sigma-rules

Files

T

Terrance DeJesus 869988c20f [Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368 )

* updated timestamp override unit test; fixed rules missing this field

* fixed flake error

* simplified and consolidated logic

* Update tests/test_all_rules.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update tests/test_all_rules.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* added comments

* updated logic; added comments; removed unused variables

* removed custom python script

* updated dates

* removed deprecated rule change

* updated dates

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/integrations/beaconing/command_and_control_beaconing.toml
- rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml

(selectively cherry picked from commit 1c10c37468)

2024-01-17 19:19:45 +00:00

data

[FR] Add Support for ES|QL Rule Type and Remote Validation (#3281 )

2023-12-08 19:51:44 +00:00

kuery

[eql2kql] fix wildcard bug (#1507 )

2022-04-21 23:44:39 -04:00

__init__.py

[FR] Add host family to data path (#2839 )

2023-06-12 16:03:33 -04:00

base.py

[FR] Add support for building block rules (BBR) (#2822 )