mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Samirbous
f10d22190a
* [New] Elastic Defend and NG-Firewall Alerts Correlation
This rule correlate any Elastic Defend alert with a set of suspicious events from Next-Gen Firewall like PAN and Fortigate by host.ip. This may indicate that this host is compromised and triggering multi-datasource alerts.
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml
* Update multiple_alerts_elastic_defend_netsecurity_by_host.toml
* Update multiple_alerts_elastic_defend_netsecurity_by_host.toml
* Update multiple_alerts_elastic_defend_netsecurity_by_host.toml
* Add suricata and fortinet_fortigate
* ++
* Update multiple_alerts_elastic_defend_netsecurity_by_host.toml
* Update pyproject.toml
* Update multiple_alerts_elastic_defend_netsecurity_by_host.toml
---------
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
(cherry picked from commit d946bb36b7)