[Rule Tuning] Accepted Default Telnet Port Connection (#3954)
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
creation_date = "2020/02/18"
|
||||
integration = ["network_traffic"]
|
||||
maturity = "production"
|
||||
updated_date = "2024/05/21"
|
||||
updated_date = "2024/08/02"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -44,7 +44,7 @@ type = "query"
|
||||
query = '''
|
||||
(event.dataset:network_traffic.flow or event.category:(network or network_traffic))
|
||||
and event.type:connection and not event.action:(
|
||||
flow_dropped or denied or deny or
|
||||
flow_dropped or flow_denied or denied or deny or
|
||||
flow_terminated or timeout or Reject or network_flow)
|
||||
and destination.port:23
|
||||
'''
|
||||
|
||||
Reference in New Issue
Block a user