admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,641 Commits 407 Branches 706 Tags
bb58cd623fff5bcd91ef5467893fcb022f58118d
Commit Graph

8 Commits

Author SHA1 Message Date
Mika Ayenson, PhD b322b7505c [Rule Tuning] Add Supplemental Mitre Mappings (#5876) 
---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

(cherry picked from commit 8993d1450b)
 2026-04-01 14:16:50 +00:00
Ruben Groenewoud 5acf1127de [Rule Tuning] Adding D4C Compatibility to Compatible Container-Related Rules (#5685) 
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword

* [Rule Tuning] Adding D4C Compatibility to Compatible Container-Related Rules

(cherry picked from commit 440ff43810)
 2026-02-06 08:42:54 +00:00
Mika Ayenson, PhD 9b69bc806e Revert "[Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules (#5578)" (#5620) 
This reverts commit c608b673bf.

(cherry picked from commit bbe83452b4)
 2026-01-26 14:35:43 +00:00
Ruben Groenewoud 625b6bc531 [Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules (#5578) 
* [Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules

* Update manifests & schemas

* [New/Updated] Migrated `process.command_line` --> `process.args` for Compatibility

* Pyproject.toml Patch

* ++

(cherry picked from commit c608b673bf)
 2026-01-26 12:31:59 +00:00
Ruben Groenewoud ccd3f70ee8 [Rule Tuning] Linux DR Tuning - 6 (#5497) 
* [Rule Tuning] Linux DR Tuning - 6

* Fix syntax error in discovery_esxi_software_via_grep.toml

* Update discovery_pam_version_discovery.toml

* Update discovery_virtual_machine_fingerprinting.toml

* Revise investigation title for kernel module enumeration

Updated the title of the investigation section to clarify focus on unusual kernel module enumeration.

* Update discovery_port_scanning_activity_from_compromised_host.toml

* Enhance ESQL query for subnet scanning detection

Updated ESQL query to include additional fields and conditions for better analysis of connection attempts from compromised hosts.

* Remove Elastic Endgame data source from rule

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2026-01-08 10:45:32 +01:00
shashank-elastic 3966981dae Add investigation guides (#4600) 2025-04-07 20:55:39 +05:30
shashank-elastic 059d7efa25 Prep for Release 9.0 (#4550) 2025-03-20 20:32:07 +05:30
Ruben Groenewoud fe0a9f4935 [New/Tuning] Docker Socket Enumeration (#4510) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-06 17:07:10 +01:00