Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
splunk
security_content
Repository navigation
Code
Issues
7
(7)
Pull requests
16
(16)
Discussions
Actions
Projects
Wiki
Security and quality
Insights
More
items
Files
Expand file tree
refs/heads/develop
Breadcrumbs
security_content
/
detections
/
application
/
Copy path
Directory actions
More options
More options
Directory actions
More options
More options
Latest commit
History
History
History
refs/heads/develop
Breadcrumbs
security_content
/
detections
/
application
/
Copy path
Top
Folders and files
Name
Name
Last commit message
Last commit date
parent directory
..
aws_bedrock_claude_cross_region_possible_inference_abuse.yml
aws_bedrock_claude_cross_region_possible_inference_abuse.yml
aws_bedrock_claude_excessive_use_of_tokens.yml
aws_bedrock_claude_excessive_use_of_tokens.yml
aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml
aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml
aws_bedrock_claude_hostile_prompt_sentiment.yml
aws_bedrock_claude_hostile_prompt_sentiment.yml
aws_bedrock_claude_possible_prompt_injection.yml
aws_bedrock_claude_possible_prompt_injection.yml
aws_bedrock_claude_sensitive_data_in_prompts.yml
aws_bedrock_claude_sensitive_data_in_prompts.yml
aws_bedrock_claude_unusually_large_prompts.yml
aws_bedrock_claude_unusually_large_prompts.yml
cisco_ai_defense_security_alerts_by_application_name.yml
cisco_ai_defense_security_alerts_by_application_name.yml
cisco_asa___aaa_policy_tampering.yml
cisco_asa___aaa_policy_tampering.yml
cisco_asa___core_syslog_message_volume_drop.yml
cisco_asa___core_syslog_message_volume_drop.yml
cisco_asa___device_file_copy_activity.yml
cisco_asa___device_file_copy_activity.yml
cisco_asa___device_file_copy_to_remote_location.yml
cisco_asa___device_file_copy_to_remote_location.yml
cisco_asa___logging_disabled_via_cli.yml
cisco_asa___logging_disabled_via_cli.yml
cisco_asa___logging_filters_configuration_tampering.yml
cisco_asa___logging_filters_configuration_tampering.yml
cisco_asa___logging_message_suppression.yml
cisco_asa___logging_message_suppression.yml
cisco_asa___new_local_user_account_created.yml
cisco_asa___new_local_user_account_created.yml
cisco_asa___packet_capture_activity.yml
cisco_asa___packet_capture_activity.yml
cisco_asa___reconnaissance_command_activity.yml
cisco_asa___reconnaissance_command_activity.yml
cisco_asa___user_account_deleted_from_local_database.yml
cisco_asa___user_account_deleted_from_local_database.yml
cisco_asa___user_account_lockout_threshold_exceeded.yml
cisco_asa___user_account_lockout_threshold_exceeded.yml
cisco_asa___user_privilege_level_change.yml
cisco_asa___user_privilege_level_change.yml
cisco_duo_admin_login_unusual_browser.yml
cisco_duo_admin_login_unusual_browser.yml
cisco_duo_admin_login_unusual_country.yml
cisco_duo_admin_login_unusual_country.yml
cisco_duo_admin_login_unusual_os.yml
cisco_duo_admin_login_unusual_os.yml
cisco_duo_bulk_policy_deletion.yml
cisco_duo_bulk_policy_deletion.yml
cisco_duo_bypass_code_generation.yml
cisco_duo_bypass_code_generation.yml
cisco_duo_policy_allow_devices_without_screen_lock.yml
cisco_duo_policy_allow_devices_without_screen_lock.yml
cisco_duo_policy_allow_network_bypass_2fa.yml
cisco_duo_policy_allow_network_bypass_2fa.yml
cisco_duo_policy_allow_old_flash.yml
cisco_duo_policy_allow_old_flash.yml
cisco_duo_policy_allow_old_java.yml
cisco_duo_policy_allow_old_java.yml
cisco_duo_policy_allow_tampered_devices.yml
cisco_duo_policy_allow_tampered_devices.yml
cisco_duo_policy_bypass_2fa.yml
cisco_duo_policy_bypass_2fa.yml
cisco_duo_policy_deny_access.yml
cisco_duo_policy_deny_access.yml
cisco_duo_policy_skip_2fa_for_other_countries.yml
cisco_duo_policy_skip_2fa_for_other_countries.yml
cisco_duo_set_user_status_to_bypass_2fa.yml
cisco_duo_set_user_status_to_bypass_2fa.yml
cisco_ios_xe_guestshell_activation_and_destroy.yml
cisco_ios_xe_guestshell_activation_and_destroy.yml
cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml
cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml
cisco_ios_xe_reconnaissance_command_activity.yml
cisco_ios_xe_reconnaissance_command_activity.yml
cisco_ios_xe_remote_access_probe_burst.yml
cisco_ios_xe_remote_access_probe_burst.yml
cisco_ios_xe_request_platform_package_describe_shell_pattern.yml
cisco_ios_xe_request_platform_package_describe_shell_pattern.yml
cisco_ios_xe_tunnel_interface_configuration.yml
cisco_ios_xe_tunnel_interface_configuration.yml
cisco_ios_xe_vty_access_class_tampering.yml
cisco_ios_xe_vty_access_class_tampering.yml
cisco_ios_xe_webui_login_from_iosd_local_port.yml
cisco_ios_xe_webui_login_from_iosd_local_port.yml
cisco_ios_xe_webui_programmatic_configuration.yml
cisco_ios_xe_webui_programmatic_configuration.yml
cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml
cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml
cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml
cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml
crushftp_server_side_template_injection.yml
crushftp_server_side_template_injection.yml
detect_distributed_password_spray_attempts.yml
detect_distributed_password_spray_attempts.yml
detect_html_help_spawn_child_process.yml
detect_html_help_spawn_child_process.yml
detect_new_login_attempts_to_routers.yml
detect_new_login_attempts_to_routers.yml
detect_password_spray_attempts.yml
detect_password_spray_attempts.yml
email_attachments_with_lots_of_spaces.yml
email_attachments_with_lots_of_spaces.yml
email_files_written_outside_of_the_outlook_directory.yml
email_files_written_outside_of_the_outlook_directory.yml
email_servers_sending_high_volume_traffic_to_hosts.yml
email_servers_sending_high_volume_traffic_to_hosts.yml
esxi_account_modified.yml
esxi_account_modified.yml
esxi_audit_tampering.yml
esxi_audit_tampering.yml
esxi_bulk_vm_termination.yml
esxi_bulk_vm_termination.yml
esxi_download_errors.yml
esxi_download_errors.yml
esxi_encryption_settings_modified.yml
esxi_encryption_settings_modified.yml
esxi_external_root_login_activity.yml
esxi_external_root_login_activity.yml
esxi_firewall_disabled.yml
esxi_firewall_disabled.yml
esxi_lockdown_mode_disabled.yml
esxi_lockdown_mode_disabled.yml
esxi_loghost_config_tampering.yml
esxi_loghost_config_tampering.yml
esxi_malicious_vib_forced_install.yml
esxi_malicious_vib_forced_install.yml
esxi_reverse_shell_patterns.yml
esxi_reverse_shell_patterns.yml
esxi_sensitive_files_accessed.yml
esxi_sensitive_files_accessed.yml
esxi_shared_or_stolen_root_account.yml
esxi_shared_or_stolen_root_account.yml
esxi_shell_access_enabled.yml
esxi_shell_access_enabled.yml
esxi_ssh_brute_force.yml
esxi_ssh_brute_force.yml
esxi_ssh_enabled.yml
esxi_ssh_enabled.yml
esxi_syslog_config_change.yml
esxi_syslog_config_change.yml
esxi_system_clock_manipulation.yml
esxi_system_clock_manipulation.yml
esxi_system_information_discovery.yml
esxi_system_information_discovery.yml
esxi_user_granted_admin_role.yml
esxi_user_granted_admin_role.yml
esxi_vib_acceptance_level_tampering.yml
esxi_vib_acceptance_level_tampering.yml
esxi_vm_discovery.yml
esxi_vm_discovery.yml
esxi_vm_exported_via_remote_tool.yml
esxi_vm_exported_via_remote_tool.yml
ivanti_vtm_new_account_creation.yml
ivanti_vtm_new_account_creation.yml
m365_copilot_agentic_jailbreak_attack.yml
m365_copilot_agentic_jailbreak_attack.yml
m365_copilot_application_usage_pattern_anomalies.yml
m365_copilot_application_usage_pattern_anomalies.yml
m365_copilot_failed_authentication_patterns.yml
m365_copilot_failed_authentication_patterns.yml
m365_copilot_impersonation_jailbreak_attack.yml
m365_copilot_impersonation_jailbreak_attack.yml
m365_copilot_information_extraction_jailbreak_attack.yml
m365_copilot_information_extraction_jailbreak_attack.yml
m365_copilot_jailbreak_attempts.yml
m365_copilot_jailbreak_attempts.yml
m365_copilot_non_compliant_devices_accessing_m365_copilot.yml
m365_copilot_non_compliant_devices_accessing_m365_copilot.yml
m365_copilot_session_origin_anomalies.yml
m365_copilot_session_origin_anomalies.yml
mcp_filesystem_server_suspicious_extension_write.yml
mcp_filesystem_server_suspicious_extension_write.yml
mcp_github_suspicious_operation.yml
mcp_github_suspicious_operation.yml
mcp_postgres_suspicious_query.yml
mcp_postgres_suspicious_query.yml
mcp_prompt_injection.yml
mcp_prompt_injection.yml
mcp_sensitive_system_file_search.yml
mcp_sensitive_system_file_search.yml
monitor_email_for_brand_abuse.yml
monitor_email_for_brand_abuse.yml
no_windows_updates_in_a_time_frame.yml
no_windows_updates_in_a_time_frame.yml
okta_authentication_failed_during_mfa_challenge.yml
okta_authentication_failed_during_mfa_challenge.yml
okta_idp_lifecycle_modifications.yml
okta_idp_lifecycle_modifications.yml
okta_mfa_exhaustion_hunt.yml
okta_mfa_exhaustion_hunt.yml
okta_mismatch_between_source_and_response_for_verify_push_request.yml
okta_mismatch_between_source_and_response_for_verify_push_request.yml
okta_multi_factor_authentication_disabled.yml
okta_multi_factor_authentication_disabled.yml
okta_multiple_accounts_locked_out.yml
okta_multiple_accounts_locked_out.yml
okta_multiple_failed_mfa_requests_for_user.yml
okta_multiple_failed_mfa_requests_for_user.yml
View all files
You can’t perform that action at this time.