 Apoorva Joshi
|
c5606e7f3f
|
Update Advanced Analytics config guides (#3302)
* Updating config guides for Advanced Analytics rules
* More updates
* Update setup instructions for LMD
* Adding more guides
* update TestRuleTiming unit test to ignore advanced analytic rules
* fixed flake error
* Moving config guides under setup instead of note
* Removing leading and trailing whitespace
* Updates as requested by PM
* Updating related integrations, minor updates to setup guides
* fixing unit tests to ignore analytic packages with multiple integration tags
* Update tests/test_all_rules.py
* fixing linting errors
---------
Co-authored-by: Kirti Kirti <kirti.kirti@elastic.co>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Removed changes from:
- rules/integrations/beaconing/command_and_control_beaconing.toml
- rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml
(selectively cherry picked from commit 9a9f5437f2)
|
2023-12-13 15:58:18 +00:00 |
|
|
Terrance DeJesus
|
d72996c401
|
[New Rule] Migrate Lateral Movement Detection Rules (#3175)
* adding LMD rules
* added setup note; updated references
* adds 2.0.0 lmd manifest and schema
* adjusted min-stack for non-ML rules
(cherry picked from commit 1e514afa57)
|
2023-10-12 19:07:54 +00:00 |
|
|
Terrance DeJesus
|
138b46a423
|
removing lmd rules and fixing version lock history (#3159)
(cherry picked from commit 57c05f0444)
|
2023-10-05 16:22:34 +00:00 |
|
|
Terrance DeJesus
|
fadd7fe320
|
[Rule Tuning] Update LMD Rules Min-Stack to 8.5 (#3142)
* updating min-stack to 8.5
* updated min stack comments
(cherry picked from commit 8650b26002)
|
2023-09-27 20:23:45 +00:00 |
|
|
Apoorva Joshi
|
116a7de890
|
[New Rule] Adding Lateral Movement Rules from Advanced Analytic LMD Package (#3119)
* Adding Lateral Movement Detection rules
* added tags; adjusted tests; updated manifests and schemas
* added default value to build_integrations_schema
* combined analytic and non-dataset packages for related integrations
* adjusted machine learning definitions
* adjusted machine learning definitions
* removed splat for machine learning list due to 3.8 constraints
---------
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
(cherry picked from commit 747ee7d593)
|
2023-09-27 18:59:55 +00:00 |
|