4 Commits

Author	SHA1	Message	Date
Terrance DeJesus	4997f95300	[Rule Tuning] Link Elastic Security Labs content to compatible rules (#2388) ... * added elastic security labs URL references * Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml Is not compatible with Windows blog. * Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml Is not compatible with Windows blog. Reverting updated date. * Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml Is not compatible with Windows blog. Reverting updated date. * Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml Is not compatible with Windows blog. * Update rules/ml/execution_ml_windows_anomalous_script.toml Is not compatible with Windows blog. Reverting updated date. * Update rules/linux/credential_access_collection_sensitive_files.toml Not compatible with Windows blog. Reverting updated date. * Update rules/linux/credential_access_collection_sensitive_files.toml Not compatible with Windows blog. * added credential access URL for mimikatz rules * updated version ml windows anomalous script rule * removed change to macOS rule since no blog correlation	2022-11-07 15:17:49 -05:00
Justin Ibarra	46d5e37b76	min_stack all rules to 8.3 (#2259) ... * min_stack all rules to 8.3 * bump date Co-authored-by: Mika Ayenson <mika.ayenson@elastic.co>	2022-08-24 10:38:49 -06:00
Justin Ibarra	6bdfddac8e	Expand timestamp override tests (#1907) ... * Expand timestamp_override tests * removed timestamp_override from eql sequence rules * add config entry for eql rules with beats index and t_o * add timestamp_override to missing fields	2022-04-01 15:27:08 -08:00
Justin Ibarra	97835bc5c5	Move misplaced rule to proper folder (#1756) ... Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>	2022-02-04 11:35:29 -09:00