Apoorva Joshi 0095a80014 Network rules for the 7.13 release (#1087) ...

* Adding network rules for the 7.13 release

* Adding rule guids

* Update rules/ml/ml_high_count_network_denies.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/ml/ml_rare_destination_country.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/ml/ml_rare_destination_country.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/ml/ml_rare_destination_country.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/ml/ml_high_count_network_events.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/ml/ml_spike_in_traffic_to_a_country.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Minor changes

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

2021-04-08 09:34:47 -07:00

..

ml_cloudtrail_error_message_spike.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_cloudtrail_rare_error_code.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_cloudtrail_rare_method_by_city.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_cloudtrail_rare_method_by_country.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_cloudtrail_rare_method_by_user.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_high_count_network_denies.toml

Network rules for the 7.13 release (#1087)

2021-04-08 09:34:47 -07:00

ml_high_count_network_events.toml

Network rules for the 7.13 release (#1087)

2021-04-08 09:34:47 -07:00

ml_linux_anomalous_compiler_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_kernel_module_arguments.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_metadata_process.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_metadata_user.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_network_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_network_port_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_network_service.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_network_url_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_process_all_hosts.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_sudo_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_anomalous_user_name.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_system_information_discovery.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_system_network_configuration_discovery.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_system_network_connection_discovery.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_system_process_discovery.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_linux_system_user_discovery.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_dns_tunneling.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_dns_question.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_server_domain.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_urls.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_user_agent.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_rare_destination_country.toml

Network rules for the 7.13 release (#1087)

2021-04-08 09:34:47 -07:00

ml_rare_process_by_host_linux.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_rare_process_by_host_windows.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_spike_in_traffic_to_a_country.toml

Network rules for the 7.13 release (#1087)

2021-04-08 09:34:47 -07:00

ml_suspicious_login_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_metadata_process.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_metadata_user.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_network_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_path_activity.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_process_all_hosts.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_process_creation.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_script.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_service.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_anomalous_user_name.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_rare_user_runas_event.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_windows_rare_user_type10_remote_login.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00