Skip to content

Commit

Permalink
++
Browse files Browse the repository at this point in the history
  • Loading branch information
@Samirbous
Samirbous committed Dec 19, 2024
1 parent d343994 commit e1b565d
Show file tree
Hide file tree
Showing 8 changed files with 15 additions and 15 deletions.
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for memory signatu
allows you to immediately begin investigating your Endpoint memory signature alerts. This rule identifies Elastic Defend
memory signature detections only, and does not include prevention alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -99,7 +99,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for memory signatu
allows you to immediately begin investigating your Endpoint memory signature alerts. This rule identifies Elastic Defend
memory signature preventions only, and does not include detection only alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -98,7 +98,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down
2 changes: 1 addition & 1 deletion rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for malicious beha
allows you to immediately begin investigating your Endpoint behavior alerts. This rule identifies Elastic Defend
behavior detections only, and does not include prevention alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for malicious beha
allows you to immediately begin investigating your Endpoint behavior alerts. This rule identifies Elastic Defend
behavior preventions only, and does not include detection only alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -83,7 +83,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for malicious file
you to immediately begin investigating your Endpoint malicious file alerts. This rule identifies Elastic Defend
malicious file detections only, and does not include prevention alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -91,7 +91,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for malicious file
you to immediately begin investigating your Endpoint malicious file alerts. This rule identifies Elastic Defend
malicious file preventions only, and does not include detection only alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -90,7 +90,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/impact_elastic_ransomware_detected.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for ransomware are
to immediately begin investigating your Endpoint ransomware alerts. This rule identifies Elastic Defend ransomware
detections only, and does not include prevention alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -81,7 +81,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Generates a detection alert each time an Elastic Defend alert for ransomware are
to immediately begin investigating your Endpoint ransomware alerts. This rule identifies Elastic Defend ransomware
preventions only, and does not include detection only alerts.
"""
enabled = true
enabled = false
from = "now-10m"
index = ["logs-endpoint.alerts-*"]
interval = "5m"
Expand Down Expand Up @@ -82,7 +82,7 @@ Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)
To avoid creation of duplicate alerts, all rules mentioned above or the Elastic Defend rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306) should be enabled.
To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).
### Additional notes
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
Expand Down

0 comments on commit e1b565d

Please sign in to comment.