mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Samirbous
d47b555a2e
* [New] Device Registration via OAuth Code Authentication
* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml
* Create persistence_identity_protect_alert_followed_by_device_reg.toml
* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml
* Create initial_access_multi_azure_identity_protection_alerts.toml
* changed from KQL to EQL
* updated rules; query logic changes; investigation guides; schema
* updating patch version
* Update pyproject.toml
* ++
* Update non-ecs-schema.json
* Update rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update persistence_identity_protect_alert_followed_by_device_reg.toml
* Update persistence_identity_protect_alert_followed_by_device_reg.toml
* Update persistence_identity_protect_alert_followed_by_device_reg.toml
---------
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
(cherry picked from commit db688e43b3)