Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules #945

Merged
merged 6 commits into from
Feb 18, 2021
Merged

[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules #945

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0dc6c9d
[Rule Tuning] Add timestamp_override field to rules
brokensound77 Feb 12, 2021
3d2ebb0
add tests for lookback and timestamp_override
brokensound77 Feb 17, 2021
53b0875
Merge remote-tracking branch 'upstream/7.12' into rule-tuning/add-tim…
brokensound77 Feb 17, 2021
4e8fea2
add lookback back after resolving conflicts
brokensound77 Feb 17, 2021
4333efa
Correct the updated_date year in new 7.12 rules w/override
brokensound77 Feb 18, 2021
418d3c2
fix dates and add test to ensure updated > creation
brokensound77 Feb 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
3 changes: 2 additions & 1 deletion rules/apm/apm_403_response_to_a_post.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -25,6 +25,7 @@ risk_score = 47
rule_id = "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e"
severity = "medium"
tags = ["Elastic", "APM"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
3 changes: 2 additions & 1 deletion rules/apm/apm_405_response_method_not_allowed.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -25,6 +25,7 @@ risk_score = 47
rule_id = "75ee75d8-c180-481c-ba88-ee50129a6aef"
severity = "medium"
tags = ["Elastic", "APM"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
3 changes: 2 additions & 1 deletion rules/apm/apm_null_user_agent.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -22,6 +22,7 @@ risk_score = 47
rule_id = "43303fd4-4839-4e48-b2b2-803ab060758d"
severity = "medium"
tags = ["Elastic", "APM"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
3 changes: 2 additions & 1 deletion rules/apm/apm_sqlmap_user_agent.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -25,6 +25,7 @@ risk_score = 47
rule_id = "d49cc73f-7a16-4def-89ce-9fc7127d7820"
severity = "medium"
tags = ["Elastic", "APM"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
3 changes: 2 additions & 1 deletion rules/aws/collection_cloudtrail_logging_created.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/10"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -28,6 +28,7 @@ risk_score = 21
rule_id = "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed"
severity = "low"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Log Auditing"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
3 changes: 2 additions & 1 deletion rules/aws/credential_access_iam_user_addition_to_group.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/04"
maturity = "production"
updated_date = "2020/12/17"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -26,6 +26,7 @@ risk_score = 21
rule_id = "333de828-8190-4cf5-8d7c-7575846f6fe0"
severity = "low"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Identity and Access"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
3 changes: 2 additions & 1 deletion rules/aws/credential_access_secretsmanager_getsecretvalue.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/07/06"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Nick Jones", "Elastic"]
Expand Down Expand Up @@ -30,6 +30,7 @@ risk_score = 73
rule_id = "a00681e3-9ed6-447c-ab2c-be648821c622"
severity = "high"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Data Protection"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_cloudtrail_logging_deleted.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/05/26"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -28,6 +28,7 @@ risk_score = 47
rule_id = "7024e2a0-315d-4334-bb1a-441c593e16ab"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Log Auditing"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -47,6 +48,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_cloudtrail_logging_suspended.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/10"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -32,6 +32,7 @@ risk_score = 47
rule_id = "1aa8fa52-44a7-4dae-b058-f3333b91c8d7"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Log Auditing"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -51,6 +52,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_cloudwatch_alarm_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/15"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -28,6 +28,7 @@ risk_score = 47
rule_id = "f772ec8a-e182-483c-91d2-72058f76a44c"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -47,6 +48,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_config_service_rule_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/26"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -32,6 +32,7 @@ risk_score = 47
rule_id = "7024e2a0-315d-4334-bb1a-552d604f27bc"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -51,6 +52,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_configuration_recorder_stopped.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/16"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -28,6 +28,7 @@ risk_score = 73
rule_id = "fbd44836-0d69-4004-a0b4-03c20370c435"
severity = "high"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -47,6 +48,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_ec2_flow_log_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/15"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -31,6 +31,7 @@ risk_score = 73
rule_id = "9395fd2c-9947-4472-86ef-4aceb2f7e872"
severity = "high"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Log Auditing"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -50,6 +51,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_ec2_network_acl_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/05/26"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -33,6 +33,7 @@ risk_score = 47
rule_id = "8623535c-1e17-44e1-aa97-7a0699c3037d"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Network Security"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -52,6 +53,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_guardduty_detector_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/05/28"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -31,6 +31,7 @@ risk_score = 73
rule_id = "523116c0-d89d-4d7c-82c2-39e6845a78ef"
severity = "high"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Monitoring"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -50,6 +51,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
3 changes: 2 additions & 1 deletion rules/aws/defense_evasion_s3_bucket_configuration_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/05/27"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -31,6 +31,7 @@ risk_score = 21
rule_id = "227dc608-e558-43d9-b521-150772250bae"
severity = "low"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Asset Visibility"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_waf_acl_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/05/21"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -28,6 +28,7 @@ risk_score = 47
rule_id = "91d04cd4-47a9-4334-ab14-084abe274d49"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Network Security"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -47,6 +48,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
4 changes: 3 additions & 1 deletion rules/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/06/09"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2020/02/11"

[rule]
author = ["Elastic"]
Expand All @@ -28,6 +28,7 @@ risk_score = 47
rule_id = "5beaebc1-cc13-4bfc-9949-776f9e0dc318"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Network Security"]
timestamp_override = "event.ingested"
type = "query"

query = '''
Expand All @@ -47,6 +48,7 @@ name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
Expand Down
Loading