Splunk ES Content Update
Splunk Built
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues.
Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.
Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.
For more information please visit the Splunk ES Content Update user documentation.
Release Notes
Version 1.0.44
Nov. 18, 2019
Enterprise Security Content Updates v 1.0.44 was released on November 20, 2019, and included a number of fixed issues, including:
* Upgraded jquery to 3.4.0 or later
* Upgraded PyYAML to 5.1 or later
* Search string bug fixed in malicious PowerShell process execution policy bypass
* Upgraded Jinja2 to 2.10.1 or later
* Fixed bug in dashboard pages that use HTML5 attribute data-toggle
For complete documentation, please visit: https://docs.splunk.com/Documentation/ESSOC/1.0.44