Jonhnathan 8bab0df7bf [Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs (#3825) ...

* [Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs

* .

* Update integration-schemas.json.gz

* Fix integration manifests

Removed changes from:
- rules/windows/collection_email_powershell_exchange_mailbox.toml
- rules/windows/command_and_control_rdp_tunnel_plink.toml
- rules/windows/command_and_control_screenconnect_childproc.toml
- rules/windows/credential_access_domain_backup_dpapi_private_keys.toml
- rules/windows/credential_access_kirbi_file.toml
- rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
- rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml
- rules/windows/defense_evasion_suspicious_zoom_child_process.toml
- rules/windows/execution_command_shell_started_by_unusual_process.toml
- rules/windows/initial_access_suspicious_ms_outlook_child_process.toml
- rules/windows/persistence_adobe_hijack_persistence.toml
- rules/windows/persistence_appcertdlls_registry.toml
- rules/windows/persistence_system_shells_via_services.toml

(selectively cherry picked from commit 54d5b442cf)

2024-06-26 14:09:43 +00:00

..

api_schemas

Prepare For Next Elastic Stack 8.15 (#3670)

2024-05-14 19:10:09 +00:00

beats_schemas

Prepare For Next Elastic Stack 8.15 (#3670)

2024-05-14 19:10:09 +00:00

ecs_schemas

Prepare For Next Elastic Stack 8.15 (#3670)

2024-05-14 19:10:09 +00:00

endgame_schemas

Updated ECS mappings from keyword to wildcard (#2518)

2023-02-07 09:43:19 -05:00

endpoint_schemas

[FR] Add Support for Multi-Fields and Validation in Rules (#2882)

2023-06-28 20:35:33 -04:00

__init__.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

attack-crosswalk.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

attack-technique-redirects.json

Refresh MITRE Attack v15.1.0 (#3725)

2024-06-04 14:48:18 +00:00

attack-v15.1.0.json.gz

Refresh MITRE Attack v15.1.0 (#3725)

2024-06-04 14:48:18 +00:00

commit-and-push.sh

Update commit-and-push.sh (#2640)

2023-03-09 17:31:19 -05:00

deprecated_rules.json

Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3567)

2024-04-02 18:37:42 +00:00

downloadable_updates.json

Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12 (#3431)

2024-02-06 19:54:15 +00:00

integration-manifests.json.gz

[Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs (#3825)

2024-06-26 14:09:43 +00:00

integration-schemas.json.gz

[Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs (#3825)

2024-06-26 14:09:43 +00:00

lock-multiple.sh

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

non-ecs-schema.json

[New Rule] AWS EC2 VPC Security Group Rule Added for Any Address or Remote Access Ports (#3599)

2024-05-28 14:52:40 +00:00

packages.yaml

[FR] Normalize yml ext to yaml (#3675)

2024-05-15 17:08:01 -05:00

rule_template_typosquatting_domain.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

rule-mapping.yaml

[FR] Normalize yml ext to yaml (#3675)

2024-05-15 20:27:01 +00:00

security-logo-color-64px.svg

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

stack-schema-map.yaml

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

test_cli.bash

[FR] Bundle KQL & Kibana libs into base dependencies (#3662)

2024-05-13 19:36:55 +00:00

test_remote_cli.bash

Refresh Kibana module with API updates (#3466)

2024-04-26 17:20:37 +00:00

test_toml.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

version.lock.json

Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3821)

2024-06-25 12:31:41 +00:00