8 Commits

Author	SHA1	Message	Date
Ross Wolf	c9d6527280	Revert #1440 new endpoint promotion rule (#1470) ... * Revert #1440 new endpoint promotion rule * Set the updated_at date	2021-09-03 08:07:20 -06:00
Nic	8b2c8c2e03	[Rule tuning] Azure Active Directory High Risk Sign-in (#1463) ... * Add Aggregated Risk Level * There can be a risk_level_during_signin:low but have a risk_level_aggregated:high which is also just as concerning and must be alerted on. * An example is a password spray attack and have a successful login. Which makes me consider a new rule for interesting risk event types	2021-08-30 14:33:44 -08:00
Ross Wolf	675e870a30	Set min stack to 7.15 for Behavior Protection promotion	2021-08-26 08:53:02 -06:00
Ross Wolf	3b338baab0	[New Rule] Endpoint Security Behavior Protection (#1440) ... * [New Rule] Endpoint Security Behavioral Protection * Update readme and labeler for endpoint integration * Fix new rule to use event.code * Fix old rule to use event.code * Changed from behavioral to behavior * Rename elastic_endpoint_security_behavioral.toml to elastic_endpoint_security_behavior_protection.toml * Back from the future (updated_date) Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>	2021-08-25 09:56:59 -06:00
Austin Songer	3b29498907	[Rule Tuning] AWS Security Group Configuration Change Detection (#1426) ... * move rule "AWS Security Group Configuration Change Detection" to integrations directory and add "aws" integration	2021-08-14 20:34:13 -08:00
Justin Ibarra	f8f643041a	[Rule tuning] Revise rule description and other text (#1398)	2021-08-03 13:07:47 -08:00
Justin Ibarra	b736d6e748	[Rule Tuning] Rule description tweaks (#1388)	2021-07-29 10:56:13 -08:00
Ross Wolf	1882f4456c	[Fleet] Track integrations in folder and metadata (#1372) ... * Track integrations in folder and metadata * Remove duplicate entry * Update note and tests	2021-07-21 15:24:56 -06:00