 Terrance DeJesus
|
7fde924213
|
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
* [Rule Tuning] Change event.dataset to data_stream.dataset
* updating ESQL field names
Removed changes from:
- rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml
- rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml
- rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml
- rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml
- rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml
- rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml
- rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml
- rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml
- rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml
- rules/integrations/aws/discovery_organization_discovery_by_rare_user.toml
- rules/integrations/aws/discovery_s3_rapid_bucket_posture_api_calls.toml
- rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml
- rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml
- rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml
- rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml
- rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml
- rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml
- rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml
- rules/windows/defense_evasion_masquerading_as_svchost.toml
(selectively cherry picked from commit deab1c0161)
|
2026-04-10 16:29:29 +00:00 |
|
|
shashank-elastic
|
b1a3a72312
|
Monthly Manifest and Schema Updation (#5920)
Removed changes from:
- rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml
(selectively cherry picked from commit 199a4d6160)
|
2026-04-06 12:07:02 +00:00 |
|
|
Ruben Groenewoud
|
6a41601d25
|
[New Rules] LiteLLM & Trivy TeamPCP Compromise (#5885)
* [New Rules] LiteLLM & Trivy TeamPCP Compromise
* ++
* Apply suggestion from @Samirbous
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Apply suggestion from @Samirbous
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* ++
* ++
* Update rules/cross-platform/collection_data_encrypted_via_openssl.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/cross-platform/collection_data_encrypted_via_openssl.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* ++
* ++
* ++
* ++
* Update rules/cross-platform/execution_suspicious_python_command_execution.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/cross-platform/execution_suspicious_python_command_execution.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* ++
* ++
* ++
* ++
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Removed changes from:
- rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml
(selectively cherry picked from commit c6f843ef9d)
|
2026-03-26 16:18:02 +00:00 |
|