Commit Graph

7 Commits

Author SHA1 Message Date
Terrance DeJesus deab1c0161 [Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names
2026-04-10 12:27:52 -04:00
Mika Ayenson, PhD 8993d1450b [Rule Tuning] Add Supplemental Mitre Mappings (#5876)
---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
2026-04-01 09:12:42 -05:00
Isai 9e6bf04e82 [Rule Tunings] AWS Removing Disclaimer from IGs (#5567)
- Removing the genAI disclaimer for the AWS ruleset Investigation guides which were all manually modified during the most recent audit.
- Removing any numbering in the investigation guides to maintain better consistency across guides
- Fixed any spacing inconsistencies
2026-01-20 15:52:48 -05:00
Isai 4cde57de07 [Tuning] First Time AWS Cloudformation Stack Creation by User (#5036)
* [Tuning] First Time AWS Cloudformation Stack Creation by User

- corrected a creation_date error
- Removed `CreateStackSet` API call as this only creates a blueprint for creating stack instances across multiple AWS accounts and regions but does not actually create the resources
- Added `CreateStackInstances` API call which is used to create resources defined in the StackSet
- removed user from rule name as this also triggers for roles
- edited description and investigation guide
- added Mitre technique

* adding highlighted fields
2025-08-29 12:36:21 -04:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
shashank-elastic d2502c7394 Prep for Release 8.17 (#4256) 2024-11-07 23:53:04 +05:30
Isai f2eb78219c [New Rule] AWS IAM User or Role Created Cloudformation Stack for First Time (#3923)
* [New Rule] AWS IAM User or Role Created Cloudformation Stack for First Time

* Update discovery_new_terms_sts_getcalleridentity.toml

* Update execution_new_terms_ec2_instance_cloudformation_createstack.toml

* Update rules/integrations/aws/execution_new_terms_ec2_instance_cloudformation_createstack.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* rule name change, removed ec2

* Update rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
2024-07-31 16:55:49 -04:00