security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[New Rule] Adding Lateral Movement Rules from Advanced Analytic LMD Package (#3119)

Browse Source 
* Adding Lateral Movement Detection rules

* added tags; adjusted tests; updated manifests and schemas

* added default value to build_integrations_schema

* combined analytic and non-dataset packages for related integrations

* adjusted machine learning definitions

* adjusted machine learning definitions

* removed splat for machine learning list due to 3.8 constraints

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 747ee7d593)
This commit is contained in:
Apoorva Joshi
2023-09-27 11:53:38 -07:00
committed by github-actions[bot]
parent 7cb4c5216d
commit 116a7de890
20 changed files with 636 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/devtools.py
+9 -4
View File
@@ -1236,14 +1236,19 @@ def build_integration_manifests(overwrite: bool, integration: str):
@integrations_group.command('build-schemas')
@click.option('--overwrite', '-o', is_flag=True, help="Overwrite the entire integrations-schema.json.gz file")
def build_integration_schemas(overwrite: bool):
@click.option('--integration', '-i', type=str,
help="Adds a single integration schema to the integrations-schema.json.gz file")
def build_integration_schemas(overwrite: bool, integration: str):
"""Builds consolidated integrations schemas file."""
click.echo("Building integration schemas...")
start_time = time.perf_counter()
build_integrations_schemas(overwrite)
end_time = time.perf_counter()
click.echo(f"Time taken to generate schemas: {(end_time - start_time)/60:.2f} minutes")
if integration:
build_integrations_schemas(overwrite=False, integration=integration)
else:
build_integrations_schemas(overwrite=overwrite)
end_time = time.perf_counter()
click.echo(f"Time taken to generate schemas: {(end_time - start_time)/60:.2f} minutes")
@integrations_group.command('show-latest-compatible')