Jonhnathan 9cba1e96e6 [Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505) ...

* [Rule Tuning] Replace KQL exceptions for Query DSL Exceptions

* update min_stack

* build out schema in more detail for Filters

* Update detection_rules/rule.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Remove enum for definition

* remove unused import

* remove $state store

* transform state

* add call to super

* add return type hint

* use dataclass metadata

* use Literal type

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mika.ayenson@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/windows/collection_mailbox_export_winlog.toml
- rules/windows/collection_posh_clipboard_capture.toml
- rules/windows/defense_evasion_posh_assembly_load.toml
- rules/windows/defense_evasion_posh_compressed.toml
- rules/windows/discovery_posh_suspicious_api_functions.toml
- rules/windows/discovery_privileged_localgroup_membership.toml
- rules/windows/execution_posh_hacktool_functions.toml
- rules/windows/execution_posh_psreflect.toml
- rules_building_block/collection_posh_compression.toml
- rules_building_block/defense_evasion_powershell_clear_logs_script.toml
- rules_building_block/discovery_posh_generic.toml
- rules_building_block/lateral_movement_posh_winrm_activity.toml

(selectively cherry picked from commit 67ca13c1ce)

2024-04-01 20:52:24 +00:00

..

__init__.py

Prepare For Next Elastic Stack Minor Release (#3490)

2024-03-06 16:02:44 +00:00

definitions.py

[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)

2024-04-01 20:52:24 +00:00

registry_package.py

[FR] Adjust Prebuilt Rules Packaging to Use Elastic Package v3 (#3252)

2023-11-01 16:53:22 +00:00

rta_schema.py

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

stack_compat.py

[FR] Adapt PyPi semver Library and Remove Custom (#2503)

2023-02-07 14:26:29 -05:00