security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4d89eab1890ac6490b06d5294e99001c3fb0fcfe
sigma-rules/rules/integrations
T
History
Isai 4d89eab189 [Rule Tuning] AWS S3 Bucket Server Access Logging Disabled (#5254) 
#### AWS S3 Bucket Server Access Logging Disabled
Rule is triggering as expected with low telemetry
- removed `any` from EQL query by replacing event category field with `event.type` as this is mapped for the API action `PutBucketLogging`
- added `event.provider` as part of query
- updated Investigation guide
- Added highlighted fields
2025-11-10 11:36:55 -05:00
..
aws
[Rule Tuning] AWS S3 Bucket Server Access Logging Disabled (#5254)
2025-11-10 11:36:55 -05:00
aws_bedrock
[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)
2025-09-30 00:36:29 -04:00
azure
[New Rule] Azure Compute Restore Point Collection Deleted (#5217)
2025-10-17 10:49:38 -04:00
azure_openai
[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)
2025-09-30 00:36:29 -04:00
beaconing
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
cyberarkpas
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
ded
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
dga
[Rule Tuning] Reduce Severity from Critical to High (#4637)
2025-05-06 21:37:47 +05:30
endpoint
Prep 8.19/9.1 (#4869)
2025-07-07 11:27:48 -04:00
fim
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
gcp
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
github
Prep for Release 9.0 (#4550)
2025-03-20 20:32:07 +05:30
google_workspace
Fix spacing in Setup information (#4470)
2025-02-20 10:04:13 +05:30
kubernetes
Investigation guides Update (#4920)
2025-07-22 07:52:48 +05:30
lmd
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
o365
[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)
2025-11-04 11:29:25 -05:00
okta
[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)
2025-09-30 00:36:29 -04:00
pad
Prep 8.19/9.1 (#4869)
2025-07-07 11:27:48 -04:00
problemchild
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00