[OSCD Sprint #2] Final Pull Request / Summary

[staf711]

The last set of Sigma rules developed during the second OSCD sprint.

Summary

• 24 responders;

WIP

• Palo Alto: issue 855; PR 886
• Duo Security: issue 859; PR 964
• Gmail: issue 859; PR 891
• Azure Active Directory: issue 858; PR 906

Konakin Maxim, TG @staf71, AT Group, 🇷🇺

Added 16 new responders for Palo Alto:

RA3104: Block internal domain
RA3101: Block external IP address
RA3102: Block internal IP address
RA3109: Block user external communication
RA3110: Block user internal communication
RA3109: Block port external communication
RA3108: Block port internal communication
RA5102: Unblock external domain
RA5101: Unblock external IP address
RA5105: Unblock external user
RA5102: Unblock external domain
RA5101: Unblock internal IP address
RA5105: Unblock user internal communication
RA5104: Unblock port external communication
RA5104: Unblock port internal communication

issue 855; PR 886

Cisco:

• Sven Kutzer, @SvenKutzer, 🇩🇪
• Gyorgy Acs, @AcsGacs, 🇭🇺

Added 2 new responders for Duo Security:

RA3601: Lock user account
RA5601: Unlock locked user account

issue 859; PR 891

David Straßegger, @Strassi7, 🇦🇹

Added 5 new responders for Gmail:

RA4201: Delete email message
RA3201: Block domain on email
RA3202: Block sender on email
RA5201: Unblock domain on email
RA5202: Unblock sender on email

issue 859; PR 891

Daniel Weiner, @DanielWeiner93, 🇺🇸

Added 1 new responder for Azure Active Directory:

RA4601: Revoke authentication credentials (API tokens)

issue 858; PR 906

[yugoslavskiy]

@jeromeleonard @nadouani @saadkadhi Hello guys! We are going to finish the sprint with these responders:

They all awaiting your approval in their Pull Requests. Looking forward to it (:

[nadouani]

@yugoslavskiy Hello, the PR has been merged, and we will release very soon