Skip to content

Commit 3a4bec1

Browse files
[Security Rules] Update security rules package to v8.8.1-beta.1 (#6008)
* [Security Rules] Update security rules package to v8.8.1-beta.1 * Add changelog entry for 8.8.1-beta.1 --------- Co-authored-by: protectionsmachine <[email protected]>
1 parent a13a046 commit 3a4bec1

File tree

3 files changed

+51
-3
lines changed

3 files changed

+51
-3
lines changed

packages/security_detection_engine/changelog.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# newer versions go on top
22
# NOTE: please use pre-release versions (e.g. -beta.0) until a package is ready for production
3+
- version: 8.8.1-beta.1
4+
changes:
5+
- description: Release security rules update
6+
type: enhancement
7+
link: https://github.com/elastic/integrations/pull/6008
38
- version: 8.7.3
49
changes:
510
- description: Release security rules update
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"attributes": {
3+
"author": [
4+
"Elastic"
5+
],
6+
"description": "Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts.",
7+
"enabled": true,
8+
"from": "now-10m",
9+
"index": [
10+
"logs-cloud_defend.alerts-*"
11+
],
12+
"language": "kuery",
13+
"license": "Elastic License v2",
14+
"max_signals": 10000,
15+
"name": "Container Workload Protection",
16+
"query": "event.kind:alert and event.module:cloud_defend\n",
17+
"required_fields": [
18+
{
19+
"ecs": true,
20+
"name": "event.kind",
21+
"type": "keyword"
22+
},
23+
{
24+
"ecs": true,
25+
"name": "event.module",
26+
"type": "keyword"
27+
}
28+
],
29+
"risk_score": 47,
30+
"rule_id": "4b4e9c99-27ea-4621-95c8-82341bc6e512",
31+
"severity": "medium",
32+
"tags": [
33+
"Elastic",
34+
"Container Workload Protection",
35+
"Kubernetes"
36+
],
37+
"timestamp_override": "event.ingested",
38+
"type": "query",
39+
"version": 1
40+
},
41+
"id": "4b4e9c99-27ea-4621-95c8-82341bc6e512_1",
42+
"type": "security-rule"
43+
}
Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
categories:
22
- security
33
conditions:
4-
kibana.version: ^8.7.0
4+
kibana.version: ^8.8.0
55
description: Prebuilt detection rules for Elastic Security
66
format_version: 1.0.0
77
icons:
@@ -12,7 +12,7 @@ license: basic
1212
name: security_detection_engine
1313
owner:
1414
github: elastic/protections
15-
release: ga
15+
release: beta
1616
title: Prebuilt Security Detection Rules
1717
type: integration
18-
version: 8.7.3
18+
version: 8.8.1-beta.1

0 commit comments

Comments
 (0)