 Thomas Patzke
|
0592cbb67a
|
Added UUIDs to rules
|
2019-11-12 23:12:27 +01:00 |
|
|
ecco
|
4c54e8322a
|
sysmon eventid 3: filter on outgoing connections (initiated: true) to avoid false positives
|
2019-09-25 11:11:22 -04:00 |
|
|
mrblacyk
|
99595a7f89
|
Added missing tags and some minor improvements
|
2019-03-05 23:25:49 +01:00 |
|
|
Tareq AlKhatib
|
a022333382
|
Added private IP filter to reduce FPs
|
2019-02-23 21:15:03 +03:00 |
|
|
Sherif Eldeeb
|
23eddafb39
|
Replace "logsource: description" with "definition" to match the specs
|
2018-11-15 09:00:06 +03:00 |
|
|
megan201296
|
a7ccfcb50d
|
Fixed spelling mistake
|
2018-07-09 09:13:31 -05:00 |
|
|
SherifEldeeb
|
48441962cc
|
Change All "str" references to be "list"to mach schema update
|
2018-01-28 02:24:16 +03:00 |
|
|
SherifEldeeb
|
112a0939d7
|
Change "reference" to "references" to match new schema
|
2018-01-28 02:12:19 +03:00 |
|
|
Florian Roth
|
c82da0dc5c
|
Rules: Suspicious locations and back connect ports
|
2017-03-19 15:22:27 +01:00 |
|