 Ruben Groenewoud
|
8a21fd77c5
|
[Rule Tuning] Interval fix + Datastream values to ESQL Rules (#5413)
* [Rule Tuning] Interval fix + Datastream values to ESQL Rules
* Update persistence_web_server_potential_command_injection.toml
(cherry picked from commit 72a2b44db1)
|
2025-12-05 15:47:17 +00:00 |
|
|
Ruben Groenewoud
|
8271cc8616
|
[Rule Tunings] Misc. Web Server Rules (#5384)
(cherry picked from commit e19ce18a40)
|
2025-12-02 08:25:00 +00:00 |
|
|
shashank-elastic
|
fb410cf44b
|
Add Investigation Guides for Rules (#5357)
(cherry picked from commit 5386345ca7)
|
2025-11-24 19:42:27 +00:00 |
|
|
Ruben Groenewoud
|
ae0f40bc75
|
[New Rule] Web Server Potential Command Injection Request (#5341)
* [New Rule] Web Server Potential Command Injection Request
* Update variable names to use consistent casing
* Add 'Domain: Network' tag to command injection rule
* Update persistence_web_server_potential_command_injection.toml
* adding missing tags
* Update rules/cross-platform/persistence_web_server_potential_command_injection.toml
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
* Update rules/cross-platform/persistence_web_server_potential_command_injection.toml
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
(cherry picked from commit 94ff4b0e3e)
|
2025-11-24 18:45:30 +00:00 |
|