sigma-rules

Author	SHA1	Message	Date
shashank-elastic	8afded11e7	Rule tuning as part of Linux Detection Rules Review (#2170 )	2022-07-29 21:55:49 +05:30
Mika Ayenson	a52751494e	2058 add setup field to metadata (#2061 ) * Convert config header to setup in note field * Parse note field into separate setup and note field with marko gfm * only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>	2022-07-18 15:41:32 -04:00
Justin Ibarra	6bdfddac8e	Expand timestamp override tests (#1907 ) * Expand timestamp_override tests * removed timestamp_override from eql sequence rules * add config entry for eql rules with beats index and t_o * add timestamp_override to missing fields	2022-04-01 15:27:08 -08:00
Justin Ibarra	3fc34b86f2	Update License to Elastic v2 (#944 )	2021-03-03 22:12:11 -09:00
Justin Ibarra	645a0cd67b	[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945 ) * [Rule Tuning] Add timestamp_override field to rules * add tests for lookback and timestamp_override * fix dates and add test to ensure updated > creation	2021-02-17 19:49:58 -09:00
Samirbous	ffaf689778	[New Rule] Persistence via KDE AutoStart Script or Desktop File Modif… (#809 ) * [New Rule] Persistence via KDE AutoStart Script or Desktop File Modification * Update persistence_kde_autostart_modification.toml * Update rules/linux/persistence_kde_autostart_modification.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/linux/persistence_kde_autostart_modification.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * relinted * Update rules/linux/persistence_kde_autostart_modification.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * format * date Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2021-02-09 10:47:05 +01:00

6 Commits