  Copy full SHA for 3dfe044

Commits on Oct 17, 2019

• Version 3.1.0 - MITRE ATT&CK and SOFTWARE_UPDATE event support

  

  Trusted Subject

  committed
  0e3bd83

  Copy full SHA for 0e3bd83

Commits on Jul 19, 2019

• Auditd data model updated to include key field and changed user field from a lookup to extracted to also support linux:audit:enriched events.

  

  Trusted Subject

  committed
  cc041de

  Copy full SHA for cc041de

Commits on Oct 14, 2018

• Updated linux-auditd/app.manifest to indicate v3.0.1

  

  Trusted Subject

  committed
  31b4719

  Copy full SHA for 31b4719

• Version 3.0.1

  

  Trusted Subject

  committed
  87ea65f

  Copy full SHA for 87ea65f

• Fixing renames in SOC dashboard's Anomalous Event Volume single value pane.

  

  Trusted Subject

  committed
  9425aa2

  Copy full SHA for 9425aa2

Commits on Oct 1, 2018

• Removed unnecessary path TA-linux_auditd/default/data/ui/nav/ and contents.

  

  Trusted Subject

  committed
  3b5b3c2

  Copy full SHA for 3b5b3c2

• Removed incompatible apps section from linux-auditd/app.manifest as correct format is unknown.

  

  Trusted Subject

  committed
  393a520

  Copy full SHA for 393a520

• Fixing unused capture groups in transform regexes found by AppInspect.

  

  Trusted Subject

  committed
  0b7609b

  Copy full SHA for 0b7609b

• Added posix_identities lookup dummy csv to meet AppInspect requirements.

  

  Trusted Subject

  committed
  3b58be6

  Copy full SHA for 3b58be6

• Rename auditd indices lookup.

  

  Trusted Subject

  committed
  c622d58

  Copy full SHA for c622d58

Commits on Sep 30, 2018

• Renamed syscalls.csv to arch_syscalls.csv to match name in transform.

  

  Trusted Subject

  committed
  b6a2966

  Copy full SHA for b6a2966

• Added linux_audit_enriched transform for dynamically sourcetyping enriched events generated by auditd which require sourcetyping.

  

  Trusted Subject

  committed
  5abafd5

  Copy full SHA for 5abafd5

• Removed commented out prop for syslogged audit events and will put into documentation.

  

  Trusted Subject

  committed
  85e3201

  Copy full SHA for 85e3201

• Improved description of enriched sourcetype in props.conf.

  

  Trusted Subject

  committed
  106550f

  Copy full SHA for 106550f

• Modified syscall dashboard, replacing redundant comm field with new normalised process_name field from PROCTYPE events.

  

  Trusted Subject

  committed
  2bccde1

  Copy full SHA for 2bccde1

• Coalesced effective user field in tty dashboard to take into consideration if posix_identities hasn't been populated with all users, especially in the case where the linux:audit:enriched sourcetype…

  Show description for b37b1a3
  

  Trusted Subject

  committed
  b37b1a3

  Copy full SHA for b37b1a3

• Modified CIM normalisation of user field for enriched events so it's populated with the value 'unknown' instead of being null. In conjunction with this I've modified the kernel and syscall dashboar…

  Show description for 8a6e879
  

  Trusted Subject

  committed
  8a6e879

  Copy full SHA for 8a6e879

• Added event_id field to Correlated Events pane of Type Enforcement dashboard.

  

  Trusted Subject

  committed
  51c12d5

  Copy full SHA for 51c12d5

Commits on Sep 28, 2018

• Removed TA-linux_auditd/default/inputs.conf

  

  Trusted Subject

  committed
  4b9d586

  Copy full SHA for 4b9d586

• Updated linux-auditd/default/data/ui/views/syscall.xml to include support for keys.

  

  Trusted Subject

  committed
  4b9384e

  Copy full SHA for 4b9384e

• Changed PROCTITLE CIM normalisation from command field to process_name.

  

  Trusted Subject

  committed
  f42971f

  Copy full SHA for f42971f

• Updated Anomalous Event Volume pane's search in SOC dashboard.

  

  Trusted Subject

  committed
  cf329e1

  Copy full SHA for cf329e1

Commits on Sep 27, 2018

• Adding icons to TA-linux_auditd

  

  Trusted Subject

  committed
  43a7858

  Copy full SHA for 43a7858

Commits on Sep 26, 2018

• Updated command field normalisation in TA-linux_auditd to support proctitle.

  

  Trusted Subject

  committed
  a358074

  Copy full SHA for a358074

• Added app.manifest to linux-auditd

  

  Trusted Subject

  committed
  79e9631

  Copy full SHA for 79e9631

• Removed pink colour from app to provide better appearance in Splunk 7.1+

  

  Trusted Subject

  committed
  f992dd5

  Copy full SHA for f992dd5

• Updated audit_types.csv and associated references.

  

  Trusted Subject

  committed
  b44f686

  Copy full SHA for b44f686

Commits on Sep 24, 2018

• Removing TA-linux_auditd/lookups/auditd_hosts.csv

  

  Trusted Subject

  committed
  9a6b89f

  Copy full SHA for 9a6b89f

• Major changes for v3.0.0

  

  Trusted Subject

  committed
  233052d

  Copy full SHA for 233052d

Commits on Nov 26, 2017

• Fixed indices typo throughout app.

  

  Trusted Subject

  committed
  c351cd5

  Copy full SHA for c351cd5

Pagination

Previous

Next