Bobby Filar 9a739b7e4c Modifying rules assoc w/ deprecation of v2 ML jobs (#1846) ...

* modifying rules assoc w/ deprecation of v2 ML jobs

* modified updated_date field

* fixed machine_learning_job_id and added min_stack_version

* replacing rest of deprecated jobs with new naming convention

* Update ml_suspicious_login_activity.toml

* removing rules assoc w/ deprecated ML jobs

* Update rules/ml/ml_linux_anomalous_compiler_activity.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/ml/ml_linux_anomalous_compiler_activity.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* updated ml job rules to reflect 8.3 changes

* updating min_stack_version for ml detection rules

Co-authored-by: Craig Chamberlain <randomuserid@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

2022-05-20 13:02:27 -07:00

..

ml_auth_rare_hour_for_a_user_to_logon.toml

Add min_stack_comments to metadata schema (#1573)

2021-10-19 20:52:53 -08:00

ml_auth_rare_source_ip_for_a_user.toml

Add min_stack_comments to metadata schema (#1573)

2021-10-19 20:52:53 -08:00

ml_auth_rare_user_logon.toml

Add min_stack_comments to metadata schema (#1573)

2021-10-19 20:52:53 -08:00

ml_auth_spike_in_failed_logon_events.toml

Add min_stack_comments to metadata schema (#1573)

2021-10-19 20:52:53 -08:00

ml_auth_spike_in_logon_events_from_a_source_ip.toml

Add min_stack_comments to metadata schema (#1573)

2021-10-19 20:52:53 -08:00

ml_auth_spike_in_logon_events.toml

Add min_stack_comments to metadata schema (#1573)

2021-10-19 20:52:53 -08:00

ml_high_count_network_denies.toml

Fix rules which were note using v2 license (#1291)

2021-06-16 08:21:30 -06:00

ml_high_count_network_events.toml

Fix typos discovered by codespell (#1430)

2021-08-14 20:29:10 -08:00

ml_linux_anomalous_compiler_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_metadata_process.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_metadata_user.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_network_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_network_port_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_process_all_hosts.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_sudo_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_anomalous_user_name.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_system_information_discovery.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_system_network_configuration_discovery.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_system_network_connection_discovery.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_system_process_discovery.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_linux_system_user_discovery.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_packetbeat_dns_tunneling.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_dns_question.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_server_domain.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_urls.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_packetbeat_rare_user_agent.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

ml_rare_destination_country.toml

Fix rules which were note using v2 license (#1291)

2021-06-16 08:21:30 -06:00

ml_rare_process_by_host_linux.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_rare_process_by_host_windows.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_spike_in_traffic_to_a_country.toml

Fix rules which were note using v2 license (#1291)

2021-06-16 08:21:30 -06:00

ml_suspicious_login_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_metadata_process.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_metadata_user.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_network_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_path_activity.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_process_all_hosts.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_process_creation.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_script.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_service.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_anomalous_user_name.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_rare_user_runas_event.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00

ml_windows_rare_user_type10_remote_login.toml

Modifying rules assoc w/ deprecation of v2 ML jobs (#1846)

2022-05-20 13:02:27 -07:00