Justin Ibarra e9b2ebab2d Update cardinality field in schema for threshold rules (#1349) ...

* Make cardinality array in schema for threshold rules
* update master, 7.12, 7.13, and 7.14 schemas with cardinality fix
* fix 7.12 downgrade to handle cardinality as an array

* Add two new rules to detect agent spoofing

Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>

(cherry picked from commit 163d9e3864)

2021-07-21 16:33:26 +00:00

..

api_schemas

Update cardinality field in schema for threshold rules (#1349)

2021-07-21 16:33:26 +00:00

beats_schemas

Add new ECS and beats schemas (#1303)

2021-06-23 22:08:39 +00:00

ecs_schemas

Add new ECS and beats schemas (#1303)

2021-06-23 22:08:39 +00:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)

2020-12-18 12:46:16 -09:00

attack-technique-redirects.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)

2020-12-18 12:46:16 -09:00

attack-v7.2.json.gz

Refresh ATT&CK data to v7.2 and expand threat validation (#330)

2020-09-23 22:03:29 -08:00

deprecated_rules.json

Lock the versions from 7.13.0 (#1256)

2021-06-04 22:15:47 +00:00

non-ecs-schema.json

[New Rule] Parent Process PID Spoofing (#1338)

2021-07-15 20:56:12 +00:00

packages.yml

Bump the Fleet package version

2021-07-07 21:19:06 -06:00

rule-mapping.yml

[New Rule] AWS EC2 Snapshot Activity

2020-07-07 15:10:06 -06:00

security-logo-color-64px.svg

[Fleet] Update template and packaging code for fleet packages (#1280)

2021-06-15 13:55:09 +00:00

stack-schema-map.yaml

Update cardinality field in schema for threshold rules (#1349)

2021-07-21 16:33:26 +00:00

test_toml.json

Add rule loader and dependencies

2020-06-29 23:17:42 -06:00

version.lock.json

Lock versions for Fleet package 0.13.2 (#1330)

2021-07-07 21:43:57 +00:00