-
Notifications
You must be signed in to change notification settings - Fork 179
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* initial dump * temporarily changes ml job link to allow docs built * removes the use of the word signal * ML rules formatting and minor text edits * new rule formatting and edits * missing full stop
- Loading branch information
1 parent
9a89975
commit 1e8c0bd
Showing
204 changed files
with
7,061 additions
and
1,115 deletions.
There are no files selected for viewing
393 changes: 289 additions & 104 deletions
393
docs/siem/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
Large diffs are not rendered by default.
Oops, something went wrong.
404 changes: 258 additions & 146 deletions
404
docs/siem/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
67 changes: 67 additions & 0 deletions
67
...ilt-rules/rule-details/administrator-privileges-assigned-to-okta-group.asciidoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| [[administrator-privileges-assigned-to-okta-group]] | ||
| === Administrator Privileges Assigned to Okta Group | ||
|
|
||
| An adversary may attempt to assign administrator privileges to an Okta group in | ||
| order to assign additional permissions to compromised user accounts. | ||
|
|
||
| *Rule type*: query | ||
|
|
||
| *Rule indices*: | ||
|
|
||
| * filebeat-* | ||
|
|
||
| *Severity*: low | ||
|
|
||
| *Risk score*: 21 | ||
|
|
||
| *Runs every*: 5 minutes | ||
|
|
||
| *Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>) | ||
|
|
||
| *Maximum alerts per execution*: 100 | ||
|
|
||
| *References*: | ||
|
|
||
| * https://developer.okta.com/docs/reference/api/system-log/ | ||
| * https://developer.okta.com/docs/reference/api/event-types/ | ||
|
|
||
| *Tags*: | ||
|
|
||
| * Elastic | ||
| * Okta | ||
|
|
||
| *Version*: 1 | ||
|
|
||
| *Added ({stack} release)*: 7.9.0 | ||
|
|
||
| *Rule authors*: Elastic | ||
|
|
||
| *Rule license*: Elastic License | ||
|
|
||
| ==== Potential false positives | ||
|
|
||
| Consider adding exceptions to this rule to filter false positives if | ||
| administrator privileges are regularly assigned to Okta groups in your | ||
| organization. | ||
|
|
||
| ==== Rule query | ||
|
|
||
|
|
||
| [source,js] | ||
| ---------------------------------- | ||
| event.module:okta and event.dataset:okta.system and | ||
| event.action:group.privilege.grant | ||
| ---------------------------------- | ||
|
|
||
| ==== Threat mapping | ||
|
|
||
| *Framework*: MITRE ATT&CK^TM^ | ||
|
|
||
| * Tactic: | ||
| ** Name: Persistence | ||
| ** ID: TA0003 | ||
| ** Reference URL: https://attack.mitre.org/tactics/TA0003/ | ||
| * Technique: | ||
| ** Name: Account Manipulation | ||
| ** ID: T1098 | ||
| ** Reference URL: https://attack.mitre.org/techniques/T1098/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.