5 Commits

Author	SHA1	Message	Date
Ruben Groenewoud	d2439bb4ea	[Rule Tuning] Linux DR Tuning - 10 (#5510) ... * [Rule Tuning] Linux DR Tuning - 10 * Update persistence_udev_rule_creation.toml * Refactor ESQL query for Linux process events * Refactor query in persistence_web_server_sus_command_execution rule Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace. * Update persistence_systemd_netcon.toml * Update persistence_web_server_sus_child_spawned.toml * Refactor process.parent.name conditions in TOML file * Update persistence_web_server_unusual_command_execution.toml * Update persistence_web_server_unusual_command_execution.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> (cherry picked from commit d968f62a5a)	2026-01-08 08:36:28 +00:00
Ruben Groenewoud	49060cbd55	[Rule Tuning] Linux DR Tuning - 9 (#5508) ... * [Rule Tuning] Linux DR Tuning - 9 * Update rules/linux/persistence_apt_package_manager_file_creation.toml * Fix formatting in persistence_boot_file_copy.toml * Update persistence_chkconfig_service_add.toml * Change user.id values to string format in TOML * Fix condition for Java process working directory * Fix logical operator in OpenSSL passwd hash rule * Fix syntax for working_directory check * Fix condition for original file name check * Update persistence_web_server_unusual_command_execution.toml * Add cloud CLI tools to persistence rules --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> (cherry picked from commit a973da1a6b)	2026-01-07 15:22:26 +00:00
Ruben Groenewoud	7452a6a4e5	[Rule Tuning] Unusual Web Server Command Execution (#5450) ... * [Rule Tuning] Unusual Web Server Command Execution * ++ (cherry picked from commit d16ee304d5)	2025-12-12 12:04:56 +00:00
shashank-elastic	b7180b1201	December Schema Refresh (#5420) ... Removed changes from: - rules/integrations/azure/ml_azure_event_failures.toml - rules/integrations/azure/ml_azure_rare_event_failures.toml - rules/integrations/azure/ml_azure_rare_method_by_city.toml - rules/integrations/azure/ml_azure_rare_method_by_country.toml - rules/integrations/azure/ml_azure_rare_method_by_user.toml (selectively cherry picked from commit 58a514340b)	2025-12-08 16:41:34 +00:00
Ruben Groenewoud	81a746cec9	[New Rule] Unusual Web Server Command Execution (#5392) ... * [New Rule] Unusual Web Server Command Execution * ++ * Add node and java to unusual command execution rule (cherry picked from commit 4fc6aa9a35)	2025-12-03 15:33:08 +00:00