Commit Graph

8 Commits

Author SHA1 Message Date
Ruben Groenewoud d968f62a5a [Rule Tuning] Linux DR Tuning - 10 (#5510)
* [Rule Tuning] Linux DR Tuning - 10

* Update persistence_udev_rule_creation.toml

* Refactor ESQL query for Linux process events

* Refactor query in persistence_web_server_sus_command_execution rule

Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace.

* Update persistence_systemd_netcon.toml

* Update persistence_web_server_sus_child_spawned.toml

* Refactor process.parent.name conditions in TOML file

* Update persistence_web_server_unusual_command_execution.toml

* Update persistence_web_server_unusual_command_execution.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
2026-01-08 09:32:57 +01:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
shashank-elastic f3b0dc1954 Prep for next release 8.16 (#3919) 2024-07-24 11:19:56 -04:00
eric-forte-elastic baee89de9b Revert "Prep for next release 8.16 (#3914)"
This reverts commit 4245a815d2.
2024-07-23 14:06:04 -04:00
shashank-elastic 4245a815d2 Prep for next release 8.16 (#3914)
* Prep for Release 8.16

* Add subscription

* Remove double subscription

* Formatting

* Formatting

* Revert Beaconing rules minstack and lock version
2024-07-23 13:04:03 -04:00
Mika Ayenson 03c99d22d3 Revert "Prep for Release 8.16 (#3913)"
This reverts commit 01135085f6.
2024-07-23 09:50:04 -05:00
shashank-elastic 01135085f6 Prep for Release 8.16 (#3913) 2024-07-23 09:42:26 -05:00
Ruben Groenewoud c87c4c9f5d [New Rules] PAM Module Creation & Unusual PAM Grantor (#3743)
* [New Rules] PAM Module Creation & Unusual PAM Grantor

* Update persistence_unusual_pam_grantor.toml

* Update persistence_pluggable_authentication_module_creation.toml

* Update rules/linux/persistence_pluggable_authentication_module_creation.toml

* Update persistence_pluggable_authentication_module_creation.toml

* Update persistence_unusual_pam_grantor.toml

* Update rules/linux/persistence_pluggable_authentication_module_creation.toml
2024-06-11 11:51:33 +02:00