5 Commits

Author	SHA1	Message	Date
Mika Ayenson, PhD	8993d1450b	[Rule Tuning] Add Supplemental Mitre Mappings (#5876) ... --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>	2026-04-01 09:12:42 -05:00
Ruben Groenewoud	ccd3f70ee8	[Rule Tuning] Linux DR Tuning - 6 (#5497) ... * [Rule Tuning] Linux DR Tuning - 6 * Fix syntax error in discovery_esxi_software_via_grep.toml * Update discovery_pam_version_discovery.toml * Update discovery_virtual_machine_fingerprinting.toml * Revise investigation title for kernel module enumeration Updated the title of the investigation section to clarify focus on unusual kernel module enumeration. * Update discovery_port_scanning_activity_from_compromised_host.toml * Enhance ESQL query for subnet scanning detection Updated ESQL query to include additional fields and conditions for better analysis of connection attempts from compromised hosts. * Remove Elastic Endgame data source from rule --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-08 10:45:32 +01:00
Jonhnathan	0268daa17d	[Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446)	2025-02-05 15:25:45 -03:00
Mika Ayenson	fe8c81d762	[FR] Generate investigation guides (#4358)	2025-01-22 11:17:38 -06:00
Ruben Groenewoud	ac541f0b18	[New Rules] Kernel Seeking/Unpacking Activity (#4341) ... * [New Rules] Kernel Seeking/Unpacking Activity * ++	2025-01-16 12:04:04 +01:00