01b1e8be26
[Rule Tuning] Update Tags for Cloud Rules ( #99 )
...
* [Rule Tuning] Update Tags for Cloud Rules
* commenting out specifying alphabetical tag order in rule formatter
* Update rule_formatter.py
* py lint
* Lint fix comments
* update modified dates
* Update credential_access_secretsmanager_getsecretvalue.toml
* adding Continuous Monitoring tag
* update tags
* fixed and in tags
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2020-08-03 17:15:15 -04:00
978a8d9df8
[Bug] Set threshold.field to empty string instead of null ( #87 )
2020-07-22 19:31:09 -04:00
7647699e2b
Add support for threshold rules ( #65 )
2020-07-16 19:06:34 -05:00
916917a619
Update rule.py
2020-07-15 09:40:07 -05:00
db4f50d4b8
Improve the validation and testing time ( #61 )
...
* Improve the validation and testing time
* Lint fix
* Cache schema validation
2020-07-15 08:05:55 -06:00
e96eabaa2e
Generate linted .ts in package ( #49 )
...
* Generate linted .ts in package
* (Lin|ni)t changes
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-07-09 17:33:28 -06:00
c28795c25e
[New Rule] Elastic Endpoint and External Alerts ( #42 )
...
* Adds the Elastic Endpoint and External Alerts rules and required schema updates
* Optimizing queries to fix tests
* Apply PEP257 changes
* Apply suggestions from code review
* Update rules/cross-platform/external_alerts.toml
* Last fixes from review
* Fixing test for unrequired default
* Adding increased default max_signals to not interfere with testing
* Make promotions folder
* Refining Elastic Endpoint rule index
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-07-09 15:24:36 -06:00
8a561b3817
Add kibana-push command ( #38 )
...
* Add kibana-push command
* Add ctx.exit instead of return
* Make the base branch configurable
2020-07-08 18:02:12 -06:00
119c98f05f
Package kibana index file with release rules ( #40 )
2020-07-08 18:58:00 -05:00
e0f2e8b4a9
Add dataset and index to network rules ( #15 )
...
* Add dataset and index to network rules
* Restore iptables changes
* Fix beats parsing logic
* Updated date and ECS version
* Only update modules if empty
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2020-07-08 13:19:35 -06:00
29a92f8976
Package notice file with release ( #32 )
2020-07-08 13:17:42 -05:00
e2d97b0a74
Remove unreachable and legacy code
...
Co-Authored-By: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-06-30 10:12:23 -06:00
0ddb8ee798
Switch to click.echo() for the banner
2020-06-29 23:58:20 -06:00
3b305d3003
Add rule loader and dependencies
...
Co-Authored-By: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-06-29 23:17:42 -06:00
Brent Murphy