From 7adb199afadad5d4e640adf9e10bf65ec703386a Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Wed, 9 Nov 2022 12:51:52 -0500 Subject: [PATCH] [Deprecation] GCP Kubernetes Rolebindings Created or Patched (#2340) * Update privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml Deprecating this rule due to high false positive rate. This behavior is too generic for an effective malicious behavior detection. * move toml file to _deprecated move toml file to _deprecated Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- ...ation_gcp_kubernetes_rolebindings_created_or_patched.toml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) rename rules/{integrations/gcp => _deprecated}/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml (95%) diff --git a/rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml b/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml similarity index 95% rename from rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml rename to rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml index 60a5320b6..892730862 100644 --- a/rules/integrations/gcp/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml +++ b/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml @@ -1,9 +1,10 @@ [metadata] creation_date = "2021/06/06" -maturity = "production" +maturity = "deprecated" +deprecation_date = "2022/10/04" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2022/08/24" +updated_date = "2022/10/04" integration = "gcp" [rule]