7 Commits

Author	SHA1	Message	Date
Justin Ibarra	6ef5c53b0c	Cleanup note field in rules (#1194) ... * standardize usage of note field	2021-05-10 13:40:56 -08:00
Justin Ibarra	3fc34b86f2	Update License to Elastic v2 (#944)	2021-03-03 22:12:11 -09:00
Justin Ibarra	90a9320f93	[Rule Tuning] Remove timestamp_override for endgame-* promotion rules (#951) ... * remove timestamp_override from endgame promotion rules * updated version.lock to previous state for endgame promotion rule changes * fix incorrect year in updated_date	2021-02-17 13:48:57 -09:00
Justin Ibarra	61deed3fd2	[Rule Tuning] 7.11.2: Add timestamp_override to all query and non-sequence EQL rules (#948) ... * [Rule Tuning] Add timestamp_override field to 7.11.0 rules * Lock versions for 7.11.2 rules	2021-02-16 10:52:48 -09:00
Brent Murphy	627610401c	[Rule Tuning] Update rules for new Fleet integrations (#729) ... * update azure indicies * remove . in index to match prior cloud rules * update o365 indicies * add event.dataset:google_workspace.admin to existing google workspace rules * gcp syntax * add gcp index * update gcp index * update index patterns for google workspace rules * update gcp index2 * update updated_date * update event outcome for azure Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>	2020-12-18 12:23:12 -05:00
Justin Ibarra	97ee8cc9ac	Refresh beats and ecs schemas and default to use latest to validate (#570) ... * Refresh beats and ecs schemas and default to use latest to validate * remove incorrect ecs_version from zoom rule * remove stale ecs_version from rules	2020-12-01 13:24:20 -09:00
David French	10d4e5d8c9	[New Rule] Google Workspace Role Modified (#556) ... * Create persistence_google_workspace_role_modified.toml * fix tpyo 🙃	2020-11-18 09:13:44 -07:00