Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Detections][EQL] EQL rule execution in detection engine #77419

Merged
merged 31 commits into from
Sep 25, 2020
Merged

[Detections][EQL] EQL rule execution in detection engine #77419

merged 31 commits into from
Sep 25, 2020

Commits on Sep 14, 2020

  1. First draft of EQL rules in detection engine

    @marshallmain
    marshallmain committed Sep 14, 2020
    Configuration menu
    Copy the full SHA
    6cf620f View commit details
    Browse the repository at this point in the history

Commits on Sep 15, 2020

  1. Reorganize functions to separate files

    @marshallmain
    marshallmain committed Sep 15, 2020
    Configuration menu
    Copy the full SHA
    82ae0c2 View commit details
    Browse the repository at this point in the history

Commits on Sep 18, 2020

  1. Start adding eventCategoryOverride option for EQL rules

    @marshallmain
    marshallmain committed Sep 18, 2020
    Configuration menu
    Copy the full SHA
    9b450bf View commit details
    Browse the repository at this point in the history

Commits on Sep 21, 2020

  1. Add building block alerts for each event within sequence

    @marshallmain
    marshallmain committed Sep 21, 2020
    Configuration menu
    Copy the full SHA
    d3fce8a View commit details
    Browse the repository at this point in the history

  2. Merge branch 'master' into eql-rules

    @marshallmain
    marshallmain authored Sep 21, 2020
    Configuration menu
    Copy the full SHA
    ad9fe1b View commit details
    Browse the repository at this point in the history

  3. Use eql instead of eql_query for rule type

    @marshallmain
    marshallmain committed Sep 21, 2020
    Configuration menu
    Copy the full SHA
    922a21e View commit details
    Browse the repository at this point in the history

  4. Remove unused imports

    @marshallmain
    marshallmain committed Sep 21, 2020
    Configuration menu
    Copy the full SHA
    ecedb3f View commit details
    Browse the repository at this point in the history

  5. Fix tests

    @marshallmain
    marshallmain committed Sep 21, 2020
    Configuration menu
    Copy the full SHA
    3e45bc8 View commit details
    Browse the repository at this point in the history

Commits on Sep 22, 2020

  1. Add basic tests for buildEqlSearchRequest

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    4faa592 View commit details
    Browse the repository at this point in the history

  2. Add rulesSchema tests for eql

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    f9e26b0 View commit details
    Browse the repository at this point in the history

  3. Add buildSignalFromSequence test

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    3fd19f0 View commit details
    Browse the repository at this point in the history

  4. Add threat rule fields to buildRuleWithoutOverrides

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    bcdde62 View commit details
    Browse the repository at this point in the history

  5. Fix buildSignalFromSequence typecheck error

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    162256a View commit details
    Browse the repository at this point in the history

  6. Add more tests

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    3f89fb9 View commit details
    Browse the repository at this point in the history

  7. Add tests for wrapBuildingBlock and generateSignalId

    @marshallmain
    marshallmain committed Sep 22, 2020
    Configuration menu
    Copy the full SHA
    8b00aa7 View commit details
    Browse the repository at this point in the history

Commits on Sep 23, 2020

  1. Merge branch 'master' into eql-rules

    @marshallmain
    marshallmain authored Sep 23, 2020
    Configuration menu
    Copy the full SHA
    2657188 View commit details
    Browse the repository at this point in the history

  2. Use isEqlRule function and fix import error

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    1011f07 View commit details
    Browse the repository at this point in the history

  3. delete frank

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    cf0f9fb View commit details
    Browse the repository at this point in the history

  4. Move sequence interface to types.ts

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    1d680a7 View commit details
    Browse the repository at this point in the history

  5. Fix import

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    5ebe577 View commit details
    Browse the repository at this point in the history

  6. Remove EQL execution placeholder, add back language to eql rule type

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    f445d87 View commit details
    Browse the repository at this point in the history

  7. allow no indices for eql search

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    1c5afd9 View commit details
    Browse the repository at this point in the history

  8. Fix unit tests for language update

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    506a3d6 View commit details
    Browse the repository at this point in the history

  9. Fix buildEqlSearchRequest tests

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    aacc605 View commit details
    Browse the repository at this point in the history

  10. Replace signal.child with signal.group

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    19cf9e2 View commit details
    Browse the repository at this point in the history

  11. remove unused import

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    b42cf73 View commit details
    Browse the repository at this point in the history

  12. Move sequence signal group building to separate testable function

    @marshallmain
    marshallmain committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    1942bf9 View commit details
    Browse the repository at this point in the history

Commits on Sep 24, 2020

  1. Merge branch 'master' into eql-rules

    @elasticmachine
    elasticmachine authored Sep 24, 2020
    Configuration menu
    Copy the full SHA
    22383a9 View commit details
    Browse the repository at this point in the history

  2. Merge branch 'master' into eql-rules

    @marshallmain
    marshallmain authored Sep 24, 2020
    Configuration menu
    Copy the full SHA
    8142b11 View commit details
    Browse the repository at this point in the history

  3. Unbork the merge conflict resolution

    @marshallmain
    marshallmain committed Sep 24, 2020
    Configuration menu
    Copy the full SHA
    45ecb42 View commit details
    Browse the repository at this point in the history

Commits on Sep 25, 2020

  1. Merge branch 'master' into eql-rules

    @elasticmachine
    elasticmachine authored Sep 25, 2020
    Configuration menu
    Copy the full SHA
    9a6e908 View commit details
    Browse the repository at this point in the history