Packs: Cloudflare & Slack (#478)

* Tweaked the Cloudflare L7 DDoS detection to filter out blocks

* Added new packs for Cloudflare and Slack

* Removed erroneous new line

* Removed unused globals

packs/cloudflare.yml

@@ -0,0 +1,15 @@
+AnalysisType: pack
+PackID: PantherManaged.Cloudflare
+DisplayName: Panther Cloudflare Pack
+Description: Group of all Cloudflare detections
+PackDefinition:
+  IDs:
+    - Cloudflare.Firewall.L7DDoS
+    - Cloudflare.Firewall.HighVolumeEventsBlocked
+    - Cloudflare.Firewall.HighVolumeEventsBlockedGreyNoise
+    - Cloudflare.Firewall.SuspiciousEventGreyNoise
+    - Cloudflare.HttpRequest.BotHighVolume
+    - Cloudflare.HttpRequest.BotHighVolumeGreyNoise
+    # Globals used in these rules/policies
+    - panther_cloudflare_helpers
+    - panther_greynoise_helpers

packs/slack.yml

@@ -0,0 +1,30 @@
+AnalysisType: pack
+PackID: PantherManaged.Slack
+DisplayName: Panther Slack Pack
+Description: Group of all Slack detections
+PackDefinition:
+  IDs:
+    - Slack.AuditLogs.AppAccessExpanded
+    - Slack.AuditLogs.AppAdded
+    - Slack.AuditLogs.AppRemoved
+    - Slack.AuditLogs.ApplicationDoS
+    - Slack.AuditLogs.DLPModified
+    - Slack.AuditLogs.EKMConfigChanged
+    - Slack.AuditLogs.EKMSlackbotUnenrolled
+    - Slack.AuditLogs.EKMUnenrolled
+    - Slack.AuditLogs.IDPConfigurationChanged
+    - Slack.AuditLogs.InformationBarrierModified
+    - Slack.AuditLogs.IntuneMDMDisabled
+    - Slack.AuditLogs.LegalHoldPolicyModified
+    - Slack.AuditLogs.MFASettingsChanged
+    - Slack.AuditLogs.OrgCreated
+    - Slack.AuditLogs.OrgDeleted
+    - Slack.AuditLogs.PassthroughAnomaly
+    - Slack.AuditLogs.PotentiallyMaliciousFileShared
+    - Slack.AuditLogs.PrivateChannelMadePublic
+    - Slack.AuditLogs.ServiceOwnerTransferred
+    - Slack.AuditLogs.SSOSettingsChanged
+    - Slack.AuditLogs.UserPrivilegeEscalation
+    # Globals used in these rules/policies
+    - panther_base_helpers
+    - panther_oss_helpers