security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move Setup information into setup filed (#3206)

Browse Source
This commit is contained in:
shashank-elastic
2023-10-23 19:28:18 +05:30
committed by GitHub
parent 3ab57fb8a7
commit 7254c582c5
108 changed files with 589 additions and 577 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_python_tty_shell.toml
+3 -3
View File
@@ -17,7 +17,9 @@ index = ["logs-endpoint.events.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Interactive Terminal Spawned via Python"
note = """## Setup
risk_score = 73
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
setup = """
This rule requires data coming in from Elastic Defend.
@@ -44,8 +46,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
risk_score = 73
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
severity = "high"
timestamp_override = "event.ingested"
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]