Justin Ibarra eeb8ab7744 Expand timestamp override tests (#1907) ...

* Expand timestamp_override tests
* removed timestamp_override from eql sequence rules
* add config entry for eql rules with beats index and t_o
* add timestamp_override to missing fields

Removed changes from:
- rules/cross-platform/impact_hosts_file_modified.toml
- rules/windows/credential_access_lsass_memdump_file_created.toml
- rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml
- rules/windows/defense_evasion_execution_lolbas_wuauclt.toml
- rules/windows/defense_evasion_suspicious_certutil_commands.toml
- rules/windows/execution_command_shell_started_by_svchost.toml

(selectively cherry picked from commit 6bdfddac8e)

2022-04-01 23:28:54 +00:00

..

aws

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

azure

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

cyberarkpas

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

endpoint

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

gcp

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

google_workspace

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

o365

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

okta

Expand timestamp override tests (#1907)

2022-04-01 23:28:54 +00:00