Commit Graph

145 Commits

Author SHA1 Message Date
elastic-renovate-prod[bot] 4223d3f8fb Update tj-actions/changed-files action to v46.0.5 (#5097)
(cherry picked from commit f52aedf41d)
2025-10-28 15:39:13 +00:00
shashank-elastic 0922a1beec Update Release Fleet and Lock versions to use ESQL Remote Validation (#5245)
(cherry picked from commit c6f1c90c2f)
2025-10-27 15:37:06 +00:00
Eric Forte 70a0986db1 Remove toml filtering for branches (#5243)
(cherry picked from commit 566242772f)
2025-10-23 16:55:01 +00:00
shashank-elastic e827bf6d01 Prep 9.2 (#5231)
Removed changes from:
- detection_rules/etc/packages.yaml

(selectively cherry picked from commit 818978975d)
2025-10-17 15:33:28 +00:00
Sergey Polzunov 2ff42fd787 feat: ESQL query validation against Elastic cluster (#4955)
* Add remote ESQL validation
---------

Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
Co-authored-by: Mika Ayenson <mika.ayenson@elastic.co>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit c7246313f7)
2025-10-15 19:19:31 +00:00
elastic-renovate-prod[bot] c54f21133d Pin dependencies (#5086)
Co-authored-by: Shashank K S <Shashank.Suryanarayana@elastic.co>

(cherry picked from commit 39b6f19eb9)
2025-09-12 17:18:41 +00:00
Sergey Polzunov 59f1fff72e fix: Better aligning prompt behaviour with jsonschema types (#4894)
* Check for `["array"]` in addition to `"array"`

* version bump

* Exclude non-ecs-schema.json from CI check

(cherry picked from commit c0631d2df2)
2025-07-11 12:12:51 +00:00
Eric Forte 3294293c4d [FR] Updates to KQL Lib Parsing and Install (#3605)
* Bump Version

* updated

* Bump patch version

* Optimization should only occur on single values

* Wildcard semantically equivalent to query_string*

* Add unit test for optimization

* Move code-checks to yml

* Add tests path to code-checks

* Add lib path for code-checks

* Install deps from local

* Update DSL optimization unit test

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 03f977246f)
2025-07-10 19:05:16 +00:00
shashank-elastic f036cb90fe Prep 8.19/9.1 (#4869)
* Prep 8.19/9.1 Release

* Download Beats Schema

* Download API Schema

* Download 8.18.3 Beats Schema

* Download Latest Integrations manifest and schema

* Comment old schemas

* Update Patch version

Removed changes from:
- detection_rules/etc/packages.yaml

(selectively cherry picked from commit 9b292b97ea)
2025-07-07 15:30:11 +00:00
Sergey Polzunov a0ec7c59a7 fix: type hinting fixes and additional code checks (#4790)
* first pass

* Adding a dedicated code checking workflow

* Type fixes

* linting config and python version bump

* Type hints

* Drop incorrect config option

* More fixes

* Style fixes

* CI adjustments

* Pyproject fixes

* CI & pyproject fixes

* Proper version bump

* Tests formatting

* Resolve cirtular dependency

* Test fixes

* Make sure the tests are formatted correctly

* Check tweaks

* Bumping python version in CI images

* Pin marshmallow do 3.x because 4.x is not supported

* License fix

* Convert path to str

* Making myself a codeowner

* Missing kwargs param

* Adding a missing kwargs to `set_score`

* Update .github/CODEOWNERS

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Dropping unnecessary raise

* Dropping skipped test

* Drop unnecessary var

* Drop unused commented-out func

* Disable typehinting for the whole func

* Update linting command

* Invalid type hist on the input param

* Incorrect field type

* Incorrect value used fix

* Stricter values check

* Simpler function call

* Type condition fix

* TOML formatter fix

* Simpligy output conditions

* Formatting

* Use proper types instead of aliases

* MITRE attack fixes

* Using pathlib.Path for an argument

* Use proper method to update a set from a dict

* First round of `ruff` fixes

* More fixes

* More fixes

* Hack against cyclic dependency

* Ignore `PLC0415`

* Remove unused markers

* Cleanup

* Fixing the incorrect condition

* Update .github/CODEOWNERS

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Set explicit default values for optional fields

* Update the guidelines

* Adding None Defaults

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

(cherry picked from commit 1fb60d6475)
2025-07-01 13:25:31 +00:00
Jan Calanog e7312493ee docs-builder: add pull-requests: write permission to docs-build workflow (#4840)
(cherry picked from commit 7661557aec)
2025-06-26 12:35:57 +00:00
shashank-elastic f3e4bfcf5e Archive Attack Coverage Update Workflow (#4821)
(cherry picked from commit 4d92da5d21)
2025-06-24 13:15:37 +00:00
shashank-elastic 711b4d621c Update Kibana MITRE workflow (#4735)
(cherry picked from commit 727a648db1)
2025-06-09 14:39:45 +00:00
shashank-elastic 9bae798708 Add update ATT&CK coverage step in lock versions (#4772)
(cherry picked from commit d1e9247bd4)
2025-06-09 13:55:17 +00:00
Eric Forte 6268062729 [FR] Add check-version-lock dev command (#4650)
* Add check-version-lock dev command

* Bump the version

* Add Check Double Bumps to lock-versions workflow

* Replace return with ctx aware exit

* Bump Version

* Update Double Bump Modulo calculation

* Update if formatting

* Undo formatting typo

* Add logic to process the local file

* Update for descriptiveness

* Allow double bump branch for testing

* Pass github token

* Re-restrict to main

* Patch version bump

* Add comment if no double bumps found

* Bump Version

(cherry picked from commit 639d748ec2)
2025-05-06 17:31:03 +00:00
Eric Forte dd7240343b [FR] Update Detection Rules MITRE Workflow to SHA Pin (#4581)
* Update to pinned hash

* version bump

(cherry picked from commit 108b64f0c2)
2025-04-15 13:08:17 +00:00
shashank-elastic 31d65ad1e1 Prep main for 9.1 (#4555)
* Prep for Release 9.1

* Update Patch Version

* Update Patch version

* Update Patch version

Removed changes from:
- detection_rules/etc/packages.yaml

(selectively cherry picked from commit e8c54169a4)
2025-03-26 15:08:47 +00:00
Eric Forte 06cf432a83 [FR] Bump changed-files Version to Patched Version (#4542)
* Bump changed-files Version to Patched Version

* patch bump

* reenable workflow

* Use full length commit hash

* Bump 44 to 46

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit 75b2b5cb6a)
2025-03-20 17:03:30 +00:00
Martijn Laarman b6fbce7f52 [ci] Add new docs-builder automation. (#4507)
* Add new docs automation

* Add path-pattern filters for documentation folders

* Update .github/workflows/docs-build.yml

Co-authored-by: Jan Calanog <nejcalanog@gmail.com>

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Jan Calanog <nejcalanog@gmail.com>
Co-authored-by: Sergey Polzunov <traut@users.noreply.github.com>

(cherry picked from commit cd9ec7838c)
2025-03-20 16:25:45 +00:00
shashank-elastic a1dd22efbe Prep for Release 9.0 (#4550)
Removed changes from:
- detection_rules/etc/packages.yaml

(selectively cherry picked from commit 059d7efa25)
2025-03-20 15:07:35 +00:00
Eric Forte 5ccb7ed4af Min stack rules from 4516 (#4549) 2025-03-19 20:27:30 -04:00
Eric Forte 5b3dc4a4a7 Revert "Add new ML detection rules for Privileged Access Detection (#4516)" (#4548)
This reverts commit 2ff8d1bb56.
2025-03-19 20:08:08 -04:00
Kirti Sodhi 2ff8d1bb56 Add new ML detection rules for Privileged Access Detection (#4516)
Add detection-rules for privileged access detection integration
2025-03-19 11:02:28 -04:00
Eric Forte 40a97f719f Temporaily Disable Changed FIles Workflow (#4538)
* Temporaily Disable Changed FIles Workflow

* bump version
2025-03-14 23:42:48 -04:00
Sergey Polzunov 3bdda091e1 chore: use docs-dev instead of docs dir for docs (#4522)
* chore: use `docs-dev` instead of `docs` folder

* patch version bump

* Rollback an incorrect rename

* Use exact docs dir in the helper comment

* Revert some overeager renamings

* Moving `docs` to `docs-dev`

* Update Docs Paths

---------

Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
2025-03-07 14:34:51 +01:00
Sergey Polzunov 081bd03618 fix(ci): use negative patterns in paths instead of paths-ignore (#4521) 2025-03-06 13:57:41 +01:00
Sergey Polzunov 8854b3bea0 Ignore changes in rules/integrations except endpoint, and in _deprecated (#4498) 2025-03-05 12:49:46 +01:00
Sergey Polzunov e528feb989 chore(ci): new CI action trigger for REACT testing workflow (#4435)
* React test trigger

* Delete outdated CI trigger

* Fixing a trigger event

* Dummy rule updates

* Fix workflow name

* Fix typo in curl command

* Use correct token

* Using full workflow filename with extension

* Simplified JSON in curl request

* Using a correct value for branch

* Use a correct ref for a workflow

* Fix for invalid field name in a dispatch data

* Simplify json body

* Revert "Dummy rule updates"

This reverts commit 6c18c5b8b39702cd4106c7b46b8534c76c4c9c27.
2025-02-06 19:39:49 +01:00
Ruben Groenewoud 80fe96109b [New & Tuning] Persistence via GRUB Bootloader (#4401)
* [New & Tuning] Persistence via GRUB Bootloader

* testing github version code workflow update

* testing github version code workflow re-order

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
2025-01-27 09:58:43 +01:00
Terrance DeJesus c912b78586 maintenance - remove hunting TOML files from repo version checks (#4374) 2025-01-14 14:45:53 -05:00
Terrance DeJesus 32a94dc7c7 updating token references (#4367) 2025-01-10 11:20:17 -05:00
Terrance DeJesus 46637f38a4 maintenance repository config update pt 4 (#4364) 2025-01-09 18:05:55 -05:00
Terrance DeJesus 98cef59a5b [Maintenance] Repository Config Update pt 3 (#4363)
* updating integrations and manual backport tokens

* updated no reply address

* changed integrations to security docs token

* changed integrations to security docs token
2025-01-09 17:20:57 -05:00
Terrance DeJesus 4e588e8d90 updated package token (#4361) 2025-01-09 16:59:02 -05:00
Terrance DeJesus ad180777cf [Maintenance] Repository Config Update (#4359)
* updating tokens

* bumped patch

* updated navigator gist ID

* updated naming

* Update .github/workflows/manual-backport.yml

* updated navigator url

* updated noreply email

* updated naming

* Update .github/workflows/manual-backport.yml

Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>

* updating README

* updated gist token

* replaced guidelines token with GITHUB_TOKEN

---------

Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
2025-01-09 16:35:18 -05:00
Terrance DeJesus 1a189a5749 [Python] Ignore Hunting Doc Changes for Version Code Checks (#4331)
* Ignore hunting docs for version code checks

* added index.md to be ignored

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
2025-01-07 12:54:27 +01:00
shashank-elastic 2c848c5111 Prep for Release 8.18 (#4288) 2024-12-09 18:25:13 +05:30
shashank-elastic d2502c7394 Prep for Release 8.17 (#4256) 2024-11-07 23:53:04 +05:30
Mika Ayenson 2ca746c4b4 [FR] Reset package version and push tag via ci (#4260) 2024-11-07 12:11:00 -06:00
Mika Ayenson 48a051e3f1 [FR] Fetch history for versioning workflow (#4259) 2024-11-07 11:57:33 -06:00
Mika Ayenson c615df680f [FR] Update the release versioning process and workflow (#4257) 2024-11-07 11:31:54 -06:00
Mika Ayenson c1ac8f0fae [FR] DRAFT Release Workflow on PR Merge (#4253) 2024-11-06 15:36:09 -06:00
Mika Ayenson 63732436b4 [FR] Update release-drafter.yml (#4252) 2024-11-06 09:02:55 -06:00
Mika Ayenson 77f42f1168 [FR] Add Versioning Processes to DR (#4223) 2024-11-06 08:14:50 -06:00
shashank-elastic e2f1fcefa8 Add flag to update the docs/ATT&CK-coverage.md with markdown URL(s) (#4077) 2024-09-19 23:12:01 +05:30
shashank-elastic f3b0dc1954 Prep for next release 8.16 (#3919) 2024-07-24 11:19:56 -04:00
eric-forte-elastic baee89de9b Revert "Prep for next release 8.16 (#3914)"
This reverts commit 4245a815d2.
2024-07-23 14:06:04 -04:00
shashank-elastic 4245a815d2 Prep for next release 8.16 (#3914)
* Prep for Release 8.16

* Add subscription

* Remove double subscription

* Formatting

* Formatting

* Revert Beaconing rules minstack and lock version
2024-07-23 13:04:03 -04:00
Mika Ayenson 03c99d22d3 Revert "Prep for Release 8.16 (#3913)"
This reverts commit 01135085f6.
2024-07-23 09:50:04 -05:00
shashank-elastic 01135085f6 Prep for Release 8.16 (#3913) 2024-07-23 09:42:26 -05:00