security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update multiple_alerts_elastic_defend_netsecurity_by_host.toml (#5375)

Browse Source
This commit is contained in:
Samirbous
2025-12-01 15:18:19 +00:00
committed by GitHub
parent 5e1ac4f450
commit bcd1b5049a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml
+4 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/11/18"
integration = ["endpoint", "panw", "fortinet_fortigate", "suricata"]
maturity = "production"
updated_date = "2025/11/18"
updated_date = "2025/11/28"
[rule]
author = ["Elastic"]
@@ -65,6 +65,9 @@ FROM logs-* metadata _id
Esql.destination_ip_values = VALUES(destination.ip)
by Esql.source_ip
| where Esql.event_module_distinct_count >= 2
| eval concat_module_values = MV_CONCAT(Esql.event_module_values, ",")
// Make sure an endpoint alert is present along one of the network ones
| where concat_module_values like "*endpoint*"
| keep Esql.alerts_count, Esql.source_ip, Esql.destination_ip_values, Esql.host_id_values, Esql.user_name_values, Esql.event_module_values, Esql.message_values, Esql.process_executable_values
'''
note = """## Triage and analysis