Ross Wolf 3b338baab0 [New Rule] Endpoint Security Behavior Protection (#1440) ...

* [New Rule] Endpoint Security Behavioral Protection
* Update readme and labeler for endpoint integration
* Fix new rule to use event.code
* Fix old rule to use event.code
* Changed from behavioral to behavior
* Rename elastic_endpoint_security_behavioral.toml to elastic_endpoint_security_behavior_protection.toml
* Back from the future (updated_date)

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

2021-08-25 09:56:59 -06:00

..

endgame_adversary_behavior_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_cred_dumping_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_cred_dumping_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_cred_manipulation_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_cred_manipulation_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_exploit_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_exploit_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_malware_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_malware_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_permission_theft_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_permission_theft_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_process_injection_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_process_injection_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_ransomware_detected.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

endgame_ransomware_prevented.toml

[Rule Tuning] Update "Endpoint Security" to "Elastic Endgame" for the relevant Endgame promotion rules (#978)

2021-03-04 17:21:17 -05:00

external_alerts.toml

[APM] Adds APM data stream 'traces-apm*' to apm rules (#105334) (#1335)

2021-07-13 07:04:58 -06:00