security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Security Content] Include "Data Source: Elastic Defend" tag (#3002)

Browse Source 
* win folder

* Other folders

* Update test_all_rules.py

* .

* updated missing elastic defend tags

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>

(cherry picked from commit 4233fef238)
This commit is contained in:
Jonhnathan
2023-09-05 15:22:01 -03:00
committed by github-actions[bot]
parent 4bb0cdc3f3
commit 063386829c
470 changed files with 478 additions and 451 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/execution_python_script_in_cmdline.toml
+1 -1
View File
@@ -23,7 +23,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version
risk_score = 47
rule_id = "ee9f08dc-cf80-4124-94ae-08c405f059ae"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution"]
tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
timestamp_override = "event.ingested"
type = "eql"