security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
915c2dea2a2e17e76a4f2a5bfd452208e7d8fe22
sigma-rules/rules/ml
T
History
Ross Wolf 915c2dea2a [Bug] Fix ML job IDs that used hyphens (#1287) 
* Fix ML job IDs that used hyphens
* Update ml_high_count_network_denies.toml
* Update ml_spike_in_traffic_to_a_country.toml
* Set updated_date

(cherry picked from commit 49cb2e8dbf)
2021-06-15 17:41:04 +00:00
..
ml_cloudtrail_error_message_spike.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00
ml_cloudtrail_rare_error_code.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00
ml_cloudtrail_rare_method_by_city.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00
ml_cloudtrail_rare_method_by_country.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00
ml_cloudtrail_rare_method_by_user.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00
ml_high_count_network_denies.toml
[Bug] Fix ML job IDs that used hyphens (#1287)
2021-06-15 17:41:04 +00:00
ml_high_count_network_events.toml
[Bug] Fix ML job IDs that used hyphens (#1287)
2021-06-15 17:41:04 +00:00
ml_linux_anomalous_compiler_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_kernel_module_arguments.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_metadata_process.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_linux_anomalous_metadata_user.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_linux_anomalous_network_activity.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00
ml_linux_anomalous_network_port_activity.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_linux_anomalous_network_service.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_network_url_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_process_all_hosts.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_linux_anomalous_sudo_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_anomalous_user_name.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_linux_system_information_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_network_configuration_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_network_connection_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_process_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_linux_system_user_discovery.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_dns_tunneling.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_dns_question.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_server_domain.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_urls.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_packetbeat_rare_user_agent.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_rare_destination_country.toml
[Bug] Fix ML job IDs that used hyphens (#1287)
2021-06-15 17:41:04 +00:00
ml_rare_process_by_host_linux.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_rare_process_by_host_windows.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_spike_in_traffic_to_a_country.toml
[Bug] Fix ML job IDs that used hyphens (#1287)
2021-06-15 17:41:04 +00:00
ml_suspicious_login_activity.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_anomalous_metadata_process.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_anomalous_metadata_user.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_anomalous_network_activity.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_anomalous_path_activity.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_anomalous_process_all_hosts.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_anomalous_process_creation.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_anomalous_script.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_anomalous_service.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_anomalous_user_name.toml
Updating rules to query v2 (#1254)
2021-06-15 14:21:09 +00:00
ml_windows_rare_user_runas_event.toml
Update License to Elastic v2 (#944)
2021-03-03 22:12:11 -09:00
ml_windows_rare_user_type10_remote_login.toml
Cleanup note field in rules (#1194)
2021-05-10 21:41:23 +00:00