-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SIEM] version 7.7 rule import #61903
Conversation
Pinging @elastic/siem (Team:SIEM) |
...ion_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json
Show resolved
Hide resolved
.../server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json
Outdated
Show resolved
Hide resolved
…repackaged_rules/windows_credential_dumping_msbuild.json Co-Authored-By: Garrett Spong <spong@users.noreply.github.com>
…o 77-siem-rules
...gacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.ts
Show resolved
Hide resolved
@elasticmachine merge upstream |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This rules @randomuserid! LGTM 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
We will bump versions of modified rules and incorporate the changes for BC3 as discussed. I also updated the schema in siem-rules to reflect index
being forbidden for machine_learning
rules
@@ -4,7 +4,7 @@ | |||
* you may not use this file except in compliance with the Elastic License. | |||
*/ | |||
|
|||
export const totalNumberOfPrebuiltRules = 92; | |||
export const totalNumberOfPrebuiltRules = 130; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
⭐️
💚 Build SucceededHistory
To update your PR or re-run it, just comment with: |
* rule import * Update x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json Co-Authored-By: Garrett Spong <spong@users.noreply.github.com> * Update add_prepackaged_rules_schema.ts * Update rule.ts * updates 'prebuilt_rules_loaded' data (elastic#61940) Co-authored-by: Garrett Spong <spong@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: MadameSheema <snootchie.boochies@gmail.com>
* rule import * Update x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json Co-Authored-By: Garrett Spong <spong@users.noreply.github.com> * Update add_prepackaged_rules_schema.ts * Update rule.ts * updates 'prebuilt_rules_loaded' data (elastic#61940) Co-authored-by: Garrett Spong <spong@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: MadameSheema <snootchie.boochies@gmail.com>
* upstream/master: (69 commits) Adding PagerDuty icon to connectors cards (elastic#60805) Fix drag and drop flakiness (elastic#61993) Grok debugger migration (elastic#60658) Endpoint: Fix resolver SVG position issue (elastic#61886) [SIEM] version 7.7 rule import (elastic#61903) Added styles to make combobox list items wider for alerting flyout (elastic#61894) [UA] Tight worker loop can cause high CPU usage (elastic#60950) [ML] DF Analytics results table: use index pattern field format if one exists (elastic#61709) [ML] Catching unknown index pattern errors (elastic#61935) [Discover] Deangularize and euificate sidebar (elastic#47559) Endpoint: Add ts-node dev dependency (elastic#61884) Add an onBlur handler for the kuery bar. Only resubmit when input changes. (elastic#61901) [ML] Handle Empty Partition Field Values in Single Metric Viewer (elastic#61649) Auto interval on date histogram is getting displayed as timestamp per… (elastic#59171) [Maps] Explicitly pass fetch function to ems-client (elastic#61846) [SIEM][CASE] Fix aria-labels and translations (elastic#61670) [ML] Settings: Increase number of items that can be paged in calendars and filters lists (elastic#61842) [EPM] update epm filepath route (elastic#61910) APM] Set ignore_above to 1024 for telemetry saved object (elastic#61732) [Logs UI] Log stream row rendering (elastic#60773) ...
* rule import * Update x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json Co-Authored-By: Garrett Spong <spong@users.noreply.github.com> * Update add_prepackaged_rules_schema.ts * Update rule.ts * updates 'prebuilt_rules_loaded' data (#61940) Co-authored-by: Garrett Spong <spong@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: MadameSheema <snootchie.boochies@gmail.com> Co-authored-by: The SpaceCake Project <randomuserid@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: MadameSheema <snootchie.boochies@gmail.com>
* rule import * Update x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json Co-Authored-By: Garrett Spong <spong@users.noreply.github.com> * Update add_prepackaged_rules_schema.ts * Update rule.ts * updates 'prebuilt_rules_loaded' data (#61940) Co-authored-by: Garrett Spong <spong@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: MadameSheema <snootchie.boochies@gmail.com> Co-authored-by: The SpaceCake Project <randomuserid@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: MadameSheema <snootchie.boochies@gmail.com>
* master: (64 commits) Adding PagerDuty icon to connectors cards (elastic#60805) Fix drag and drop flakiness (elastic#61993) Grok debugger migration (elastic#60658) Endpoint: Fix resolver SVG position issue (elastic#61886) [SIEM] version 7.7 rule import (elastic#61903) Added styles to make combobox list items wider for alerting flyout (elastic#61894) [UA] Tight worker loop can cause high CPU usage (elastic#60950) [ML] DF Analytics results table: use index pattern field format if one exists (elastic#61709) [ML] Catching unknown index pattern errors (elastic#61935) [Discover] Deangularize and euificate sidebar (elastic#47559) Endpoint: Add ts-node dev dependency (elastic#61884) Add an onBlur handler for the kuery bar. Only resubmit when input changes. (elastic#61901) [ML] Handle Empty Partition Field Values in Single Metric Viewer (elastic#61649) Auto interval on date histogram is getting displayed as timestamp per… (elastic#59171) [Maps] Explicitly pass fetch function to ems-client (elastic#61846) [SIEM][CASE] Fix aria-labels and translations (elastic#61670) [ML] Settings: Increase number of items that can be paged in calendars and filters lists (elastic#61842) [EPM] update epm filepath route (elastic#61910) APM] Set ignore_above to 1024 for telemetry saved object (elastic#61732) [Logs UI] Log stream row rendering (elastic#60773) ...
Pinging @elastic/security-solution (Team: SecuritySolution) |
Summary
This PR does not contain new Kibana features. It adds 38 new SIEM rules and makes syntax modifications to existing rules. The rules execute in the existing (siem) detection engine.
Checklist
For maintainers