Samirbous 30f51c0738 [Tuning] Diverse Rules (#6129) ...

* Update command_and_control_auditd_curl_wget_from_container.toml

* Update credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml

* Update discovery_kubectl_secrets_all_namespaces.toml

* Update discovery_kubectl_secrets_all_namespaces.toml

* Update credential_access_kubernetes_secret_read_by_node_or_pod_service_account.toml

* Update execution_aws_ssm_session_manager_child_process.toml

* Update credential_access_kubernetes_secret_read_by_node_or_pod_service_account.toml

* Update credential_access_kubernetes_secret_read_by_node_or_pod_service_account.toml

* Update discovery_kubernetes_multi_resource_setup_recon.toml

* Update discovery_kubernetes_multi_resource_setup_recon.toml

* Update credential_access_kubernetes_multiple_secret_retrieval_burst.toml

* Update discovery_kubernetes_multi_resource_setup_recon.toml

Removed changes from:
- rules/cross-platform/discovery_kubectl_secrets_all_namespaces.toml

(selectively cherry picked from commit 85f59d9d4e)

2026-05-18 09:45:37 +00:00

..

aws

[New] EKS Access Entry Granted Cluster Admin Policy (#6091)

2026-05-14 15:47:47 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296)

2025-11-11 02:09:11 +00:00

azure

[New] Potential Tycoon2FA AiTM Rules (#6143)

2026-05-18 09:27:11 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)

2025-09-30 04:38:50 +00:00

beaconing

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

cyberarkpas

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

ded

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

dga

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

endpoint

Prep 8.19/9.1 (#4869)

2025-07-07 15:30:11 +00:00

fim

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

gcp

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

github

Field not supported in integration (#6131)

2026-05-13 12:22:01 +00:00

google_workspace

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

kubernetes

[Tuning] Diverse Rules (#6129)

2026-05-18 09:45:37 +00:00

lmd

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

microsoft_exchange_online_message_trace

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

o365

[New] Potential Tycoon2FA AiTM Rules (#6143)

2026-05-18 09:27:11 +00:00

okta

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:18:45 +00:00

pad

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

problemchild

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00