adding insider threat, fixing minor display bug

Author: josehelps

bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2

@@ -38,7 +38,7 @@ tags:
 We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported.
 {% endif %}
 
-[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
 
 #### Description
 

detections/cloud/gsuite_drive_share_in_external_email.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Dev Sec Ops
+  - Insider Threat
   asset_type: GSuite
   confidence: 90
   context:

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Dev Sec Ops
+  - Insider Threat
   asset_type: GSuite
   confidence: 30
   context:

detections/endpoint/high_frequency_copy_of_files_in_network_share.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Information Sabotage
+  - Insider Threat
   confidence: 30
   context:
   - Source:Endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml

@@ -48,6 +48,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Insider Threat
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/ssa___sdelete_application_execution.yml

@@ -45,6 +45,7 @@ references:
 tags:
   analytic_story:
   - Information Sabotage
+  - Insider Threat
   cis20: []
   confidence: 70
   context:

detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml

@@ -49,6 +49,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Insider Threat
   confidence: 70
   context:
   - Source:Endpoint

detections/experimental/endpoint/ssa___excessive_number_of_office_files_copied.yml

@@ -25,7 +25,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: user may copy a lot of office fies from one folder to another
 references: []
 tags:
-  analytic_story: []
+  analytic_story:
+  - Insider Threat
   confidence: 80
   context:
   - Source:Endpoint

detections/experimental/endpoint/ssa___high_file_deletion_frequency.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
+  - Insider Threat
   confidence: 80
   context:
   - Source:Endpoint

docs/Gemfile.lock

@@ -322,4 +322,4 @@ DEPENDENCIES
   webrick (~> 1.7)
 
 BUNDLED WITH
-   2.3.6
+   2.3.6