[Detection Rules] Remove timestamp_override in endgame promotion rules (

#91771) (#91784) ## Summary Pulls updates from elastic/detection-rules#951. This basically reverts the changes made in #91553 for _only_ the endgame promotion rules ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
elastic · Feb 18, 2021 · e3f3833 · e3f3833
1 parent 701cf53
commit e3f3833
Show file tree

Hide file tree

Showing 15 changed files with 15 additions and 30 deletions.
diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/endpoint_adversary_behavior_detected.json b/...er/lib/detection_engine/rules/prepackaged_rules/endpoint_adversary_behavior_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...n/server/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_dumping_detected.json b/...n/server/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_dumping_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/.../server/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_dumping_prevented.json b/.../server/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_dumping_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_manipulation_detected.json b/...ver/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_manipulation_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_manipulation_prevented.json b/...er/lib/detection_engine/rules/prepackaged_rules/endpoint_cred_manipulation_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...lution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_exploit_detected.json b/...lution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_exploit_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...ution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_exploit_prevented.json b/...ution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_exploit_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...lution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_malware_detected.json b/...lution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_malware_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...ution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_malware_prevented.json b/...ution/server/lib/detection_engine/rules/prepackaged_rules/endpoint_malware_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/endpoint_permission_theft_detected.json b/...rver/lib/detection_engine/rules/prepackaged_rules/endpoint_permission_theft_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/endpoint_permission_theft_prevented.json b/...ver/lib/detection_engine/rules/prepackaged_rules/endpoint_permission_theft_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/endpoint_process_injection_detected.json b/...ver/lib/detection_engine/rules/prepackaged_rules/endpoint_process_injection_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/endpoint_process_injection_prevented.json b/...er/lib/detection_engine/rules/prepackaged_rules/endpoint_process_injection_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...ion/server/lib/detection_engine/rules/prepackaged_rules/endpoint_ransomware_detected.json b/...ion/server/lib/detection_engine/rules/prepackaged_rules/endpoint_ransomware_detected.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }
diff --git a/...on/server/lib/detection_engine/rules/prepackaged_rules/endpoint_ransomware_prevented.json b/...on/server/lib/detection_engine/rules/prepackaged_rules/endpoint_ransomware_prevented.json
@@ -19,7 +19,6 @@
     "Elastic",
     "Endpoint Security"
   ],
-  "timestamp_override": "event.ingested",
   "type": "query",
-  "version": 5
+  "version": 4
 }