 Jonhnathan
|
1c50f35aed
|
[Security Content] Update rules based on docs review (#1803)
* Adds suggestions from security-docs
* Update rules/windows/lateral_movement_powershell_remoting_target.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
|
2022-03-01 21:39:30 -03:00 |
|
|
Jonhnathan
|
cbf0798646
|
[Rule Tuning] Change Rules to use Source.ip instead of source.address (#1704)
* Replace source.address to source.ip for compatibility
* Change query
* Missing and condition
|
2022-01-13 16:40:10 -03:00 |
|
|
Jonhnathan
|
cc241c0b5e
|
[Rule Tuning] Update network.direction (#1547)
* Update network.direction
* bump updated_date
|
2021-10-13 21:46:36 -03:00 |
|
|
Justin Ibarra
|
3fc34b86f2
|
Update License to Elastic v2 (#944)
|
2021-03-03 22:12:11 -09:00 |
|
|
Brent Murphy
|
64366218c7
|
adjust risk score (#938)
|
2021-02-08 13:15:42 -05:00 |
|
|
Justin Ibarra
|
a0e86e20d6
|
[Rule Tuning] Add windows integration index to rules (#923)
|
2021-01-28 20:53:57 -09:00 |
|
|
Samirbous
|
ccea74d9d8
|
[New Rule] Incoming Execution via PowerShell Remoting (#624)
* [New Rule] Incoming Execution via PowerShell Remoting
* eql syntax
* Update rules/windows/lateral_movement_powershell_remoting_target.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* Update rules/windows/lateral_movement_powershell_remoting_target.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* ecs_version
* Update rules/windows/lateral_movement_powershell_remoting_target.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
|
2020-12-08 17:16:10 +01:00 |
|