sigma-rules

Author	SHA1	Message	Date
Terrance DeJesus	deab1c0161	[Rule Tuning] Change event.dataset to data_stream.dataset (#5943 ) * [Rule Tuning] Change event.dataset to data_stream.dataset * updating ESQL field names	2026-04-10 12:27:52 -04:00
Mika Ayenson, PhD	8993d1450b	[Rule Tuning] Add Supplemental Mitre Mappings (#5876 ) --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>	2026-04-01 09:12:42 -05:00
Ruben Groenewoud	d968f62a5a	[Rule Tuning] Linux DR Tuning - 10 (#5510 ) * [Rule Tuning] Linux DR Tuning - 10 * Update persistence_udev_rule_creation.toml * Refactor ESQL query for Linux process events * Refactor query in persistence_web_server_sus_command_execution rule Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace. * Update persistence_systemd_netcon.toml * Update persistence_web_server_sus_child_spawned.toml * Refactor process.parent.name conditions in TOML file * Update persistence_web_server_unusual_command_execution.toml * Update persistence_web_server_unusual_command_execution.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-08 09:32:57 +01:00
Mika Ayenson	fe8c81d762	[FR] Generate investigation guides (#4358 )	2025-01-22 11:17:38 -06:00
shashank-elastic	63e91c2f12	Back-porting Version Trimming (#3704 )	2024-05-23 00:45:10 +05:30
Mika Ayenson	2c3dbfc039	Revert "Back-porting Version Trimming (#3681 )" This reverts commit `71d2c59b5c`.	2024-05-22 13:51:46 -05:00
shashank-elastic	71d2c59b5c	Back-porting Version Trimming (#3681 )	2024-05-23 00:11:50 +05:30
Jonhnathan	458e67918a	[Security Content] Small tweaks on the setup guides (#3308 ) * [Security Content] Small tweaks on the setup guides * Additional Fixes * Avoid touching deprecated rules	2024-03-11 09:09:40 -03:00
Ruben Groenewoud	5a80423003	[BBR Promotion] Linux BBR --> DR Promotion (#3472 ) * [BBR Promotion] Linux BBR --> DR Promotion * [BBR Promotion] Linux BBR --> DR Promotion --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2024-03-06 10:49:42 -03:00

9 Commits