-
d3faf0d0d6
[New Rule] Shell Configuration Modification (#3629)
Ruben Groenewoud
2024-04-30 13:41:13 +02:00
-
ab1e9b4484
[New Rule] Shell Configuration Modification (#3629)
Ruben Groenewoud
2024-04-30 13:41:13 +02:00
-
e29994c338
[New Rule] Shell Configuration Modification (#3629)
Ruben Groenewoud
2024-04-30 13:41:13 +02:00
-
f7215a7ced
[Rule Tuning] Linux DRs (#3628)
Ruben Groenewoud
2024-04-30 13:26:09 +02:00
-
4c2dde5f32
[Rule Tuning] Linux DRs (#3628)
Ruben Groenewoud
2024-04-30 13:26:09 +02:00
-
115c3a6dfd
[Rule Tuning] Linux DRs (#3628)
Ruben Groenewoud
2024-04-30 13:26:09 +02:00
-
55a17e12db
[New] Potential privilege escalation via CVE-2022-38028 (#3616)
Samirbous
2024-04-29 15:10:27 +01:00
-
f1ea5eed21
[New] Potential privilege escalation via CVE-2022-38028 (#3616)
Samirbous
2024-04-29 15:10:27 +01:00
-
8f6de1c235
[New] Potential privilege escalation via CVE-2022-38028 (#3616)
Samirbous
2024-04-29 15:10:27 +01:00
-
09a7e2e81b
Refresh Kibana module with API updates (#3466)
Justin Ibarra
2024-04-26 11:12:50 -06:00
-
afb974a2f1
Refresh Kibana module with API updates (#3466)
Justin Ibarra
2024-04-26 11:12:50 -06:00
-
c567d3731a
Refresh Kibana module with API updates (#3466)
Justin Ibarra
2024-04-26 11:12:50 -06:00
-
dfd261590b
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3615)
integration-v8.11.13
github-actions[bot]
2024-04-23 17:59:01 +05:30
-
3cc76c318b
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3615)
integration-v8.10.16
github-actions[bot]
2024-04-23 17:59:01 +05:30
-
374f21fbc4
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3615)
github-actions[bot]
2024-04-23 17:59:01 +05:30
-
868ab80c63
Fix minstack version for 0365 in azure integration rules (#3612)
shashank-elastic
2024-04-22 19:17:49 +05:30
-
02d64808b0
Fix minstack version for 0365 in azure integration rules (#3612)
shashank-elastic
2024-04-22 19:17:49 +05:30
-
7673ba484d
Fix minstack version for 0365 in azure integration rules (#3612)
shashank-elastic
2024-04-22 19:17:49 +05:30
-
bda38d6f27
updating performance note (#3608)
Terrance DeJesus
2024-04-18 16:36:07 -04:00
-
850d992ea7
updating performance note (#3608)
Terrance DeJesus
2024-04-18 16:36:07 -04:00
-
69d42ecc71
updating performance note (#3608)
Terrance DeJesus
2024-04-18 16:36:07 -04:00
-
25dafb68f1
[Rule Tuning] Reverting To Previous Version (#3607)
Terrance DeJesus
2024-04-18 15:19:27 -04:00
-
91e69ac322
[Rule Tuning] Tuning
Account Password Reset Remotely (#3478)
Terrance DeJesus
2024-04-18 12:49:32 -04:00
-
fea73c9686
[New Rule] Potential Windows Session Hijacking via CcmExec (#3602)
Jonhnathan
2024-04-18 12:57:35 -03:00
-
e6411e64d6
[New Rule] Potential Windows Session Hijacking via CcmExec (#3602)
Jonhnathan
2024-04-18 12:57:35 -03:00
-
6ae0902a38
[New Rule] Potential Windows Session Hijacking via CcmExec (#3602)
Jonhnathan
2024-04-18 12:57:35 -03:00
-
4562d694b0
[Rule Tuning] Further Tight up Elastic Defend Index Patterns (#3584)
Jonhnathan
2024-04-16 13:26:42 -03:00
-
15f513880f
[Rule Tuning] Further Tight up Elastic Defend Index Patterns (#3584)
Jonhnathan
2024-04-16 13:26:42 -03:00
-
5004ff115c
[Rule Tuning] Further Tight up Elastic Defend Index Patterns (#3584)
Jonhnathan
2024-04-16 13:26:42 -03:00
-
f3d95cccce
adjust aws rule index patterns and tags (#3595)
Terrance DeJesus
2024-04-16 10:08:57 -04:00
-
ae6cf3fe1b
adjust aws rule index patterns and tags (#3595)
Terrance DeJesus
2024-04-16 10:08:57 -04:00
-
74312797bf
adjust aws rule index patterns and tags (#3595)
Terrance DeJesus
2024-04-16 10:08:57 -04:00
-
e33d80804f
[Rule Tuning] Windows BBR Promotion (#3577)
Jonhnathan
2024-04-16 09:28:17 -03:00
-
0c17c28022
[Rule Tuning] Windows BBR Promotion (#3577)
Jonhnathan
2024-04-16 09:28:17 -03:00
-
c2d1586270
[Rule Tuning] Windows BBR Promotion (#3577)
Jonhnathan
2024-04-16 09:28:17 -03:00
-
06a9b0e3b6
Bump KQL Version in Init (#3597)
Eric Forte
2024-04-15 11:06:16 -04:00
-
b323183cec
Bump KQL Version in Init (#3597)
Eric Forte
2024-04-15 11:06:16 -04:00
-
114db81f07
Bump KQL Version in Init (#3597)
Eric Forte
2024-04-15 11:06:16 -04:00
-
f291aa105d
Update defense_evasion_untrusted_driver_loaded.toml (#3596)
Samirbous
2024-04-15 14:52:39 +01:00
-
7b4cbaf0ab
Update defense_evasion_untrusted_driver_loaded.toml (#3596)
Samirbous
2024-04-15 14:52:39 +01:00
-
919a438257
Update defense_evasion_untrusted_driver_loaded.toml (#3596)
Samirbous
2024-04-15 14:52:39 +01:00
-
52e86dc8e8
[Tuning] Connection to Commonly Abused Web Services (#3587)
Samirbous
2024-04-11 12:11:28 +01:00
-
5cc02b9bc4
[Tuning] Connection to Commonly Abused Web Services (#3587)
Samirbous
2024-04-11 12:11:28 +01:00
-
9692e59abb
[Tuning] Connection to Commonly Abused Web Services (#3587)
Samirbous
2024-04-11 12:11:28 +01:00
-
608a0ff0c2
[Rule Tuning] Windows BBR Rule Tuning - 1 (#3579)
Jonhnathan
2024-04-08 10:38:41 -03:00
-
e311ca538b
[Rule Tuning] Windows BBR Rule Tuning - 1 (#3579)
Jonhnathan
2024-04-08 10:38:41 -03:00
-
d0dfa479bb
[Rule Tuning] Windows BBR Rule Tuning - 1 (#3579)
Jonhnathan
2024-04-08 10:38:41 -03:00
-
d21d94a8f8
[Rule Tuning] Windows BBR Rule Tuning - 3 (#3581)
Jonhnathan
2024-04-08 09:47:48 -03:00
-
724790e74a
[Rule Tuning] Windows BBR Rule Tuning - 3 (#3581)
Jonhnathan
2024-04-08 09:47:48 -03:00
-
c5addae009
[Rule Tuning] Windows BBR Rule Tuning - 3 (#3581)
Jonhnathan
2024-04-08 09:47:48 -03:00
-
9756346df0
[Rule Tuning] Windows BBR Rule Tuning - 2 (#3580)
Jonhnathan
2024-04-08 09:34:26 -03:00
-
740f139cbd
[Rule Tuning] Windows BBR Rule Tuning - 2 (#3580)
Jonhnathan
2024-04-08 09:34:26 -03:00
-
1bc59bdc04
[Rule Tuning] Windows BBR Rule Tuning - 2 (#3580)
Jonhnathan
2024-04-08 09:34:26 -03:00
-
2a3a5a250e
[Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition (#3576)
Jonhnathan
2024-04-08 08:57:33 -03:00
-
535175c33d
[Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition (#3576)
Jonhnathan
2024-04-08 08:57:33 -03:00
-
109e8a85a5
[Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition (#3576)
Jonhnathan
2024-04-08 08:57:33 -03:00
-
525997e4e7
[Rule Tuning] WRITEDAC Access on Active Directory Object (#3583)
Jonhnathan
2024-04-08 08:43:25 -03:00
-
b4743f52de
[Rule Tuning] WRITEDAC Access on Active Directory Object (#3583)
Jonhnathan
2024-04-08 08:43:25 -03:00
-
e125a4e4cf
[Rule Tuning] WRITEDAC Access on Active Directory Object (#3583)
Jonhnathan
2024-04-08 08:43:25 -03:00
-
74d428b09e
[Rule Tuning] Svchost spawning Cmd (#3578)
Jonhnathan
2024-04-08 07:50:20 -03:00
-
591ce49694
[Rule Tuning] Svchost spawning Cmd (#3578)
Jonhnathan
2024-04-08 07:50:20 -03:00
-
aa0cc42ff6
[Rule Tuning] Svchost spawning Cmd (#3578)
Jonhnathan
2024-04-08 07:50:20 -03:00
-
a2cb089d12
updated to v14.0 mitre ATT&CK (#3289)
Terrance DeJesus
2024-04-05 14:30:23 -04:00
-
940a776dd0
updated to v14.0 mitre ATT&CK (#3289)
Terrance DeJesus
2024-04-05 14:30:23 -04:00
-
0cb42983c1
updated to v14.0 mitre ATT&CK (#3289)
Terrance DeJesus
2024-04-05 14:30:23 -04:00
-
02be3c08e9
Bump KQL lib Version (#3575)
Eric Forte
2024-04-05 13:38:54 -04:00
-
6e8d5f31b8
Bump KQL lib Version (#3575)
Eric Forte
2024-04-05 13:38:54 -04:00
-
e6f48ade01
Bump KQL lib Version (#3575)
Eric Forte
2024-04-05 13:38:54 -04:00
-
dee8c947de
Update default (#3574)
Eric Forte
2024-04-04 20:27:14 -04:00
-
354acf7f5a
Update default (#3574)
Eric Forte
2024-04-04 20:27:14 -04:00
-
fbb6df506e
Update default (#3574)
Eric Forte
2024-04-04 20:27:14 -04:00
-
72ba0b16a9
[Bug] KQL fails validation on uppercase keywords (#3568)
Eric Forte
2024-04-04 18:03:30 -04:00
-
c6df1d085f
[Bug] KQL fails validation on uppercase keywords (#3568)
Eric Forte
2024-04-04 18:03:30 -04:00
-
1566c29bae
[Bug] KQL fails validation on uppercase keywords (#3568)
Eric Forte
2024-04-04 18:03:30 -04:00
-
645fa593a1
[Bug] New Terms Rule Import Failing (#3569)
Eric Forte
2024-04-04 17:37:13 -04:00
-
07204987f2
[Bug] New Terms Rule Import Failing (#3569)
Eric Forte
2024-04-04 17:37:13 -04:00
-
fa75876322
[Bug] New Terms Rule Import Failing (#3569)
Eric Forte
2024-04-04 17:37:13 -04:00
-
5a28e1ecac
[Bug] Add explicit format preserver (#3566)
Mika Ayenson
2024-04-04 15:50:48 -05:00
-
d3458a0b7f
[Bug] Add explicit format preserver (#3566)
Mika Ayenson
2024-04-04 15:50:48 -05:00
-
c35652c8c8
[Bug] Add explicit format preserver (#3566)
Mika Ayenson
2024-04-04 15:50:48 -05:00
-
ec275e8d99
[Bug] Threshold Rule Importing Failures (#3560)
Eric Forte
2024-04-03 14:15:09 -04:00
-
5066f9203c
[Bug] Threshold Rule Importing Failures (#3560)
Eric Forte
2024-04-03 14:15:09 -04:00
-
a9cc323d09
[Bug] Threshold Rule Importing Failures (#3560)
Eric Forte
2024-04-03 14:15:09 -04:00
-
a6ea41cae0
Add filebeat-* index pattern to rules based on system.auth dataset (#3561)
Mirko Bez
2024-04-03 11:27:31 +02:00
-
2812118000
Add filebeat-* index pattern to rules based on system.auth dataset (#3561)
Mirko Bez
2024-04-03 11:27:31 +02:00
-
153657029b
Add filebeat-* index pattern to rules based on system.auth dataset (#3561)
Mirko Bez
2024-04-03 11:27:31 +02:00
-
fe9217892f
Deprecate Releasing to a patch kibana version workflow (#3552)
shashank-elastic
2024-04-03 08:34:45 +05:30
-
502deb1978
Deprecate Releasing to a patch kibana version workflow (#3552)
shashank-elastic
2024-04-03 08:34:45 +05:30
-
3fbffa24ed
Deprecate Releasing to a patch kibana version workflow (#3552)
shashank-elastic
2024-04-03 08:34:45 +05:30
-
112ae41cd3
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3567)
integration-v8.11.12
github-actions[bot]
2024-04-02 23:59:42 +05:30
-
d515a539d4
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3567)
integration-v8.10.15
github-actions[bot]
2024-04-02 23:59:42 +05:30
-
8d5bd3b0f6
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3567)
github-actions[bot]
2024-04-02 23:59:42 +05:30
-
4e88c2d024
Fix minstack version for O365 prod rules (#3565)
shashank-elastic
2024-04-02 21:33:18 +05:30
-
7438c38b29
Fix minstack version for O365 prod rules (#3565)
shashank-elastic
2024-04-02 21:33:18 +05:30
-
0e2eb5a84c
Fix minstack version for O365 prod rules (#3565)
shashank-elastic
2024-04-02 21:33:18 +05:30
-
eca9b72a2c
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution (#3545)
Jonhnathan
2024-04-02 11:06:08 -03:00
-
a3ba0fcda3
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution (#3545)
Jonhnathan
2024-04-02 11:06:08 -03:00
-
4ab7c9b178
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution (#3545)
Jonhnathan
2024-04-02 11:06:08 -03:00
-
6cf92b25d3
[Tuning] Connection to Commonly Abused Web Services (#3425)
Samirbous
2024-04-02 14:41:10 +01:00
-
010e564256
[Tuning] Connection to Commonly Abused Web Services (#3425)
Samirbous
2024-04-02 14:41:10 +01:00