security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update Okta and Github Min-Stack Versions for Release (#4290)

Browse Source
This commit is contained in:
Terrance DeJesus
2024-12-09 10:28:33 -05:00
committed by GitHub
parent e7b88ae3fc
commit 052672b09f
67 changed files with 204 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml
+4 -2
View File
@@ -2,7 +2,9 @@
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
@@ -25,7 +27,7 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
configuration where event.dataset == "github.audit"
configuration where event.dataset == "github.audit"
and github.category == "protected_branch" and event.type == "change"
'''
rules/integrations/github/execution_github_app_deleted.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml
+5 -3
View File
@@ -2,7 +2,9 @@
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
@@ -29,8 +31,8 @@ timestamp_override = "event.ingested"
type = "threshold"
query = '''
event.dataset:"github.audit" and event.category:"configuration" and event.action:"git.clone" and
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token") and
event.dataset:"github.audit" and event.category:"configuration" and event.action:"git.clone" and
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token") and
github.repository_public:false
'''
rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2023/12/14"
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
rules/integrations/github/execution_new_github_app_installed.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
rules/integrations/github/impact_github_repository_deleted.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
rules/integrations/github/persistence_github_org_owner_added.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2023/09/11"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]
rules/integrations/github/persistence_organization_owner_role_granted.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2023/09/11"
integration = ["github"]
maturity = "production"
updated_date = "2024/12/09"
updated_date = "2024/12/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
[rule]
author = ["Elastic"]