Releases: splunk/security_content
Releases · splunk/security_content
v1.0.47
Enterprise Security Content Updates v 1.0.47 included the following enhancements:
Fixed issues:
- CRL-1700 Remove ES macro dependency by introducing new macros security_content_ctime replacing the ctime macro across all content, and introducing security_content_summariesonly replacing the summariesonly macro across all content.
- Removed runstory macro definition .
- Removed comment macro for empty definition.
v1.0.46
Enterprise Security Content Updates v 1.0.46 included the following enhancements.
Fixed issues:
- CRL-1688 Ensure that ESCU is supported on Splunk Enterprise 8.0
- CRL-1686 Resolve broken hyperlinks in content files
- CRL-1609 Fix for validation check on Feedback Center page
v1.0.45
Enterprise Security Content Updates v 1.0.45 included the following enhancements.
Updated Analytic Stories:
- Added new searches "Abnormally High AWS Instances Launched by User - MLTK detection" and "Abnormally High AWS Instances Terminated by User - MLTK detection" to the "Suspicious AWS EC2 Activities" Analytic Story
- Added new search "Abnormally High AWS Instances Launched by User - MLTK detection" to the "Cloud Cryptomining" Analytic Story
Fixed issues:
- CRL-1493 ESCU Fraud Searches Are Mislabeled
- CRL-1697 Added: Cloud Compute Instance Created With Previously Unseen Image detection to Cloud Cryptomining story