[Rule Tuning] 7.11.2: Add timestamp_override to all query and non-sequence EQL rules (#948)

* [Rule Tuning] Add timestamp_override field to 7.11.0 rules
* Lock versions for 7.11.2 rules
This commit is contained in:
Justin Ibarra
2021-02-16 10:52:48 -09:00
committed by GitHub
parent 66be82808c
commit 61deed3fd2
360 changed files with 1640 additions and 1152 deletions
+2 -1
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/04/15"
maturity = "production"
updated_date = "2020/11/03"
updated_date = "2020/02/16"
[rule]
author = ["Elastic"]
@@ -18,6 +18,7 @@ risk_score = 73
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
severity = "high"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution"]
timestamp_override = "event.ingested"
type = "query"
query = '''