Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add testcase to check for related_integrations based on index #4096

Merged
merged 19 commits into from
Oct 21, 2024
Merged

Add testcase to check for related_integrations based on index #4096

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
0f8b6b5
Add testcase to check for related_integrations based on index
shashank-elastic Sep 23, 2024
8172997
Refine apm index search
shashank-elastic Sep 23, 2024
837d23e
Fix failing rules
shashank-elastic Sep 23, 2024
42b4ba8
Refactor Definitions declarations
shashank-elastic Sep 23, 2024
8c2407b
Fix Lint errors
shashank-elastic Sep 23, 2024
331f4c6
Dynamic mapping of integration from index pattern
shashank-elastic Sep 27, 2024
c0598a0
Fix Lint errors
shashank-elastic Sep 27, 2024
7b10168
Merge branch 'main' into issue-4046
shashank-elastic Sep 27, 2024
094ac2f
Fix updated date
shashank-elastic Sep 27, 2024
a6fa89f
Merge branch 'main' into issue-4046
shashank-elastic Oct 3, 2024
a89a60c
Updated Data
shashank-elastic Oct 3, 2024
e7bbe73
Merge branch 'main' into issue-4046
shashank-elastic Oct 7, 2024
cc99924
Merge main and resolve conflicts
shashank-elastic Oct 17, 2024
d5a1126
fix corrupted rule
shashank-elastic Oct 17, 2024
24395ba
fix corrupted rule and update review comments
shashank-elastic Oct 17, 2024
c28254f
fix corrupted rule
shashank-elastic Oct 17, 2024
9bcc586
fix failing rules
shashank-elastic Oct 17, 2024
72070f3
PR Review comments
shashank-elastic Oct 18, 2024
58155e6
Merge branch 'main' into issue-4046
shashank-elastic Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions detection_rules/schemas/definitions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,3 +247,11 @@ def validator(value):
'geo_point', 'geo_shape', 'point', 'shape',
'percolator'
]

# definitions for the integration to index mapping unit test case
IGNORE_IDS = ["eb079c62-4481-4d6e-9643-3ca499df7aaa", "699e9fdb-b77c-4c01-995c-1c15019b9c43",
"0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0", "a198fbbd-9413-45ec-a269-47ae4ccf59ce",
"0c41e478-5263-4c69-8f9e-7dfd2c22da64", "aab184d3-72b3-4639-b242-6597c99d8bca",
"a61809f3-fb5b-465c-8bff-23a8a068ac60", "f3e22c8b-ea47-45d1-b502-b57b6de950b3"]
IGNORE_INDICES = ['.alerts-security.*', 'logs-*', 'metrics-*', 'traces-*', 'endgame-*',
'filebeat-*', 'packetbeat-*', 'auditbeat-*', 'winlogbeat-*']
4 changes: 2 additions & 2 deletions rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2022/09/03"
integration = ["endpoint"]
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2024/09/10"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/04/03"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/command_and_control_rdp_tunnel_plink.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/10/14"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2024/10/15"
updated_date = "2024/10/17"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/command_and_control_screenconnect_childproc.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2024/03/27"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2024/10/15"
updated_date = "2024/10/17"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/command_and_control_tunnel_vscode.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2024/09/09"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2024/10/15"
updated_date = "2024/10/17"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/credential_access_cmdline_dump_tool.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/11/24"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/credential_access_dcsync_newterm_subjectuser.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2022/12/19"
integration = ["windows"]
integration = ["windows", "system"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/credential_access_persistence_network_logon_provider_modification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/03/18"
integration = ["endpoint", "m365_defender"]
integration = ["endpoint", "m365_defender", "windows"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/credential_access_saved_creds_vaultcmd.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/01/19"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/11/27"
integration = ["windows"]
integration = ["windows", "system"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/defense_evasion_cve_2020_0601.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/03/19"
integration = ["windows"]
integration = ["windows", "system"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
2 changes: 1 addition & 1 deletion rules/windows/defense_evasion_defender_disabled_via_registry.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/12/23"
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/defense_evasion_from_unusual_directory.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/10/30"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/defense_evasion_sip_provider_mod.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/01/20"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/defense_evasion_suspicious_zoom_child_process.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2024/10/15"
updated_date = "2024/10/17"

[transform]
[[transform.osquery]]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/defense_evasion_unusual_system_vp_child_program.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/08/19"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/defense_evasion_via_filter_manager.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "m365_defender"]
integration = ["endpoint", "windows", "m365_defender", "system"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/execution_com_object_xwizard.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/01/20"
integration = ["endpoint", "windows", "m365_defender"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/execution_suspicious_pdf_reader.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/03/30"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/execution_via_mmc_console_file_unusual_path.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2024/06/19"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2024/10/15"
updated_date = "2024/10/17"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/impact_stop_process_service_threshold.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/12/03"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/lateral_movement_execution_from_tsclient_mup.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/11/11"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/lateral_movement_unusual_dns_service_children.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/07/16"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/persistence_registry_uncommon.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/11/18"
integration = ["endpoint"]
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/persistence_via_update_orchestrator_service_hijack.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/08/17"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/privilege_escalation_dns_serverlevelplugindll.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2024/05/29"
integration = ["endpoint"]
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2024/09/12"
integration = ["endpoint", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "sentinel_one_cloud_funnel", "m365_defender", "windows"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2024/10/15"
updated_date = "2024/10/17"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/privilege_escalation_printspooler_registry_copyfiles.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/11/26"
integration = ["endpoint"]
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/10/17"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down
4 changes: 2 additions & 2 deletions rules_building_block/collection_files_staged_in_recycle_bin_root.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/08/24"
integration = ["endpoint"]
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules_building_block/collection_outlook_email_archive.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/08/21"
integration = ["endpoint"]
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/08/09"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules_building_block/command_and_control_bitsadmin_activity.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/08/21"
integration = ["endpoint"]
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/08/09"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules_building_block/credential_access_win_private_key_access.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/08/21"
integration = ["endpoint"]
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/08/09"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
4 changes: 2 additions & 2 deletions rules_building_block/defense_evasion_cmd_copy_binary_contents.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/08/23"
integration = ["endpoint"]
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/08/09"
updated_date = "2024/09/23"

[rule]
author = ["Elastic"]
Expand Down
Loading
Loading