yuriShafet 75f5ebfb94 [Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523) (#5686) ...

Add EQL exclusions for benign activity:
Opera GX renderer children,
Slack creating slack children,
Node using playwright to create chrome process
Python editors accessing reg.exe
Logitech manager activity
 and Zabbix script paths.

(cherry picked from commit 64cca9e1ba)

2026-02-05 20:57:33 +00:00

..

aws

[Rule Tunings] AWS remove target.entity.id and actor.entity.id fields (#5603)

2026-01-22 20:05:38 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296)

2025-11-11 02:11:34 +00:00

azure

[Rule Tuning] Entra ID OAuth Phishing via First-Party Microsoft Application (#5610)

2026-01-26 19:58:26 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)

2025-09-30 00:36:29 -04:00

beaconing

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

cyberarkpas

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

ded

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

dga

[Rule Tuning] Reduce Severity from Critical to High (#4637)

2025-05-06 21:37:47 +05:30

endpoint

Prep 8.19/9.1 (#4869)

2025-07-07 11:27:48 -04:00

fim

[Rule Tuning] Potential Persistence via File Modification (#5404)

2025-12-05 09:36:50 +00:00

gcp

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

github

[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)

2026-02-05 12:27:46 +00:00

google_workspace

Fix spacing in Setup information (#4470)

2025-02-20 10:04:13 +05:30

kubernetes

[New Rules] Misc. K8s RBAC Abuse Rules (#5673)

2026-02-05 16:45:12 +00:00

lmd

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

o365

[Tuning] M365 Exchange Inbox Phishing Evasion Rule Created (#5648)

2026-02-05 13:06:17 +00:00

okta

[New Rule] Okta AiTM Session Cookie Replay Detection (#5627)

2026-01-29 14:02:12 +00:00

pad

Prep 8.19/9.1 (#4869)

2025-07-07 11:27:48 -04:00

problemchild

[Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523) (#5686)

2026-02-05 20:57:33 +00:00