Skip to content

Test Automatic Codex Review (DO NOT MERGE) #4258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyth0n1c wants to merge 2 commits into from
+3 −3
Closed

Test Automatic Codex Review (DO NOT MERGE) #4258

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f930539
intentionally add a string with a dangling quote to
pyth0n1c Sep 4, 2026
02097a4
mess up some other fields, making invalid date and changing
pyth0n1c Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions detections/network/3cx_supply_chain_attack_network_indicators.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: 3CX Supply Chain Attack Network Indicators
id: 791b727c-deec-4fbe-a732-756131b3c5a1
version: 11
creation_date: '2023-04-11'
modification_date: '2026-05-13'
creation_date: '2023-02-11'

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore the immutable creation date

For this existing detection, changing creation_date from 2023-04-11 to 2023-02-11 corrupts its historical metadata. The EventBasedDetection schema explicitly defines this field as the object's original creation date and says it should never be updated (schemas/EventBasedDetection.schema.json:6841-6845), so retain the prior value and use modification_date for this change.

Useful? React with 👍 / 👎.

modification_date: '2026-55-13'
author: Michael Haag, Splunk
status: production
type: TTP
Expand All @@ -15,7 +15,7 @@ search: |
max(_time) as lastTime
from datamodel=Network_Resolution where
DNS.query=*
NOT DNS.query IN ("-", "unknown")
NOT DNS.query IN ("-", "unknown", "something_new)

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Close the unterminated SPL string literal

The added "something_new value has no closing quote, so Splunk cannot parse this production detection when it is deployed or executed. As a result, the search will fail instead of evaluating 3CX indicators; close the string before the closing parenthesis.

Useful? React with 👍 / 👎.

by DNS.answer DNS.answer_count DNS.query
DNS.query_count DNS.reply_code_id DNS.src
DNS.vendor_product
Expand Down
Loading