Commit Graph

30 Commits

Author SHA1 Message Date
Eric Forte 65441b8e67 [FR] Update readme with wsl instructions for py312 (#3649)
* Update README

* Removed DaC Specifics

* Add troubleshooting guide.

* Update Troubleshooting.md

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
2024-05-07 13:50:40 -04:00
Mika Ayenson c8c8c96956 [FR] Add ability to generate hunt index (#3643) 2024-05-03 13:43:22 -05:00
Mika Ayenson 00b8a77f50 [FR] Add Hunt Structure and Initial LLM Queries 🚀 (#3637) 2024-05-03 09:33:06 -05:00
Mika Ayenson e37bc6f781 Update README.md (#3524) 2024-03-20 13:32:26 -05:00
Mika Ayenson d26981f712 [FR] Independently package kql / kibana and bump to py3.12 (#3514) 2024-03-14 20:18:32 -05:00
Mika Ayenson 3d2a36be32 Revert "[FR] Independently package kql / kibana and bump to py3.12 (#3492)"
This reverts commit fc139fc3c2.
2024-03-14 19:48:50 -05:00
Mika Ayenson fc139fc3c2 [FR] Independently package kql / kibana and bump to py3.12 (#3492) 2024-03-14 19:14:25 -05:00
Mika Ayenson 90bc760c56 Update README.md to fix etc path (#2913) 2023-07-06 15:00:45 -04:00
Mika Ayenson 493c638252 [Bug] Add pywin32 to windows install (#2886) 2023-06-28 10:47:29 -04:00
eric-forte-elastic 6449cecd08 [FR] Add support for building block rules (BBR) (#2822)
* added test bbr

* initial implementation

* Added Unit test and exempted bbr from integrations

* fixed linting

* Add schema validation to building block rules

* add separate error messages

* fixed linting

* Add testing bbr validation

* fixed linting

* Add default values

* fixed linting

* added defaults

* fixed linting

* cleaned up test rule

* removed .gitkeep

* read .gitkeep

* Switch to using validates_schema

* addressing some linting

* fixed linting

* Update detection_rules/schemas/definitions.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* add env variable check

* fix skip function

* updated name

* Update detection_rules/schemas/definitions.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Add bbr validation unit test

* Clean up comments

* fix linting

* Move convert time to utils

* Moved to rules_building_block

* Add check for only bbr in bbr dir

* fix linting

* additional linting fix

* Changed to bbr rule loader

* fixed bbr default

* Updated error messages and README

* fixed more linting

* Updating root level README

* Fixed convert_time_span calls

* fixed typo in unit test logic and updated txt

* fixed error message

* updated comment for clarity

* Update detection_rules/rule.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/rule.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Updated validation methods for clarity

* fix doctring location

* Fixed typo

* updated error messages.

* removed excess whitespace

* Add per rule bypass

* Add single rule bypass

* Split unit tests

* Update detection_rules/rule.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update detection_rules/rule.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
2023-06-20 09:00:30 -04:00
Mika Ayenson 5bf69b7967 Update package and install process (#1948) 2022-12-08 15:49:49 -05:00
Mika Ayenson 6219fc06b9 Move etc under detection_rules (#1885)
* Move etc directory under detection_rules
* Prepend original `etc` path with `detection_rules`
* Update docstrings in util and CODEOWNERS
* Add resiliency to tags to account for the old directory structure
* Bug fix: remove unused param caused by commit 6ed1a39efe

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
2022-05-02 10:11:21 -04:00
Justin Ibarra 254b4eb23f Generate ATT&CK navigator layer files and links (#1787)
* Generate attack layer files and build with package
* add update-navigator-gists command
* add workflow to update navigator gists on pushes to main
* Add coverage readme
* fix keys for links
* update navigator layer names
* purge gist files prior to update; add badge
* Update how the navigator links are displayed
* moved navigator code to dedicated and refactored to dataclasses
* convert gist links to permalink versions
* alphabetize; catch 404 for gist update
2022-03-04 08:20:44 -09:00
Ross Wolf 9bbb122d20 Update the prebuilt rule link 2021-04-14 22:02:46 -06:00
Ross Wolf c0af222e7e Move Rule into a dataclass (#1029)
* WIP: Convert Rule to a dataclass
* Fix make release
* Lint fixes
* Remove dead code
* Fix lint and tests
* Use Python 3.8 in GitHub actions
* Update README to 3.8+
* Add Python 3.8 assertion
* Fix is_dirty property
* Remove incorrect pop from contents
* Add mixin with from_dict() and to_dict() methods
* Bypass validation for deprecated rules
* Fix rule_prompt
* Fix dict_hash usage
* Fix rule_event_search
* Switch to definitions.Date
* Fix toml-lint command, ignoring 'unneeded defaults'
* Moved severity Literal to definitions.Severity
* Remove BaseMarshmallowDataclass
* Fix lint and tests
* Add maturity to metadata for rule prompt loop
* Fix typo in devtools
* Use rule loader to load single rule in toml-lint
* Add Schema hint to __schema method
* Add MITREAttackURL definition
* Fix is_dirty to compare sha<-->sha
* Normalize the autoformatted rule output for API and toml-lint
* Make the package hash match
* Make the rule object mutable but not rule contents
* Restore the rules
2021-03-24 10:24:32 -06:00
Justin Ibarra 3fc34b86f2 Update License to Elastic v2 (#944) 2021-03-03 22:12:11 -09:00
Justin Ibarra e2c860693c Repaired merge from PR 876 - RTA docs (#935) 2021-02-04 08:34:54 -09:00
David French 33e731416d Add badges to README.md (#596) 2020-11-30 06:14:08 -08:00
Justin Ibarra bd680a2bd4 Re-organize commands under more specific click groups (#356)
* Restructure commands under more specific click groups
* standardize CLI error handling
* add global debug options
* move es and kibana clients into their click groups
* move commands and groups to dedicated files 
* distinguish variable names for better env/config parsing
2020-10-07 12:15:33 -08:00
Ross Wolf 5310ec722a Fix NOTICE.txt typo 2020-08-24 08:06:58 -06:00
Ross Wolf 1fccc39699 Change verbiage around Elastic license 2020-08-19 11:47:10 -06:00
Justin Ibarra 28c869fb5f Expand documentation on CLI and workflows (#130) 2020-08-18 14:27:51 -05:00
Ross Wolf 83e33e70bb Rename slack channel 2020-07-30 19:44:02 -06:00
Ross Wolf 89d6498c42 Add webinar link 2020-07-17 09:31:57 -06:00
Ross Wolf 4fd66d690d Fix blog post link 2020-06-30 11:20:42 -06:00
Ross Wolf d8675b0599 Add links to blog post and rule reference 2020-06-30 10:57:45 -06:00
Ross Wolf 5e7ea22eef Fix directory order 2020-06-30 09:57:02 -06:00
Ross Wolf e1317386ca Edits to documentation 2020-06-30 08:08:30 -06:00
Ross Wolf 133d335728 Alphabetize the subdirectory order 2020-06-29 23:57:31 -06:00
Ross Wolf fb0d36941c Add documentation and update license notice 2020-06-29 23:21:16 -06:00