Isai 73f87ad7e6 [New Rule] Suspicious Network Tool Launched Inside A Container (#2759) ...

* [New Rule] Suspicious Network Tool Launched Inside A Container

new rule

* Apply suggestions from code review

removed unused fields, adjust from field for readability

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* update based on reviews

added additional tools, added false positives section, raised risk score

* Update discovery_suspicious_network_tool_launched_inside_a_container.toml

adjusted tags

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

2023-05-16 15:21:42 -04:00

..

aws

[Rule Tuning] Tuning 'AWS Access Secret in Secrets Manager' to New Terms (#2760)

2023-05-03 09:28:59 -04:00

azure

[FR] Add Integration Schema Query Validation (#2470)

2023-02-02 16:22:44 -05:00

cloud_defend

[New Rule] Suspicious Network Tool Launched Inside A Container (#2759)

2023-05-16 15:21:42 -04:00

cyberarkpas

[Bug] Unit Tests Passing for Rules with Integrations Not Reflected in Manifests (#2682)

2023-04-03 09:42:40 -04:00

endpoint

[Bug] Unit Tests Passing for Rules with Integrations Not Reflected in Manifests (#2682)

2023-04-03 09:42:40 -04:00

gcp

[Security Content] Expand Abbreviated Tags (#2414)

2023-03-06 17:37:52 -03:00

google_workspace

updating min stack comments (#2712)

2023-04-12 14:30:34 -04:00

kubernetes

[FR] Add Endpoint, APM and Windows Integration Tags to Rules and Supportability (#2429)

2023-01-04 09:30:07 -05:00

o365

[FR] Add Endpoint, APM and Windows Integration Tags to Rules and Supportability (#2429)

2023-01-04 09:30:07 -05:00

okta

[Bug] Unit Tests Passing for Rules with Integrations Not Reflected in Manifests (#2682)

2023-04-03 09:42:40 -04:00