security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
27da0d6ed74032bae10f250d162b2bbabb4dc0f3
sigma-rules/rules/ml
T
History
Jonhnathan ed57d46d15 [Rule Tuning] Small update on rule descriptions (#1508) 
(cherry picked from commit 5e4a7e67df)
2021-09-30 20:55:18 +00:00
..
ml_auth_rare_hour_for_a_user_to_logon.toml
Add min_stack_version to 7.14+ only rules (#1321)
2021-07-06 13:42:09 -06:00
ml_auth_rare_source_ip_for_a_user.toml
Add min_stack_version to 7.14+ only rules (#1321)
2021-07-06 13:42:09 -06:00
ml_auth_rare_user_logon.toml
[Rule Tuning] Small update on rule descriptions (#1508)
2021-09-30 20:55:18 +00:00
ml_auth_spike_in_failed_logon_events.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_auth_spike_in_logon_events_from_a_source_ip.toml
[Rule tuning] Fix typo in ML rule descriptions (#1484)
2021-09-14 16:37:55 +00:00
ml_auth_spike_in_logon_events.toml
Add min_stack_version to 7.14+ only rules (#1321)
2021-07-06 13:42:09 -06:00
ml_high_count_network_denies.toml
Fix rules which were note using v2 license (#1291)
2021-06-16 08:21:30 -06:00
ml_high_count_network_events.toml
Fix typos discovered by codespell (#1430)
2021-08-15 04:30:11 +00:00
ml_linux_anomalous_compiler_activity.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_linux_anomalous_kernel_module_arguments.toml
[Rule tuning] Fix spacing in reference URLs (#1455)
2021-09-01 00:00:06 +00:00
ml_linux_anomalous_metadata_process.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_linux_anomalous_metadata_user.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_linux_anomalous_network_activity.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_linux_anomalous_network_port_activity.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_linux_anomalous_network_service.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_network_url_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_process_all_hosts.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_linux_anomalous_sudo_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_user_name.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_linux_system_information_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_network_configuration_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_network_connection_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_process_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_user_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_dns_tunneling.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_dns_question.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_server_domain.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_urls.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_user_agent.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_rare_destination_country.toml
Fix rules which were note using v2 license (#1291)
2021-06-16 08:21:30 -06:00
ml_rare_process_by_host_linux.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_rare_process_by_host_windows.toml
[rule-tuning] Adding more context with triage/investigation (#1481)
2021-09-16 01:08:23 +00:00
ml_spike_in_traffic_to_a_country.toml
Fix rules which were note using v2 license (#1291)
2021-06-16 08:21:30 -06:00
ml_suspicious_login_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_anomalous_metadata_process.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_windows_anomalous_metadata_user.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_windows_anomalous_network_activity.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_windows_anomalous_path_activity.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_windows_anomalous_process_all_hosts.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_windows_anomalous_process_creation.toml
Updating rules to query v2 (#1254)
2021-06-15 07:20:50 -07:00
ml_windows_anomalous_script.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_anomalous_service.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_anomalous_user_name.toml
[Rule tuning] Revise rule description and other text (#1398)
2021-08-03 21:08:48 +00:00
ml_windows_rare_user_runas_event.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_rare_user_type10_remote_login.toml
Cleanup note field in rules (#1194)
2021-05-10 13:40:56 -08:00