From a86ea6fa51a6ec72c69484fddbf3a50ad7ea7a26 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 25 Jul 2024 10:52:00 -0500 Subject: [PATCH] Manual Testing flag due to ES Lookups --- .../endpoint/detect_remote_access_software_usage_fileinfo.yml | 3 ++- .../endpoint/detect_remote_access_software_usage_process.yml | 1 + detections/network/detect_remote_access_software_usage_dns.yml | 1 + .../network/detect_remote_access_software_usage_traffic.yml | 1 + detections/web/detect_remote_access_software_usage_url.yml | 1 + 5 files changed, 6 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 7f0de37bc0..0bf7620e9a 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -65,7 +65,8 @@ tags: - process_name - process risk_score: 25 - security_domain: endpoint + security_domain: endpoint + manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index ffa5277821..833f731b24 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -79,6 +79,7 @@ tags: - Processes.parent_process_name risk_score: 25 security_domain: endpoint + manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index e12efc189d..b79584b519 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -65,6 +65,7 @@ tags: - DNS.answer risk_score: 25 security_domain: endpoint + manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 34eab59c4a..b7407380f2 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -65,6 +65,7 @@ tags: - user risk_score: 25 security_domain: network + manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index aeb5a714f6..c3cfab2438 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -72,6 +72,7 @@ tags: - Web.url_domain risk_score: 25 security_domain: network + manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: