elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

James Valente c25110e975 [Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce (#4405 )

* Add exceptions for non-interactive signin failures.

Include exceptions for error codes, restricted to `NonInteractiveUserSignInLogs` and token refreshes:

- 70043 : Refresh token expired or no longer valid due to conditional access frequency checks
- 70044 : Session expired or no longer valid due to conditional access frequency checks
- 50057 : User account is disabled

* Update rules/integrations/azure/credential_access_entra_signin_brute_force_microsoft_365.toml

* Update metadata for `updated_date`

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit 36d595ae2f)

2025-05-06 17:17:43 +00:00

aws

[New Rule] Adding Coverage for AWS S3 Static Site JavaScript File Uploaded (#4617 )

2025-04-30 20:29:03 +00:00

aws_bedrock

Prep for Release 9.0 (#4550 )

2025-03-20 15:07:35 +00:00

azure

[Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce (#4405 )

2025-05-06 17:17:43 +00:00

azure_openai

Add investigation guides (#4600 )