5 Commits

Author	SHA1	Message	Date
Ross Wolf	978a8d9df8	[Bug] Set threshold.field to empty string instead of null (#87)	2020-07-22 19:31:09 -04:00
Justin Ibarra	7647699e2b	Add support for threshold rules (#65)	2020-07-16 19:06:34 -05:00
Ross Wolf	db4f50d4b8	Improve the validation and testing time (#61) ... * Improve the validation and testing time * Lint fix * Cache schema validation	2020-07-15 08:05:55 -06:00
Garrett Spong	c28795c25e	[New Rule] Elastic Endpoint and External Alerts (#42) ... * Adds the Elastic Endpoint and External Alerts rules and required schema updates * Optimizing queries to fix tests * Apply PEP257 changes * Apply suggestions from code review * Update rules/cross-platform/external_alerts.toml * Last fixes from review * Fixing test for unrequired default * Adding increased default max_signals to not interfere with testing * Make promotions folder * Refining Elastic Endpoint rule index Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2020-07-09 15:24:36 -06:00
Ross Wolf	3b305d3003	Add rule loader and dependencies ... Co-Authored-By: Justin Ibarra <brokensound77@users.noreply.github.com>	2020-06-29 23:17:42 -06:00