splunk/security_content v4.28.0

on GitHub

New Analytics

• Splunk Authentication Token Exposure in Debug Log

Updated Analytics

• Splunk Command and Scripting Interpreter Risky Commands
• ASL AWS Concurrent Sessions From Different Ips
• Gsuite Outbound Email With Attachment To External Domain
• Detect Excessive Account Lockouts From Endpoint
• Detect Excessive User Account Lockouts
• Short Lived Windows Accounts
• Windows Create Local Account

Playbooks Updated

• Active Directory Enable Account Dispatch