3 Commits

Author	SHA1	Message	Date
Terrance DeJesus	1c10c37468	[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368) ... * updated timestamp override unit test; fixed rules missing this field * fixed flake error * simplified and consolidated logic * Update tests/test_all_rules.py Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update tests/test_all_rules.py Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * added comments * updated logic; added comments; removed unused variables * removed custom python script * updated dates * removed deprecated rule change * updated dates --------- Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>	2024-01-17 14:14:38 -05:00
Apoorva Joshi	9a9f5437f2	Update Advanced Analytics config guides (#3302) ... * Updating config guides for Advanced Analytics rules * More updates * Update setup instructions for LMD * Adding more guides * update TestRuleTiming unit test to ignore advanced analytic rules * fixed flake error * Moving config guides under setup instead of note * Removing leading and trailing whitespace * Updates as requested by PM * Updating related integrations, minor updates to setup guides * fixing unit tests to ignore analytic packages with multiple integration tags * Update tests/test_all_rules.py * fixing linting errors --------- Co-authored-by: Kirti Kirti <kirti.kirti@elastic.co> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>	2023-12-13 07:53:41 -08:00
Apoorva Joshi	a4f9cf4616	[New Rule] Adding Beaconing Rules from Advanced Analytic Beaconing Package (#3128) ... * Adding beaconing rules * Update rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> * Update rules/integrations/beaconing/command_and_control_beaconing.toml Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> * Updating min stack version * added beaconing to manifests and schemas; updated rules --------- Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2023-10-30 10:05:24 -04:00