Terrance DeJesus 4b4b2cc9c8 [Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157) ...

* enforcing aggregate or keep in ES|QL queries

* Update hunting/definitions.py

* Update hunting/definitions.py

* Update hunting/definitions.py

* updated capitalization of linting

* updated raise value error

* Update hunting/definitions.py

* added note about stats in best practices

2024-10-16 09:16:28 -04:00

..

credential_access_mfa_bombing_push_notications.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

credential_access_rapid_reset_password_requests_for_different_users.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

defense_evasion_failed_oauth_access_token_retrieval_via_public_client_app.toml

[Hunt Tuning] Enforce STATS or KEEP functions in ES|QL hunting queries (#4157)

2024-10-16 09:16:28 -04:00

defense_evasion_multiple_application_sso_authentication_repeat_source.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

defense_evasion_multiple_client_sources_reported_for_oauth_access_tokens_granted.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

defense_evasion_rare_oauth_access_token_granted_by_application.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

initial_access_higher_than_average_failed_authentication.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

initial_access_impossible_travel_sign_on.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

initial_access_password_spraying_from_repeat_source.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

persistence_multi_factor_push_notification_bombing.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00

persistence_rare_domain_with_user_authentication.toml

[Hunting] Re-factor Hunting Library Code (#4085)

2024-10-03 12:47:40 -04:00