FilesExpand file tree

develop

/

investigations

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

investigations

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
aws_activity_via_region.yml		aws_activity_via_region.yml
aws_network_interface_details.yml		aws_network_interface_details.yml
aws_s3_bucket_details.yml		aws_s3_bucket_details.yml
aws_user_activities_by_user_field.yml		aws_user_activities_by_user_field.yml
aws_user_activity_by_accesskeyid.yml		aws_user_activity_by_accesskeyid.yml
aws_user_activity_by_src_user.yml		aws_user_activity_by_src_user.yml
container_listing_aws_investigation.yml		container_listing_aws_investigation.yml
dns_hijack_enrichment.yml		dns_hijack_enrichment.yml
dns_server_history.yml		dns_server_history.yml
dns_traffic_stats.yml		dns_traffic_stats.yml
domain_cert_investigation.yml		domain_cert_investigation.yml
email_sent_to_hidden_cobra_actors.yml		email_sent_to_hidden_cobra_actors.yml
excessive_account_lockouts_enrichment.yml		excessive_account_lockouts_enrichment.yml
first_occurrence_mac_address.yml		first_occurrence_mac_address.yml
get_acl_details.yml		get_acl_details.yml
get_all_aws_activitiy_from_city.yml		get_all_aws_activitiy_from_city.yml
get_all_aws_activitiy_from_country.yml		get_all_aws_activitiy_from_country.yml
get_all_aws_activitiy_from_region.yml		get_all_aws_activitiy_from_region.yml
get_all_aws_activitiy_from_src_ip.yml		get_all_aws_activitiy_from_src_ip.yml
get_all_backup_data_for_host.yml		get_all_backup_data_for_host.yml
get_authentication_logs_for_endpoint.yml		get_authentication_logs_for_endpoint.yml
get_backup_logs_for_endpoint.yml		get_backup_logs_for_endpoint.yml
get_certificate_for_domain.yml		get_certificate_for_domain.yml
get_ec2_details_by_instance_id.yml		get_ec2_details_by_instance_id.yml
get_ec2_launch_details.yml		get_ec2_launch_details.yml
get_email_info.yml		get_email_info.yml
get_emails_from_sender.yml		get_emails_from_sender.yml
get_emails_from_source.yml		get_emails_from_source.yml
get_logon_rights_modifications_for_endpoint.yml		get_logon_rights_modifications_for_endpoint.yml
get_logon_rights_modifications_for_user.yml		get_logon_rights_modifications_for_user.yml
get_network_traffic_from_src_ip.yml		get_network_traffic_from_src_ip.yml
get_notable_history_for_endpoint.yml		get_notable_history_for_endpoint.yml
get_notable_info.yml		get_notable_info.yml
get_okta_activity_by_app.yml		get_okta_activity_by_app.yml
get_okta_activity_by_ip.yml		get_okta_activity_by_ip.yml
get_okta_user_activity.yml		get_okta_user_activity.yml
get_parent_process_info.yml		get_parent_process_info.yml
get_process_creating_dns_traffic.yml		get_process_creating_dns_traffic.yml
get_process_file_activity.yml		get_process_file_activity.yml
get_process_info.yml		get_process_info.yml
get_process_info_for_port.yml		get_process_info_for_port.yml
get_process_registry_activity.yml		get_process_registry_activity.yml
get_rdp_authentications.yml		get_rdp_authentications.yml
get_registry_activities.yml		get_registry_activities.yml
get_risk_for_endpoint.yml		get_risk_for_endpoint.yml
get_risk_for_user.yml		get_risk_for_user.yml
get_update_logs_for_endpoint.yml		get_update_logs_for_endpoint.yml
get_user_info_from_identity_table.yml		get_user_info_from_identity_table.yml
get_vulnerability_logs_for_endpoint.yml		get_vulnerability_logs_for_endpoint.yml
get_web_activity.yml		get_web_activity.yml
get_web_activity_by_src_ip.yml		get_web_activity_by_src_ip.yml
get_web_posts_by_src.yml		get_web_posts_by_src.yml
get_web_session_info.yml		get_web_session_info.yml
get_wmi_sysmon_events.yml		get_wmi_sysmon_events.yml
investigate_cloud_compute_instance_activities.yml		investigate_cloud_compute_instance_activities.yml
investigate_failed_logins_for_multiple_destinations.yml		investigate_failed_logins_for_multiple_destinations.yml
investigate_pass_the_hash_attempts.yml		investigate_pass_the_hash_attempts.yml
investigate_pass_the_ticket_attempts.yml		investigate_pass_the_ticket_attempts.yml
investigate_previous_unseen_user.yml		investigate_previous_unseen_user.yml
investigate_user_activities_in_all_cloud_regions.yml		investigate_user_activities_in_all_cloud_regions.yml
investigate_user_activities_in_single_cloud_region.yml		investigate_user_activities_in_single_cloud_region.yml
suspicious_email_attachment_investigate_and_delete.yml		suspicious_email_attachment_investigate_and_delete.yml
suspicious_strings_in_HTTP_header.yml		suspicious_strings_in_HTTP_header.yml
user_activity_via_cloudtrail.yml		user_activity_via_cloudtrail.yml
View all files