[SIEM] Add initial candidate rules for 7.8 merge may 4#65169
[SIEM] Add initial candidate rules for 7.8 merge may 4#65169randomuserid merged 6 commits intomasterfrom
Conversation
adjust rule count to 145
|
Pinging @elastic/siem (Team:SIEM) |
randomuserid
added
release_note:skip
rw-access
left a comment
rw-access
left a comment
There was a problem hiding this comment.
LGTM.
only request is to update the title of the PR to something more meaningful.
e.g. [SIEM] Add initial candidate rules for 7.8
rw-access
left a comment
rw-access
left a comment
There was a problem hiding this comment.
looks like you're missing the rules .gz file
randomuserid
changed the title
|
@elasticmachine merge upstream |
brokensound77
left a comment
brokensound77
left a comment
There was a problem hiding this comment.
👍 looks like versions aligned as expected
spong
left a comment
spong
left a comment
There was a problem hiding this comment.
LGTM! 👍 Nice to see the conversion script standardizing on the EoF newline and sorted keys.
| "language": "kuery", | ||
| "name": "Attempt to Disable IPTables or Firewall", | ||
| "query": "event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables) or process.name:systemctl and process.args:(firewalld and (disable or stop or kill))", | ||
| "risk_score": 47, |
There was a problem hiding this comment.
Just wondering, how are these defined? I see that the user can select whatever risk_score they want when creating a rule. Is this arbitrary at 47, or is there some meaning behind where it came from?
There was a problem hiding this comment.
they are linked to severity by default.
|
@elasticmachine merge upstream |
* 78 rules populated rules with a package from the siem-rules repo * Update index.ts * Update rule.ts adjust rule count to 145 Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
💚 Build SucceededHistory
To update your PR or re-run it, just comment with: |
* 78 rules populated rules with a package from the siem-rules repo * Update index.ts * Update rule.ts adjust rule count to 145 Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Garrett Spong <spong@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
MindyRS
added
the
Team: SecuritySolution
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
8 participants
Summary
First pass at rule additions for v 7.8
Checklist
Delete any items that are not applicable to this PR.
For maintainers