sigma-rules

Files

T

Isai 07579f2bd7 [Rule Tunings] AWS remove target.entity.id and actor.entity.id fields (#5563 )

* [Rule Tunings] AWS removal of target.entity.id and actor.entity.id fields

Related Issue : - https://github.com/elastic/security-team/issues/14019

`target.entity.id` and `related.entity.id` fields will soon be fully removed from the AWS Integration. This rule tuning replaces rule queries that relied on `target.entity.id` with the equivalent field `entity.target.id` which was introduced with AWS version 4.7.0 along with several new entity classification fields. This tuning also removes references to these fields in highlighted fields and investigation guides for several rules.

* update data for defense_evasion_route53_dns_query_resolver_config_deletion.toml

update data for defense_evasion_route53_dns_query_resolver_config_deletion.toml

* updated_dates

2026-01-21 13:54:56 -05:00

aws

[Rule Tunings] AWS remove target.entity.id and actor.entity.id fields (#5563 )

2026-01-21 13:54:56 -05:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

Prep for Release 9.3 (#5548 )

2026-01-12 21:07:07 +05:30

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )