d31ea6253e
Refresh ATT&CK mappings to v9.0 ( #1401 )
...
* Refresh ATT&CK mappings to v9.0
* Update rules to reflect ATT&CK changes
2021-08-04 14:16:10 -08:00
0b65678d8c
[Rule tuning] Correct tags with associated threat mappings ( #1003 )
2021-03-08 14:12:29 -09:00
3fc34b86f2
Update License to Elastic v2 ( #944 )
2021-03-03 22:12:11 -09:00
645a0cd67b
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules ( #945 )
...
* [Rule Tuning] Add timestamp_override field to rules
* add tests for lookback and timestamp_override
* fix dates and add test to ensure updated > creation
2021-02-17 19:49:58 -09:00
f13e9ce0d0
[New Rule] Shell Profile Modification ( #878 )
...
* [New Rule] Shell Profile Modification
* added auditbeat index
* Update persistence_shell_profile_modification.toml
* excluding noisy processes
* Update rules/cross-platform/persistence_shell_profile_modification.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/cross-platform/persistence_shell_profile_modification.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/cross-platform/persistence_shell_profile_modification.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted
* Update rules/cross-platform/persistence_shell_profile_modification.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* added note short desc
* Update persistence_shell_profile_modification.toml
* added FPs note
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-02-10 17:44:15 +01:00
Justin Ibarra