 Mika Ayenson
|
fe8c81d762
|
[FR] Generate investigation guides (#4358)
|
2025-01-22 11:17:38 -06:00 |
|
|
shashank-elastic
|
d2502c7394
|
Prep for Release 8.17 (#4256)
|
2024-11-07 23:53:04 +05:30 |
|
|
Mika Ayenson
|
03c99d22d3
|
Revert "Prep for Release 8.16 (#3913)"
This reverts commit 01135085f6.
|
2024-07-23 09:50:04 -05:00 |
|
|
shashank-elastic
|
01135085f6
|
Prep for Release 8.16 (#3913)
|
2024-07-23 09:42:26 -05:00 |
|
|
James Valente
|
8baf5dc2d8
|
Add exceptions to C2 Beaconing Activity (#3771)
|
2024-06-11 18:43:46 +05:30 |
|
|
Gus Carlock
|
8b28a515c1
|
Update rule setup instructions for UEBA packages (#3652)
* update detection-rules instructions for UEBA packages
---------
Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com>
|
2024-05-28 14:21:46 -05:00 |
|
|
Susan
|
a4ecfe3ccf
|
Beaconing - Add whitelist to rules, with some more processes (#3497)
* Add whitelist to rules, with some more processes
* Update rules exceptionlist
* Update exceptions
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
|
2024-03-14 15:51:02 -04:00 |
|
|
Jonhnathan
|
458e67918a
|
[Security Content] Small tweaks on the setup guides (#3308)
* [Security Content] Small tweaks on the setup guides
* Additional Fixes
* Avoid touching deprecated rules
|
2024-03-11 09:09:40 -03:00 |
|
|
Terrance DeJesus
|
1c10c37468
|
[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368)
* updated timestamp override unit test; fixed rules missing this field
* fixed flake error
* simplified and consolidated logic
* Update tests/test_all_rules.py
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
* Update tests/test_all_rules.py
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
* added comments
* updated logic; added comments; removed unused variables
* removed custom python script
* updated dates
* removed deprecated rule change
* updated dates
---------
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
|
2024-01-17 14:14:38 -05:00 |
|
|
Apoorva Joshi
|
9a9f5437f2
|
Update Advanced Analytics config guides (#3302)
* Updating config guides for Advanced Analytics rules
* More updates
* Update setup instructions for LMD
* Adding more guides
* update TestRuleTiming unit test to ignore advanced analytic rules
* fixed flake error
* Moving config guides under setup instead of note
* Removing leading and trailing whitespace
* Updates as requested by PM
* Updating related integrations, minor updates to setup guides
* fixing unit tests to ignore analytic packages with multiple integration tags
* Update tests/test_all_rules.py
* fixing linting errors
---------
Co-authored-by: Kirti Kirti <kirti.kirti@elastic.co>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
|
2023-12-13 07:53:41 -08:00 |
|
|
Apoorva Joshi
|
a4f9cf4616
|
[New Rule] Adding Beaconing Rules from Advanced Analytic Beaconing Package (#3128)
* Adding beaconing rules
* Update rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml
Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>
* Update rules/integrations/beaconing/command_and_control_beaconing.toml
Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>
* Updating min stack version
* added beaconing to manifests and schemas; updated rules
---------
Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
|
2023-10-30 10:05:24 -04:00 |
|