security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a575cf9ff3fc7c40fb45995f4d47a64fc0c0b97b
sigma-rules/rules/ml
T
History
Derek Ditch 580db2c13e Add timeline_id to detection rules (#95) 
* Adds timeline_id to all network rules
- Uses the ID for the 'Generic Network Timeline' from Elastic
* Adds timeline_id to all endpoint rules
- Uses the ID for the 'Generic Endpoint Timeline' from Elastic
* Adds timeline_id to all process-oriented rules
    - Uses the ID for the 'Generic Process Timeline' from Elastic
* Ran tests and toml-lint
* Bumped 'updated_date'
2020-10-27 13:34:16 -05:00
..
ml_cloudtrail_error_message_spike.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_cloudtrail_rare_error_code.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_cloudtrail_rare_method_by_city.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_cloudtrail_rare_method_by_country.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_cloudtrail_rare_method_by_user.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_compiler_activity.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_kernel_module_arguments.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_metadata_process.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_metadata_user.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_network_activity.toml
Add timeline_id to detection rules (#95)
2020-10-27 13:34:16 -05:00
ml_linux_anomalous_network_port_activity.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_network_service.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_network_url_activity.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_process_all_hosts.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_sudo_activity.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_anomalous_user_name.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_system_information_discovery.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_system_network_configuration_discovery.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_system_network_connection_discovery.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_system_process_discovery.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_linux_system_user_discovery.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_packetbeat_dns_tunneling.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_packetbeat_rare_dns_question.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_packetbeat_rare_server_domain.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_packetbeat_rare_urls.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_packetbeat_rare_user_agent.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_rare_process_by_host_linux.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_rare_process_by_host_windows.toml
Add timeline_id to detection rules (#95)
2020-10-27 13:34:16 -05:00
ml_suspicious_login_activity.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_metadata_process.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_metadata_user.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_network_activity.toml
Add timeline_id to detection rules (#95)
2020-10-27 13:34:16 -05:00
ml_windows_anomalous_path_activity.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_process_all_hosts.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_process_creation.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_script.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_service.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_anomalous_user_name.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_rare_user_runas_event.toml
[Rule Tuning] Tag Categorization Updates (#380)
2020-10-26 13:50:45 -05:00
ml_windows_rare_user_type10_remote_login.toml
Add timeline_id to detection rules (#95)
2020-10-27 13:34:16 -05:00