From 9ce8faebeac4c98fe175aba1220342714645e07b Mon Sep 17 00:00:00 2001 From: eric-forte-elastic <119343520+eric-forte-elastic@users.noreply.github.com> Date: Tue, 7 Feb 2023 09:43:19 -0500 Subject: [PATCH] Updated ECS mappings from keyword to wildcard (#2518) Co-authored-by: Mika Ayenson --- .../8.4.0/endgame_ecs_mapping.json.gz | Bin 1219 -> 1229 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/detection_rules/etc/endgame_schemas/8.4.0/endgame_ecs_mapping.json.gz b/detection_rules/etc/endgame_schemas/8.4.0/endgame_ecs_mapping.json.gz index ae00f30ffba0549115910240b7283720b5b0ae05..0aee5372bd4abc10dea6e8152944b0fc63ccb9a6 100644 GIT binary patch literal 1229 zcmV;;1Ty;{iwFR@%LpQxEXJr@y=$!Fe%Gr$4`)dg0;p$G4LhK>J4ai|q!FU&i(?vlb(e zfPYLha0lz8(QjC%LUSdv8V|8HX|~1%F?r$yiT#u`o#I!9w5W z9J=|OgT0wr1$R(cC$j_F6bW#-KFadk^-gBtQ)a3l|_T5933?wAsb z8A+YRAeo9WA+EUC{$6%5R;s<2%N1bEDO6!h4j zD{oWt9@X1YyBYOcQ1(T6QL5=o53Q2}QfCVdd}88;VmTY5Kxl@CCFy5Z_J`U1H|}6t z7v0+#%cd`fzY8TP+M<6m_8&y30J*F9p22>6{LG*q-+!>E>j5SLW!60jf2GV=T2etv zpD8wm949KxSI}5FpzNv*eyHf$HUG>@a$sVV@M0f}$!sHwNu^G9;HF2e1;=i0)E!?b z?#$3R<|Kx}mV;R5IjF;P;b8281f%JeU`frb=9|!rnjX~L|a#bJRN?y+hp96mj0B1;1}BpJ1umnlF2Ot*VsM7ukH zX}>$bX~TDd8{1jtoo`{0`BQ;33}O-FLB$!gtr!X!U44ruKqr z@JPI+r|uoVMmNqHdrzC})=rT^i&oF$IVqx@fwzboc+$VOLc9HR9zAN#cnrc7aRNT^ zSgxm$ljcB3<%!{3OkSp#LP!?6zQ&?~UbA(zhLimcO@~QlCSK)#D3w zm`jbYgUdi|XJ&o4Ywc*wbYZyUfZ@3OjA5Rj#|%TJCe4dFjzagXk~)O`B~{;vV{9DG zWHmkUPv~YZ&I(w9^zHIe)E+ZK<^U6O<{eK*%{wEVHb(|EaCSyUnMv4i0OWHlV(_W9 zk!tkVsKssHc;$DWR%w}6Lh<AE@k)1%4By$C}lTEWkn|0oZK05wQnlBNn&OALg1Q(S1h+`ky#JK rv%KClLRTtWCvB~!Wid-CmgURpmJ=+m6fF^{&42#`Ffw6#ogM%HDT!X8 literal 1219 zcmV;!1U&m6iwFQ#C|6?w|CLzFuHz^W{gqbMBTL=Vokg$aPb^|r93~h%fHOBent$&y zwi6txfV+vJI)~zM>H+@m^p}?-I4{QO^z+-P7amT3d^?E&v~Og;*lzIn*Vz7L)?x$_ z@Q;ZG?qHoX`VH%pTtLzH7M!EO^TR`cl+itx_TL5$7v-$97L&S=aw?OTSrcyg2IpoY9B9LdA1mRfksJ0`_q zMv`YSNQPoeh%+v>zo%V{m2xlUatRo73RxIa`BY3;g?!BLx!BAMVM4Vy;%l=IIhtXA zWi>VHs6Lk3!>B)kvM|`7^#BurGW(u{zfxvQEvcZT z?-UzDjuRE;D`>17P@aA07R@M0Z{$!sBuNu^45;HFou1;=V{)E$=; zS7zuOa}&eKmWx>DIjF;X;b8281f%YjU`fuc=9|W%rz;G_q)JTS_0r;mX~3+Y#b$vK?lEg996mj0B1!`|BoVcmmo7j7OtpJqM7cYF zX}vqZX~BzNs^SHhQ-Y{@t36xvb_!kfcC=Xb0@2A|hg1m0IXU#Jam*tuAj=OiL%?WX zaiIzZZn$yHMT}BCI1n!w43u#>Dd8{1jtopB{0`BQ;3eMS+jp^!!gtr!X!U44hW3JL z@JPI+x9%OlLO0GDYfqb;)=rT^i&oF$IZ2|Ofv<=gc+$VOLc9HT9t|~TyawTpI02t{ zEZ5V>Npm2i^2Bg%PF|*%LP!9^~t3d>#r6>-!LGth4tlOAK?Q2>Ln}#|4BXM zIYjk*641s$#J%N-Vd~DQPb}onQ{N(2GWsm^Av$PTru17Q1(+x9@42x%33xXx!s-gA32jjm3XEiwT9#W;B)iG(@wR z??X9qwQnLUX=3H{g^6o6Ua{S(O=dk%W6f+k;G%m4)97C9wDv1@i0;*tME7bgM)yi% zqkDx*(Y>-V(H#*=(M?iWkx4cucZOW;n~H9dSUG)R;+l