Mika Ayenson
94 lines
2.1 KiB
YAML
94 lines
2.1 KiB
YAML
name: New Hunt
|
|
description: Suggestions and ideas for new hunts
|
|
title: "[New hunt] Name of hunt"
|
|
labels: ["Hunt: New", "Team: TRADE"]
|
|
assignees: []
|
|
projects: ["elastic/1268"]
|
|
|
|
body:
|
|
- type: textarea
|
|
id: description
|
|
attributes:
|
|
label: Description
|
|
description: "Provide a detailed description of the activity to be detected."
|
|
placeholder: "Detailed description..."
|
|
|
|
- type: dropdown
|
|
id: target_huntset
|
|
attributes:
|
|
label: Target Huntset
|
|
description: "Select the target rulset."
|
|
options:
|
|
- apm
|
|
- cross-platform
|
|
- aws
|
|
- aws_bedrock
|
|
- azure
|
|
- azure_openai
|
|
- beaconing
|
|
- cloud_defend
|
|
- cyberparkpas
|
|
- ded
|
|
- dga
|
|
- endpoint
|
|
- fim
|
|
- gcp
|
|
- github
|
|
- google_workspace
|
|
- kubernetes
|
|
- lmd
|
|
- o365
|
|
- okta
|
|
- problemchild
|
|
- linux
|
|
- macos
|
|
- ml
|
|
- network
|
|
- promotions
|
|
- threat_intel
|
|
- windows
|
|
- other
|
|
|
|
- type: dropdown
|
|
id: hunt_type
|
|
attributes:
|
|
label: Target hunt Type
|
|
description: "Select the target type."
|
|
options:
|
|
- Custom (KQL or Lucene)
|
|
- Machine Learning
|
|
- Threshold
|
|
- Event Correlation (EQL)
|
|
- Indicator Match
|
|
- New Terms
|
|
- ES|QL
|
|
- OSQuery
|
|
|
|
- type: textarea
|
|
id: query
|
|
attributes:
|
|
label: Query
|
|
description: "Provide the query for the hunt (optional)."
|
|
placeholder: "Query..."
|
|
|
|
- type: textarea
|
|
id: related_issues_prs
|
|
attributes:
|
|
label: Related issues or PRs
|
|
description: "Link any related issues or PRs (optional)."
|
|
placeholder: "Related issues or PRs..."
|
|
|
|
- type: textarea
|
|
id: references
|
|
attributes:
|
|
label: References
|
|
description: "List any references (optional)."
|
|
placeholder: "References..."
|
|
|
|
- type: textarea
|
|
id: example_data
|
|
attributes:
|
|
label: Redacted Example Data
|
|
description: "Provide a redacted example JSON data from the actual activity."
|
|
placeholder: "Example JSON data..."
|