security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[New] Alerts in Different ATT&CK Tactics by Host (#5343)

Browse Source 
* [New] Alerts in Different ATT&CK Tactics by Host

Using ES|QL and alerts risk score to identify top risky hosts based on presence of multiple alert touching at least 4 unique tactics in a 24h time Window.

* Update multiple_alerts_risky_host_esql.toml

* Update multiple_alerts_risky_host_esql.toml

* Update multiple_alerts_risky_host_esql.toml

* Update multiple_alerts_risky_host_esql.toml

* Update multiple_alerts_risky_host_esql.toml

* Update non-ecs-schema.json

* ++

* Update multiple_alerts_edr_elastic_defend_by_host.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
This commit is contained in:
Samirbous
2025-11-24 17:16:09 +00:00
committed by GitHub
parent 01c74e7e26
commit fda139f4bf
3 changed files with 206 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/etc/non-ecs-schema.json
+4 -1
View File
@@ -145,7 +145,10 @@
"kibana.alert.rule.threat.tactic.id": "keyword",
"kibana.alert.workflow_status": "keyword",
"kibana.alert.rule.rule_id": "keyword",
"kibana.alert.rule.name": "keyword"
"kibana.alert.rule.name": "keyword",
"kibana.alert.risk_score": "long",
"kibana.alert.rule.type": "keyword",
"kibana.alert.rule.threat.tactic.name": "keyword"
},
"logs-google_workspace*": {
"gsuite.admin": "keyword",