5f54eb8006
chore: Removing RTAs ( #4437 )
...
* Delete RTAs
* Delete RTA-related orchestration code
* Drop RTAs from tests
* Remove RTAs from README
* Further cleanup
* Readme update
* Version bump and no more RTAs
* Styling fixes
* Drop RTAs from config files
* Drop `rule-mapping.yaml`
* Bring back event collector / normalizer
* Drop rta mention
* Cleanup rta leftovers
* Style fix
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
2025-03-05 12:35:57 +01:00
ad180777cf
[Maintenance] Repository Config Update ( #4359 )
...
* updating tokens
* bumped patch
* updated navigator gist ID
* updated naming
* Update .github/workflows/manual-backport.yml
* updated navigator url
* updated noreply email
* updated naming
* Update .github/workflows/manual-backport.yml
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com >
* updating README
* updated gist token
* replaced guidelines token with GITHUB_TOKEN
---------
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com >
2025-01-09 16:35:18 -05:00
50e23ba242
[Hunting] Re-factor Hunting Library Code ( #4085 )
...
* updating python code for hunting library
* fixed okta queries; added MITRE search capability
* fixed hunting unit test imports
* fixed duplicate UUID; fixed duplicate index entry bug
* fixed technique finding sub-technique in search
* added more unit tests
* linted
* flake errors addressed; fixed unit test import; fixed markdown generate bug
* added description for generate-markdown command
* updated README
* adjusted YAML index, adjusted code for index changes
* adjusted relative imports; updated CODEOWNERS
* adding updates; moving to different branch for main dependencies
* finished run-query command; made some code adjustments
* removed some comments
* revised makefile; fixed unit tests; adjusted detection rules pyproject
* updated README
* updated README
* adjusted unit tests; adjusted hunt guidelines; updated makefile; adjusted several commands
* adjusted package to be more object-oriented
* removed unused variable
* Add simple breakdown stats
* addressed feedback; added keyword option for search
* Update hunting/README.md
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Update detection_rules/etc/test_hunting_cli.bash
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com >
* addressing feedback
* addressed feedback
* added message for unknown index; fixed function call
* fixed search command
* fixed flake error
---------
Co-authored-by: Mika Ayenson <Mika.ayenson@elastic.co >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com >
2024-10-03 12:47:40 -04:00
78837549e8
[FR] Bundle KQL & Kibana libs into base dependencies ( #3662 )
2024-05-13 14:29:03 -05:00
65441b8e67
[FR] Update readme with wsl instructions for py312 ( #3649 )
...
* Update README
* Removed DaC Specifics
* Add troubleshooting guide.
* Update Troubleshooting.md
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
---------
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2024-05-07 13:50:40 -04:00
c8c8c96956
[FR] Add ability to generate hunt index ( #3643 )
2024-05-03 13:43:22 -05:00
00b8a77f50
[FR] Add Hunt Structure and Initial LLM Queries 🚀 ( #3637 )
2024-05-03 09:33:06 -05:00
e37bc6f781
Update README.md ( #3524 )
2024-03-20 13:32:26 -05:00
d26981f712
[FR] Independently package kql / kibana and bump to py3.12 ( #3514 )
2024-03-14 20:18:32 -05:00
3d2a36be32
Revert "[FR] Independently package kql / kibana and bump to py3.12 ( #3492 )"
...
This reverts commit fc139fc3c2
2024-03-14 19:48:50 -05:00
fc139fc3c2
[FR] Independently package kql / kibana and bump to py3.12 ( #3492 )
2024-03-14 19:14:25 -05:00
90bc760c56
Update README.md to fix etc path ( #2913 )
2023-07-06 15:00:45 -04:00
493c638252
[Bug] Add pywin32 to windows install ( #2886 )
2023-06-28 10:47:29 -04:00
6449cecd08
[FR] Add support for building block rules (BBR) ( #2822 )
...
* added test bbr
* initial implementation
* Added Unit test and exempted bbr from integrations
* fixed linting
* Add schema validation to building block rules
* add separate error messages
* fixed linting
* Add testing bbr validation
* fixed linting
* Add default values
* fixed linting
* added defaults
* fixed linting
* cleaned up test rule
* removed .gitkeep
* read .gitkeep
* Switch to using validates_schema
* addressing some linting
* fixed linting
* Update detection_rules/schemas/definitions.py
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com >
* add env variable check
* fix skip function
* updated name
* Update detection_rules/schemas/definitions.py
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com >
* Add bbr validation unit test
* Clean up comments
* fix linting
* Move convert time to utils
* Moved to rules_building_block
* Add check for only bbr in bbr dir
* fix linting
* additional linting fix
* Changed to bbr rule loader
* fixed bbr default
* Updated error messages and README
* fixed more linting
* Updating root level README
* Fixed convert_time_span calls
* fixed typo in unit test logic and updated txt
* fixed error message
* updated comment for clarity
* Update detection_rules/rule.py
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com >
* Update detection_rules/rule.py
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com >
* Updated validation methods for clarity
* fix doctring location
* Fixed typo
* updated error messages.
* removed excess whitespace
* Add per rule bypass
* Add single rule bypass
* Split unit tests
* Update detection_rules/rule.py
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Update detection_rules/rule.py
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
---------
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2023-06-20 09:00:30 -04:00
5bf69b7967
Update package and install process ( #1948 )
2022-12-08 15:49:49 -05:00
6219fc06b9
Move etc under detection_rules ( #1885 )
...
* Move etc directory under detection_rules
* Prepend original `etc` path with `detection_rules`
* Update docstrings in util and CODEOWNERS
* Add resiliency to tags to account for the old directory structure
* Bug fix: remove unused param caused by commit 6ed1a39efebrokensound77@users.noreply.github.com >
2022-05-02 10:11:21 -04:00
254b4eb23f
Generate ATT&CK navigator layer files and links ( #1787 )
...
* Generate attack layer files and build with package
* add update-navigator-gists command
* add workflow to update navigator gists on pushes to main
* Add coverage readme
* fix keys for links
* update navigator layer names
* purge gist files prior to update; add badge
* Update how the navigator links are displayed
* moved navigator code to dedicated and refactored to dataclasses
* convert gist links to permalink versions
* alphabetize; catch 404 for gist update
2022-03-04 08:20:44 -09:00
9bbb122d20
Update the prebuilt rule link
2021-04-14 22:02:46 -06:00
c0af222e7e
Move Rule into a dataclass ( #1029 )
...
* WIP: Convert Rule to a dataclass
* Fix make release
* Lint fixes
* Remove dead code
* Fix lint and tests
* Use Python 3.8 in GitHub actions
* Update README to 3.8+
* Add Python 3.8 assertion
* Fix is_dirty property
* Remove incorrect pop from contents
* Add mixin with from_dict() and to_dict() methods
* Bypass validation for deprecated rules
* Fix rule_prompt
* Fix dict_hash usage
* Fix rule_event_search
* Switch to definitions.Date
* Fix toml-lint command, ignoring 'unneeded defaults'
* Moved severity Literal to definitions.Severity
* Remove BaseMarshmallowDataclass
* Fix lint and tests
* Add maturity to metadata for rule prompt loop
* Fix typo in devtools
* Use rule loader to load single rule in toml-lint
* Add Schema hint to __schema method
* Add MITREAttackURL definition
* Fix is_dirty to compare sha<-->sha
* Normalize the autoformatted rule output for API and toml-lint
* Make the package hash match
* Make the rule object mutable but not rule contents
* Restore the rules
2021-03-24 10:24:32 -06:00
3fc34b86f2
Update License to Elastic v2 ( #944 )
2021-03-03 22:12:11 -09:00
e2c860693c
Repaired merge from PR 876 - RTA docs ( #935 )
2021-02-04 08:34:54 -09:00
33e731416d
Add badges to README.md ( #596 )
2020-11-30 06:14:08 -08:00
bd680a2bd4
Re-organize commands under more specific click groups ( #356 )
...
* Restructure commands under more specific click groups
* standardize CLI error handling
* add global debug options
* move es and kibana clients into their click groups
* move commands and groups to dedicated files
* distinguish variable names for better env/config parsing
2020-10-07 12:15:33 -08:00
5310ec722a
Fix NOTICE.txt typo
2020-08-24 08:06:58 -06:00
1fccc39699
Change verbiage around Elastic license
2020-08-19 11:47:10 -06:00
28c869fb5f
Expand documentation on CLI and workflows ( #130 )
2020-08-18 14:27:51 -05:00
83e33e70bb
Rename slack channel
2020-07-30 19:44:02 -06:00
89d6498c42
Add webinar link
2020-07-17 09:31:57 -06:00
4fd66d690d
Fix blog post link
2020-06-30 11:20:42 -06:00
d8675b0599
Add links to blog post and rule reference
2020-06-30 10:57:45 -06:00
5e7ea22eef
Fix directory order
2020-06-30 09:57:02 -06:00
e1317386ca
Edits to documentation
2020-06-30 08:08:30 -06:00
133d335728
Alphabetize the subdirectory order
2020-06-29 23:57:31 -06:00
fb0d36941c
Add documentation and update license notice
2020-06-29 23:21:16 -06:00
Sergey Polzunov