yuriShafet 64cca9e1ba [Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523) (#5686) ...

Add EQL exclusions for benign activity:
Opera GX renderer children,
Slack creating slack children,
Node using playwright to create chrome process
Python editors accessing reg.exe
Logitech manager activity
 and Zabbix script paths.

2026-02-05 15:54:26 -05:00

..

defense_evasion_ml_rare_process_for_a_host.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_ml_rare_process_for_a_parent_process.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_ml_rare_process_for_a_user.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_ml_suspicious_windows_event_high_probability.toml

[Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523) (#5686)

2026-02-05 15:54:26 -05:00

defense_evasion_ml_suspicious_windows_event_low_probability.toml

[Tuning] Diverse Rules Tuning (#5482)

2025-12-18 15:30:12 +00:00

defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00