security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert #1440 new endpoint promotion rule (#1470)

Browse Source 
* Revert #1440 new endpoint promotion rule
* Set the updated_at date

Removed changes from:
- rules/integrations/endpoint/elastic_endpoint_security_behavior_protection.toml

(selectively cherry picked from commit c9d6527280)
This commit is contained in:
Ross Wolf
2021-09-03 08:07:20 -06:00
committed by github-actions[bot]
parent eb37f07417
commit 2ef59e918f
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/endpoint/elastic_endpoint_security.toml
+2 -3
View File
@@ -1,8 +1,7 @@
[metadata]
creation_date = "2020/07/08"
maturity = "production"
updated_date = "2021/08/25"
integration = "endpoint"
updated_date = "2021/09/03"
[rule]
author = ["Elastic"]
@@ -26,7 +25,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.kind:alert and event.module:(endpoint and not endgame) and not event.code: behavior
event.kind:alert and event.module:(endpoint and not endgame)
'''