 Jonhnathan
|
b956a4350f
|
[Rule Tuning] Multiple Alerts Involving a User (#5498)
* [Rule Tuning] Multiple Alerts Involving a User
* Update multiple_alerts_involving_user.toml
* Update multiple_alerts_involving_user.toml
* Update non-ecs-schema.json
* ++
* Update multiple_alerts_involving_user.toml
* ++
* Update non-ecs-schema.json
|
2025-12-19 12:57:25 -03:00 |
|
|
Mika Ayenson
|
fe8c81d762
|
[FR] Generate investigation guides (#4358)
|
2025-01-22 11:17:38 -06:00 |
|
|
shashank-elastic
|
63e91c2f12
|
Back-porting Version Trimming (#3704)
|
2024-05-23 00:45:10 +05:30 |
|
|
Mika Ayenson
|
2c3dbfc039
|
Revert "Back-porting Version Trimming (#3681)"
This reverts commit 71d2c59b5c.
|
2024-05-22 13:51:46 -05:00 |
|
|
shashank-elastic
|
71d2c59b5c
|
Back-porting Version Trimming (#3681)
|
2024-05-23 00:11:50 +05:30 |
|
|
Jonhnathan
|
b4c84e8a40
|
[Security Content] Tags Reform (#2725)
* Update Tags
* Bump updated date separately to be easy to revert if needed
* Update resource_development_ml_linux_anomalous_compiler_activity.toml
* Apply changes from the discussion
* Update persistence_init_d_file_creation.toml
* Update defense_evasion_timestomp_sysmon.toml
* Update defense_evasion_application_removed_from_blocklist_in_google_workspace.toml
* Update missing Tactic tags
* Update unit tests to match new tags
* Add missing IG tags
* Delete okta_threat_detected_by_okta_threatinsight.toml
* Update command_and_control_google_drive_malicious_file_download.toml
* Update persistence_rc_script_creation.toml
* Mass bump
* Update persistence_shell_activity_by_web_server.toml
* .
---------
Co-authored-by: Mika Ayenson <Mika.ayenson@elastic.co>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
|
2023-06-22 18:38:56 -03:00 |
|
|
Jonhnathan
|
0e535e5931
|
[Rule Tuning] Remove unreleased timeline from alert correlation rules (#2462)
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
|
2023-01-12 12:10:59 -03:00 |
|
|
Jonhnathan
|
0acbe1d832
|
[New Rule] Multiple Alerts Involving a User (#2401)
* [New Rule] Multiple Alerts Involving a User
* Update definitions.py
* update query
* Update multiple_alerts_involving_user.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
|
2023-01-03 12:25:40 -03:00 |
|