-
Notifications
You must be signed in to change notification settings - Fork 70
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add kibana/security-rule asset type (#142)
* Add kibana/rules for detection rules as JSON files * Update changelog.yml * Limit scope to a single 'security-rule' asset * Update spec and statik * Update specs * Loosen up security_rule artifact
- Loading branch information
Showing
4 changed files
with
50 additions
and
1 deletion.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
37 changes: 37 additions & 0 deletions
37
test/packages/good/kibana/security_rule/rule-000047bb-b27a-47ec-8b62-ef1a5d2c9e19.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
{ | ||
"author": [ | ||
"Elastic" | ||
], | ||
"description": "Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls.", | ||
"false_positives": [ | ||
"Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization." | ||
], | ||
"index": [ | ||
"filebeat-*", | ||
"logs-okta*" | ||
], | ||
"language": "kuery", | ||
"license": "Elastic License v2", | ||
"name": "Attempt to Modify an Okta Policy Rule", | ||
"note": "The Okta Fleet integration or Filebeat module must be enabled to use this rule.", | ||
"query": "event.dataset:okta.system and event.action:policy.rule.update", | ||
"references": [ | ||
"https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", | ||
"https://developer.okta.com/docs/reference/api/system-log/", | ||
"https://developer.okta.com/docs/reference/api/event-types/" | ||
], | ||
"risk_score": 21, | ||
"rule_id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19", | ||
"severity": "low", | ||
"tags": [ | ||
"Elastic", | ||
"Identity", | ||
"Okta", | ||
"Continuous Monitoring", | ||
"SecOps", | ||
"Identity and Access" | ||
], | ||
"timestamp_override": "event.ingested", | ||
"type": "query", | ||
"version": 5 | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters