Add timeline_id to detection rules (#95)
* Adds timeline_id to all network rules
- Uses the ID for the 'Generic Network Timeline' from Elastic
* Adds timeline_id to all endpoint rules
- Uses the ID for the 'Generic Endpoint Timeline' from Elastic
* Adds timeline_id to all process-oriented rules
- Uses the ID for the 'Generic Process Timeline' from Elastic
* Ran tests and toml-lint
* Bumped 'updated_date'
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
creation_date = "2020/02/18"
|
||||
ecs_version = ["1.6.0"]
|
||||
maturity = "production"
|
||||
updated_date = "2020/10/26"
|
||||
updated_date = "2020/10/27"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -19,6 +19,7 @@ risk_score = 21
|
||||
rule_id = "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc"
|
||||
severity = "low"
|
||||
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Execution"]
|
||||
timeline_id = "76e52245-7519-4251-91ab-262fb1a1728c"
|
||||
type = "query"
|
||||
|
||||
query = '''
|
||||
|
||||
Reference in New Issue
Block a user