3 Commits

Author	SHA1	Message	Date
Jonhnathan	458e67918a	[Security Content] Small tweaks on the setup guides (#3308) ... * [Security Content] Small tweaks on the setup guides * Additional Fixes * Avoid touching deprecated rules	2024-03-11 09:09:40 -03:00
Apoorva Joshi	9a9f5437f2	Update Advanced Analytics config guides (#3302) ... * Updating config guides for Advanced Analytics rules * More updates * Update setup instructions for LMD * Adding more guides * update TestRuleTiming unit test to ignore advanced analytic rules * fixed flake error * Moving config guides under setup instead of note * Removing leading and trailing whitespace * Updates as requested by PM * Updating related integrations, minor updates to setup guides * fixing unit tests to ignore analytic packages with multiple integration tags * Update tests/test_all_rules.py * fixing linting errors --------- Co-authored-by: Kirti Kirti <kirti.kirti@elastic.co> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>	2023-12-13 07:53:41 -08:00
Terrance DeJesus	835be9b245	[New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193) ... * adding new LotL rules * added endpoint tags; updated technique mapping * added missing data source tag * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * updated note, references and date * changed ATT&CK technique to binary proxy execution --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>	2023-10-23 12:23:56 -04:00