Prep for Release 9.0 (#4550)
This commit is contained in:
@@ -2,9 +2,7 @@
|
||||
creation_date = "2023/08/23"
|
||||
integration = ["endpoint", "auditd_manager", "crowdstrike", "sentinel_one_cloud_funnel"]
|
||||
maturity = "production"
|
||||
min_stack_version = "8.13.0"
|
||||
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
|
||||
updated_date = "2025/02/04"
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[transform]
|
||||
[[transform.osquery]]
|
||||
@@ -41,7 +39,14 @@ resources. Attackers can exploit the ProxyChains utility to hide their true sour
|
||||
perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "endgame-*", "logs-auditd_manager.auditd-*", "logs-crowdstrike.fdr*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
|
||||
index = [
|
||||
"auditbeat-*",
|
||||
"endgame-*",
|
||||
"logs-auditd_manager.auditd-*",
|
||||
"logs-crowdstrike.fdr*",
|
||||
"logs-endpoint.events.process*",
|
||||
"logs-sentinel_one_cloud_funnel.*",
|
||||
]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "ProxyChains Activity"
|
||||
|
||||
Reference in New Issue
Block a user