3 Commits

Author	SHA1	Message	Date
Terrance DeJesus	906c43891c	[Rule Tuning] Change event.dataset to data_stream.dataset (#5943) ... * [Rule Tuning] Change event.dataset to data_stream.dataset * updating ESQL field names Removed changes from: - rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml - rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml - rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml - rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml - rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml - rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml - rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml - rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml (selectively cherry picked from commit deab1c0161)	2026-04-10 16:31:06 +00:00
shashank-elastic	e10aced1a1	Monthly Manifest and Schema Updation (#5920) ... Removed changes from: - rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml (selectively cherry picked from commit 199a4d6160)	2026-04-06 12:08:32 +00:00
Ruben Groenewoud	5a31a4eccf	[New Rules] LiteLLM & Trivy TeamPCP Compromise (#5885) ... * [New Rules] LiteLLM & Trivy TeamPCP Compromise * ++ * Apply suggestion from @Samirbous Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Apply suggestion from @Samirbous Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * ++ * ++ * Update rules/cross-platform/collection_data_encrypted_via_openssl.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/cross-platform/collection_data_encrypted_via_openssl.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * ++ * ++ * ++ * ++ * Update rules/cross-platform/execution_suspicious_python_command_execution.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/cross-platform/execution_suspicious_python_command_execution.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * ++ * ++ * ++ * ++ --------- Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> Removed changes from: - rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml (selectively cherry picked from commit c6f843ef9d)	2026-03-26 16:19:45 +00:00