mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Terrance DeJesus
7fde924213
* [Rule Tuning] Change event.dataset to data_stream.dataset
* updating ESQL field names
Removed changes from:
- rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml
- rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml
- rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml
- rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml
- rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml
- rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml
- rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml
- rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml
- rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml
- rules/integrations/aws/discovery_organization_discovery_by_rare_user.toml
- rules/integrations/aws/discovery_s3_rapid_bucket_posture_api_calls.toml
- rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml
- rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml
- rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml
- rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml
- rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml
- rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml
- rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml
- rules/windows/defense_evasion_masquerading_as_svchost.toml
(selectively cherry picked from commit deab1c0161)