Release

.gitmodules

@@ -1,4 +1,4 @@
 [submodule "contentctl"]
 	path = contentctl
 	url = https://github.com/splunk/contentctl.git
-        ignore = all
+	ignore = all

dist/DA-ESS-ContentUpdate/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/app.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -10,7 +10,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 20240124193302
+build = 20240124220001
 
 [triggers]
 reload.analytic_stories = simple

dist/DA-ESS-ContentUpdate/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/content-version.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -62804,7 +62804,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.uri_path="/template/aui/text-inline.vm" Web.http_method=POST Web.status IN (200, 202) by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.uri_path, Web.status | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter`
+search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url="*/template/aui/text-inline.vm*" Web.http_method=POST Web.status IN (200, 202) by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter`
 
 [ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule]
 action.escu = 0

dist/DA-ESS-ContentUpdate/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-01-24T19:36:41 UTC
+# On Date: 2024-01-24T22:03:46 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/api/version.json

@@ -1 +1 @@
-{"version": {"name": "v4.22.0", "published_at": "2024-01-24T19:40:33Z"}}
+{"version": {"name": "v4.22.0", "published_at": "2024-01-24T22:08:23Z"}}

requirements.txt

@@ -1,15 +1,15 @@
 attackcti==0.3.9
 docker==6.1.3
-GitPython==3.1.37
-Jinja2==3.1.2
-jsonschema==4.19.1
+GitPython==3.1.41
+Jinja2==3.1.3
+jsonschema==4.20.0
 mock==4.0.3
-psutil==5.9.5
+psutil==5.9.7
 pycvesearch==1.2
 pydantic==1.10.8
-pysigma==0.9.8
+pysigma==0.11.0
 pysigma-backend-splunk==1.0.2
-pytest==7.4.2
+pytest==7.4.4
 PyYAML>=5.4.1
 questionary==1.10.0
 requests==2.31.0