security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move Setup information into setup filed (#3206)

Browse Source 
(cherry picked from commit 7254c582c5)
This commit is contained in:
shashank-elastic
2023-10-23 19:28:18 +05:30
committed by github-actions[bot]
parent 21bff0b9d2
commit 60475f6aa0
108 changed files with 589 additions and 577 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_remote_code_execution_via_postgresql.toml
+3 -3
View File
@@ -20,7 +20,9 @@ index = ["logs-endpoint.events.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Code Execution via Postgresql"
note = """## Setup
risk_score = 47
rule_id = "2a692072-d78d-42f3-a48a-775677d79c4e"
setup = """
This rule requires data coming in from Elastic Defend.
@@ -47,8 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
risk_score = 47
rule_id = "2a692072-d78d-42f3-a48a-775677d79c4e"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
type = "eql"