Add timeline_id to detection rules (#95)

* Adds timeline_id to all network rules
- Uses the ID for the 'Generic Network Timeline' from Elastic
* Adds timeline_id to all endpoint rules
- Uses the ID for the 'Generic Endpoint Timeline' from Elastic
* Adds timeline_id to all process-oriented rules
    - Uses the ID for the 'Generic Process Timeline' from Elastic
* Ran tests and toml-lint
* Bumped 'updated_date'
This commit is contained in:
Derek Ditch
2020-10-27 13:34:16 -05:00
committed by GitHub
parent 2065af89b1
commit 580db2c13e
183 changed files with 368 additions and 191 deletions
+2 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/15"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/10/27"
[rule]
author = ["Elastic"]
@@ -19,6 +19,7 @@ risk_score = 73
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
severity = "high"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution"]
timeline_id = "76e52245-7519-4251-91ab-262fb1a1728c"
type = "query"
query = '''