phantinuss b991a5be52 chore: test rules: warn on errors or invalid FP reasons ...

also adapted the existing rules to pass the tests

2022-05-09 16:07:55 +02:00

..

cisco/aaa

remove invalid tag

2022-01-19 18:23:30 +01:00

zeek

chore: test rules: warn on errors or invalid FP reasons

2022-05-09 16:07:55 +02:00

net_apt_equationgroup_c2.yml

refactor: change all " of them" expressions

2022-01-11 10:59:57 +01:00

net_dns_c2_detection.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_firewall_high_dns_bytes_out.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_firewall_high_dns_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_dns_bytes_out.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_dns_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_null_records_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_high_txt_records_requests_rate.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_mal_dns_cobaltstrike.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_pua_cryptocoin_mining_xmr.yml

Update net_pua_cryptocoin_mining_xmr.yml

2021-11-20 19:20:07 +01:00

net_susp_dns_b64_queries.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_susp_dns_txt_exec_strings.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_susp_network_scan_by_ip.yml

fix: remove penetration testing as a valid false positive

2022-03-16 13:51:26 +01:00

net_susp_network_scan_by_port.yml

fix: remove penetration testing as a valid false positive

2022-03-16 13:51:26 +01:00

net_susp_telegram_api.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

net_wannacry_killswitch_domain.yml

fix: empty query in rule > bug

2022-03-24 15:17:29 +01:00