Commit Graph

4 Commits

Author SHA1 Message Date
Ruben Groenewoud d968f62a5a [Rule Tuning] Linux DR Tuning - 10 (#5510)
* [Rule Tuning] Linux DR Tuning - 10

* Update persistence_udev_rule_creation.toml

* Refactor ESQL query for Linux process events

* Refactor query in persistence_web_server_sus_command_execution rule

Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace.

* Update persistence_systemd_netcon.toml

* Update persistence_web_server_sus_child_spawned.toml

* Refactor process.parent.name conditions in TOML file

* Update persistence_web_server_unusual_command_execution.toml

* Update persistence_web_server_unusual_command_execution.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
2026-01-08 09:32:57 +01:00
shashank-elastic 059d7efa25 Prep for Release 9.0 (#4550) 2025-03-20 20:32:07 +05:30
Mika Ayenson 7c6c77932c [FR] Add Remaining Guides (#4412) 2025-01-22 14:43:30 -06:00
Ruben Groenewoud b633987e5b [New Rule] Initramfs Unpacking via unmkinitramfs (#4387)
* [New Rule] Initramfs Unpacking via unmkinitramfs

* Update rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml
2025-01-20 13:43:54 +01:00