sigma-rules

Files

T

Isai a14a1fd068 [Rule Tuning] AWS Service Quotas Multi-Region GetServiceQuota Requests (#5468 )

* [Rule Tuning] AWS Service Quotas Multi-Region GetServiceQuota Requests

This rule is alerting as expected with very few instances in telemetry (only have data from 1 cluster).
- added more fields for context in the query.
- added metadata fields to query
- reduced execution window
- added highlighted fields

#### screenshot of working query with additional context

* Update rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

2025-12-19 16:46:45 -05:00

aws

[Rule Tuning] AWS Service Quotas Multi-Region GetServiceQuota Requests (#5468 )

2025-12-19 16:46:45 -05:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

[Rule Tuning] Entra ID User Sign-in with Unusual Client (#5473 )

2025-12-18 20:04:11 -05:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )