From 88109b012f8d1f9fe75e75cab23a2ca7f86014e7 Mon Sep 17 00:00:00 2001 From: Craig Date: Mon, 6 Apr 2020 14:38:24 -0400 Subject: [PATCH 1/8] bc5 rule merge version changes field changes to endpoint rules removed max_signals from 7 rules --- .../403_response_to_a_post.json | 46 +++--- .../405_response_method_not_allowed.json | 46 +++--- ..._security_adversary_behavior_detected.json | 38 ++--- ...dpoint_security_cred_dumping_detected.json | 38 ++--- ...point_security_cred_dumping_prevented.json | 38 ++--- ...t_security_cred_manipulation_detected.json | 38 ++--- ..._security_cred_manipulation_prevented.json | 38 ++--- ...ic_endpoint_security_exploit_detected.json | 38 ++--- ...c_endpoint_security_exploit_prevented.json | 38 ++--- ...ic_endpoint_security_malware_detected.json | 38 ++--- ...c_endpoint_security_malware_prevented.json | 38 ++--- ...nt_security_permission_theft_detected.json | 38 ++--- ...t_security_permission_theft_prevented.json | 38 ++--- ...t_security_process_injection_detected.json | 38 ++--- ..._security_process_injection_prevented.json | 38 ++--- ...endpoint_security_ransomware_detected.json | 38 ++--- ...ndpoint_security_ransomware_prevented.json | 38 ++--- ...den_file_attribute_with_via_attribexe.json | 98 ++++++------- .../eql_adobe_hijack_persistence.json | 68 ++++----- .../eql_clearing_windows_event_logs.json | 68 ++++----- ...delete_volume_usn_journal_with_fsutil.json | 68 ++++----- ...deleting_backup_catalogs_with_wbadmin.json | 68 ++++----- .../eql_direct_outbound_smb_connection.json | 68 ++++----- ...ble_windows_firewall_rules_with_netsh.json | 68 ++++----- ...coding_or_decoding_files_via_certutil.json | 68 ++++----- .../eql_local_scheduled_task_commands.json | 74 +++++----- .../eql_local_service_commands.json | 68 ++++----- ...ql_msbuild_making_network_connections.json | 68 ++++----- .../eql_mshta_making_network_connections.json | 74 +++++----- .../eql_psexec_lateral_movement_command.json | 104 +++++++------- ...ql_suspicious_ms_office_child_process.json | 68 ++++----- ...l_suspicious_ms_outlook_child_process.json | 68 ++++----- .../eql_system_shells_via_services.json | 68 ++++----- ...usual_network_connection_via_rundll32.json | 68 ++++----- .../eql_unusual_parentchild_relationship.json | 68 ++++----- ...ql_unusual_process_network_connection.json | 68 ++++----- .../eql_user_account_creation.json | 68 ++++----- ...ume_shadow_copy_deletion_via_vssadmin.json | 68 ++++----- ..._volume_shadow_copy_deletion_via_wmic.json | 68 ++++----- ...l_windows_script_executing_powershell.json | 68 ++++----- .../linux_anomalous_network_activity.json | 46 +++--- ...linux_anomalous_network_port_activity.json | 46 +++--- .../linux_anomalous_network_service.json | 46 +++--- .../linux_anomalous_network_url_activity.json | 46 +++--- .../linux_anomalous_process_all_hosts.json | 46 +++--- .../linux_anomalous_user_name.json | 46 +++--- .../linux_hping_activity.json | 46 +++--- .../linux_iodine_activity.json | 46 +++--- .../linux_kernel_module_activity.json | 80 +++++------ .../linux_mknod_activity.json | 46 +++--- .../linux_netcat_network_connection.json | 50 +++---- .../linux_nmap_activity.json | 46 +++--- .../linux_nping_activity.json | 46 +++--- ...nux_process_started_in_temp_directory.json | 40 +++--- .../linux_shell_activity_by_web_server.json | 80 +++++------ .../linux_socat_activity.json | 46 +++--- .../linux_strace_activity.json | 46 +++--- .../linux_tcpdump_activity.json | 104 +++++++------- .../linux_whoami_commmand.json | 74 +++++----- .../network_dns_directly_to_the_internet.json | 82 +++++------ ...fer_protocol_activity_to_the_internet.json | 104 +++++++------- ...hat_protocol_activity_to_the_internet.json | 104 +++++++------- .../network_nat_traversal_port_activity.json | 74 +++++----- .../network_port_26_activity.json | 112 +++++++-------- ...rk_port_8000_activity_to_the_internet.json | 74 +++++----- ..._to_point_tunneling_protocol_activity.json | 74 +++++----- ...k_proxy_port_activity_to_the_internet.json | 74 +++++----- ...te_desktop_protocol_from_the_internet.json | 134 +++++++++--------- ...mote_desktop_protocol_to_the_internet.json | 104 +++++++------- ...mote_procedure_call_from_the_internet.json | 68 ++++----- ...remote_procedure_call_to_the_internet.json | 68 ++++----- ...file_sharing_activity_to_the_internet.json | 98 ++++++------- .../network_smtp_to_the_internet.json | 104 +++++++------- ..._server_port_activity_to_the_internet.json | 74 +++++----- ...rk_ssh_secure_shell_from_the_internet.json | 134 +++++++++--------- ...work_ssh_secure_shell_to_the_internet.json | 74 +++++----- .../network_telnet_port_activity.json | 134 +++++++++--------- .../network_tor_activity_to_the_internet.json | 104 +++++++------- ...l_network_computing_from_the_internet.json | 104 +++++++------- ...ual_network_computing_to_the_internet.json | 74 +++++----- .../prepackaged_rules/null_user_agent.json | 82 +++++------ .../packetbeat_dns_tunneling.json | 46 +++--- .../packetbeat_rare_dns_question.json | 46 +++--- .../packetbeat_rare_server_domain.json | 46 +++--- .../packetbeat_rare_urls.json | 46 +++--- .../packetbeat_rare_user_agent.json | 46 +++--- .../rare_process_by_host_linux.json | 46 +++--- .../rare_process_by_host_windows.json | 46 +++--- .../prepackaged_rules/sqlmap_user_agent.json | 46 +++--- .../suspicious_login_activity.json | 46 +++--- .../windows_anomalous_network_activity.json | 46 +++--- .../windows_anomalous_path_activity.json | 46 +++--- .../windows_anomalous_process_all_hosts.json | 46 +++--- .../windows_anomalous_process_creation.json | 46 +++--- .../windows_anomalous_script.json | 46 +++--- .../windows_anomalous_service.json | 46 +++--- .../windows_anomalous_user_name.json | 46 +++--- .../windows_certutil_network_connection.json | 69 +++++---- ...and_prompt_connecting_to_the_internet.json | 104 +++++++------- ...s_command_shell_started_by_powershell.json | 98 ++++++------- ...dows_command_shell_started_by_svchost.json | 68 ++++----- .../windows_credential_dumping_msbuild.json | 76 +++++----- .../windows_cve_2020_0601.json | 69 +++++---- ...ws_defense_evasion_via_filter_manager.json | 68 ++++----- ...ecution_msbuild_started_by_office_app.json | 110 +++++++------- ...s_execution_msbuild_started_by_script.json | 104 +++++++------- ...ion_msbuild_started_by_system_process.json | 104 +++++++------- ...ows_execution_msbuild_started_renamed.json | 74 +++++----- ...cution_msbuild_started_unusal_process.json | 80 +++++------ ...dows_execution_via_compiled_html_file.json | 104 +++++++------- ...dows_execution_via_net_com_assemblies.json | 99 +++++++------ ...ution_via_trusted_developer_utilities.json | 104 +++++++------- ...le_program_connecting_to_the_internet.json | 98 ++++++------- .../windows_injection_msbuild.json | 104 +++++++------- ...isc_lolbin_connecting_to_the_internet.json | 98 ++++++------- .../windows_modification_of_boot_config.json | 69 +++++---- .../windows_msxsl_network.json | 69 +++++---- .../windows_net_command_system_account.json | 69 +++++---- ..._persistence_via_application_shimming.json | 98 ++++++------- ...escalation_via_accessibility_features.json | 98 ++++++------- ...rocess_discovery_via_tasklist_command.json | 74 +++++----- .../windows_rare_user_runas_event.json | 46 +++--- ...windows_rare_user_type10_remote_login.json | 46 +++--- ...er_program_connecting_to_the_internet.json | 104 +++++++------- .../windows_suspicious_pdf_reader.json | 68 ++++----- .../windows_uac_bypass_event_viewer.json | 69 +++++---- .../windows_whoami_command_activity.json | 74 +++++----- 127 files changed, 4314 insertions(+), 4321 deletions(-) diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json index 3b043439759c1..74a9764ea558e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json @@ -1,24 +1,24 @@ -{ - "description": "A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed", - "false_positives": [ - "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: POST Request Declined", - "query": "http.response.status_code:403 and http.request.method:post", - "references": [ - "https://en.wikipedia.org/wiki/HTTP_403" - ], - "risk_score": 47, - "rule_id": "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 1 +{ + "description": "A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed", + "false_positives": [ + "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: POST Request Declined", + "query": "http.response.status_code:403 and http.request.method:post", + "references": [ + "https://en.wikipedia.org/wiki/HTTP_403" + ], + "risk_score": 47, + "rule_id": "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json index 12c6a5feabebb..fbbdd0f83e1f1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json @@ -1,24 +1,24 @@ -{ - "description": "A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource", - "false_positives": [ - "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: Unauthorized Method", - "query": "http.response.status_code:405", - "references": [ - "https://en.wikipedia.org/wiki/HTTP_405" - ], - "risk_score": 47, - "rule_id": "75ee75d8-c180-481c-ba88-ee50129a6aef", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 1 +{ + "description": "A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource", + "false_positives": [ + "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: Unauthorized Method", + "query": "http.response.status_code:405", + "references": [ + "https://en.wikipedia.org/wiki/HTTP_405" + ], + "risk_score": 47, + "rule_id": "75ee75d8-c180-481c-ba88-ee50129a6aef", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json index a3302896b7e98..7a62ef44838f5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Adversary Behavior - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:rules_engine_event", - "risk_score": 47, - "rule_id": "77a3c3df-8ec4-4da4-b758-878f551dee69", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Adversary Behavior - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and (event.action:rules_engine_event or endgame.event_subtype_full:rules_engine_event)", + "risk_score": 47, + "rule_id": "77a3c3df-8ec4-4da4-b758-878f551dee69", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json index 8c2c5f32feab7..eaa86ea5eac22 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Dumping - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:cred_theft_event and endgame.metadata.type:detection", - "risk_score": 73, - "rule_id": "571afc56-5ed9-465d-a2a9-045f099f6e7e", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Dumping - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)", + "risk_score": 73, + "rule_id": "571afc56-5ed9-465d-a2a9-045f099f6e7e", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json index 6a96da3218bf2..5524f5f086430 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Dumping - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:cred_theft_event and endgame.metadata.type:prevention", - "risk_score": 47, - "rule_id": "db8c33a8-03cd-4988-9e2c-d0a4863adb13", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Dumping - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)", + "risk_score": 47, + "rule_id": "db8c33a8-03cd-4988-9e2c-d0a4863adb13", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json index 954e35ccd644a..776c800791996 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Manipulation - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:token_manipulation_event and endgame.metadata.type:detection", - "risk_score": 73, - "rule_id": "c0be5f31-e180-48ed-aa08-96b36899d48f", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Manipulation - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)", + "risk_score": 73, + "rule_id": "c0be5f31-e180-48ed-aa08-96b36899d48f", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json index 0de35891a3e81..084914b2a475c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Manipulation - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:token_manipulation_event and endgame.metadata.type:prevention", - "risk_score": 47, - "rule_id": "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Manipulation - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)", + "risk_score": 47, + "rule_id": "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json index 3652b7068ecd2..782c9d5e29970 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Exploit - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:exploit_event and endgame.metadata.type:detection", - "risk_score": 73, - "rule_id": "2003cdc8-8d83-4aa5-b132-1f9a8eb48514", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Exploit - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)", + "risk_score": 73, + "rule_id": "2003cdc8-8d83-4aa5-b132-1f9a8eb48514", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json index dbc910c3002a7..f656155fa4750 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Exploit - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:exploit_event and endgame.metadata.type:prevention", - "risk_score": 47, - "rule_id": "2863ffeb-bf77-44dd-b7a5-93ef94b72036", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Exploit - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)", + "risk_score": 47, + "rule_id": "2863ffeb-bf77-44dd-b7a5-93ef94b72036", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json index efe2806532be0..c6f536e1e7f55 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Malware - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:file_classification_event and endgame.metadata.type:detection", - "risk_score": 99, - "rule_id": "0a97b20f-4144-49ea-be32-b540ecc445de", - "severity": "critical", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Malware - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)", + "risk_score": 99, + "rule_id": "0a97b20f-4144-49ea-be32-b540ecc445de", + "severity": "critical", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json index 51028b9dbeeb3..71fec58740995 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Malware - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:file_classification_event and endgame.metadata.type:prevention", - "risk_score": 73, - "rule_id": "3b382770-efbb-44f4-beed-f5e0a051b895", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Malware - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)", + "risk_score": 73, + "rule_id": "3b382770-efbb-44f4-beed-f5e0a051b895", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json index c30ca0632f410..6829f0f18526f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Permission Theft - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:detection", - "risk_score": 73, - "rule_id": "c3167e1b-f73c-41be-b60b-87f4df707fe3", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Permission Theft - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)", + "risk_score": 73, + "rule_id": "c3167e1b-f73c-41be-b60b-87f4df707fe3", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json index ed0c714254743..a8d3cb31f16a9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Permission Theft - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:prevention", - "risk_score": 47, - "rule_id": "453f659e-0429-40b1-bfdb-b6957286e04b", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Permission Theft - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)", + "risk_score": 47, + "rule_id": "453f659e-0429-40b1-bfdb-b6957286e04b", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json index 63b008849487a..f8e35b845ae2b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Process Injection - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:kernel_shellcode_event and endgame.metadata.type:detection", - "risk_score": 73, - "rule_id": "80c52164-c82a-402c-9964-852533d58be1", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Process Injection - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)", + "risk_score": 73, + "rule_id": "80c52164-c82a-402c-9964-852533d58be1", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json index 135b4a95e8005..176c71a1cfc70 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Process Injection - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:kernel_shellcode_event and endgame.metadata.type:prevention", - "risk_score": 47, - "rule_id": "990838aa-a953-4f3e-b3cb-6ddf7584de9e", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Process Injection - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)", + "risk_score": 47, + "rule_id": "990838aa-a953-4f3e-b3cb-6ddf7584de9e", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json index d4042a5e6b9e1..ee90b812a0156 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Ransomware - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:ransomware_event and endgame.metadata.type:detection", - "risk_score": 99, - "rule_id": "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd", - "severity": "critical", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint detected Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Ransomware - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)", + "risk_score": 99, + "rule_id": "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd", + "severity": "critical", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json index befdf611da223..bf5d71c799a25 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Ransomware - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and event.action:ransomware_event and endgame.metadata.type:prevention", - "risk_score": 73, - "rule_id": "e3c5d5cb-41d5-4206-805c-f30561eae3ac", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 1 +{ + "description": "Elastic Endpoint prevented Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Ransomware - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)", + "risk_score": 73, + "rule_id": "e3c5d5cb-41d5-4206-805c-f30561eae3ac", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json index 6c9b54b8ddb02..19bfb78a04df7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json @@ -1,50 +1,50 @@ -{ - "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Adding Hidden File Attribute via Attrib", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:attrib.exe and process.args:+h", - "risk_score": 21, - "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1158", - "name": "Hidden Files and Directories", - "reference": "https://attack.mitre.org/techniques/T1158/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1158", - "name": "Hidden Files and Directories", - "reference": "https://attack.mitre.org/techniques/T1158/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Adding Hidden File Attribute via Attrib", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:attrib.exe and process.args:+h", + "risk_score": 21, + "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1158", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1158/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1158", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1158/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json index 3b4d2bc040217..2fb6d32ac097d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json @@ -1,35 +1,35 @@ -{ - "description": "Detects writing executable files that will be automatically launched by Adobe on launch.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Adobe Hijack Persistence", - "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexec.exe", - "risk_score": 21, - "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1044", - "name": "File System Permissions Weakness", - "reference": "https://attack.mitre.org/techniques/T1044/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Detects writing executable files that will be automatically launched by Adobe on launch.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Adobe Hijack Persistence", + "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexec.exe", + "risk_score": 21, + "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1044", + "name": "File System Permissions Weakness", + "reference": "https://attack.mitre.org/techniques/T1044/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json index 244d329cc4bb7..e1307c6bdbc3c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Clearing Windows Event Logs", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wevtutil.exe and process.args:cl or process.name:powershell.exe and process.args:Clear-EventLog", - "risk_score": 21, - "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1070", - "name": "Indicator Removal on Host", - "reference": "https://attack.mitre.org/techniques/T1070/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Clearing Windows Event Logs", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wevtutil.exe and process.args:cl or process.name:powershell.exe and process.args:Clear-EventLog", + "risk_score": 21, + "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal on Host", + "reference": "https://attack.mitre.org/techniques/T1070/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json index 4087542816588..b42a847c9618c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Delete Volume USN Journal with Fsutil", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:fsutil.exe and process.args:(deletejournal and usn)", - "risk_score": 21, - "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Delete Volume USN Journal with Fsutil", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:fsutil.exe and process.args:(deletejournal and usn)", + "risk_score": 21, + "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json index eca06723e68b8..8f77c0c937ced 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Deleting Backup Catalogs with Wbadmin", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wbadmin.exe and process.args:(catalog and delete)", - "risk_score": 21, - "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Deleting Backup Catalogs with Wbadmin", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wbadmin.exe and process.args:(catalog and delete)", + "risk_score": 21, + "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json index e37c877c62889..6e695fef9a75e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Direct Outbound SMB Connection", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and destination.port:445 and not process.pid:4 and not destination.ip:(127.0.0.1 or \"::1\")", - "risk_score": 47, - "rule_id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1210", - "name": "Exploitation of Remote Services", - "reference": "https://attack.mitre.org/techniques/T1210/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Direct Outbound SMB Connection", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and destination.port:445 and not process.pid:4 and not destination.ip:(127.0.0.1 or \"::1\")", + "risk_score": 47, + "rule_id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1210", + "name": "Exploitation of Remote Services", + "reference": "https://attack.mitre.org/techniques/T1210/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json index f6b4bc67ed9b1..db0e9fbfbcb68 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Disable Windows Firewall Rules via Netsh", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:netsh.exe and process.args:(disable and firewall and set) or process.args:(advfirewall and off and state)", - "risk_score": 47, - "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1089", - "name": "Disabling Security Tools", - "reference": "https://attack.mitre.org/techniques/T1089/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Disable Windows Firewall Rules via Netsh", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:netsh.exe and process.args:(disable and firewall and set) or process.args:(advfirewall and off and state)", + "risk_score": 47, + "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1089", + "name": "Disabling Security Tools", + "reference": "https://attack.mitre.org/techniques/T1089/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json index 38162889737ff..e51e78e95c248 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies the use of certutil.exe to encode or decode data. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to encode or decode base64 data for stealthier command and control or exfiltration.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Encoding or Decoding Files via CertUtil", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:certutil.exe and process.args:(-decode or -encode or /decode or /encode)", - "risk_score": 47, - "rule_id": "fd70c98a-c410-42dc-a2e3-761c71848acf", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1140", - "name": "Deobfuscate/Decode Files or Information", - "reference": "https://attack.mitre.org/techniques/T1140/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies the use of certutil.exe to encode or decode data. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to encode or decode base64 data for stealthier command and control or exfiltration.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Encoding or Decoding Files via CertUtil", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:certutil.exe and process.args:(-decode or -encode or /decode or /encode)", + "risk_score": 47, + "rule_id": "fd70c98a-c410-42dc-a2e3-761c71848acf", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json index 42007f153bd55..bfc3378734772 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json @@ -1,38 +1,38 @@ -{ - "description": "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges.", - "false_positives": [ - "Legitimate scheduled tasks may be created during installation of new software." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Local Scheduled Task Commands", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:schtasks.exe and process.args:(-change or -create or -run or -s or /S or /change or /create or /run)", - "risk_score": 21, - "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1053", - "name": "Scheduled Task", - "reference": "https://attack.mitre.org/techniques/T1053/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Local Scheduled Task Commands", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:schtasks.exe and process.args:(-change or -create or -run or -s or /S or /change or /create or /run)", + "risk_score": 21, + "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json index 9559baabe0e40..cb79c1c8f523d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Local Service Commands", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:sc.exe and process.args:(config or create or failure or start)", - "risk_score": 21, - "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Local Service Commands", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:sc.exe and process.args:(config or create or failure or start)", + "risk_score": 21, + "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json index 3e34aacf605c7..5c5b8bd0a434a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "MsBuild Making Network Connections", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:MSBuild.exe and not destination.ip:(127.0.0.1 or \"::1\")", - "risk_score": 47, - "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "MsBuild Making Network Connections", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:MSBuild.exe and not destination.ip:(127.0.0.1 or \"::1\")", + "risk_score": 47, + "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json index 769614e8faf53..dea469babeaa9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json @@ -1,38 +1,38 @@ -{ - "description": "Identifies mshta.exe making a network connection. This may indicate adversarial activity as mshta.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Mshta", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:mshta.exe", - "references": [ - "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html" - ], - "risk_score": 47, - "rule_id": "a4ec1382-4557-452b-89ba-e413b22ed4b8", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1170", - "name": "Mshta", - "reference": "https://attack.mitre.org/techniques/T1170/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies mshta.exe making a network connection. This may indicate adversarial activity as mshta.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Mshta", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:mshta.exe", + "references": [ + "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html" + ], + "risk_score": 47, + "rule_id": "a4ec1382-4557-452b-89ba-e413b22ed4b8", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1170", + "name": "Mshta", + "reference": "https://attack.mitre.org/techniques/T1170/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json index ac170665042f6..4c7942622aca3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.", - "false_positives": [ - "PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "PsExec Network Connection", - "query": "process.name:PsExec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\"", - "risk_score": 21, - "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1035", - "name": "Service Execution", - "reference": "https://attack.mitre.org/techniques/T1035/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1035", - "name": "Service Execution", - "reference": "https://attack.mitre.org/techniques/T1035/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.", + "false_positives": [ + "PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "PsExec Network Connection", + "query": "process.name:PsExec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\"", + "risk_score": 21, + "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1035", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1035/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1035", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1035/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json index 95c9c6b72f8f4..31416486f3331 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Suspicious MS Office Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or powerpnt.exe or winword.exe) and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", - "risk_score": 21, - "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Suspicious MS Office Child Process", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or powerpnt.exe or winword.exe) and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", + "risk_score": 21, + "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1193", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1193/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json index 7f6c9257fabfd..647e48d60e2ef 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Suspicious MS Outlook Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:outlook.exe and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", - "risk_score": 21, - "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Suspicious MS Outlook Child Process", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:outlook.exe and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", + "risk_score": 21, + "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1193", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1193/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json index 1c001caa1539c..fbe264ff6aba4 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json @@ -1,35 +1,35 @@ -{ - "description": "Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "System Shells via Services", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:services.exe and process.name:(cmd.exe or powershell.exe)", - "risk_score": 47, - "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1050", - "name": "New Service", - "reference": "https://attack.mitre.org/techniques/T1050/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "System Shells via Services", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:services.exe and process.name:(cmd.exe or powershell.exe)", + "risk_score": 47, + "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1050", + "name": "New Service", + "reference": "https://attack.mitre.org/techniques/T1050/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json index 0165f4d7512e4..a56838c06126f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial activity and may identify malicious DLLs.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Unusual Network Connection via RunDLL32", - "query": "process.name:rundll32.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "52aaab7b-b51c-441a-89ce-4387b3aea886", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1085", - "name": "Rundll32", - "reference": "https://attack.mitre.org/techniques/T1085/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial activity and may identify malicious DLLs.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Unusual Network Connection via RunDLL32", + "query": "process.name:rundll32.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "52aaab7b-b51c-441a-89ce-4387b3aea886", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1085", + "name": "Rundll32", + "reference": "https://attack.mitre.org/techniques/T1085/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json index 0b4bf9ff32945..f1f9d2fec379a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Unusual Parent-Child Relationship", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and (process.name:smss.exe and not process.parent.name:(System or smss.exe) or process.name:csrss.exe and not process.parent.name:(smss.exe or svchost.exe) or process.name:wininit.exe and not process.parent.name:smss.exe or process.name:winlogon.exe and not process.parent.name:smss.exe or process.name:lsass.exe and not process.parent.name:wininit.exe or process.name:LogonUI.exe and not process.parent.name:(wininit.exe or winlogon.exe) or process.name:services.exe and not process.parent.name:wininit.exe or process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or services.exe) or process.name:spoolsv.exe and not process.parent.name:services.exe or process.name:taskhost.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:taskhostw.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:userinit.exe and not process.parent.name:(dwm.exe or winlogon.exe))", - "risk_score": 47, - "rule_id": "35df0dd8-092d-4a83-88c1-5151a804f31b", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1093", - "name": "Process Hollowing", - "reference": "https://attack.mitre.org/techniques/T1093/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Unusual Parent-Child Relationship", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and (process.name:smss.exe and not process.parent.name:(System or smss.exe) or process.name:csrss.exe and not process.parent.name:(smss.exe or svchost.exe) or process.name:wininit.exe and not process.parent.name:smss.exe or process.name:winlogon.exe and not process.parent.name:smss.exe or process.name:lsass.exe and not process.parent.name:wininit.exe or process.name:LogonUI.exe and not process.parent.name:(wininit.exe or winlogon.exe) or process.name:services.exe and not process.parent.name:wininit.exe or process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or services.exe) or process.name:spoolsv.exe and not process.parent.name:services.exe or process.name:taskhost.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:taskhostw.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:userinit.exe and not process.parent.name:(dwm.exe or winlogon.exe))", + "risk_score": 47, + "rule_id": "35df0dd8-092d-4a83-88c1-5151a804f31b", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1093", + "name": "Process Hollowing", + "reference": "https://attack.mitre.org/techniques/T1093/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json index 2c88a2061844c..2d16906e4d149 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Unusual Process Network Connection", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:(Microsoft.Workflow.Compiler.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or odbcconf.exe or rcsi.exe or xwizard.exe)", - "risk_score": 21, - "rule_id": "610949a1-312f-4e04-bb55-3a79b8c95267", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Unusual Process Network Connection", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:(Microsoft.Workflow.Compiler.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or odbcconf.exe or rcsi.exe or xwizard.exe)", + "risk_score": 21, + "rule_id": "610949a1-312f-4e04-bb55-3a79b8c95267", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json index 240df34419132..efcbd2f8e0f81 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or domain.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "User Account Creation", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(net.exe or net1.exe) and not process.parent.name:net.exe and process.args:(user and (/ad or /add))", - "risk_score": 21, - "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1136", - "name": "Create Account", - "reference": "https://attack.mitre.org/techniques/T1136/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or domain.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "User Account Creation", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(net.exe or net1.exe) and not process.parent.name:net.exe and process.args:(user and (/ad or /add))", + "risk_score": 21, + "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json index e12c2e70138c9..cc7343deaa964 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Volume Shadow Copy Deletion via VssAdmin", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:vssadmin.exe and process.args:(delete and shadows)", - "risk_score": 73, - "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1490", - "name": "Inhibit System Recovery", - "reference": "https://attack.mitre.org/techniques/T1490/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Volume Shadow Copy Deletion via VssAdmin", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:vssadmin.exe and process.args:(delete and shadows)", + "risk_score": 73, + "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json index 94b8846741e3e..f36b9280986aa 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Volume Shadow Copy Deletion via WMIC", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:WMIC.exe and process.args:(delete and shadowcopy)", - "risk_score": 73, - "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Volume Shadow Copy Deletion via WMIC", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:WMIC.exe and process.args:(delete and shadowcopy)", + "risk_score": 73, + "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json index b0a754a662c0e..0497f007b6253 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Script Executing PowerShell", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(cscript.exe or wscript.exe) and process.name:powershell.exe", - "risk_score": 21, - "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Windows Script Executing PowerShell", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(cscript.exe or wscript.exe) and process.name:powershell.exe", + "risk_score": 21, + "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1193", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1193/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json index 1123c1161c4ce..7d96ecbaa3077 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_activity_ecs", - "name": "Unusual Linux Network Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "52afbdc5-db15-485e-bc24-f5707f820c4b", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_activity_ecs", + "name": "Unusual Linux Network Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-485e-bc24-f5707f820c4b", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json index 19dd643945b17..82ce2558a1014 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_port_activity_ecs", - "name": "Unusual Linux Network Port Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "3c7e32e6-6104-46d9-a06e-da0f8b5795a0", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_port_activity_ecs", + "name": "Unusual Linux Network Port Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "3c7e32e6-6104-46d9-a06e-da0f8b5795a0", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json index e2e5803618d06..4a757b5acdde2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies unusual listening ports on Linux instances that can indicate execution of unauthorized services, backdoors, or persistence mechanisms.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_service", - "name": "Unusual Linux Network Service", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "52afbdc5-db15-596e-bc35-f5707f820c4b", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies unusual listening ports on Linux instances that can indicate execution of unauthorized services, backdoors, or persistence mechanisms.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_service", + "name": "Unusual Linux Network Service", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-596e-bc35-f5707f820c4b", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json index 40dd2e76c7214..f2eb7bd2390bc 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual web URL request from a Linux host, which can indicate malware delivery and execution. Wget and cURL are commonly used by Linux programs to download code and data. Most of the time, their usage is entirely normal. Generally, because they use a list of URLs, they repeatedly download from the same locations. However, Wget and cURL are sometimes used to deliver Linux exploit payloads, and threat actors use these tools to download additional software and code. For these reasons, unusual URLs can indicate unauthorized downloads or threat activity.", - "false_positives": [ - "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_url_activity_ecs", - "name": "Unusual Linux Web Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "52afbdc5-db15-485e-bc35-f5707f820c4c", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual web URL request from a Linux host, which can indicate malware delivery and execution. Wget and cURL are commonly used by Linux programs to download code and data. Most of the time, their usage is entirely normal. Generally, because they use a list of URLs, they repeatedly download from the same locations. However, Wget and cURL are sometimes used to deliver Linux exploit payloads, and threat actors use these tools to download additional software and code. For these reasons, unusual URLs can indicate unauthorized downloads or threat activity.", + "false_positives": [ + "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_url_activity_ecs", + "name": "Unusual Linux Web Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-485e-bc35-f5707f820c4c", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json index 6bac2f25fd7de..05200b4aedbf6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_process_all_hosts_ecs", - "name": "Anomalous Process For a Linux Population", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "647fc812-7996-4795-8869-9c4ea595fe88", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_process_all_hosts_ecs", + "name": "Anomalous Process For a Linux Population", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "647fc812-7996-4795-8869-9c4ea595fe88", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json index 8b7e6c89482f7..437e67169996c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", - "false_positives": [ - "Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_user_name_ecs", - "name": "Unusual Linux Username", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "b347b919-665f-4aac-b9e8-68369bf2340c", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", + "false_positives": [ + "Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_user_name_ecs", + "name": "Unusual Linux Username", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "b347b919-665f-4aac-b9e8-68369bf2340c", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json index bb8e8983661e6..09a1c34c5cb06 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.", - "false_positives": [ - "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Hping Process Activity", - "query": "process.name:(hping or hping2 or hping3) and event.action:executed", - "references": [ - "https://en.wikipedia.org/wiki/Hping" - ], - "risk_score": 73, - "rule_id": "90169566-2260-4824-b8e4-8615c3b4ed52", - "severity": "high", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.", + "false_positives": [ + "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Hping Process Activity", + "query": "process.name:(hping or hping2 or hping3) and event.action:executed", + "references": [ + "https://en.wikipedia.org/wiki/Hping" + ], + "risk_score": 73, + "rule_id": "90169566-2260-4824-b8e4-8615c3b4ed52", + "severity": "high", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json index 4e49702855a76..d2fc5fc03c1ec 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection.", - "false_positives": [ - "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Potential DNS Tunneling via Iodine", - "query": "process.name:(iodine or iodined) and event.action:executed", - "references": [ - "https://code.kryo.se/iodine/" - ], - "risk_score": 73, - "rule_id": "041d4d41-9589-43e2-ba13-5680af75ebc2", - "severity": "high", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection.", + "false_positives": [ + "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Potential DNS Tunneling via Iodine", + "query": "process.name:(iodine or iodined) and event.action:executed", + "references": [ + "https://code.kryo.se/iodine/" + ], + "risk_score": 73, + "rule_id": "041d4d41-9589-43e2-ba13-5680af75ebc2", + "severity": "high", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json index cf8cd72b7aa6f..00396816824b5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json @@ -1,41 +1,41 @@ -{ - "description": "Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.", - "false_positives": [ - "Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Persistence via Kernel Module Modification", - "query": "process.name:(insmod or kmod or modprobe or rmod) and event.action:executed", - "references": [ - "https://www.hackers-arise.com/single-post/2017/11/03/Linux-for-Hackers-Part-10-Loadable-Kernel-Modules-LKM" - ], - "risk_score": 21, - "rule_id": "81cc58f5-8062-49a2-ba84-5cc4b4d31c40", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/techniques/TA0003/" - }, - "technique": [ - { - "id": "T1215", - "name": "Kernel Modules and Extensions", - "reference": "https://attack.mitre.org/techniques/T1215/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.", + "false_positives": [ + "Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Persistence via Kernel Module Modification", + "query": "process.name:(insmod or kmod or modprobe or rmod) and event.action:executed", + "references": [ + "https://www.hackers-arise.com/single-post/2017/11/03/Linux-for-Hackers-Part-10-Loadable-Kernel-Modules-LKM" + ], + "risk_score": 21, + "rule_id": "81cc58f5-8062-49a2-ba84-5cc4b4d31c40", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/techniques/TA0003/" + }, + "technique": [ + { + "id": "T1215", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1215/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json index 3bd3848c07581..58d830fbf05b2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json @@ -1,24 +1,24 @@ -{ - "description": "The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command shell when the traditional version of netcat is not available to the payload.", - "false_positives": [ - "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Mknod Process Activity", - "query": "process.name:mknod and event.action:executed", - "references": [ - "https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem" - ], - "risk_score": 21, - "rule_id": "61c31c14-507f-4627-8c31-072556b89a9c", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command shell when the traditional version of netcat is not available to the payload.", + "false_positives": [ + "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Mknod Process Activity", + "query": "process.name:mknod and event.action:executed", + "references": [ + "https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem" + ], + "risk_score": 21, + "rule_id": "61c31c14-507f-4627-8c31-072556b89a9c", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json index cd523b6594ccd..f431cd6103e77 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json @@ -1,26 +1,26 @@ -{ - "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.", - "false_positives": [ - "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Netcat Network Activity", - "query": "process.name:(nc or ncat or netcat or netcat.openbsd or netcat.traditional) and event.action:(bound-socket or connected-to or socket_opened)", - "references": [ - "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", - "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", - "https://en.wikipedia.org/wiki/Netcat" - ], - "risk_score": 47, - "rule_id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.", + "false_positives": [ + "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Netcat Network Activity", + "query": "process.name:(nc or ncat or netcat or netcat.openbsd or netcat.traditional) and event.action:(bound-socket or connected-to or socket_opened)", + "references": [ + "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", + "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", + "https://en.wikipedia.org/wiki/Netcat" + ], + "risk_score": 47, + "rule_id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json index 604cfa172fd84..3fd1e355adf78 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks, and identify listening services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.", - "false_positives": [ - "Security testing tools and frameworks may run `Nmap` in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Nmap Process Activity", - "query": "process.name:nmap", - "references": [ - "https://en.wikipedia.org/wiki/Nmap" - ], - "risk_score": 21, - "rule_id": "c87fca17-b3a9-4e83-b545-f30746c53920", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks, and identify listening services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.", + "false_positives": [ + "Security testing tools and frameworks may run `Nmap` in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Nmap Process Activity", + "query": "process.name:nmap", + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "risk_score": 21, + "rule_id": "c87fca17-b3a9-4e83-b545-f30746c53920", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json index 8e71b5b906711..7c6db25832057 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.", - "false_positives": [ - "Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Nping Process Activity", - "query": "process.name:nping and event.action:executed", - "references": [ - "https://en.wikipedia.org/wiki/Nmap" - ], - "risk_score": 47, - "rule_id": "0d69150b-96f8-467c-a86d-a67a3378ce77", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.", + "false_positives": [ + "Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Nping Process Activity", + "query": "process.name:nping and event.action:executed", + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "risk_score": 47, + "rule_id": "0d69150b-96f8-467c-a86d-a67a3378ce77", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json index c50026d7736ae..267bdd151872c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json @@ -1,21 +1,21 @@ -{ - "description": "Identifies processes running in a temporary folder. This is sometimes done by adversaries to hide malware.", - "false_positives": [ - "Build systems, like Jenkins, may start processes in the `/tmp` directory. These can be exempted by name or by username." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Unusual Process Execution - Temp", - "query": "process.working_directory:/tmp and event.action:executed", - "risk_score": 47, - "rule_id": "df959768-b0c9-4d45-988c-5606a2be8e5a", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "Identifies processes running in a temporary folder. This is sometimes done by adversaries to hide malware.", + "false_positives": [ + "Build systems, like Jenkins, may start processes in the `/tmp` directory. These can be exempted by name or by username." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Unusual Process Execution - Temp", + "query": "process.working_directory:/tmp and event.action:executed", + "risk_score": 47, + "rule_id": "df959768-b0c9-4d45-988c-5606a2be8e5a", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json index 01f117e0a225b..87e1583af9ebf 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json @@ -1,41 +1,41 @@ -{ - "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.", - "false_positives": [ - "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Potential Shell via Web Server", - "query": "process.name:bash and user.name:(apache or www or www-data) and event.action:executed", - "references": [ - "https://pentestlab.blog/tag/web-shell/" - ], - "risk_score": 47, - "rule_id": "231876e7-4d1f-4d63-a47c-47dd1acdc1cb", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/techniques/TA0003/" - }, - "technique": [ - { - "id": "T1100", - "name": "Web Shell", - "reference": "https://attack.mitre.org/techniques/T1100/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.", + "false_positives": [ + "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Potential Shell via Web Server", + "query": "process.name:bash and user.name:(apache or www or www-data) and event.action:executed", + "references": [ + "https://pentestlab.blog/tag/web-shell/" + ], + "risk_score": 47, + "rule_id": "231876e7-4d1f-4d63-a47c-47dd1acdc1cb", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/techniques/TA0003/" + }, + "technique": [ + { + "id": "T1100", + "name": "Web Shell", + "reference": "https://attack.mitre.org/techniques/T1100/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json index a16b164e9ee4a..8d8b897665fd8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json @@ -1,24 +1,24 @@ -{ - "description": "A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.", - "false_positives": [ - "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Socat Process Activity", - "query": "process.name:socat and not process.args:-V and event.action:executed", - "references": [ - "https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat" - ], - "risk_score": 47, - "rule_id": "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.", + "false_positives": [ + "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Socat Process Activity", + "query": "process.name:socat and not process.args:-V and event.action:executed", + "references": [ + "https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat" + ], + "risk_score": 47, + "rule_id": "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json index 9b18039b63fd0..62ff74e4ddf49 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Strace runs in a privileged context and can be used to escape restrictive environments by instantiating a shell in order to elevate privileges or move laterally.", - "false_positives": [ - "Strace is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or SREs engaged in debugging or system call tracing." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Strace Process Activity", - "query": "process.name:strace and event.action:executed", - "references": [ - "https://en.wikipedia.org/wiki/Strace" - ], - "risk_score": 21, - "rule_id": "d6450d4e-81c6-46a3-bd94-079886318ed5", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 1 +{ + "description": "Strace runs in a privileged context and can be used to escape restrictive environments by instantiating a shell in order to elevate privileges or move laterally.", + "false_positives": [ + "Strace is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or SREs engaged in debugging or system call tracing." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Strace Process Activity", + "query": "process.name:strace and event.action:executed", + "references": [ + "https://en.wikipedia.org/wiki/Strace" + ], + "risk_score": 21, + "rule_id": "d6450d4e-81c6-46a3-bd94-079886318ed5", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json index 5ae48c8db9984..e29650f02ed87 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json @@ -1,53 +1,53 @@ -{ - "description": "The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a prelude to lateral movement or defense evasion.", - "false_positives": [ - "Some normal use of this command may originate from server or network administrators engaged in network troubleshooting." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Network Sniffing via Tcpdump", - "query": "process.name:tcpdump and event.action:executed", - "risk_score": 21, - "rule_id": "7a137d76-ce3d-48e2-947d-2747796a78c0", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1040", - "name": "Network Sniffing", - "reference": "https://attack.mitre.org/techniques/T1040/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1040", - "name": "Network Sniffing", - "reference": "https://attack.mitre.org/techniques/T1040/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a prelude to lateral movement or defense evasion.", + "false_positives": [ + "Some normal use of this command may originate from server or network administrators engaged in network troubleshooting." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Network Sniffing via Tcpdump", + "query": "process.name:tcpdump and event.action:executed", + "risk_score": 21, + "rule_id": "7a137d76-ce3d-48e2-947d-2747796a78c0", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1040", + "name": "Network Sniffing", + "reference": "https://attack.mitre.org/techniques/T1040/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1040", + "name": "Network Sniffing", + "reference": "https://attack.mitre.org/techniques/T1040/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json index 7fef4e813da98..8e762e89e42d0 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json @@ -1,38 +1,38 @@ -{ - "description": "The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.", - "false_positives": [ - "Security testing tools and frameworks may run this command. Some normal use of this command may originate from automation tools and frameworks." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "User Discovery via Whoami", - "query": "process.name:whoami and event.action:executed", - "risk_score": 21, - "rule_id": "120559c6-5e24-49f4-9e30-8ffe697df6b9", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1033", - "name": "System Owner/User Discovery", - "reference": "https://attack.mitre.org/techniques/T1033/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.", + "false_positives": [ + "Security testing tools and frameworks may run this command. Some normal use of this command may originate from automation tools and frameworks." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "User Discovery via Whoami", + "query": "process.name:whoami and event.action:executed", + "risk_score": 21, + "rule_id": "120559c6-5e24-49f4-9e30-8ffe697df6b9", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json index e08d681d14463..3c69078ec4f37 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json @@ -1,42 +1,42 @@ -{ - "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications.", - "false_positives": [ - "Exclude DNS servers from this rule as this is expected behavior. Endpoints usually query local DNS servers defined in their DHCP scopes, but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations. In that case, such devices or networks can be excluded from this rule when this is expected behavior." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "DNS Activity to the Internet", - "query": "destination.port:53 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 169.254.169.254/32 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.251 or 224.0.0.252 or 255.255.255.255 or \"::1\" or \"ff02::fb\")", - "references": [ - "https://www.us-cert.gov/ncas/alerts/TA15-240A", - "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf" - ], - "risk_score": 47, - "rule_id": "6ea71ff0-9e95-475b-9506-2580d1ce6154", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications.", + "false_positives": [ + "Exclude DNS servers from this rule as this is expected behavior. Endpoints usually query local DNS servers defined in their DHCP scopes, but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations. In that case, such devices or networks can be excluded from this rule when this is expected behavior." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "DNS Activity to the Internet", + "query": "destination.port:53 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 169.254.169.254/32 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.251 or 224.0.0.252 or 255.255.255.255 or \"::1\" or \"ff02::fb\")", + "references": [ + "https://www.us-cert.gov/ncas/alerts/TA15-240A", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf" + ], + "risk_score": 47, + "rule_id": "6ea71ff0-9e95-475b-9506-2580d1ce6154", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json index 24c3bad817227..2a39ca23f7fca 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects events that may indicate the use of FTP network connections to the Internet. The File Transfer Protocol (FTP) has been around in its current form since the 1980s. It can be a common and efficient procedure on your network to send and receive files. Because of this, adversaries will also often use this protocol to exfiltrate data from your network or download new tools. Additionally, FTP is a plain-text protocol which, if intercepted, may expose usernames and passwords. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.", - "false_positives": [ - "FTP servers should be excluded from this rule as this is expected behavior. Some business workflows may use FTP for data exchange. These workflows often have expected characteristics such as users, sources, and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP workflow or business requirement is often suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "FTP (File Transfer Protocol) Activity to the Internet", - "query": "network.transport:tcp and destination.port:(20 or 21) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "87ec6396-9ac4-4706-bcf0-2ebb22002f43", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may indicate the use of FTP network connections to the Internet. The File Transfer Protocol (FTP) has been around in its current form since the 1980s. It can be a common and efficient procedure on your network to send and receive files. Because of this, adversaries will also often use this protocol to exfiltrate data from your network or download new tools. Additionally, FTP is a plain-text protocol which, if intercepted, may expose usernames and passwords. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.", + "false_positives": [ + "FTP servers should be excluded from this rule as this is expected behavior. Some business workflows may use FTP for data exchange. These workflows often have expected characteristics such as users, sources, and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP workflow or business requirement is often suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "FTP (File Transfer Protocol) Activity to the Internet", + "query": "network.transport:tcp and destination.port:(20 or 21) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "87ec6396-9ac4-4706-bcf0-2ebb22002f43", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json index bf286d4cab506..455f7b84cfeff 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects events that use common ports for Internet Relay Chat (IRC) to the Internet. IRC is a common protocol that can be used for chat and file transfers. This protocol is also a good candidate for remote control of malware and data transfers to and from a network.", - "false_positives": [ - "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions, such as when a NAT-ed web server replies to a client which has used a port in the range by coincidence. In this case, these servers can be excluded. Some legacy applications may use these ports, but this is very uncommon and usually only appears in local traffic using private IPs, which does not match this rule's conditions." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "IRC (Internet Relay Chat) Protocol Activity to the Internet", - "query": "network.transport:tcp and destination.port:(6667 or 6697) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "c6474c34-4953-447a-903e-9fcb7b6661aa", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that use common ports for Internet Relay Chat (IRC) to the Internet. IRC is a common protocol that can be used for chat and file transfers. This protocol is also a good candidate for remote control of malware and data transfers to and from a network.", + "false_positives": [ + "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions, such as when a NAT-ed web server replies to a client which has used a port in the range by coincidence. In this case, these servers can be excluded. Some legacy applications may use these ports, but this is very uncommon and usually only appears in local traffic using private IPs, which does not match this rule's conditions." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "IRC (Internet Relay Chat) Protocol Activity to the Internet", + "query": "network.transport:tcp and destination.port:(6667 or 6697) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "c6474c34-4953-447a-903e-9fcb7b6661aa", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json index 61c1e3d47cf7a..e86ebc64ebdc1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.", - "false_positives": [ - "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "IPSEC NAT Traversal Port Activity", - "query": "network.transport:udp and destination.port:4500", - "risk_score": 21, - "rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.", + "false_positives": [ + "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "IPSEC NAT Traversal Port Activity", + "query": "network.transport:udp and destination.port:4500", + "risk_score": 21, + "rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json index a9a39b61884c5..cbd6cb26ade83 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json @@ -1,57 +1,57 @@ -{ - "description": "This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.", - "false_positives": [ - "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SMTP on Port 26/TCP", - "query": "network.transport:tcp and destination.port:26", - "references": [ - "https://unit42.paloaltonetworks.com/unit42-badpatch/", - "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/" - ], - "risk_score": 21, - "rule_id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.", + "false_positives": [ + "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SMTP on Port 26/TCP", + "query": "network.transport:tcp and destination.port:26", + "references": [ + "https://unit42.paloaltonetworks.com/unit42-badpatch/", + "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/" + ], + "risk_score": 21, + "rule_id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json index 2f1390411f97b..7e3fbe92bb7e3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "TCP Port 8000 is commonly used for development environments of web server software. It generally should not be exposed directly to the Internet. If you are running software like this on the Internet, you should consider placing it behind a reverse proxy.", - "false_positives": [ - "Because this port is in the ephemeral range, this rule may false under certain conditions, such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs, which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "TCP Port 8000 Activity to the Internet", - "query": "network.transport:tcp and destination.port:8000 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "08d5d7e2-740f-44d8-aeda-e41f4263efaf", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "TCP Port 8000 is commonly used for development environments of web server software. It generally should not be exposed directly to the Internet. If you are running software like this on the Internet, you should consider placing it behind a reverse proxy.", + "false_positives": [ + "Because this port is in the ephemeral range, this rule may false under certain conditions, such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs, which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "TCP Port 8000 Activity to the Internet", + "query": "network.transport:tcp and destination.port:8000 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "08d5d7e2-740f-44d8-aeda-e41f4263efaf", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json index f7170d8d33a51..f1689d3fd1170 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of connections to tunnel their traffic while avoiding detection.", - "false_positives": [ - "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server replies to a client that used this port by coincidence. This is uncommon but such servers can be excluded." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "PPTP (Point to Point Tunneling Protocol) Activity", - "query": "network.transport:tcp and destination.port:1723", - "risk_score": 21, - "rule_id": "d2053495-8fe7-4168-b3df-dad844046be3", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of connections to tunnel their traffic while avoiding detection.", + "false_positives": [ + "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server replies to a client that used this port by coincidence. This is uncommon but such servers can be excluded." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "PPTP (Point to Point Tunneling Protocol) Activity", + "query": "network.transport:tcp and destination.port:1723", + "risk_score": 21, + "rule_id": "d2053495-8fe7-4168-b3df-dad844046be3", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json index da4319cf15307..854a303e66af9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that may describe network events of proxy use to the Internet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically, environments will use an internal IP address for a proxy server. It can also be used to circumvent network controls and detection mechanisms.", - "false_positives": [ - "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "Proxy Port Activity to the Internet", - "query": "network.transport:tcp and destination.port:(1080 or 3128 or 8080) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "ad0e5e75-dd89-4875-8d0a-dfdc1828b5f3", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may describe network events of proxy use to the Internet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically, environments will use an internal IP address for a proxy server. It can also be used to circumvent network controls and detection mechanisms.", + "false_positives": [ + "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "Proxy Port Activity to the Internet", + "query": "network.transport:tcp and destination.port:(1080 or 3128 or 8080) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "ad0e5e75-dd89-4875-8d0a-dfdc1828b5f3", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json index d3b65a36f084b..dc2650c63d26d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json @@ -1,68 +1,68 @@ -{ - "description": "This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RDP (Remote Desktop Protocol) from the Internet", - "query": "network.transport:tcp and destination.port:3389 and not source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RDP (Remote Desktop Protocol) from the Internet", + "query": "network.transport:tcp and destination.port:3389 and not source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json index 79618a867c73f..47a1addb925bb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects network events that may indicate the use of RDP traffic to the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "RDP connections may be made directly to Internet destinations in order to access Windows cloud server instances but such connections are usually made only by engineers. In such cases, only RDP gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RDP (Remote Desktop Protocol) to the Internet", - "query": "network.transport:tcp and destination.port:3389 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "e56993d2-759c-4120-984c-9ec9bb940fd5", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RDP traffic to the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "RDP connections may be made directly to Internet destinations in order to access Windows cloud server instances but such connections are usually made only by engineers. In such cases, only RDP gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RDP (Remote Desktop Protocol) to the Internet", + "query": "network.transport:tcp and destination.port:3389 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "e56993d2-759c-4120-984c-9ec9bb940fd5", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json index da1e46750f3bd..15c2e504c033f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json @@ -1,35 +1,35 @@ -{ - "description": "This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RPC (Remote Procedure Call) from the Internet", - "query": "network.transport:tcp and destination.port:135 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 73, - "rule_id": "143cb236-0956-4f42-a706-814bcaa0cf5a", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RPC (Remote Procedure Call) from the Internet", + "query": "network.transport:tcp and destination.port:135 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 73, + "rule_id": "143cb236-0956-4f42-a706-814bcaa0cf5a", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json index d07d19b8fffee..6e5c552045afb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json @@ -1,35 +1,35 @@ -{ - "description": "This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RPC (Remote Procedure Call) to the Internet", - "query": "network.transport:tcp and destination.port:135 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 73, - "rule_id": "32923416-763a-4531-bb35-f33b9232ecdb", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RPC (Remote Procedure Call) to the Internet", + "query": "network.transport:tcp and destination.port:135 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 73, + "rule_id": "32923416-763a-4531-bb35-f33b9232ecdb", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json index 93a4b0ebbbd8e..073f7d7a58c2b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json @@ -1,50 +1,50 @@ -{ - "description": "This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration.", - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SMB (Windows File Sharing) Activity to the Internet", - "query": "network.transport:tcp and destination.port:(139 or 445) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 73, - "rule_id": "c82b2bd8-d701-420c-ba43-f11a155b681a", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration.", + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SMB (Windows File Sharing) Activity to the Internet", + "query": "network.transport:tcp and destination.port:(139 or 445) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 73, + "rule_id": "c82b2bd8-d701-420c-ba43-f11a155b681a", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json index ca287605490ef..4023e63df0ab9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an enterprise network, there is typically a dedicated internal host that performs this function. It is also frequently abused by threat actors for command and control, or data exfiltration.", - "false_positives": [ - "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and personal devices may send email traffic to remote Internet destinations. In this case, such devices or networks can be excluded from this rule if this is expected behavior." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SMTP to the Internet", - "query": "network.transport:tcp and destination.port:(25 or 465 or 587) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "67a9beba-830d-4035-bfe8-40b7e28f8ac4", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an enterprise network, there is typically a dedicated internal host that performs this function. It is also frequently abused by threat actors for command and control, or data exfiltration.", + "false_positives": [ + "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and personal devices may send email traffic to remote Internet destinations. In this case, such devices or networks can be excluded from this rule if this is expected behavior." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SMTP to the Internet", + "query": "network.transport:tcp and destination.port:(25 or 465 or 587) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "67a9beba-830d-4035-bfe8-40b7e28f8ac4", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json index 3a5bd5bff98f5..6bec24199b3eb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that may describe database traffic (MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases should almost never be directly exposed to the Internet, as they are frequently targeted by threat actors to gain initial access to network resources.", - "false_positives": [ - "Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and database instances are accessed directly across the Internet." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SQL Traffic to the Internet", - "query": "network.transport:tcp and destination.port:(1433 or 1521 or 3336 or 5432) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "139c7458-566a-410c-a5cd-f80238d6a5cd", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may describe database traffic (MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases should almost never be directly exposed to the Internet, as they are frequently targeted by threat actors to gain initial access to network resources.", + "false_positives": [ + "Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and database instances are accessed directly across the Internet." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SQL Traffic to the Internet", + "query": "network.transport:tcp and destination.port:(1433 or 1521 or 3336 or 5432) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "139c7458-566a-410c-a5cd-f80238d6a5cd", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json index 429a91183e88a..7c7aab3da16c9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json @@ -1,68 +1,68 @@ -{ - "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SSH (Secure Shell) from the Internet", - "query": "network.transport:tcp and destination.port:22 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 47, - "rule_id": "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SSH (Secure Shell) from the Internet", + "query": "network.transport:tcp and destination.port:22 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 47, + "rule_id": "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json index a260245b4dade..aa5afd1dcb177 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "SSH connections may be made directly to Internet destinations in order to access Linux cloud server instances but such connections are usually made only by engineers. In such cases, only SSH gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SSH (Secure Shell) to the Internet", - "query": "network.transport:tcp and destination.port:22 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "6f1500bc-62d7-4eb9-8601-7485e87da2f4", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "SSH connections may be made directly to Internet destinations in order to access Linux cloud server instances but such connections are usually made only by engineers. In such cases, only SSH gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SSH (Secure Shell) to the Internet", + "query": "network.transport:tcp and destination.port:22 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "6f1500bc-62d7-4eb9-8601-7485e87da2f4", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json index 4cfe15683c825..9d9dc31f28320 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json @@ -1,68 +1,68 @@ -{ - "description": "This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embed ed systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.", - "false_positives": [ - "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "Telnet Port Activity", - "query": "network.transport:tcp and destination.port:23", - "risk_score": 47, - "rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embed ed systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.", + "false_positives": [ + "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "Telnet Port Activity", + "query": "network.transport:tcp and destination.port:23", + "risk_score": 47, + "rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json index 8c8bb809c9fec..57e8dd9e35bdd 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects network events that may indicate the use of Tor traffic to the Internet. Tor is a network protocol that sends traffic through a series of encrypted tunnels used to conceal a user's location and usage. Tor may be used by threat actors as an alternate communication pathway to conceal the actor's identity and avoid detection.", - "false_positives": [ - "Tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used one of these ports by coincidence. In this case, such servers can be excluded if desired." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "Tor Activity to the Internet", - "query": "network.transport:tcp and destination.port:(9001 or 9030) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "7d2c38d7-ede7-4bdf-b140-445906e6c540", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1188", - "name": "Multi-hop Proxy", - "reference": "https://attack.mitre.org/techniques/T1188/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of Tor traffic to the Internet. Tor is a network protocol that sends traffic through a series of encrypted tunnels used to conceal a user's location and usage. Tor may be used by threat actors as an alternate communication pathway to conceal the actor's identity and avoid detection.", + "false_positives": [ + "Tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used one of these ports by coincidence. In this case, such servers can be excluded if desired." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "Tor Activity to the Internet", + "query": "network.transport:tcp and destination.port:(9001 or 9030) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "7d2c38d7-ede7-4bdf-b140-445906e6c540", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1188", + "name": "Multi-hop Proxy", + "reference": "https://attack.mitre.org/techniques/T1188/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json index 4204a4fe62e88..18c65dcae6b3d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "VNC (Virtual Network Computing) from the Internet", - "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 73, - "rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1219", - "name": "Remote Access Tools", - "reference": "https://attack.mitre.org/techniques/T1219/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "VNC (Virtual Network Computing) from the Internet", + "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 73, + "rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Tools", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json index 898282e36df19..3c155d672bb50 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "VNC (Virtual Network Computing) to the Internet", - "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1219", - "name": "Remote Access Tools", - "reference": "https://attack.mitre.org/techniques/T1219/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "VNC (Virtual Network Computing) to the Internet", + "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Tools", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json index afbbb2a34d545..fc5edbc810530 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json @@ -1,42 +1,42 @@ -{ - "description": "A request to a web application server contained no identifying user agent string.", - "false_positives": [ - "Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." - ], - "filters": [ - { - "$state": { - "store": "appState" - }, - "exists": { - "field": "user_agent.original" - }, - "meta": { - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "user_agent.original", - "negate": true, - "type": "exists", - "value": "exists" - } - } - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: No User Agent", - "query": "url.path:*", - "references": [ - "https://en.wikipedia.org/wiki/User_agent" - ], - "risk_score": 47, - "rule_id": "43303fd4-4839-4e48-b2b2-803ab060758d", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 1 +{ + "description": "A request to a web application server contained no identifying user agent string.", + "false_positives": [ + "Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." + ], + "filters": [ + { + "$state": { + "store": "appState" + }, + "exists": { + "field": "user_agent.original" + }, + "meta": { + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "user_agent.original", + "negate": true, + "type": "exists", + "value": "exists" + } + } + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: No User Agent", + "query": "url.path:*", + "references": [ + "https://en.wikipedia.org/wiki/User_agent" + ], + "risk_score": 47, + "rule_id": "43303fd4-4839-4e48-b2b2-803ab060758d", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json index c70725dcb645a..a6fc753c8a3e8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", - "false_positives": [ - "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this signal and such parent domains can be excluded." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_dns_tunneling", - "name": "DNS Tunneling", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "91f02f01-969f-4167-8f66-07827ac3bdd9", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", + "false_positives": [ + "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this signal and such parent domains can be excluded." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_dns_tunneling", + "name": "DNS Tunneling", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8f66-07827ac3bdd9", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json index 3ed40ddf27864..b73140ad9d87c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal. Network activity that occurs rarely, in small quantities, can trigger this signal. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_dns_question", - "name": "Unusual DNS Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "746edc4c-c54c-49c6-97a1-651223819448", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal. Network activity that occurs rarely, in small quantities, can trigger this signal. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_dns_question", + "name": "Unusual DNS Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "746edc4c-c54c-49c6-97a1-651223819448", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json index c49bc95be75d2..3235b5b71fdf2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", - "false_positives": [ - "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_server_domain", - "name": "Unusual Network Destination Domain Name", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "17e68559-b274-4948-ad0b-f8415bb31126", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", + "false_positives": [ + "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_server_domain", + "name": "Unusual Network Destination Domain Name", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "17e68559-b274-4948-ad0b-f8415bb31126", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json index 02a4a5f729a16..b70de10dfc6c9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic.", - "false_positives": [ - "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_urls", - "name": "Unusual Web Request", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "91f02f01-969f-4167-8f55-07827ac3acc9", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic.", + "false_positives": [ + "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_urls", + "name": "Unusual Web Request", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8f55-07827ac3acc9", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json index 76ed6b263a704..f67d6c393c082 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity.", - "false_positives": [ - "Web activity that is uncommon, like security scans, may trigger this signal and may need to be excluded. A new or rarely used program that calls web services may trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_user_agent", - "name": "Unusual Web User Agent", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "91f02f01-969f-4167-8d77-07827ac4cee0", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity.", + "false_positives": [ + "Web activity that is uncommon, like security scans, may trigger this signal and may need to be excluded. A new or rarely used program that calls web services may trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_user_agent", + "name": "Unusual Web User Agent", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8d77-07827ac4cee0", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json index 048f93e170656..a731a23ccb96c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "rare_process_by_host_linux_ecs", - "name": "Unusual Process For a Linux Host", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "46f804f5-b289-43d6-a881-9387cf594f75", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "rare_process_by_host_linux_ecs", + "name": "Unusual Process For a Linux Host", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "46f804f5-b289-43d6-a881-9387cf594f75", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json index 7bc46cdc04dd2..496c9204c5b44 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "rare_process_by_host_windows_ecs", - "name": "Unusual Process For a Windows Host", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "6d448b96-c922-4adb-b51c-b767f1ea5b76", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "rare_process_by_host_windows_ecs", + "name": "Unusual Process For a Windows Host", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "6d448b96-c922-4adb-b51c-b767f1ea5b76", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json index fd240262d021f..4f1efa5ada063 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json @@ -1,24 +1,24 @@ -{ - "description": "This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.", - "false_positives": [ - "This rule does not indicate that a SQL injection attack occurred, only that the `sqlmap` tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity." - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: sqlmap User Agent", - "query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"", - "references": [ - "http://sqlmap.org/" - ], - "risk_score": 47, - "rule_id": "d49cc73f-7a16-4def-89ce-9fc7127d7820", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 1 +{ + "description": "This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.", + "false_positives": [ + "This rule does not indicate that a SQL injection attack occurred, only that the `sqlmap` tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity." + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: sqlmap User Agent", + "query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"", + "references": [ + "http://sqlmap.org/" + ], + "risk_score": 47, + "rule_id": "d49cc73f-7a16-4def-89ce-9fc7127d7820", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json index 915bc1bcfc051..c723d42cc061d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies an unusually high number of authentication attempts.", - "false_positives": [ - "Security audits may trigger this signal. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "suspicious_login_activity_ecs", - "name": "Unusual Login Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "4330272b-9724-4bc6-a3ca-f1532b81e5c2", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies an unusually high number of authentication attempts.", + "false_positives": [ + "Security audits may trigger this signal. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "suspicious_login_activity_ecs", + "name": "Unusual Login Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "4330272b-9724-4bc6-a3ca-f1532b81e5c2", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json index 72671760c9c8d..f9154551e7e09 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_network_activity_ecs", - "name": "Unusual Windows Network Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "ba342eb2-583c-439f-b04d-1fdd7c1417cc", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_network_activity_ecs", + "name": "Unusual Windows Network Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "ba342eb2-583c-439f-b04d-1fdd7c1417cc", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json index 082fce438ca9e..58c407c7f9c6b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware.", - "false_positives": [ - "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_path_activity_ecs", - "name": "Unusual Windows Path Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "445a342e-03fb-42d0-8656-0367eb2dead5", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware.", + "false_positives": [ + "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_path_activity_ecs", + "name": "Unusual Windows Path Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "445a342e-03fb-42d0-8656-0367eb2dead5", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json index 93469b5a06223..fbaa92145899c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_process_all_hosts_ecs", - "name": "Anomalous Process For a Windows Population", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "6e40d56f-5c0e-4ac6-aece-bee96645b172", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_process_all_hosts_ecs", + "name": "Anomalous Process For a Windows Population", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "6e40d56f-5c0e-4ac6-aece-bee96645b172", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json index 1b80e443baae6..39c7965ea8534 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners.", - "false_positives": [ - "Users running scripts in the course of technical support operations of software upgrades could trigger this signal. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_process_creation", - "name": "Anomalous Windows Process Creation", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners.", + "false_positives": [ + "Users running scripts in the course of technical support operations of software upgrades could trigger this signal. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_process_creation", + "name": "Anomalous Windows Process Creation", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json index 4de5443bcaf3f..477222667a504 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks.", - "false_positives": [ - "Certain kinds of security testing may trigger this signal. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_script", - "name": "Suspicious Powershell Script", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9d60-fc0fa58337b6", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks.", + "false_positives": [ + "Certain kinds of security testing may trigger this signal. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_script", + "name": "Suspicious Powershell Script", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9d60-fc0fa58337b6", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json index 7e0641fee68c2..0dc1597627fcc 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_service", - "name": "Unusual Windows Service", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9c71-fc0fa58338c7", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_service", + "name": "Unusual Windows Service", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9c71-fc0fa58338c7", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json index 217404b6eb474..b6a54cdad7d0b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", - "false_positives": [ - "Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_user_name_ecs", - "name": "Unusual Windows Username", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9c59-fc0fa58336a5", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", + "false_positives": [ + "Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_user_name_ecs", + "name": "Unusual Windows Username", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9c59-fc0fa58336a5", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json index 2cda21cf7d5ef..db75515684155 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json @@ -1,36 +1,35 @@ -{ - "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Network Connection via Certutil", - "query": "process.name:certutil.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1105", - "name": "Remote File Copy", - "reference": "https://attack.mitre.org/techniques/T1105/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Certutil", + "query": "process.name:certutil.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Remote File Copy", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json index 2427ab4d7cc55..f8b8bcf64d5b7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL.", - "false_positives": [ - "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Command Prompt Network Connection", - "query": "process.name:cmd.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command-Line Interface", - "reference": "https://attack.mitre.org/techniques/T1059/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1105", - "name": "Remote File Copy", - "reference": "https://attack.mitre.org/techniques/T1105/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL.", + "false_positives": [ + "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Command Prompt Network Connection", + "query": "process.name:cmd.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Remote File Copy", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json index f8e5bd22576a4..fac5bf924c86e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json @@ -1,50 +1,50 @@ -{ - "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "PowerShell spawning Cmd", - "query": "process.parent.name:powershell.exe and process.name:cmd.exe", - "risk_score": 21, - "rule_id": "0f616aee-8161-4120-857e-742366f5eeb3", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command-Line Interface", - "reference": "https://attack.mitre.org/techniques/T1059/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1086", - "name": "PowerShell", - "reference": "https://attack.mitre.org/techniques/T1086/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "PowerShell spawning Cmd", + "query": "process.parent.name:powershell.exe and process.name:cmd.exe", + "risk_score": 21, + "rule_id": "0f616aee-8161-4120-857e-742366f5eeb3", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1086", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1086/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json index 71aafa9984ecb..5c6a7f9f996e3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Svchost spawning Cmd", - "query": "process.parent.name:svchost.exe and process.name:cmd.exe", - "risk_score": 21, - "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command-Line Interface", - "reference": "https://attack.mitre.org/techniques/T1059/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Svchost spawning Cmd", + "query": "process.parent.name:svchost.exe and process.name:cmd.exe", + "risk_score": 21, + "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json index 4ff7891438554..bf5a89b2e1a68 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json @@ -1,38 +1,38 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Loading Windows Credential Libraries", - "query": "(winlog.event_data.OriginalFileName: (vaultcli.dll or SAMLib.DLL) or dll.name: (vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe and event.action: \"Image loaded (rule: ImageLoad)\"", - "risk_score": 73, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1003", - "name": "Credential Dumping", - "reference": "https://attack.mitre.org/techniques/T1003/" - } - ] - } - ], - "type": "query", - "version": 1 -} +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Loading Windows Credential Libraries", + "query": "(winlog.event_data.OriginalFileName: (vaultcli.dll or SAMLib.DLL) or dll.name: (vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe and event.action: \"Image loaded (rule: ImageLoad)\"", + "risk_score": 73, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "type": "query", + "version": 1 +} \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json index c08bb7b3315f5..878494b902736 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json @@ -1,36 +1,35 @@ -{ - "description": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)", - "query": "event.provider:\"Microsoft-Windows-Audit-CVE\" and message:\"[CVE-2020-0601]\"", - "risk_score": 21, - "rule_id": "56557cde-d923-4b88-adee-c61b3f3b5dc3", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1116", - "name": "Code Signing", - "reference": "https://attack.mitre.org/techniques/T1116/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)", + "query": "event.provider:\"Microsoft-Windows-Audit-CVE\" and message:\"[CVE-2020-0601]\"", + "risk_score": 21, + "rule_id": "56557cde-d923-4b88-adee-c61b3f3b5dc3", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1116", + "name": "Code Signing", + "reference": "https://attack.mitre.org/techniques/T1116/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json index 3f97f7aca74f6..d15bc671599f8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json @@ -1,35 +1,35 @@ -{ - "description": "The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Potential Evasion via Filter Manager", - "query": "event.code:1 and process.name:fltMC.exe", - "risk_score": 21, - "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1222", - "name": "File and Directory Permissions Modification", - "reference": "https://attack.mitre.org/techniques/T1222/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Potential Evasion via Filter Manager", + "query": "event.code:1 and process.name:fltMC.exe", + "risk_score": 21, + "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json index 72e02f8718d03..1c7426ebbf9e1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json @@ -1,56 +1,56 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. It is quite unusual for this program to be started by an Office application like Word or Excel." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started by an Office Application", - "query": "process.name:MSBuild.exe and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or outlook.exe or powerpnt.exe or winword.exe) and event.action: \"Process Create (rule: ProcessCreate)\"", - "references": [ - "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" - ], - "risk_score": 73, - "rule_id": "c5dc3223-13a2-44a2-946c-e9dc0aa0449c", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. It is quite unusual for this program to be started by an Office application like Word or Excel." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started by an Office Application", + "query": "process.name:MSBuild.exe and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or outlook.exe or powerpnt.exe or winword.exe) and event.action: \"Process Create (rule: ProcessCreate)\"", + "references": [ + "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" + ], + "risk_score": 73, + "rule_id": "c5dc3223-13a2-44a2-946c-e9dc0aa0449c", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json index ad519f1516aa6..7a390b45a9918 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json @@ -1,53 +1,53 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started by a Script Process", - "query": "process.name:MSBuild.exe and process.parent.name:(cmd.exe or powershell.exe or cscript.exe or wscript.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started by a Script Process", + "query": "process.name:MSBuild.exe and process.parent.name:(cmd.exe or powershell.exe or cscript.exe or wscript.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json index 1bbce904f2518..47ef24a888f6d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json @@ -1,53 +1,53 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started by a System Process", - "query": "process.name:MSBuild.exe and process.parent.name:(explorer.exe or wmiprvse.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 47, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started by a System Process", + "query": "process.name:MSBuild.exe and process.parent.name:(explorer.exe or wmiprvse.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 47, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json index eea4b3b4efe10..c14f134d1365a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json @@ -1,38 +1,38 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Using an Alternate Name", - "query": "(pe.original_file_name:MSBuild.exe or winlog.event_data.OriginalFileName: MSBuild.exe) and not process.name: MSBuild.exe and event.action: \"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1036", - "name": "Masquerading", - "reference": "https://attack.mitre.org/techniques/T1036/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Using an Alternate Name", + "query": "(pe.original_file_name:MSBuild.exe or winlog.event_data.OriginalFileName: MSBuild.exe) and not process.name: MSBuild.exe and event.action: \"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json index 81ea14e265388..920a991e9ed57 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json @@ -1,41 +1,41 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. If a build system triggers this rule it can be exempted by process, user or host name." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started an Unusual Process", - "query": "process.parent.name:MSBuild.exe and process.name:(csc.exe or iexplore.exe or powershell.exe)", - "references": [ - "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" - ], - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1500", - "name": "Compile After Delivery", - "reference": "https://attack.mitre.org/techniques/T1500/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. If a build system triggers this rule it can be exempted by process, user or host name." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started an Unusual Process", + "query": "process.parent.name:MSBuild.exe and process.name:(csc.exe or iexplore.exe or powershell.exe)", + "references": [ + "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" + ], + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1500", + "name": "Compile After Delivery", + "reference": "https://attack.mitre.org/techniques/T1500/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json index 2b6e1fb3daaec..9c03844194af4 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json @@ -1,53 +1,53 @@ -{ - "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", - "false_positives": [ - "The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process Activity via Compiled HTML File", - "query": "event.code:1 and process.name:hh.exe", - "risk_score": 21, - "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "false_positives": [ + "The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Process Activity via Compiled HTML File", + "query": "event.code:1 and process.name:hh.exe", + "risk_score": 21, + "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json index c397c955fe64f..ddc9c47a4dbb5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json @@ -1,51 +1,50 @@ -{ - "description": "RegSvcs.exe and RegAsm.exe are Windows command line utilities that are used to register .NET Component Object Model (COM) assemblies. Adversaries can use RegSvcs.exe and RegAsm.exe to proxy execution of code through a trusted Windows utility.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Execution via Regsvcs/Regasm", - "query": "process.name:(RegAsm.exe or RegSvcs.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "47f09343-8d1f-4bb5-8bb0-00c9d18f5010", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1121", - "name": "Regsvcs/Regasm", - "reference": "https://attack.mitre.org/techniques/T1121/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1121", - "name": "Regsvcs/Regasm", - "reference": "https://attack.mitre.org/techniques/T1121/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "RegSvcs.exe and RegAsm.exe are Windows command line utilities that are used to register .NET Component Object Model (COM) assemblies. Adversaries can use RegSvcs.exe and RegAsm.exe to proxy execution of code through a trusted Windows utility.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Execution via Regsvcs/Regasm", + "query": "process.name:(RegAsm.exe or RegSvcs.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "47f09343-8d1f-4bb5-8bb0-00c9d18f5010", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1121", + "name": "Regsvcs/Regasm", + "reference": "https://attack.mitre.org/techniques/T1121/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1121", + "name": "Regsvcs/Regasm", + "reference": "https://attack.mitre.org/techniques/T1121/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json index f60a986996d6f..f0fd1b49a261e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies possibly suspicious activity using trusted Windows developer activity.", - "false_positives": [ - "These programs may be used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Trusted Developer Application Usage", - "query": "event.code:1 and process.name:(MSBuild.exe or msxsl.exe)", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies possibly suspicious activity using trusted Windows developer activity.", + "false_positives": [ + "These programs may be used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Trusted Developer Application Usage", + "query": "event.code:1 and process.name:(MSBuild.exe or msxsl.exe)", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json index 4b3efead776d2..cfc5af3dc82d4 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json @@ -1,50 +1,50 @@ -{ - "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Compiled HTML File", - "query": "process.name:hh.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Compiled HTML File", + "query": "process.name:hh.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json index c6310c12ed974..9f6946c46a2c9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json @@ -1,53 +1,53 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process Injection by the Microsoft Build Engine", - "query": "process.name:MSBuild.exe and event.action:\"CreateRemoteThread detected (rule: CreateRemoteThread)\"", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1055", - "name": "Process Injection", - "reference": "https://attack.mitre.org/techniques/T1055/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1055", - "name": "Process Injection", - "reference": "https://attack.mitre.org/techniques/T1055/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Process Injection by the Microsoft Build Engine", + "query": "process.name:MSBuild.exe and event.action:\"CreateRemoteThread detected (rule: CreateRemoteThread)\"", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json index 0cd68ba5c1ed8..131c7708493e2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json @@ -1,50 +1,50 @@ -{ - "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Signed Binary", - "query": "process.name:(expand.exe or extrac.exe or ieexec.exe or makecab.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1218", - "name": "Signed Binary Proxy Execution", - "reference": "https://attack.mitre.org/techniques/T1218/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1218", - "name": "Signed Binary Proxy Execution", - "reference": "https://attack.mitre.org/techniques/T1218/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Signed Binary", + "query": "process.name:(expand.exe or extrac.exe or ieexec.exe or makecab.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json index d761226276496..98eb3ca8dfb80 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json @@ -1,36 +1,35 @@ -{ - "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Modification of Boot Configuration", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:bcdedit.exe and process.args:(/set and (bootstatuspolicy and ignoreallfailures or no and recoveryenabled))", - "risk_score": 21, - "rule_id": "69c251fb-a5d6-4035-b5ec-40438bd829ff", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Modification of Boot Configuration", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:bcdedit.exe and process.args:(/set and (bootstatuspolicy and ignoreallfailures or no and recoveryenabled))", + "risk_score": 21, + "rule_id": "69c251fb-a5d6-4035-b5ec-40438bd829ff", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json index 9b45d03aae375..633ac503b13ec 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json @@ -1,36 +1,35 @@ -{ - "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Network Connection via MsXsl", - "query": "process.name:msxsl.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "b86afe07-0d98-4738-b15d-8d7465f95ff5", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1220", - "name": "XSL Script Processing", - "reference": "https://attack.mitre.org/techniques/T1220/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via MsXsl", + "query": "process.name:msxsl.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "b86afe07-0d98-4738-b15d-8d7465f95ff5", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1220", + "name": "XSL Script Processing", + "reference": "https://attack.mitre.org/techniques/T1220/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json index 390c9c278905c..d538ec7c4d2b7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json @@ -1,36 +1,35 @@ -{ - "description": "Identifies the SYSTEM account using the Net utility. The Net utility is a component of the Windows operating system. It is used in command line operations for control of users, groups, services, and network connections.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Net command via SYSTEM account", - "query": "(process.name:net.exe or process.name:net1.exe and not process.parent.name:net.exe) and user.name:SYSTEM and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1087", - "name": "Account Discovery", - "reference": "https://attack.mitre.org/techniques/T1087/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies the SYSTEM account using the Net utility. The Net utility is a component of the Windows operating system. It is used in command line operations for control of users, groups, services, and network connections.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Net command via SYSTEM account", + "query": "(process.name:net.exe or process.name:net1.exe and not process.parent.name:net.exe) and user.name:SYSTEM and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json index 0488667d06c82..c6cfa6d9738ea 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json @@ -1,50 +1,50 @@ -{ - "description": "The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Potential Application Shimming via Sdbinst", - "query": "event.code:1 and process.name:sdbinst.exe", - "risk_score": 21, - "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1138", - "name": "Application Shimming", - "reference": "https://attack.mitre.org/techniques/T1138/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1138", - "name": "Application Shimming", - "reference": "https://attack.mitre.org/techniques/T1138/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Potential Application Shimming via Sdbinst", + "query": "event.code:1 and process.name:sdbinst.exe", + "risk_score": 21, + "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1138", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1138/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1138", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1138/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json index 26f0a0bcc245c..3982c57303ab8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json @@ -1,50 +1,50 @@ -{ - "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Potential Modification of Accessibility Binaries", - "query": "event.code:1 and process.parent.name:winlogon.exe and process.name:(atbroker.exe or displayswitch.exe or magnify.exe or narrator.exe or osk.exe or sethc.exe or utilman.exe)", - "risk_score": 21, - "rule_id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1015", - "name": "Accessibility Features", - "reference": "https://attack.mitre.org/techniques/T1015/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1015", - "name": "Accessibility Features", - "reference": "https://attack.mitre.org/techniques/T1015/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Potential Modification of Accessibility Binaries", + "query": "event.code:1 and process.parent.name:winlogon.exe and process.name:(atbroker.exe or displayswitch.exe or magnify.exe or narrator.exe or osk.exe or sethc.exe or utilman.exe)", + "risk_score": 21, + "rule_id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1015", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1015/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1015", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1015/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json index 28ebdb44fddd2..2b5338a716781 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json @@ -1,38 +1,38 @@ -{ - "description": "Adversaries may attempt to get information about running processes on a system.", - "false_positives": [ - "Administrators may use the tasklist command to display a list of currently running processes. By itself, it does not indicate malicious activity. After obtaining a foothold, it's possible adversaries may use discovery commands like tasklist to get information about running processes." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process Discovery via Tasklist", - "query": "event.code:1 and process.name:tasklist.exe", - "risk_score": 21, - "rule_id": "cc16f774-59f9-462d-8b98-d27ccd4519ec", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1057", - "name": "Process Discovery", - "reference": "https://attack.mitre.org/techniques/T1057/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Adversaries may attempt to get information about running processes on a system.", + "false_positives": [ + "Administrators may use the tasklist command to display a list of currently running processes. By itself, it does not indicate malicious activity. After obtaining a foothold, it's possible adversaries may use discovery commands like tasklist to get information about running processes." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Process Discovery via Tasklist", + "query": "event.code:1 and process.name:tasklist.exe", + "risk_score": 21, + "rule_id": "cc16f774-59f9-462d-8b98-d27ccd4519ec", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json index 3dca119b5a28e..01be55e536e6e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users.", - "false_positives": [ - "Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_rare_user_runas_event", - "name": "Unusual Windows User Privilege Elevation Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9d82-fc0fa58449c8", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users.", + "false_positives": [ + "Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_rare_user_runas_event", + "name": "Unusual Windows User Privilege Elevation Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9d82-fc0fa58449c8", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json index 09ff2a0cedf41..82ae48e5e8ea0 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames.", - "false_positives": [ - "Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_rare_user_type10_remote_login", - "name": "Unusual Windows Remote User", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9e93-fc0fa69550c9", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames.", + "false_positives": [ + "Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_rare_user_type10_remote_login", + "name": "Unusual Windows Remote User", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9e93-fc0fa69550c9", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json index 920ff28a9a9cd..bdf51b4538692 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", - "false_positives": [ - "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Regsvr", - "query": "process.name:(regsvr32.exe or regsvr64.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 169.254.169.254 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1117", - "name": "Regsvr32", - "reference": "https://attack.mitre.org/techniques/T1117/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1117", - "name": "Regsvr32", - "reference": "https://attack.mitre.org/techniques/T1117/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Regsvr", + "query": "process.name:(regsvr32.exe or regsvr64.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 169.254.169.254 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1117", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1117/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1117", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1117/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json index 9d4c2438acfb9..cac51f6a50c07 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Suspicious PDF Reader Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(AcroRd32.exe or Acrobat.exe or FoxitPhantomPDF.exe or FoxitReader.exe) and process.name:(arp.exe or dsquery.exe or dsget.exe or gpresult.exe or hostname.exe or ipconfig.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or ping.exe or qprocess.exe or quser.exe or qwinsta.exe or reg.exe or sc.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or installutil.exe or Microsoft.Workflow.Compiler.exe or msbuild.exe or mshta.exe or msxsl.exe or odbcconf.exe or rcsi.exe or regsvr32.exe or xwizard.exe or atbroker.exe or forfiles.exe or schtasks.exe or regasm.exe or regsvcs.exe or cmd.exe or cscript.exe or powershell.exe or pwsh.exe or wmic.exe or wscript.exe or bitsadmin.exe or certutil.exe or ftp.exe)", - "risk_score": 21, - "rule_id": "53a26770-9cbd-40c5-8b57-61d01a325e14", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1204", - "name": "User Execution", - "reference": "https://attack.mitre.org/techniques/T1204/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Suspicious PDF Reader Child Process", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(AcroRd32.exe or Acrobat.exe or FoxitPhantomPDF.exe or FoxitReader.exe) and process.name:(arp.exe or dsquery.exe or dsget.exe or gpresult.exe or hostname.exe or ipconfig.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or ping.exe or qprocess.exe or quser.exe or qwinsta.exe or reg.exe or sc.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or installutil.exe or Microsoft.Workflow.Compiler.exe or msbuild.exe or mshta.exe or msxsl.exe or odbcconf.exe or rcsi.exe or regsvr32.exe or xwizard.exe or atbroker.exe or forfiles.exe or schtasks.exe or regasm.exe or regsvcs.exe or cmd.exe or cscript.exe or powershell.exe or pwsh.exe or wmic.exe or wscript.exe or bitsadmin.exe or certutil.exe or ftp.exe)", + "risk_score": 21, + "rule_id": "53a26770-9cbd-40c5-8b57-61d01a325e14", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json index 0d4168640bc60..0796c5904e44e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json @@ -1,36 +1,35 @@ -{ - "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "max_signals": 33, - "name": "Bypass UAC via Event Viewer", - "query": "process.parent.name:eventvwr.exe and event.action:\"Process Create (rule: ProcessCreate)\" and not process.executable:(\"C:\\Windows\\SysWOW64\\mmc.exe\" or \"C:\\Windows\\System32\\mmc.exe\")", - "risk_score": 21, - "rule_id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1088", - "name": "Bypass User Account Control", - "reference": "https://attack.mitre.org/techniques/T1088/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Bypass UAC via Event Viewer", + "query": "process.parent.name:eventvwr.exe and event.action:\"Process Create (rule: ProcessCreate)\" and not process.executable:(\"C:\\Windows\\SysWOW64\\mmc.exe\" or \"C:\\Windows\\System32\\mmc.exe\")", + "risk_score": 21, + "rule_id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1088", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1088/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json index 46af0c5b586a5..b5cff435d4b75 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json @@ -1,38 +1,38 @@ -{ - "description": "Identifies use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.", - "false_positives": [ - "Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Whoami Process Activity", - "query": "process.name:whoami.exe and event.code:1", - "risk_score": 21, - "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1033", - "name": "System Owner/User Discovery", - "reference": "https://attack.mitre.org/techniques/T1033/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.", + "false_positives": [ + "Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Whoami Process Activity", + "query": "process.name:whoami.exe and event.code:1", + "risk_score": 21, + "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file From 028574037aca6be5286f5a7c8738c81035a1c327 Mon Sep 17 00:00:00 2001 From: Garrett Spong Date: Mon, 6 Apr 2020 16:14:23 -0600 Subject: [PATCH 2/8] Fixing monitoring i18n (#62715) --- x-pack/plugins/translations/translations/ja-JP.json | 1 - x-pack/plugins/translations/translations/zh-CN.json | 1 - 2 files changed, 2 deletions(-) diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index 79c1bbc49810b..40aad409c76ca 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -10995,7 +10995,6 @@ "xpack.monitoring.alerts.licenseExpiration.actionGroups.default": "デフォルト", "xpack.monitoring.alerts.licenseExpiration.newSubject": "NEW X-Pack 監視:ライセンス期限", "xpack.monitoring.alerts.licenseExpiration.resolvedSubject": "RESOLVED X-Pack 監視:ライセンス期限", - "xpack.monitoring.alerts.licenseExpiration.ui.firingMessage": "このクラスターのライセンスは、#relative で #absolute に期限が切れます。", "xpack.monitoring.alerts.licenseExpiration.ui.resolvedMessage": "このクラスターのライセンスはアクティブです。", "xpack.monitoring.alerts.lowSeverityName": "低", "xpack.monitoring.alerts.mediumSeverityName": "中", diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 77bf8f1467783..490976eb27222 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -10999,7 +10999,6 @@ "xpack.monitoring.alerts.licenseExpiration.actionGroups.default": "默认值", "xpack.monitoring.alerts.licenseExpiration.newSubject": "新 X-Pack Monitoring：许可证到期", "xpack.monitoring.alerts.licenseExpiration.resolvedSubject": "已解决 X-Pack Monitoring：许可证到期", - "xpack.monitoring.alerts.licenseExpiration.ui.firingMessage": "此集群的许可证将在 #relative 后，即 #absolute到期", "xpack.monitoring.alerts.licenseExpiration.ui.resolvedMessage": "此集群的许可证处于活动状态。", "xpack.monitoring.alerts.lowSeverityName": "低", "xpack.monitoring.alerts.mediumSeverityName": "中", From dec30e3fc6afa0ce8ea4ac65c3cbd448f2d6f956 Mon Sep 17 00:00:00 2001 From: Garrett Spong Date: Mon, 6 Apr 2020 18:08:10 -0600 Subject: [PATCH 3/8] Updates esarchiver test data with the latest rules (#62723) --- .../prebuilt_rules_loaded/data.json.gz | Bin 40255 -> 41865 bytes .../prebuilt_rules_loaded/mappings.json | 3026 +---------------- 2 files changed, 143 insertions(+), 2883 deletions(-) diff --git a/x-pack/test/siem_cypress/es_archives/prebuilt_rules_loaded/data.json.gz b/x-pack/test/siem_cypress/es_archives/prebuilt_rules_loaded/data.json.gz index 90d4cfe0f2734823f0acccd4ba4ea977fe939f4d..573c006d1507d9c84c581c9abab7d60d96bfebe3 100644 GIT binary patch literal 41865 zcmV)bK&ihUiwFP!000026YRZvbK6LkFZh3d3WV>*jy<8I@O~(EH^Sv|MR~?{>y}*A zv3F`hH<6hj(Eou-=CVo`%-N*`RnOQOxIvVn{L(O>+}qrrWAc+vYE>ECI{Wbcll8M|m0niXjE|L-K?PjO z952CJc?lP$9Dj`lLjm2U@jtB^c=A#$kM`1d2jc9HyD!f%!QyjIjx?*8yH_LV8 zQ> z6w5o$pnrG2_hz{#{hGXgdDMAxaVDx7$1n1hZ$U5hX6B_{>_(BzRF%65=p5)`n@{8>Rx2JoX+~!jSpP*V@e0TRt-WDqt zMO&FQf1_e^?EK^QnuPW?dV_KM%l|#tni?@txFl|FPOzn@8cr`P*0HCrR=(Ww@y!|P zwz1__tk@Lc>iId<0xS9)=j%L|C+pAFppgEnKf!PQ)yhpA=BR2{jqa=YOx`|Q{&J(! ztCwb9K|d4v5biIVvd{UQCtc#i|4Y~Q-+#e>{`)U~`LA^mg>=Fs3*3aoP8KjfNC8_! zLNc2NvG2rgVh8SvM-)l8dx+xqa^B40&^)axSXhnqS+!SHePO+;%2FS)Yomz|5_j(` zSB+Jg(s0f$Ve_)^?6l^k`Z|Nc0bVrMO{=CBpUn!hD>ozS%Or2CDZhr3T;f$YEF^9w zyw0JeeObIgNYJRIw=IN6Ro1G~DsabyBU4)G^`Zo5Ra;r=s}e9&06e5QiY__)B|BvC z^uS@dIc&Jf%c2^mu!{BuIha%a&sW_#6#Y6hlLOQF8n^6|ZmF7;`sUA9G?6pCkVm+{ zPhNk@MO`(p9!7tIN3){38ojHgGXMki2-X0ChIEX8vHK-t+W$Fi+FAdj$-6&g`L+8q zTU^Z*uBpYZuK;798RmB-QvqGcy5IGnysuaJKY1H;f(yMv7aIU=+P3Z9dULSTy{Aupc|*HB(gd&CcGjF6AM+OKy%o0KdG?S{pCI`zv=5B~OHw}O%+PowXY0a?u9%r@_-dci}3pgsO=@hUA z!+&5(+PW%^tQl@Lup^^BYYLkvFY{)4M1X;}91tfW!&+C+l|8b41H4*XTk{5X^1GV= zczCQ}MeqWjH7(9dGiq6(RNEX8{8?(}yyWwCQq}oCp>!??;FB^AXC6yO#aY*sH4rb{ ze+$_Dsz8Vib6vnPLEtrp$sx2;Dm`j--#fzUy*wbQc_9Jk=Hs!#_CWviCo+1qDX?}P zg{*HCIY7;~?oGLvz(Ms<@w&{*@xN86{?rScjdQ&it9f&7dV7v@dESllxf0DzBJf*9 z-HAS}1$?-=x*D0SVqWx}`}Dkiy|#c2>F0k@wJ)P7HRV;0?cVOHH;NXL1+u5DweL)+2v zrB5FpR=lk}iTeV4;$(Bho1ZwIV@E7;;a@(F6-#;Iuz2hyypUZ&fsgz zVJ5x{vt$3 zy|&7#Wc`z>9K*=LMvG;_hI`!?yg63chS8A*ZBJ~D%eF#2ld$0E54Zozdo%E2G6qUx zKbEi7#xklLUF8?~Ov#*+!3BRE(^vFrGk2rJcEThGL*}}n&HUK)SsE*!#i0`jFZGoS z+=IK((;9nLV3QSCWc``i6D;D|{>E6uwj=2|na?5_M9g=CgmLL}mN_bp;vfK!_u^fR zqFr=e{=6M5^7(Eo^0_;U=>#?|!=I;o1|XvR}90^Q#B&$2a2+sY-NNqE|>J z@7`Dwa-3CD1u$WVJ4lIPz!o`6Rdqf_>yf$vJr;lhpX{I$^b4DWm`qOdGH=i{MH-uQ z-s-{;)1aQHK!gIr0tYQ(I(Tzl0-UM6Q<0bXnwCQe|dED5ui`C$YSW*kb!!-#uc6bltS&OK=g zO`T5<@MVkeW&OF@7x;oA{-*E+ke{E$oW+R0FLQ4FZBp@RzBYpS0?6ZvUL67l>k2?gw=>_yHebw?a`VCCal|oMkFZBAJD0^4vX@qx(FS`%Pv`p32eF zdMewVcfY6dnGW)xlj3-J8{L|xGBo1gsr+5g-};~DzMwzf+Zg?YFnVqTfI0Lthxsss zjAtI8zXW7y&TXC?+;t*<2bEVpe?IF~Rs^a5!+oGtt=dNbKtMkDJ(-xM2H>E=XlJYY zP!^smMUKJEjVfhhVI$g_XIU;Rnb+`UajP*4q{v}m0=6uyR89D0j^RqA%>ukdQE{e< zh2L4GS7d7z1eiC%y46%}_T7z~mBDa7al|1BwOwIIYUO1;A+38$~r9ll3OU zT6CAHnJP`u-DpBte5lCdDY*)1017}nujU$(&dWX=aXpOu{wwPK6!ldr*cy#y+kVbT z_o%0+kAv){XwA+m;<#pAZl zrG#~sL&r%KXLYlr-KBDhpx2xZFj5H9xmBwvAk9I=iv`wOJfQ{Mq8dz*8T1Bf7aR-A zTjPk8!WWHH5U`@)Aq&4Tw2D@Rb}XZhp#j0DwaB*&E@AapBStv=Q+4u0x6N38oPO@z z&uBK&y1K#+&Wib%<)t14{D_vmA?T#(UibA3eejzRT<$#JVE3?^xtPEMx|XV5bkKY} zO3%H#IpNfwyQh37eaZ(cph(Qe)_0mxu9t}c&DSop^T6i}3K0_OVm+Z&j@ zf4RIYX7d!p$GkCb!ykC%_zaeO&WqD|+FMDEKYuv;GCDgQ#Wp}khqjsQkDdE$lM^dr6W}61pd?NkiUoQ=s5Suj_(F%^E-VuZ%2xBoF|qd{RgDT zcXZakdH6f(zA!>;d%~l?C&Hum)Idb-iVKzhq?M`oH~vVk|TFR<~yEZ z+|N9gg@LDh+jpY$#S^zh7*4!v;^S|p@2uCqX{<>e5E4MQ^$zg;nq4 zF`5a;nB*2o>k?r%2)q-L6nHVM8gvUqPX&P3z0?aZy28fXXz~$CS0Fd!D0L~=D@ziQ zc|BH$xk;P-byie)YwRb3P}m0FB^exqJ0hCt0%kFug<(L8b*b>lXTc7$M~L36=Ml<_ z4MF-=%xE%iVSUF7ehAoq7}gt<{*-)kZsK~r6S64uIP(L~VQGpX4xX379ajmNKBWWb zk4L{B%%}U7KHcX5e4WI;ANao48+bl?Zm-%VN84t3E3Exi>>7*)%lNXPJgLnsV@Xx0`4*pp+7i~2|Jls~I z0wiqorauk~L+d&$e5)-Zx_v;y8=>Lem-%J{*Q`SG3u^C+qPn7??t6D@D#*AoZ;<<$ z=96p@8K34w&S@ZxYx6=!Z&mn(^_uzt10{jQc{9_-A3e#vDZ$uIy5YUc=7t84X3(uh zn+jk6MN!SsC~}$CRXN2KNJa&^jYb8GkjJHjwT@vmUh!*+pKmmoC3N8L^XaTN`7GL_ z8?PI-JX$x~Hn8rguWCALZy6|br%lk{Ue-B zHK2e`)uqB?Y)hVr@e@zF>)b!-28kNho$c|aLdDNu#=pBN#XhJ~4yu&xt5ViKnD<4M zvIXW`+fLF<1|jnT2L{jcBbFv^%#tKdR2undkn)2`aR*f?XPlYA5tg{J6 zhsZZi>8QGnI;CqI%1Wfyz|HnGIerSw;f8$x?Edb@2@QeU%3NAV1FE|&4;y+tj2Fiq~P@ci2G z5}Y^R58k|38>NWd)JMM9c}Kg8Hb+l z+YyT$KViO9iY1-Q(|8aSAwf0$J5y8A9m-<{Gia{}8=1q)pnF<+$#i$lO@ zksk*tjwE+8|Ctk|9IVlYV7KQS?6&q7x-YWR7E&A8ZjwZt$4sS;fWeDnmbd|DQRsMH zCPOcd;)Cqu@1E@R1x~*mF+pKd?zAi6O-fwQXB{wlDqW`LT_ro{fKLh`vLoeuT4%Tvv7d208b9ek-IKZZv6XnVH0z z@pb|ze^?!H8socAV@?U5kZA=^$jd61k4tZE=?OJNG{cmX-^~9pZ@YdjUYM8NE67Yp zYU9NlR}+PnJax6oL3lPRu1D5ShEznSfY%AEPz2CyD3+Q{)RbJ7078z{(SVKvn?gN? zHlUP-YzG`(gF(c65GeO_!iuKlu|B{3f)+=Wb|ONpW`)Tl&%2Sin&j{jGE38BqTH() zsQc!nDD>u~z?lK8s@X+QXkW04bmG}fMv**2e2TKwLDu+z7Q6(YA+FcN_Uyg4;oa#7 z8%bAqF#sAR6`-0_W-N7loB4i_*r5tV;M)gB*n{ZtJRM>8bl#o#0TbRQ*dlW_(E(Xs zx5vy06(8iy?<8-ozccTPyqRplR%Z(#eI;2I_$Y7MAgrfB!cv|FHV-4;OCK7h0S6fdCZR#_hLJ8<4hi~-Y#b0Daps9k1fG;5_IoDkjKjk0M_*vIBc3p zRbV@VWq5G|2EMgSHgv1YhHm}6N*5=4uL{?+>T}bQ-nj%1cb)O3xYiE?w9{H*K~77? zTrn^Cyd|P*C=?U-jM15=FFn0peu8r79a)8m$eo&qTtbkdngVc{=BT-W=^`8pBTlMj zILoe=IM$(%QeE}!*6MR?v`#T(rh6%!F?#2aF$9(?SwK4XGTqo58{Si2;QKgeSP2(^ ziA$4E5ih9etf;OP@|%1i6*=*d_mBN!o{J0gcTxiVi1g^`?8!O};mCTg%|Fzz8k*iY zy)F8KqujHZFT8d7p+(THHU2n7M_s}pC_}qzWre~VkS)@NlY5XF%=z8blJbl!2bhxy z0bhaq^kkW+P>4|0U^;a=#T5$xEmup{pb5tz5XQx7FuffEKGvX#WjZSR*}O(4Js9Nf zyICF`O~T(T#94k>;fx&_`^z1x$#_~B*S}gDm~a_(YqFzkK@$ijuOc%^Ng-Hk8lHad zEKFu~n87#J5jj`7=wU&Y9Gy}_HR|HPo68irJn1J z5|+<7j`}&SmUAVVos`pV74@ww=jQwxiRySf&!sw6j!+W*Ii=AMr6iVR}yNB2hxrZ$J^|RjLw&xyVdk5|DchVlO z|AFocdJQ)B6bL;YNP#iXSxTz+h^1}@5Y~~tbka~bf%D?g>n`SSKLrS&_pbMsyy+YT zej)T@eIl?|KPsL3auJ=m5Iw2JP=fV3E80)*@SJ{QrGO6V>&_vXoCFBe@qq&YazS@q z0velHvd&RGrH^@vLxm5dMBU!OH{d&?J`J-(CDn;@8g;w?d|;Ax?i>$>+tE3(Jqdit3{%q!R>PE|e4 zn}&iCK2=hC3vH852O4$AoBo|J*ZQCBzF@9!^UUdi9SFdt8FSMR0ILU8q+W>H*DQ41 zEXhQizIeV1PE1PV2f=tx^`(IQJMny@AgYRD&ZR)wzxktxB@o4UazjQUzMg6?1hEYa%# zHZZ?u_&sQ{ACyV7MzrMxELu3ciXtCVxFf8}W8AckZTFbg6s&%hUe9>bFeC_K z(}pf@!^HXx+Kuo4karCr2e$oSXc}(4*4qpv;-3LbUf%pBH^IVC|3Uw_JNn0PKe2GU z1uP6_O%&QTQz_=qc6`oYJbfm42Dms)V>=EGSUB22{i8mF7wi}mr=)i^Y5n@;(?@d3 zUmF207eNf@*6Wd&Oy7{RUJnQ*`pD(!oRBXf(YiGx1p}Z=W&DZ`bQ<(6$2OtfvZI?= zU|Lj$q3ay<=GRY}@LfmH(-w^wkzDRBbLhCveh1h>%ysA#zJhFk$fA%poxPISFw~$m z`VE{V1T$K%I++kic?4+wrg8z{mYM~E=-;)IFA_e83*-$E-LR9pp&4-MJbGcOat<9w z(2Nej0K3bEdPEP?Qy{hEQuCEiOa92!RWDc=4`Pf7yKWXkeMHcm-mvxUpyxc`~sbp_mNp z7}fk4i;;XDE+<(M`B@;7x7hRT8;kK^zTZv)~b_vZ5{@=UZsC0w@4!% zOYNns8zqAcp5E187 zox-k-e%fT&=#3R98Wd^_pdX1M`pOql$3aNgDZP86*Z0#Z-(g4ON#aTtIv$3D*e*-5 zEM~Erq;bMkY&*|h`R?5Z_D&aH&z9hx_rwfo-UDQ~t2WH-v7~wNGl2L0y)$0tmpN>N zAj>s^7h6naYWs(&Kj`7N0s7b9miGko`+>cA@|`S6WFj3Fx}n4TRK*OF9xz)7PlznC zBm2d>+lOATgP^~U7(!yTthJbRS`$bD7|bm5MOp7lNz`a-BmbKP0N(0KzghLjdWW7e z1nh6UmJ5xhDOn3)xM_u32LSG3J}o;Ze5CE@9;1Ad{YTS1Xl}m$s=r+8EiM-T`8@4h zo6bJG|788#<-S3;r?F=I;642tl!8oOeBIwsvAxVV7a)^%50ETV1H~9J4#=C2&r6afx+>X#$UCo?>C= z8FcQBm!2@KiXV7c7$gd|88>0RojNSdWXjSo2_iQRmF=fbn^t8H(1l}f3NKddjH~g* z`t!9H_#zr5?&dDck@Nsrq%rfA7r?(Vh2thzpk%C6tTN%eczh9g$?hgwI4kok>(q!} z#0=@K9;HS!@Akg8HHX6=J&835E5?nD`iGX%^-ZfXZ>!o+an4Y?*IG^2uD0qD`E}`= zyWD(y*3KzYT%+^554lZ|j|mPHN@-VV_vF5(J!9&iFqt=kRFV>oqr4ze+^&7dD4Jt} zZ_ML|I0p`tj&Bp-sMt^-n9%)Lao!nV`kAY%l(?6{zLIZ(v- zn@X)Sf~*_)5ih)y4K!{RZogO!AEbHivUMPMZsy~$YFdn8oEI<+-1sn1N(!A$i8vE5 zg~giA!i)TlHzb+``!EVea*oN*u`N0g#4sN<`c+gVK1c!&MJ?*)^t~K}dm1?*RZvh~ z)dv*+q$ob+&BSDVSGA$v;2^9{$PfAI>dO3wq1^dqW3WFU;+UaYzG(}dj*ycBz{&U+ z77e47ar|mCZKdluaTH>fQR!sxuh3)Mj|79$Njh9e;fVD4CxQMReh&j=^*vl49wOPG zjTTqP7PG<~;Ntgzi|c=s`vMo;%|p*(!QJrn9{@`bch!KAF<{Vgf39D@C}r zsts+;LGBhKbCYz}f1G|^Vranf$WgYTbXgtET4lAoxELhPGHh}1>D1T6vDVHpu~;*@ zQKueoa;8N>2>p;If`HGv)NydyhZX?H2m1C^YZ8883yjSii76T#8aK(&A(raF`|UMv`Y-U z){Ibqq-tn)n5S?D)*!k&)W|+lD|lA3OmieNLAgOoI_Ne{lftdve?B!$HqIB=N}McF z<)whtft+qVQ^~wb)P^HUZPSft7TkaWtsinXgbie0*%MjAEY1Uaf zmZls2O@g(pnhba%QZMu!mT5*WDHyi_fTVsJOWWmPB%(vU=v~YgZTk-sQ)vFE-*Ioi zqjig_tpA1Xi*yid9t9W0VdQ~$#dzuj%nv}SiX#!TSj0}u6Ygc) zd-2l2E)rAxcKXhGZ8F{y|DHsjk9PpN-)KjOArRhzq|l+op~SGnLV@)e9}R4qkrHmV zWkk1E@i}){mzVJuHqFPF_3qi2ipR<9s@> zRSbVd?#K!0x8u@<1TVz;N{Cnfe06f-{Q2t5tx8uEet&6io-XH|<9i}?y^z^S5HdgW zUB)9jWU=F?f^%DB0e|i}@9syyAIzt_O^=zU2ER`7fIj@a-mt7wlB3x#T%aOm5GA%f zJ$bSxdU9{~vGDpI>%L&&XbX%Gewg`+L&1KOFy9Lm$PiA-f-p!p4{a{fgY$N@izIFT z^CRkt32)wjZd=xoBjPpcaYY{0MB>n4-PfPaENIJ-_1Bt(<;r#Xp{UQ@l}?&?B5r_FxZJ`01%6&nS-sE^lWMxc*fmbx z>6@#GZ)k~8g%6z@_>Fv%Cir13@Q2cPo5QRe-K+k!@(h;+OpqK|q^B1}HOHW?%e=12 zDJ>w<*e|Kgsr`SPe%Ai^G`-l(l9nBg7UE54BECfsv0HFmULgIHo;7Gizd}|mu!DyB zhlvlb;aK(vv-=fY=Pu zHg>_4xa(t~=lx871PY5|f0Yt`4b_l7yb$|;u&y5{IclFu?ub)%`(c+5BLz(iCjMZB8P>E>fSap*(!#d_VlCE@H&pupx0=C0JSw20!Ce0xw*&{K~0 z9uzoIoIo5MEP`d^dexODLJQ)L{2$Ntkw^>x-iG*MewbJo0ByOD=ROq29Z` zE0lLRpYrmuDrlIXsU3s4-nw)ka1T#A*QzPt!zIU}dy4Er1qO~l^!1=XS60>qoWCFn zHccgRB5E{6^@Bl+rW+z$hcI+glbK0(cF>T6sPw}`r5njawkmIUekPS4CoJ((IE@3_ zW;_Zr44iU;NMwl{CI@-rAa86(-uUi8!0~@gy7iIsN|#NDYJPOQ%r;+fidJ64ZiwR}sW4hDFWDGW_yD!|W;+*c_rEXSHHOt6d0NROs(8r0i#NspkRedb-V@s-t}&JlnWX!(Gb9@}p^ z)ZBI~>`UP*8gBiz^d6R!)*vIJG0&(pOiJ2&OZi~Jh_qNs5h7if%u%Pjso^4@x09;Q z|B06ki=UY$hzO_J#Y0>}RaE3{Rsu|?Br5eh!V*%>|d z;AyYE<}j+Oi_3CV&`yA(a;_)U&~+6Lmuv*o73Ipjx#Rm>7OHHY2uGnLw4JtNbFLDVcLZ zl=$oT_kNLV$W7pTp6y|t8b9_D<^y74shheiwmqKOp&bRWJTR$l5!Ajt{d9vwbrs58 z#i6?POzlfzCOg;|(27vlK^Uh@`Dk&J$Zr&f9+N>Pvyf+ra{#oly@P=Eccb)2V7m@z z=lTomIL)LY#1Jg+|F>Z6l#2J~{GyPZ#zHipjZfLWCmCJe)RW9fMHc7jpKL;Pr>g^htm&WQ?jka+2+GpI5A#~9)W6{@cY zH;g5whj`ZSUC{BO&1Cb#HWGO4h?%rw-XfrTpiI|}VcM{v!Dj58-^(9AsmdU8RexxHIvNCYxtU{DVkEL$K@EtEichFhs~JqdRpL`G339d zQ&;ef;u>0}!vf4LE)YY}tKAzT>(}Z^5nI=)POWP5kjK|7!zs!%HQC>2-iOP4O<4{< z>i!E^&3c{DwOt zcgLb^h>r_cC!N11nNRPiX>&`S^C*~ntH=TPy>-v*WgpE}_HR|HPaDnrj3&Ty9E$UW zu(6ZK`BqWif|#$au14m#8j0$7JkO;97=4V@nqRP_pp^D_R;zRllg6e6gWbLvP1MqKzpsi))v{+@8!tg`d&#N2+`Q)gp+@u!c= zzfb!w;6cQ_{!H!*;&!5q5w{5LY+J)}3 z!zzoUq?r9+kic}RFj;EeAUOJf@gViAs)y-HhtU>CiyW*JEK%rWe&jv}_iMOtZJ0>4 zGem9xjUG^RmFmG;hfoZkD)p1F7;1La6kAbW8%H>Rb?8NP+KruZjFLAR7u(9U8-WYgiBP zQTI*mCS1U7pdA_e9?WO(7Obcv=yEzAkKq*3+VSP|3x`I>+9gcWD1y ziROSfw}d!-Kj5D4DrS2b9JQ{5Q#K4j_!&kjb*17mI3Ug+hB&`93FrFLxG!+i+Z=9& zJWNIE`79N-WPZpMOKm%0iFA1oCo)Loizl#;onZIjrg6Lb5gOiwezt3j(FGkX)UiFZ z96-u!$vEFDkd8WRbhIJr#JpYzP$(pGtdLS4ktQG%M4Q)IFf(PjN(jzU5WKhPtLJn~-(m}+i)B?kz#350T@*pYS+ut0<%^SR7eA|i)n!p`9Q z@Vxj*895ISYC8~W{b}462<7{mYwRMKN*-rS2+RSL2#@jD5lpy_8!0zQGT(Xe5Na1m z-9P0>%~55o^%Lxi(t2Nx5#^j29U7XRtur0YX>>^IJAIZtKL{SfpU$Wz?Vh;0`XlR# zFZ6iO26D5njfM+e``f1v*6R-Nd|Kr1!JgN1{F5{+Z>(mXY9*fmG+nshP`5_fwq{_@ z?ZQ|W8mt+=M*YsZq%)Xzb!k{v15FgveD!n@hlz9?8$?|eXlmkwvoy)z$n!FrJCPl6q2S*1lO_Z3dz}Gz zOMz#>69*!>(fxr)U+Q^-o8`~lE@J(T$r##vi$Q46h-VOX=-xN^?>otROVjQirv3Ru zo;g1*^6XoMko7m{eGx*U&GooJkcCm`yG(ManD4lP@lb&T7je%P(v1W8;`uV;a2FGi z8d&t9{JYLXq={GV5)ZzM1Y!mT#2>;jWJm6jM0H?L%M?oqmu^TAZ3PezR^uYc5;@uy zaIwV`7sIfW-7B5z?xFI2EAwbgze9;T9H!>J;;r1ijkQwgwNqqQ7N}hSbp*<8B z>>#)wIo{fHx5rfx1kXTB@bAqy+ilF&`$q7BZ&70K5A%MI6TXL>u%8SSUb1-xT07x! z8buLH562q#9{k#(aXop{c|9N8!30>F|#zfIBilI~J z2!ZijH4+J4s)Z!+EK)D+6-IxQqJGITK<3iEzo6Ur&$ydym6pstD2Kln=v)88+!N5}Z-K?Zi^Bklc32t% zPWEG8u{cv1vm@oEQ5r^Ja&YpE;@ty%pNUCJv&3HJ+&cUJ&%V6>gxuTJ{1Fsn1Hgys z-{sN{Y%b=4I_Qf-|o#cgypKxsu$865TimeI&&3dwlJegAtRBF(MZs$TOb9gqujf zh%RTTpDCt7$5p;xX2@@|3_^2fR@4}ju;231g* z3$g*gX;@>eYaEiwcBxBlzOf*}D)_v_y@Oz_NjlT(HnG$tj#}hQ!fYai)tT+rB)~mj zzTHq1F1ZlD6?OHS^xO_P;_sCAK=POBYu=ttc-dA{SP@H?^(tSW#wF1Cn%A@LY1vTg z7eB`fq&l8yDz@%7#tUKr-S2#+mEPU&G9|rb|5FYBbOwJnli`oyE3odG1yaUEZ2ta7 z*Msgi;o$Da6}j+qKWo*$)`ja&AVUec=)Q2 zY5(W6Y5UO>P5*){zjl9Si>tZ9_|CHho!@Oa;zZKTd<@!k9Ie^%LIlrge3(s1w9dq?%|J z<2=FPYzD>gX1Y|kXcj{z7XwDyYCq%E73@2d#;dz>wOA}y)4U(LtK}Edylp65R9`U6 zw{?qPCH;-WiInt}# z*Qv)zJnjlNkAuYXG!oDH-{ihXJifa*^@SZ|k?p3;c9AzE_EQ!+B4vT^+sc-<65)Z{ z7!$AVs>^h*tsx=ei-9}qdq_+C<~h<%>Ex6xQc_Wxjxi?r1YA^44KZ*E=y^zS)k#9g zLu?e@YqB~l=LucprB^+E>viVnk&!pE0^4ZO9pnSn(fyj&V!2r(>!)iAfP*SB%DgEn z)tEH)3!b-|SuL!$AfEx2N-^<cJcPi3B)NNp<4fmYaqG!_(nNA)GLaBA*3GmM}kbC7fAF%%mF$A^pHflsG8Q zcSw02MBnCB`vl7KAUfoI`%X}D{m*h=pk%PQS8WRCL*@&gIkt3Q@WPm-%6C~B1c8?Z z(sRS`r9;WkOP)jY9kWhrIwqBbzs)CQy)Wgg${*o!akBtS;B893Rrknx2XO3yz~8O+ za)FGwn$J}ql@zxeMAu29U8b3Cm@Um*A}detUX7d}ueD136X7G0ghjptuX@=Lvo70~ZOsCQeLW z^$qxCb9cP- z<_QTs5MDJWS0~-;Z*Nv`JV5PFF6#ieCPqvHV@5ARSA?7Ae0GtYHYF*{+#KM%4 z)wGM^(KGfRS>R^w5rhz+4>*jXkj)?-JJi)Y}n#~XO$h+fEPXopMG*gT_smpxV z$yg%&h`BD00v={=;yRBy)F=6Pa)`irDkYJh*!L@mK9rL@&D)Mo@i(<)RS`7cpep)K zs-pG3(LDijPULM2caXuB+q(u}!woJ3yAG2`ls2XgLi#^MOxVkis+ zpL}~}r(1OTr7o#UW||{!{g`749z89|$-&FRdMUN#jc{)SoTy(|N~OA{ zHFQveCFi_gWDBjTqDwYODL?z_QfS?{)X9}@8!{J#>1?1n00~=dMpL5QHBaYS%LP5k zTg;`U8XCV`+e%A?lf>&B;PJv2c4VDlIVI}AiVlAhZN4Gpr^H%?8f4`}3#my=4`_4mrcgeYdApCiRIf`x-kG>uwA1F&U!!WK%CwP#E0iKu zt3p?h-M&sSA1`YvOqpou$hMMrtXNwaXJ)u_j^!%(X1(P00EK3#KyF%CRu}4e1Wh^y zcmUG^-!A-3UvP75K66Gt+2Da2m}@DOKm(#4fvYZkEQ8NM=d{I3L1-WA5jdv;&#A!k zOJ_8b*&!>(AAmphnl(LIk%H1-2Ul#uh=qd^>g+2dK@mF!G%swG-j07mphK z9aR7Q^5xWeP4p9AP>lvF3>7kMB`P>L-u5}XtED88Yhy~%;^Bv82ooE99+`whh&+0i zFRaJl6>QszSn8Xt(IMcg`v86Wa{9)aAlDCOJmNYNJ>V?FQpPt8u^ND#98nb(>?E<> zP+)kM!@bLDPbVqnfzMTG0J5B;+Of2*VeR&#8NzFK4jrF@)(*+$me-aJ}dAJOO%kewAgFIlU; zwu@>g>*|q}XBKU7Ld{@ZX^er8Wdc8Mtrs7{fH00pBiJJrIw5bGMq87Sb4RTpfwcwA2|<>BfpfoE$NHaOvN zA87jYqlRg~fE*3HQMrvUU5B#WG2nx=XZmGY7K=B#p`8MTS&|&?Di2qOoNF%xJ)m7a zF_c8C3%~`KK#T(6ut!)Eu2^^bX8>#QKXkT__;P6!kDx$cQ9VYUSn3d#mW z<&##-ZZ4z|-FWTVI90Brr3SrlM)~aIwPTOyf5$OC;6(1o3F)`v(uD*s#QIA3rsq=_ z*07=&I2OOXRJ`)%tCJJw&sR?vM-)d&gkBP|gbTodksY#BWHxhEn!2uSyP5AjbN^4r zxlh6W&bV{qKkqc<$##_dj`PHxpf@IFWzWct_&aK7POG}zo-3&D?LM)tW8WV?w$O`h zX~ONNp78ko2_JUJ`YWDTZwr#x$S&N0#4Rp@ct4Ch-j5U3jsE&Uaee)5dSAqKfAee{ zt`Lc%Kt2zm#AAMvCM->Yj75%c1CFlNhin{Cu#2H(rzo$VlE*DbQ2LKAbC8V-#OSw0 z_oo!qjTp-=I2C?S85Fc3ZzCp zy_%p}r5rY;lMZVImlVw_w?siY6B-enex+|yiotk!DRPP1rSbV1jy+BY)z``KW{^4| z{va{_IEfKtHt*?#G3nZY=O+R3fkw=CFmT0_8D^1+ec$%OR2_t|gD|!YVeDWudlU{| z{|nt093I3QcDHjuDCoUAP$@}T=Rk}z-Hc|Pm%4F8BW9fIHI|ZdN~r-*v_&2}5CT;LFmK?ob<|NNF#N}mAs}?z^vhf6Um%`SWsLvofDT12;|lbS~J1^C}<)%exd&fTBsJ@Q}9ty3h^WI6T|Jk z?d%wh(lSwR`6A=noJ!Uy!nLi32FL)*E0uO&RgcKuu$5g(5OO3#_Q0OIf@mtRKC(C&(xBNK<_k-jyIbZuT50KKMQ^Ec>4Z?GYNZQ>+qsJ6H!uQF&v zVf|yyL2keVv^48&osY+4#lhq#^sSHJAU5n7X6CeHlh)Ohrr)M>7Uh>_J|pxF9RdMS z!he4M?V}MBO?Rb5OdAa>{RSE`vfk?XznWCmW!|6(mXm>!h?RAoMx2tHR;m>Z)$0j| zcVVh(OieJ2I3h#Yh*~vPr6RK_HPqBc!U^GAy+huvu&e2M(XB;~uqHj%x1n2%{$z5BaZku4d+F8Hwt6JO|PASe3_Et@&kq2aad8Li)d!O$!DaaWk5<)8f@;QjZg< zFb;x*r7pT6C4LOBz)o2fqcctFIgT4Xq15v|;jdX}=iOnpeX=uWV<`OThX9>ka~a4#Sp45ou&o~FnYmZAIl1Rpf&NkgEvZer&%<8o|~pLuf^G8v(s#;8ee z;EohPSxahf%pwK|0d>biW$F|uigX@3gz`5irn^KaMI|oaK*YFM^k!PshUbhi7P{_p z8lUqH;hihd95BX~Foy4Wwi~%AOClFerc{KCdxEpf2|PEA9Tf=ofHA%s##rH_eiL@A zfEVje;=aHOZ*zDdQ{QuAl`v^15%Wcwveb_hi(E91hbnag_r=2tZwE6D$iKmm%D&Wp#&zQ21|xzAr@{e(%1toM|k%sOj%O`&Z_)qh5y z_|eJO-j+IX5(e&7nf2+6YC0n0-0JF&tSjDNkl&&Wy2Oqpw#(MrWfq|Ca8@h$x3OAx zF?rfgP^%m1$>t{S2Nb`s9~(>Xx~e}6FkKqIAt_x~OV?-#=&Zoh!P=7){V(BeS(U6y z4%ZA?eaIs4wA>kHIo^W(OPSsV8L@7sz`BtmYmoWs%`PVYg`L>3Me4C2^I@wN31?}N z1uXC~n>&#mapgXDNn`&A>KylhECyfdd4s#<&)x1~{Z0wbbJc7OjzS|2LdSO%I-c*e zA2OmnN(xzjcitB%WDDGcPVCv94A7Cn&X}M2lEu=ESj64H4Sa_?GJf$=NZ>phDdhLY z5LI+hx#}CeX16SXa7rnbDr^m`eQ1JQ6@}D^90>ZB0^xW$Ov;8nr}GkUZ7vjXvSARF z_Rc+s9eXTxyq@9NN(73n2|S08IPijNs+jY8`uty4jv<+x0Br16bbdNXB(j0Chw~0jQlWv{qpG}F$k^= zJ(r6hjz8=5NKB@0C|aaPYdx2j2L4yX(Bj%&%Qm=diYuf|lZ%>CRQ#Vn{O%+SC zBw@ZE3dU21Ggk`Ri9Ijz)A-;;vpecd*L|1-;O-rGGgJw6KLcg<{>c!}Zq5(>G>^-& zv-V!RFOo#!Z!AgJv6sl$bC^(p%Y3D5mMEc^YYWF$!gp={!qX+jBYzit&%4mJPV4%6 zLu}*uC2V73OpB~8b&%N;M!l^;0io#@5aEAqt>!9kk=1*yBl#%&!Y;P!>W+eD(Z{6b-#G;*Bi2LW2kwX?jb3YonD(&v;1NWa>Q2BW6>Q8P_L zzH+O`FS-`;+VE80(taDB1p=vB(U zl=t~%0In3(c#O^fWtY50bHExk?_+pu@5$`PTkDe7*N71cbPCXn1H@KUitF_<{oPFT zXNYZYc@}8=D51#uT0^UYv%z=M0uNU2LKBRJffMKHbg?RnLpO;7=4Fn@d^dC%595#p znHNN9nkK1u_I}3Ez1le>>$oFH^kejL(No*@AJEI0)Yo*H9FtsoUk@K^>OUyxzL$b- z{SS0cFrx2ouAoaJKMGynV`=21FnBH|n&1&rcI*kj*FoZ|14i7zfVZ;+k3)wOdy)u( zIwsof!y=??d&Ci@LhVUP)pi-?`Utl{C|j>u>ypwL{Tk+`p}Y#S3N7`EH84zy;>oq)ousy_hUUxR|K&QW7t;RUXEg0 z^~kiDwEVsYZpX&0da9n6vM4}UIM*o-ZrFDy;+FvF6^0@ z-lMy@vTyWc*%VcEF`uox2?u)18<2Z$MEgB8xQ-K$IGqsVhY zW}}z1?W!y$E1*_7tCQo^KAu&6Co1SP*y-^KDnMG?Xq2Whw!z3+1Trr3WyE!4A3| zze6WBgvlLleUGpS6KpgaSuac`4D?D7SVdnx!7_APv6>d}QnTR0sIpdJ9=Vc`vfda8 zC6_mNFw`ZNYLTrO;Ty)4)zvjR%K*a21w5mZ{_0$C>$}4oF!=T`_?irMx54_Ax?Jeo zhj)2BZcapTOS^s#D>uDDtDezPhn4<>S%y8&NmE7pAZ2NCSZwov#cpKFG;&oM9uWWT zY1n^R%c{idcB9E-Ti{8}|zOf($X2jKUefZzHb>7D>T$4)j^%mz*-eLG=^ zmxauCl*hOYAX-L3#meS93hWo3XxQ1oM8j_>IBe+6@(aZXQNAGSw3^Lzq}3CInVrGm z3mbsWS&LCQ-Qf(EOg>!PP^W+^@>!uwlO`3WIMZMdaVET$6-p7cvx(3$Sh7~=e?nPN zhbS@AgN8a|4f(7lM}%lRlNEBW;dfmU-P@u`UG6su4?_;NN(eg5%vHpf(Bwk((Q~Nq zU66E8m{vg`Wy;IzK}U24)>J>g#l*Ihd>1CWz;Ne|Is+3MmrAFGgLd|5dIz*1+=2$R z6Kr>lS$k{P#^47IUIv(APZPftxPZ=ix8l#u+@8bmozrX_62NUS5-jwiOvH}Mq9h5? z&2nYD2~=@pQVnIFvkxQ zUpQ&(+Ap3?Hgb0`zw9Y~u}w>gBjoY=cUaG=us&7znc{!)%$Tk>QH~)S7I9u(=;Eik zcvaU`-G{{^e$X1RW#`?2>+Ybjn`WL}gk(u|nL~lHMwTya-A2sQE*rgb)VfK82o-h5 zD%2P%K^V2%D+=r~p=3)Xq}MAwdo^U*4Rbi9QR7XqP4k<1BOrlOQy#fG&6wX?Xhb+(Xrzk+ukvqR}4f0_N#g26ksZI zZ1&N7H%xz)On;UQ`}pslHiRs(BSa8qaK_o8%lw49EakD!0wItL+;fC)KX*Nycb}ea zu<>o6qZ??jsKzJegK~oV)pSd{x8B{}e{In|fG6hGsG*$TpsL$GMqTAWx%OAOH<)yD zMV;bdl4fbb+$;l3nnnQw6dy9>WWvjwOof?z@tD-xK@ZBa3c%my)C6xWT~HTFmM`hr z_&~`vGEep=mtc*Y)3^^>CNhE~_jtO{gr zW`ArGPN$gXp{{0SH6tKBpN%zfKD2r|1AI)MSi{ z8%eD{SNnpbyv>tEaXXD-fMm?IL&^Ls@fc4%pK*|QU;t&xGw;PCsa;H2`{B2D)@usS zFI8*(2F=3pgt}o<>YiR3ZfQd#s`a!5vgyL%32Go5s*_e@qJs}v=71FhTC6Eylb1o5ye_Qji$&jK_TTAIJ+KJ!!GubJSN7*z^y)CRz{wG zeVh#)v3+n28es=HeDT>~^bO)N1utl}PHU;Uyu7T6OOryZD?op+owK1KvF}<&uxo&{ z?kvx+Bhb4Vwk>e>@co~Z-~>;#)|3_rj&@F}SWC?&0Dut+!=R7Vk;b01-mpd5(2eQA zVD@2)Kqga|Isjg{og6_;s9|obtBFD!{`u_}25V&jC1JW}1*)nk#e;x9%hu?nC*0t1 zPOa)1M9n}vDyqB`+V>Jhq0|i%yrDK?UplaAR;l_bin+wRXoRQ>HRj^l;)@_Lt%JTX z7DqI_t??X1CZR<-HBPfSu-QXlifczw&5i~uHOq2g0>qGa4VU?c(_Z;5E9g6-H~``B zvme}lX$Hf%8*m!G={-Ty-9|wh2~P7#D`v(hu}B+1H(rNf7~!`VhDoG#)%yE^076)ji8M-Kj2zCN7IS|O z)wSc?r@DS;NT%_hclvnRj+?3DJh7Xp|8PD7%}M<`?zg8^y+!|0{~6@4aP0fz$#9pg z`SwD}o_@mP`zL(ZCF`$v4tM!W(fHee)GaQ8ct0!`-j9>FO{$}ZCGNF%>V1*8{mpF` zY2x{zFJi|12&prIjB)7*<_YEbK_s|HUVL;}w2SGPzq~u8bIXct+uovZy;SV2+{FX2 z5RC*N=3VA>RZdC%Mo#91oP*i%P>KanrM1SYM3D;FBqrnsi=dE1lv#!4%De_izPMf? zk7w3(H75bBGpckYFZl0>qeK;QKjNJwblFg+&Eq$FJ+MRV)Na zl=VqsYo1Js{0>4SReHY+d57@W_5a%>$MuEA#o#TAkET_ksOEBMEgq3ub}le`2xfA; zW62(^=mQP;AE%!i(nrv`>=N>6JptC9lj)9nr7Q1pnd?WmAP0BMoKja!v%I7avh5F( zZD~{6bBXp&Pb@o@fsB;PBHzvcCrLQ;mE=tMPUgFz2ZNkFb5E>;IJ+C->_L)wlq9qM z7rHN!Ot3kRogMiwd~U+x%!9#8d4lP6LdH>siDk-prVf(KE=C3*^wvVhcd`*8=+iHt z<;$d?GY?=K05wQ^Fx`|!5c&}!MzlDil%$mn!vcbmW2yY*-B`pMk-fASo{F|WvgUJ7s+Mx0F6$mt)h)Ujc&4N80 z&a$eg#@E_vNdc}%=AJ_vm!_eUTe_Amx9_3W^cLpDJmrG?>rCFpen^a91qHT>k((Y! z4;ijUkTp6v3)ZFrF$8l3VkF1-!I9SEq1W10t*v(mSU*B=dQ!{n?up#PRdJ9Rf1Ewk zv11#TwCA`a%*F8g<=RELv{j&@fJqrA%#Y!(SlXP)ObRD<<21;;gI)9>NFD^qA1Fw! z|B>#CAQ`$F3zEJAJ3R~_^M&s)U%C;9l(xf=bSLtKqteJf2$IR}36j74d}_V^O?y-R zteT6qn)R0bH%}l^-jE!7(XvmuZgPvFOo?slWQki+CEmPcYQxALo!#$da`ei$j273u z(`d)TNW$WfYp0?(@;Su}0aTXos$Q8536aJ`#*1mypv;Is7c-!D=D5y2ccaNi2$XZO zcbTvovfc4|taLJaiEkEF-s+C%a~$Oo>;Ot=DC*`EYp)?c#WKO^!DI!0T`GKXP018T z(a0OUl!OuuF#JD-uXgDb9q=D=L$|5S2eoi*;b z=4sslkSDRgK?TDByMP0^?6L8@?7G>-WYHH!j>j3F=0(nFw#>vVxT>rQcf4MnT9jkj zy<0(BFH@@Wyf}HWmN*rJN#aSD!7(bB@4)$*#J*sO5=ojSzMaWnuPt#O%-;W&wv#=P zo!;vc&pMr_MK0Jc+Sz1~ljY!I`lK$V_QA#UAWuJyJiY#gy*Kjo<}Rjw%)`)Cg1M=R zVeo>KB_Kz$G!=0c1)=M!17%yhgY+1Ge12!W{v)qjv>KUD#d=pw0UpB1_NEglewa*+ z?dxRfTWuN9?SoXksZ@=lxI(Iio+x->*>hJDooriNHuG3ue>&RV33T=B>{sj`3bI)C zcM@jtfrBi2kYyLLto8r>zg7?%$I@Fj{~x^R*!@blTi$)Npn9v~^@Zt;W!=cTL)Hx< z+ZJi;Fq!#2^Fz)V4`jqVFN%^l3p|xRjecsgMj;;1l;v^={*r}y)AH(hk=ZF?1apXLe6|Y$zbpT zmt{hwp|I`L_S1ua8$Uk*_s5!yhvMxmlkq{geL~^(mdSW$1zYPN*d7GiA1~OxL`PVU zOFt2z!y+yP^IhSv6izu7d9IS&%>tfg2S?b0XuBoR_8{0iO0Ze~E8QExW^+1LCzU)4 zeV6&%bu>9l;zd5o!Y~LEp7@b)U%X(G?4V%ty9xFBn@X+U5NtQ?6C|5_+h=9$lC)WW zuTmrHP&icGv6yzTXTSgU(Evmv@GMwFG1Mxp0c}#aT2BW5MF&d}NR)F5$y^o#j)v6v zM+BsyMuz_wQHO}~)zCX*QT#7-izB!9kxm>*LX#R}%pbG}iUWi^#b`lz@(M}vv3)Q; z%H&Z$>LSKqkDy>acnt&&WyCY{ww8xT+QBffo}2_D6*1c}{r{Mk`9GvQd8YBUPQ;sQ|Bg{pGO}oY`BkOP2 ztB#452y9_x%j=GX=Lm&4Y*m9)ueDxeBxx=;35A*)Eh4$FD|z0SY^5tEj;_s1qgXUe zqBTWDQy#CBBnyy=6wZrjhhZw>CWvzo#RtL@@5Cg%F?Hmr%WI5YflIops>J<4uN^Fx zCcYESX?Z~z*EfntE93jB%c?ms=`K=`b%{gGX!WkVDASJXYF^5&hBc*H{ObDDDM~MlRk=wmsHe#>qni0j^sx6Iss=VV$epA~vUn-sKQu{H zznN&MNr4*Zc>@g@S#N1|!AqFA^0kfmnjkxgO{7VkmUcXzm*PE$b zPy4n1pcJzHOzw*m;`p1Ve9eL^3%rEMECx{|Qi{ci@R%FAVP=DD=Y}tyqB6F_9hO2& z993sw`SwIxYl|d6-Kq`P|^vglX|1uqwd zo0W3M&7@j4WEJGe!1NAx$R=<5jA91r>*2iF9BK#j8zF7?f-$A^h&3<&t}PQJt<<{D zgM4M3K!7s9%1mS(kSj2iJzq}Swa8(yFw6|HSzuL|{OssMl2O+3WFyC#$DH8X&|^tVwGmG^Ws6A>ah!0=0rC*;HqmV&+8p3uF>sg404{KJMY$?tbPS|5 z1aP_w)cQ`}+uT{}egU24=E6Ndn@ymN6UC0SgMbAh44Kbm#u6FYEE9Id;hglMG(13? zorgB-PvgEo8-H`YC;|WH`i{#Y3IFmv0EawMDNEhZmbRV3-Rz}9o6w7Pl6aWZ6(2g~ zh{dd*JD|ZV^MzUOOF64xwXf~|d$WKAin&$u$a)7@B~L=H~mahGh6HE*HQMJni%}XCK~wGGjn?vKe}Gk||Yc zo>X`%FEdOQO3hva`aI5eGqjt{y*E`U$1vx6;Jm4)AEDz3ed~kV=Xyx(+Um`*mVp7F`5~Jr8=Vw!h+sgy}Q>V8te6M?>^`V$_ietJM5#w zvx`~|qQ>Yjt~4*4F_yu* z^S08OE9ga4G#ZBWL6c1v!<=3ZVg?8&QeGs?H>?A~Q?+v;%6tx!xF<2n2B44ddpyzK z&O*^;R8<;0!%na^E}E&58C&b9;Q*{LLNhI@@v&<=-mx7V+u^ZZ{R{;V=m=A+tQa&4 z=484dE(#stIl}Q-04FH(L(DG$SC}2SK@g^K!jpY*2YMpq)l*=h71(F}iP{&|S7&pp zm~>+|h%%Qcn@i>g5of8ClEDrYs8D21>>Sc@{-5@~wYzN`+w%MT3QpY*o!mBLf&^cl zPpKqzD}9ryOgU9`XH90g@uJL*M5;+Cj(e^9-{%~Fq^O4BF=BTN0K{V-iwSL56 zkW4FqiG>(`imZ|aX86^Y*L!4NX+r0d)%SNvg{if%542pROU1YT^8=qz{sjy?PLIi{SI7Du&xXrO}W z#GBAogA~_+siu^c$;Og+G_)=ajm#1U5kf0devTt1uvi79me+NHt6_|>sgOOM+AE&I z0oWWg>3ndNeaR+TW!wNJe0Pd7ZA&;L<0zG!Mnw2L0V6r~i3nIgQs0eOC<8z7+#U`c z036zUppFI(#XATRa(&I9-@MR6b#myu*n__kFQjflJy-FxheHP#ByqPiT| zpDW8Vfm+wuNDl#A;F%G|6L)mGTHg(zpb3({!9JQvqa?B*!z}6p9soHO#_-y^)73N6 zBW+~0+bYdT6=IPFn2fGBMI`oi417~FJ|b2w9Uz=JR_fjbVmblPYiN+r!U0-+-uD0$ zqR{nI7)Avs^!&HC72**-w7xW@#cVjl?m#$VJxnOQj;=1`tL+iSUJ*uRC&vz5HtW%c zorGKB4;8Y&RZNqZ$`Gk$^n$-%*9mL*Z{vI8v&v|4(g%=ksxcr2kW`PU3tj(bkr z?ewm2!$p%*4T;atEDl7=DS z9_7SWQKF?%q3f%o7A<|UWVd%Jm%eV+^51b~#hs>?D&4D8Dea|7pCsY2cldxLsKqQGDreSr%2bB;WE5lkXgj?rd0G9n@~rkZ5TjHV!YUvRx@YL%-b;rDl>-GOU+^KT85FP$axgQ zDhuq=Eo5nL=N+P*_reQs7+Glk3F7GGu`8Y29IzPiL}`7W$FLV@?7ZFwt_+FcKA7!AywcR%2AtPilg)5+6-F1@gJI>J+nNi8SOwB<0GKgDt@Y60nn7*i}FZbl+8Ehqw%6_ zA7w1VP`O+)lK7kv#;72iy4ZO>S2|GAi~B66gdUz3<;^eW&Zk+Pz&4d^R81oY=y4f%kW_anei514n@Hf-u4hM^G zSJIW%avE;JV7MSFta4OhaNtU1{5h@eDAaM?++S^?+dG`!n!T;s@zS#N;Wd-mS8ptI zb0?-n8@f;CUDwf)SQ!Htx{+#rH&@eW&GDM|5UGL{x~?)|GvDXA_&4aw*49202NTU) zzFs@^SVU4`DqKw0JZC-A;5G-;Yvnb=u$9*oO7%ji&XW~Ny>%pyMTo-PKF2(ET@)%W$Y7y~XDAhY$uIMJo{3infniQp^eKW0ba}sjWWNsNCwVro*&~!&FIgi5*8ws8znD)+P*o~*nG*C)j z86HCnbTmh72rHC5)v_ds^V@_g3=l2ymZ^C^6w8?MU-K+;l+>_nLEISwWV#$-YC8Zx z_*9qh2JsS}UK}X{vr&n!$KXO-Utq6aG%{U1`||EEQK%S;MG_L3cpgeR2_gb2iHO1| zrJ4uuqQ^uBugtaiFdhpa^0o&=sS=UPy_hh?1OOtP5}pJ;Nm(ddHw~hIvmOw!!vjQr zYSDG1I~@_yhJfeHss1@aD!Jb)3}PJW{DEOUnTboOoi(^IU&7{V^3>5ch2PEcE1sj5 z3ORx0C__I5lGfRz_Bv0!g2e}b&=`|=YcI|GH#U&LwwDh40i_*B6>n4K7kLmHu0O1` zs{>)aJpbSCJ511DXCrheiEIQ=MQ@tT-idZ9v}Jqlgf(FV&r)^vv;yH4ZeXeoIx#=R z`~JJV)4$tWK@v!GtPPx&#SobtZRiHxV@+JBD`Wt$q=glL$g(u7f$yx2hJ6TIGV0t} zK$RVKL|vY=2^H4ShG1|Wl5+zG(P0n*O~&Nki3yyr>&erP2Ek|G!agT8gVX5j^AC1{ zoZ3g>-zw8j&I?3N0G#ZXcnbFN^ADRP+b>*w&xH3ILo^giq>TKOM4X1Og~09+CsLCn zl@awK6~zxECcJlu#xu)%ef9CflEm0LB(*N*b>opb8fEtFBcD|yn8#e`yqGb<5|076 zR1xt~75ZTsd131H%IpV7)cmTEF={<8EBj`iBUpKPn_HfTo`r)O8Wyz)!PQDx(## zSUj*ZuBEQl*RL4Mjqpg$Fks2LbegtweLDGa$tTX+Z&Hu&?*1%FOJxW{Y~(m<9rny- z0R!A@y;C(hJTY)+R^}(R#`cohLwA*1>Grvnm0q;O%buk1a+^J-Wen|3te*@ywJHH?Fn#V|J@5c!~>X7V*F%{<{bMrdz{ zgnu_w)J?B61H3|{ZG&@Q_RZP9EseMdvQFpcqO-}cgf6RYappO_6LDiFV&gBI3%NBO zMY+22^=`y%+=#C563GQ4O5m9i2auKMSQF~Sk&GmzTnD`y@!;Kvn-Al$AY?|jK*(T8 zR%EJ2un|qm>$AnT4*|tXB`l)jsSTXb)kj@^;FA^S6`%5RQ)2bHnB~)zklY{m*CBl9 zE-}c#>bLIG4Ck`@KW>Pg{XvhbKTJN>dwva5e_f6Ly|j?S?-0D-_qThxi?t7!8KaNT z!!V<(KeOrOf9T?;OpjF42DgjEVURu*uo+8-IBsO(>67c#xk zK>hU(KCD@<`2;YYu@;u6uz%+HgT!r=2p{mktevuVJvmF&KIF-%CS0P_e0MwC>`BRn z7E%4tF1(#*#T0Ljxd!3D-MDv}%R41rfCYqkWNHPyfay3YjNSNet}9Z}&HcE^qkIkb z)3TbH+WzOlRas>W#GhctgQ34id}iH|D>vGVhP|Wv4li{FUbxM|*s--POy=Z8$7{() zXKARU6s}96ICKf6nj^!dPof}Ae4WZ54(WrO3b)t0w4hEV@9Jedho3H`n&8@ji|w!Z zIiN;u){%i5x?a%je-i`wYx){${er{fEj_$|*~gPLeH@*6Y~Z=!!=K!{ZuNd+UAH6N z|5($*7;B}!UKn+xyM~&E0S&uVZ_TH`zG95(lX#4X&-faUO-gCgivmhG8k^j91e5oA|8E|A^ z&xU6v&-oz(XRluzA9OvaUuNhZN?bRhN#X@8Vs4VqhxS)p&HcK?I}3t=n{1<8Ik)t- zGV<=ayY=QDo|OK~t8XE`p5aM`&yp=VXqFMIF_UL_oKlSRSuxQ$ zRydhFq^Fu%+j2X%(tfniOR_e}R_D}x_QPoV(=u2GDf4~e=>+4kbV!8IjCj81i#U}Y z55nhtS{4tWhYmN!x;ZPWv$fIV{~hw(ItMN_`w0~AWm-(;XdUKv169>QJ)P{XAK@YRPpu~> zmO~cP*Dx*$6U3UfH?7R#BXbpaih^(P{` zIuW5!OqCl1B#>c<5xM9}PkfR}H|1dx1g`9p%?|%WWbk`oaYZlC8bsPMxel|*vI z35$6|IE?@b`C&*s<)^+!pL@(u=pCS%>FX99IB#a-32uhOdDEa0;?$3r^EOwLB6~nc z^>P7o$g^7Yz%e$s39eYVE|XSY9lx|9lH&qb6F@Md+1P{&;a9M{eQADX$miO}rukw0 z<=byHasDfuFcn}XQHKLL=kMNrs5`+#a7>U1&?Mq3)JZpF@g3FoO|Z_xLWx7S+CG>V z;Mx#I{RkN4?C^hq`#dvGdq-H*&WW@7UhNn5^#B`a2oZ2$J5$Z@n%}%wkR?UPd;t?7 zonDyFac(uGm=7+hnZQymQn;&?pKs3+7x_0}jUb{tl|e`XtrEh*KoRco1eTg0b(16w zb)+AJH7>K^m`sUqJ&$co5E3T|$28v*qj=*%1*_P1XRLDY^IsDnK-P`lCX4Aeit zYT}qha;I$5Zq%zaZwc(~dkVGrgLx#UP?Y*x<2sj0nMR%($E-lt^w11<*Jbcdlb)2kInXi&FnN-kInvi zxjz`jLf=&hLrF%(V8KE@G8rcD*7dZP2P*;^>yJ_MVi`QPqFg-34}7i{5bL% z@uS2iELEHc#XKUl=8C&Q$7%BP1wxO|TyW#$cF<^7TU>lvLflVF3G3SdMrc6~7#|BT zZv2=Yiv!mSw&!Q}m{6L#NJvEqi#?Cg|zTYwl!6bNqaODjEn_?4uXXp{``^~%!lXo*AwJx zM4CmU_(YxvsKH!(Zu1B~Kvfv1_ai{hFU||NqnB;YC4kIXZc;8QM?fPqpj0D&Qzun+ z>PObhksbm>9K+8~YBKY6EjR3^hWa|IE^Pn-0#*RIxgK@JZ|b{;@=sAoy;}ydi3)A& zZzwNM8Vb_Ni0gEi&(Wz}%L;b-w)l#rkE|y1sK>nD8}t6MGFRpyuQdR!e^Nhj4Fc{; z-Q$cngBfGKK(^Ed)J|~EYCr8>l1wm-uhaG{WD$#zL2rW~31Q_=S#n3%^KXGi{$bjuj932|cW8Fu>x|=_)M}u{@4?>L+ z?dkx)t%?H=Q)V^cTEs+inx@oubr=QD9_vO2s73VNxFXN%2T?hnc=ZLquJJoon};Yk zRa?>&OX^Bb8xC`a*HH}D#xvO<#6|gOKy7-C*-mgnKg9$C0D<@^Z1>q$fWX6znK|CK z*mbF)E!bQNUae`%+l3yv+Z+D#!%)@f9i*!cQW#q^s5kgX32HA4jZ>c3@is4w#wPr0 zM3hd?&ENB1p3Z-H3cuWAI4e)3)B#r{3>0icT6rW6DCS+diLZPvlY~F@IEv#sNp}PP zcD%T_zV6Ny8u&dtd?a|d`BQl;@X+_RhKDR6ZsQ0YV*zG+uKj;}jTf=bMnYsZCxvT*U@^0#VO8VZ0<%Ux z34MVjU>=J+JHfLEJguHkM+B+WJ2L6AeI)ErI1Lw2VLL^Bcn~QYo|EfqJ&?utR6tjs zTJ%JaSs%qwPd%4Lr*3d6uZ1p&t|piaKLkT~GWER;xY=%WC~~GH^<%KFg8)|1z!M}+ z1SgtNUwEEYOvFdvQ1ouYhHo21wH+ZtZ_hE7(H)+|<&|{HV9KcX7d{#w-1uoc7C^|h zKO6V`F!WOql2i-y7c!4<7a(<%av`+z!<6c04+!G}t_6>+YxKxxIW9MiCr~dP`K+t1C~b~aqoi5cO#V5@9CK`Kk0+m=U(w3IS|IsC z|1;MLK^@u~Mp_l-RP!bsO-HJ1-i<3RO#$uu$xJkFCO9uAP;C7k`W%py!nZG1@#~9r zt`GjK6)*>{i}56b1*|E7my`D8RFuV+`B!3yv`p>0Y+7+O&hq91soG{qSPXqPUaI_C`?7)ub^gW-N!wLLY0?zi_wy3cc{RfcKx`P><~_!y9gkbT>0Sa4 zY}LLil#p0=I{}a3vX0|ni~H6=+B1%&YkUb(4DXy69EP+rWa?5(Qc z;H|1!zy6WTs*VX|E56$};#F11%mhjp3#Y;**lE|`#xdU;I#1isDeC#K97fTbBfUA& zn}3VH9W*N|qoqxF)fiCM1bu;suG4+|#`|(wif_Ir2Tsk{ zxpM-nFeSyb05_u94P)Qi0oWu!iFPLyIe6D#Mhdu5) z9Ng!|!R@&3w|W-ukmw@lao!{0yv?7+W5Idh_Q`+D4``?YN!--+2=ii266$%x4JhSq zp8G-s0YcwKSr=nPill>@=f z@y@{cRa8jU0&QvQfo?yF21Tl9l^~c~x67PHSL|PN3 zyLfQAN7bu<1!?Mq#Fq&}Zbp{~<@@k9N|S*5+)ZWgK-(|IforFi=| z#u&;?LK=~Xx)BC}CM5Cwh)5NNTyQD03ZFgjqru@G9KO%;**E7;Eu2?12D%&X@w@=& zbo~i7o9eO{VM~KW0I@44;A+WGc|Jc%gyta66UwCmQY-B-qHcDbf%E53Ti=7kvhkP5rCQ{p>z44!)&Tfm zh_`I$`->|8S{yDalyy)Tr-btXTG2S5aPc(cs#ysoq4y~REDG?q)KGSgj;GPU`462p z1X)5$ZdC)csT=MMBcQN6Xj*k*zbN&@%n>M~ZAGgIR-wNHg$e4D)t>>zz)hd5xyz~m zC*w@ug|N%%27;}i0YgZ}BLWLswE>01ZKuwuP%#^rbwojwsF%e`v=PsJf;U+LiAMQuo8cmw@a`B@N@9%S1x#1ul z3${$y*4Q$PVirUwrYd4en4&2WB8o|nL~hIjNkzb(J+}1y!^M`3Gp9BG9pZe_ZX1MpZ5J(jOKvxN-jOuC)AUDJoKh7}i#>TY+ zE*NEBwDUKef5{N)pvw{Zteke*T%(J>pH9bAP;zcq|7i0N3$kYGEn%sY$yq zXt6Zu3kShw%4Y!mjx5Fv5e-bKi*{hnaG+KL-D*xUwa3%LG=XI^J%3fH(O!znp(p*O5~;PKQ~iMP@~Ty_Qes9)>0?y^S?D39;R)6f`btgVpQZ zSj~(+WR_=B8>x<4#mOQKdM*D*@IM&pX<3X;EZq$5$fczsY8@EHF`~b5Q~*ME7N+T1 zrFV%@Rh5H3ZsVi)JX=>o^F}5eaH3JUr*neY5E-3dkJP@i`p~n&xR?d64RjV#X!FMJ zQ+wIa3upaebx+hfLXCF~`h<^Q?y2hre4RL%tp@5)O}z$Hbqkw!twBFcaWh0j7_7CX z_c~ff8^&!lE+3RwvKgFK!l`ljAP6+`0&bx)lV@aTNhgTZiWEB)ns5mpnq*1%RG0AP zs!p7}#l6!eVYCy>)Kf?~E1Q~5a73#yia0{q0BWZhdX#Xgtt}GnvdT~;vYswBwOf?M zl@WZhheoIiP|YSreF+*3NJZIvQfv*B1-Di~-2>;9on=>-h4VFo?yC%$>lI!!GiOi6 z{o0AcH)DHjuB-_vxEknsfrE0P^6J7&+~otx-hK6O_f^C~tt68~2Jjb4WJr>TQxXOg zU_(q3#^T<6^=R&^Wnb0D_8GVn-fljUM*?qsx_!WXOqFyaFC;RisN)`K68mvV5;yUJ zfCVx0pS`kV?9#*cVIgE|jv;?8s_7n}ZpX`IFzwuJWN?HkOqQH!*2o|*r?BT|Uo(YG zHA;|ck4M{+Py{#&2W?fYgLcxOG6P#X*wz_qR94BVan;p=v`46U1=~mo#hCUQAZv~< z&B3Z^pp-^2*|eA&nRE=-s<~(i6Z^O7(JL%Y#QS*~$nPnmAp?QxF}M)d7uf3;_O!1* z&f6UxVqqG)EDeb8;)F0?g@ng3C5azLG7S=zMnR8<4*WQ8^FcfoDCC9Pb4<80q>;x+ zO7S?)ivoZ`iNH{?G>KWt(lqU%&;fExylR3zmcURGj{mWk%&hL-9zfB#QS7K4MN6=# zgBQlIS!9!uuH~@NZI;(@SWY_9dg{zQBDH%DV8~1waMclzG34dgVa}vM8L-JC4g%0r zj17+-ILJk%AyKHAtAa2kfpj%8HoR+4Ew#e!Wc*TOO>N1;H|4BoyilypYVJpl*US-?1n$*_kGd@}E=P@P0*Oom;7sH3F%F-3pZpl;m}nAztZqyojWG` zueryC(%TTO1ulza+2bZ;YeRR?r{%U~)oKc4OaR14^dcwPT#R4L zJ7M6wo8sGl&N7q6XM4tWNLICOr)gng(bkP|N14yY(3|dn0!;rLM!5U&a=O-!#R@vz zi;iAbr{X@cdJAFq&VBhoHkXY?ndrfkkKhS{?R7NDhIoNdkj7>86hI&PztF}a;(EfX zil7Nb#+CVa19w>D-+2F35YGZp0E<10OqY&J|`&YHD6rO`O=0}|lf(bBSPc)0BJ+Q9xMhuln zsfQS(SUQ7W-hOgW(5%SOeEL=VL(8f2p-^C4y?FiWhnJ{=r^jLh#SENRo%COfl0@_7 zmX<+9fQY|cF9uN>N*H`%XTwWOKdu-1<`!(Ldpg1IYuUW$3?mp9ok4!NPP}5Lw#7q2 z1f$eVeCCrFsScPB0f~ixb;6a2qH!9y)a@PhhXeuX9Xb;?EtlJ(KKcZ}{xMp5PiVY* zl>Z=U4XEv{X_1?L$ecT)SO_ya+u3l!FeX?0u0DLb@c^5-41}4?T z1jeM!s=BF)TMO$<)14FvkI+*EphOB*(E;+_DUte@Od)Y5wG6nVO(>7XNKL7zt*DouuMclBUm}mK3Yf3e> zM$(!>s_b8|MdugddTLtgx$y(n&FT^+adq>Z(L1{oxBQ`9epWhdJX*UVU0~Ss#k!tY zUqv%o=ILLz$U}cmb3I+27(Wb)m5=_xzw*@&D)_JXIxK|-E;hJ*!ylToq6{x{bmSqR~0_JXBB2&fK_gDP*Mn`0H8B4!Tf;x2!60H=5i882MJ^2Gb{8`7(HWyUkdf<>C=My1RC8G8lux1{ zO?;io06u=0QF3d&OJ>SsGCyDFI?BgcK7;-1*Zf?TTATHBz&t;s;rtKlI^t(zq03)W zqqk=kiS9y*yp~fwo~*U%e0Sg`P2T2%#`pFczOQw;(2j?nA<-c9v`!-u2A%@bTqZDVsMa~DycF5g5YpP#SLU9%$&=Ko z6MiTFE0mj(+MjDVD-FY#wl!mmVXwoCR(q^b*+@DJ!5g&vd{(spZV(k2k>vxGF>9XL zh3G!)v%t^N0nKYb#=F6^*IzYeCY@9oF8dAd@jj!<`9<&cg^TYbf zx8Lkj>b%0K0rnFYjkMYMySE?eJI6`oOiKAR=}|63pqkNH*MTN<_9MK zr!LNXa8blv9)cOv-4;=-Sr*qrip@vtC?G{NNa*&iP?0hk28mA?!zd*w1mT>)+aPvXlz2M! zdq{DJna{uRyeh_ziYn$+_Q0YC7KZ>V%63NH3r{Tne2*|9mV%|B7mz5z)f6+7xTf%z zN<5(xl}1AKFyfG4#O5P*B%TR3-kyBU^E}N(#7Ph-%*u0J6xj4gpk3&`zzgBa9!9VO zhY=r3vn=ijM@-t%dmzyRiN^;L_53?fByl5|hxTQl0x7_}RRLk18Jq=qJ9w3T% zqet2V5BC^7N(@wu(CjBZGZg-Y+zvShxI(t!1 z5%Z0mKzj@|3StT!%*Bi!ccz7z!I?w z-`ab6U@VH;$D%w|EXw8&=8<4Ex`TrwKx3Q>}lm?ozltnRn_B>2s zbbxY{Z*y6wI>h{qu3zI~X5-3VLti4j+_us5HDZ%c98wrHa82ii?+EHv+PpIMd0VRy z249ZEmn|QY6{O7O@jSbMwd7U`5SXz-zQ50RYT)B1NeYLhVn8p|~(Mlh2hggJqfBP0$ACDj{AHbvX*Cp9 z6EbTe&ueD{#g@?eaq(3f1qGBXxXMN-(BR}nR$V(;I@dc;sDFv55}i#|kN=)1{;Ma} z8b_fa5y9zYXPnU};Mr(a>UPfU(RHZfAfhTr2@Dq{ER-He(jX*B5-aT~U#leOvlI_V zaO-YfN3$d~rt0pLwvL6^@d<#s%^%8R0d@ZNZbPkwh&2sK0N9SO6cBODV?{jSdlBG0 zN)_!vU37pcY?T##`d}$9R+%`q0(f=lT~ZA|1)`WCv%m@^LDeDGsDYerFD4|{a*xjKRk#1({jflC;Nzu>=wgo&3hNtuqBI06S>FWl1$_dHqTxA`-A zEXWTt;I>45Dv07ldLfZX91#}Kgz&_d#N`Q1m2gAusb`P;;sZP|{#fC-DkmFHiW2&LY9vf~WfoKC8m6?P^RHQ1wx$7jFqYkoFw?+XR(~5IQz7j73kUwr4uE&b-_ab=n@I4$;7-G9g2^n)kBbQa$>*zfD5{zJXg?`X{9e$0Eb zVf#4KjhEu1F&nneES9Mo`5qWqajGR@5%UPAzK^VNu1{mFqd@j%!vRJCoZC#A^GiJ% z+0fE8r(XB78=64S_HZ925ON@lu8|}eoxJD&=ls*#4>mTlgUdN$_elvDe58lkfl~RX zHV-BU#b>zz=M6m@%E)UlG;B1dVMNA2QFJq#dYlSx#+F*Q1+n;$XL-|t3BvZu5bXE9 z;-?o40MikRut5P$Jn?d9fTdQJW7V)KPl_uTE}R>NS9y<4V%PH&ixlw_84;F-3E`ga z!7J2`j=0aIIszxLe;d^Mh+98AnEBGC`EZoy?-}IV~p14FP=^=BBByj|AFN(s5dZ`;Iw+{$l2N)3WN)-UJe$M^@tB|vP zQNAC#v$QLfbA`-S`LI5N$2)LR69{kItxXIjpG^ylh_~=>#Ai7!1$dNi8w9w`e%QmW z$A(`xT7aOYmuD|N|M2?k^JjosLzn<{KEsP|arpA{XERLjk1PuT8`hJu=|O*gaCnYdiVl+;DXM)ci{hvuk%~ zkg*;OJ`x(-{5d@qH0W;60OYx;aD6UF6iP-Imo7<|rbM7<1k)-}LHgX$V0?%Q2X&SY zdRNAi>5hX18duA$!2qv1k(@Rrz$AUQ7vrgVaRqRTE1S1%BRv~FAajz=o1CHFe|x`S zw7@IO0D|qQB~K zMBuVWgejG=_w20}KR!IGr3ox}U0zS7#jB6+obyRhq==mVn2n$lxWIgkYv;x5Ki(31 zTcJxG;=G=fU-gfCG_ivCZi&onz|R;CD4?yhL>r% zRwh5r0A2jJQ!?5V_%Zx+9tAyj=$|wu9Mr=n6U{AyJ35Zxeyhd^o7%jY6KAA{U~i4F zVEc6RPW|r_Qvue>*G%aW43buFoYb?Eyqc+OO5h2pEsrtSHE?6_+yA@p*!;h}#yf{W z5J{MoDuHc_i8v-;`)VRXD*V(Jfs%gDvU+%8zu{emh0@NsU1)YF_!}Mvu%u5Q_;usw z@>qanxIM7+eNT9)_DPt!0b$e=Bne_h0-m_37R;6E*;8P};Q;HlFU# z*I}R~?0i1D1_I%dIQ101@|l-VC6|H(dRTe@u+*dR9f?`pg&Yq(zg_PkNei0s1QPR( z>7e5&4}9 z%7^N|s;#6S#?`lKbWi4vd(pSe3*3mnZEk7UmR3ER+rilm^Pzn%)_{mZo@zHDu1aFU zB0naA28zTgVquUbL7Mh_zJ~+{y*pC({_Fg`b8Z%xCa-jterl+`_ftO-4BY(DJQ^4n zZO`o%a_t6DLL%-#=f$BHA8eK24 z^BV8B1}tcjwR+x#13-0M_Jr=>uETd5kTZ1i?dGv0O_E`~z<>UHeqH_f>z^U}{CPZ< z%SnUXUrqJc_d37YBjEF?U^1c!Nj<>`qiINZA{0rbPJHQUo`&922Yl?-q`j7We^!qL0s7n1I0&BwLQqD+5M8M%7DTAf zB{5GFjRKc5;Xivv;6bwc0vrI?X1EiT4IHTHb74(Gd$tY&ZGsOTOx}f>sXWV(6t`P$ zs?CXh9SeXiL80fg4hH0L=Zn6^V)^UO51!&>@)RHng?X^TG%S zD-zZQ)!MLyiDeOh=9HcKkj+a^q2Q%dIpp_+Wm*;R0^0;&$y8}#S#!J$OSf?qJ^uVY zF{)@4oY5QUyzCtp`3-bld@9NU%#S8oL1oos#IGwDZFxBlVHoBxm72HkM3{8X=6z9p zXi2t9|hl2fvRoc#vta`OEW1qi&?6ZSx@^Xfl&JY`0c93iA2Q`!0x@W63V+0Zz&%qoo8nB}u-#(N5pM=*PE z<2Nr}EV7HhV}T|}OILgYcild16RkuL`6;1kB47gyDTyUbh>WBk`$Ett_4+XAJ`B1K zgYLtik1!1S37mdxzCs_1i4txvQX-;6uqYN#Fn0-K+yfIO62w;?3t0qJMEbd(enhT& zcqYo?;VrgkOR7Rx(DWF?jlm+Ycj)B$${7{X((09sb~XIJDgZ3PvQs&#$h8S(Zew8J z@+`*!05jMF6a0wR=8JJq7h|6FA)(-2;r~f^Jc~ z99Cy9%qf_`{il}P68=#y_Xy`H=LwA|CoJ(`vyd)q7J`N(4TL6skVwK*5RxQ;zc`HpCbi3i zpY#y!0KLqA6eGAH=lqhxLt+Rhoi}=(%8}+E|kx<*_Pv)_pwrG3Q#{HOv5tOZYk^*Xzf+VR3 zh|dF+x}nSc)|35wQJd!1`G_ol-I?e(x@9ub`SBnV@dr%|AV z^!AA^d%WTN@IK3D-|p6`-FT#q1Z{XbNOPAgVM>Q7QLYc2r&5k0Zwb8hSi+@_x#-ab zJwSD`-)#(;$(M*wQh{DXXxgQY#C~P=zdqo5`=?H$$Fh z|1w9T2JKw6?Y7xd*l5el)JUgxfyYEkjLCHHK|=95XBGFhc{XUuP| z);I~TE};u2Fj7cpG{XF{I=2j&Q=QImVoK5434nmt?2lL}%FtbM>;eg0Q!Wm#>6f~O z)MPd_(W#SJIVmda>aqcm`}t>_O-wf!&wUJ_D!?N%oB6Zm?{TQ(&z-hG;HSN zsO}y-2)`^U)BW)Dp-Xf_RQ!8`e(Tv$cRn^=US6<+ ziV`J-;oCa+6`u?2m?=ywSiE3qFn!<{VLwj>R#kurS{R9-2vgM(MTtCy_z z^@{bkLfB1ZgfsfWu7NN!F0ex{a3Wl2Ssf&fUMcE6c=+n-YEW-X16iC7XPMHcIzPo~ z>vv!g;W_;2q|{;t<3`3K0_%D;xSWnhKWxbf=Cep7G$COaq=a!UiAZ!z!q`W_SkGs! z+~ZmLV?yV8qFpq5Zi~{-WVKs~BAtv}($tdEyX#g&9>Zi(iTc3q)?8jR!po5-sr>=6~yav4T#W?9! zexE^4H!51zXEH8u;Q(+lnvHXdk^p&R`IqKr_#6+~XQcUI{pH(l_Ca-C;p_l#$A!&_ z(a!n1w;$@8H>$f6*kUcVZ&4zYf|%iv#0o;U+TODU;B^Q?d^88Sn7DLi9_@}F&CZFl z`d;l9_VoZ82n!z{;3{_3x@T>O-I5p1OvelJp%Fl+i!dKtR5O7^T%>SIi@)9DQLpE^ zzEm#Fo~mt z8nSi;u!|w(q@*E{n#x$mzR<$$k;4H7ZM|vy7tpxrvOPK}q$_lg`jlvjD{!n8;oOZ0 ztipa6Cy8Ql+B+!@1#E0ST1Nvm!tIYYyh!*mN{EN93FcEy0A#pCc|jr=ho05X{&*v# z@gW~?d@Rj+xF>WmX-n@9IC@0!_=uvOe+PHMaig!oi$gz6wICvmBEpzbVEgibB)(1) zCL+&W%69L472o%aW8?8U68I3u+j9%KZWM>i_lTQ@9>9mxBSJ}!DC(vnBH`x? zA3XOd`6?a@PW0Z29$OqTwm3L<#f^wVCfbj6$cUdZNtj4c;E=_{)gk4ft2s@1k2ns< zVX^Ue9Sh<}=nj&qbr^(P5Sl>0F)vJrV4+Kd)*h9S>$_6*h{HQP#PO#V&Z`cI`1w44 zr6Kb^bAIn;j(pJYQf-VmUOA;kstA*&aRs$@smn_}ot4NA%N^zhm}ERDka)wUF*TVZ zmDOWfx>jk43zta~sdHj2#HgziTJoBH-TC>`r;pCq+(45$#Ydy!3a(CTlmd0zS@-OcPJ7d~uWI7;le%QAyiMEbWHv1%|FmgN zhmqku8Iyk}Q>00<3&qpNRG4%!Xda0HJlfM)bzvyn*%E!ty>eG{KDf%hWD`IU+|an- zyHk8JF0i~ULqY((TCYEqMDRE!S_dxm5*~7$_Mm5ndEKu*eptdg>p;-DV33VR z>S*8&+Zyg9ItoMTM?^9n09JGZ5(lwIq{m{#W64slKcDe}Ckl5y{(An&`K{g(-_-Ep z0f5Jpb6?csx2Wf2=dj1lq2?=;!r=?xr^h-y);WBvn1EG@+@86Ws%$LjXdXkJOO>p~T(Z@1q%yMWlV=d0GRC zOejgB6rf}%d=a{SDE()jO%o>G;nLfDG-?6l^<_3vfO)KMyt>RL+wdPZ!g;M=b~(!} zSI2ytcC1c8gI)BT{}|=%+MRgJD_mSG>s`xuT;ZlS?C_-ESwXL*{bZ?+Yt0HvP-m9Y ze_ta?SB>FS!;O5C(v{mT^vJ6V76BZ3tTQ> zQE7bR5=Irj$1Qamx?IA0Y{2jD?(UYQLb`2V?Hc69$>8l)P3v_2?M?eoeVDw>hjU5w zdF5-GHYtix_4V#P@7}_4AyZy`xnJ9si@9}1HN{@-xLmZ0?lo0ksH^eX5#HmGsgDf2 zO2x!YFhQ5cK8a&VNk9Y2W0$2q75fFvy*l|8>g0)kJMnn4G5lPh+hLi^XVW`d5GGIj zo_zd~$j3K-NRLJ`W~(g1xu@%5RspEH=s0fp=#09N>!r#iQ5;f2spdp*<&!8#G3HSQ z@bQBzsoU#avau$UTKhqNy+A_j1=DGqf6%ZZx2@;d*$;*xqr|_Z#)4cI;!+VZ<3vlLHy`Wz%-ufJZEH zY1saWZX0lR?*R{zK@o@sI(ZWdtm*GLvU^kceSGga+l)vk%3;veAg21_Rf5 z@qtTN6^rWfe;Jy247ZfdujkHxfhBiA*+ux$98~B(wfN6$dK&oAzz>}l|M~N$5ARQ` z=K6nV`K5U2yoU91tWRTi;12vGhAA8R&N)wcnbns)WCq={2CJh_MvjVNi!O3I#(tufMsAa~C$);|CC5`Ji7nnd00AjM@0KG28Y!840+k}8kby^qBv5#VZmxspwC~4Iqb~C@!`sEW2bsjrB^;5~f_IGU z7aV`ji1bb?bE=Y~wBl(?`2$dBAni>T0oAk}KTPE6k>0KVD4_(~r3(Ivtc#^(6ovJ? zY2IBr?mmdZqE_;}1?D}FQAKCr{))TV|K+^$iL3JtXzf$Gu43ZAU0!d`_xP^-ZPIvg z^MLOoKk@Lre6LdrskZf-C^&dm_9=q7`8!S}flaZa@1)n!YK5{%oclNu8~1&-79*N~ z|22n3_Z1xDPU57=hI#8p2RrE)kt1Gk-S|4=yfe<`;XB55;G@9Syhjh@7N;msX6fh` zwoYDWc^R#?UfrZqQ&QWjZ6QioOaSeWYfQlH$_x#@^^_(o#*^AY)@BV{SD9uo#1A^kq?qmb9=}d@28%->YlyS_q=UP4TIu`l8NZHNGu-t? zte&(1O8eg!q#IrFsuW#?-kg2TQoHOOX9?|)wmv!Tw$IzwtmpmV_?P?rQ_-PQJR95BXsQiX+2wW$d$V<0%kD)M z)2X`uzWzXLTl|oYOopi{E-uy_^jSB$R6}V(K_e#4ndyR9XZ>Fl_VL&2wW|~_MI+yG z%rkzQWzTkoh#L;sy()9_YF<-D@v?Q|G77i-j=mO|l6r8}?#C!X>vagPA*`*-A5M?M ziQkVYon2bG1=6fZZmOdT@MYgm603)lt}cq1a~Go;Oz*qX>mhJe^BOwPQ#vZsGnJUJ zU+y$Ey2NUKCRBY0bZlw88t=A(!z`_b0uCz&+BwK(z6L-sjaFv%d=%p(+bb?}*r9Ca1s#Y5n9rntJ%Poe>Vz3mC+ zmNGB-QCmOYfokp)Bp8v!Q>KmAqK40yTyi?UfIM#;x@UUQ(l{qY$)bUS8V#(BeZ?X+ z5vmpW6y{RW;mJWaKN8yCu40AEyW_1RSDRd!mNH;hmEPL_{0^tz;Q+-NK9;E(*@yYS zG2mb5HaJl%UI!N>PU=l}`l?fAR@!o-diOfQHL5(-lImPDoU@xpJLjrS{H%NzUwy1`Xml)5ro{B z2K1`SkQv+G1#usTy$yDi+M*FakG<&n)mwjq*oB`M!%u(2Rsu@pTx=B{;EiBKPVk%6 z*`y*AZKS{D?YiV3iBA_7pUbb?^V?Zb6GsBiQ$ieh5*Sj{RUAXk=0I{(`)_dU(yMNJ z@(KH^gaw)Xs)Cb8PO^wn%Dd|k%b16z$IJ_U{Hp8{O|G6+-?BY#PU`XtfTi5aN8{ZUaPim#k-Kb|GWw=z?k4Aj!fGGS`Nc*)nul+|tPZcrp z@)Cd1i>Q_?wyC4tmW%*FB>Bx3?4WaIhJM3!8iXQnxNQWHt`>6QCgL(rPOds=&Jl({ z!D=Yw%>x8^`%*P=y)u1AGI^J%)@XCDTIBxCRZH~3iafW??XG*JH1DI+_6T)&&qCGz z3N*|`V_B1X*mjVv1A>qsAbqzmoTa2a3zmd-Q0$F|wFrVjvT)kwh=gPWyCUvnvC%eP z${o>vkC-1~UuH+L`JhyHA8DjcI)a=clA0dm?l4rVy0o*(1*kt7_)|@@85XIHM zP#^9P%#cD{Kbgu2LQ=rq4@qHAFAdr6ok&`Suay4CU4U$Ciw2rUGq^+L{KIf%R8jtD zn-H9%cP!&FWLP#Z{;lE`InvGg>MdHy@{u_|E-{dF-Ti@RIRDl3vR6Ut)kK_M){qY@ zd^x}*XI3NE;eqLR(vcV%TJdt;GZQfb99Z> zzdM>BG+z$={h0dtlE3`Bv};(*PKXMG2HeSEztCs|_{SrK`r%taJoC9;Av zmEv-bT)mTje0YTbm82cH5(q86OS*|)U4>c4ZpHsB35 zbw3ZkgLJrFyEWXt&SBn%3j1W-&f>!0WW7_kgN5v*38#_*IzZCYKFQupDMVRvkV11x zksP&2TXZKF@EPda)pTb+^(+Grl=xs-X2{knyCt7QYr{9AfiZJ9e6a$Q$WTTn?1irn*ex!gHz#Ym zdN_@n*yVD#T4rE07^FzWArVlbDvtnKJMtH8Q;;mq0Mq5L4IAlzL0Ldz%^Vwyhz}br zI3?5ZBAAT`vsbvGLg?qK|1jNZVBT+?}ag z-|zk5KFIM)Pphp0Gj}BFDJW8LhK6l?N9Ai(*|q z(HgsaQJ!CwYf8_`8Jm47C%GeiMmfPaOT$c>9gW%{wy=?8lXS{w=Saco-xh?T`61o` z$7%nn*&=i;bf>fSY|CQhS-_|#0mcx1m7WRA^SSN8ke~5`r0SV|ozBajVxrXU+P^|R zAsWo3^Kskx_K$pzY1LE<a*t1jek-Mb6^m1^VBdcIlB4yq|9^>>V)Aq;yn30 z=)_22Pm4i-Tu$2Uxc=B{!6u^Tp$7gweP@v0DZ?GBuO(fmozqHb&GWQ7OEzZLIyw*5 z74Ri5%8HI(*A4VaOsl_((wv-P7HGQ(G?}j;XyO|)fZcrhxm<{tHJB!pt77!mvj*fQ zFG)$fum4D<&xT#ntWrP{+mho+Yu(e&Qh|_?*{*nUNa$~gj}6xc;RwWVvFjhP zZ)er}cT}zgvEj2WHEgg&jN!${Ty?q4I(6H6224#J^acUgTp1Nfn+sS2Q6@h~iS@H}g5Qtrf9#Ja}l;8zRb$N58ADA}_7vV9eQ zPBun*N7g)3?b{m%sa*_Ubl5i!<(j>?W{EcDF0i}mO2#e_$$C>P`fxb1fCh!C)d*V_ z4D34VTP#h6$f1}y2Y_YvScDROqZEL}*(P+v(sHY;U880P#&i0W9r9{9~-X zAJT2?pDbe|0Y(QDF6Rn4Yd(8{csPETv{)H!uKn1%Yxd)F0`VJyUwAAD1XWD(+~jK4 zoc7&The^E()|Dhsk`ae%^jIH%udk!;IkUQ3gg>Kt+c1AbS6%#bOL<_*E6Me)2VBDk z(a`nH1zX~}B2aDy{b^vpV=o~X3KFHC5Ow+8>3J_3s%Xo%ArNwKLsxVIA5T69c0ez< zCY;@`7}Fxs!^d62Z#S~(FT4OQI2T~RutsJCiC|-6L zDXfUxrMywakRTQplVBAZD2eO_g6`RG6;g|9PQLDG&BlL|0-SmGDW^}Ga8}doR|fqo zcyzR)16ODFTv7sI3$VR?mE@kq;?*@dBCtiUb6L@qb3x_JhhkYAV$j(rIYfmdO=5U^ zJ_`l?CqbSc`!1Z3@udizF87XBBA*U`;=>KcwK_KyqLp(prSFpOzBx+@2EltuB~7cI$hw<{R#7Z00J z6EGOrORsVNk1@=$I8sW^&6;#U}Dw#Wa-b6}p;;%Df%;d#ljvewjDm z1^jTBU?YYdR1Q{imT>zNXKJ6CKNLPbjzR$Vpx^K%*);xzd?tH?P()sP^cxOXQ91{qL2}#IhYr2Ft;FgfPebh(EWUll^5trF$mZg+`+okV2dU27N0*}>L3Ue5 zm-ToKbF2}NZ7e+Tc)Q$z_y-s-iJ)*UaT1|U@$Gefm$i}tZA}(+q*V~RQY_J{QgH~z zNZPSubi`#s_+1rx#ildCs3~m7Jmv|n0J2DJw_z&Cbh?2Qgugg;j!|#!I8F+Uy^;~q zU-U#NH2O7_3U8q@64V#+LHMdm*-(REaXlGl0`m;3Ca1o?<=}>m{%EC^*W$pNZ(Jxm zYWcS0c0T?tPiYL+MMd@+CPvO0$(#(O{6F!?8MO`bO>?)F($qo@%uL3W`j7YO2?}mI zU1yxpy@O{4t=I{M&a{oDa{8CZZ`IES?IjWmc)*I?npr;@=tWgmL|GCE3LzkOiwU~H z*os_H^N7~_QtTNVjeH7m^a*dnv5D*mJY=bcdgVE8XaUvvPPzenD|zKU4&+U2WBAJT z%+k1NfZjZypLm1ZyrO3R8qNn5I@X=ICvb^~CZf&YXY&=O*u0;OraVMH_s=eA2;nctuh`iM1H6?S!q zH5RHvkIdL}GGL9iD6D-(riu)^cV3a(eWBp+B+(WL-%>sIYUaF34xprGd&o>$Pw7>q zCJ8JiB^f!v;Pt|n!HU%*VD43@n3ZR)%q}ZP(Qf{M3=J439rM%r-_htam~=OJEGcHU z%x(!6R#H~Q&6=>3q@DR27wO@f6j&~Jy0Cb(E(RD}_I>L7!S?XbhXW}pE1P<Q2N z+nV&T`__#xwTwqLv!_Ohn4|Pt!ct!4QnpJjgw z>wcw`HhFku*W1FbcEv~7>Yx*cVn&aT6@X!X#eu<5@w5Hgd%sU0EN^vbX&=|K0{|Jz zCpK@Oc{n-eM^~K4+P5`Da<_B6(X+B*4Kbli2eGC^J}nuC`s5Zz{J#=JDAUPE^od|V zOEht3? z>f%fy{$gP804bwUPSM00Pe!ujR!H$0AVG5+$mAw}(JMF9qYGO0{O*&WBd;!14x%>>rGCR{vZmb(;yHo+$%_>1M9p~J5OG{NCYrNLRRG`|G zSP4El0+kd;g~pbY1g9cjnG4fT*UcF!SbNsOfQOM4%z)qj`&z@yvnk?6Ri3~fmEg$L zJCYEU(@V{C&n{6SbFpy#sA7p|V`;8rgV8CNGjCG+z+M?4ZyKL0yFaGPVQj@EV`Z;+ z!;Hx}Q|a2;yBLLte+KYS+*!k9jun?vAUdrLt63bOUvd4W)d{ZVk2(Bi^qEnzQsqd+Wu z&Jftm4CDSRL@F$()pvenmjt(+jv#JygUflm=$`~6!Yj{c34tq8q4zQLpdnjuTtb@T zBsZSee~%$MaCd;2|Bwz})iC>6r9fU>$mvu2fx5RxSozYCK^U?KXVuvCQll1CO3Ib} zC_ZuN)M%2^GjH(Zst>(YDqseR!HB~}j=ko~h8%1jwNI6#SOkT~x2$h$c>&)v-ZS;trO4nfU#-i9VBfQw^HsVk9RU^GCbtVtclHOu^h!$pU+8 zM{gOklIBIBYyyX6H5D})JM{whVT>vfQ7=oouv*n6?8kG##XR6HRYZ;WI#4D>^SM(7 z?iB^CEZtHwU^YeEDM7bZW}~$fdF>2;`3=+EXrgs&(g;UPh0468)nz5M6s;pkb;d7^ z>aC~uHz@b9i^R}r=sBn4RAlAt#$5Cf87#lC1ut6PCi51m$S~CE<%~A(y!xaFOOq`S z_8kiS#ak0UB3gA-EbnOb#O`r@w^pBFH0h~O!XwPZZp_$(AU zw1A;qV1YjPaMS-XTso*+70Gz8_zb!v-`!m{VHr~Nzeuysy&-dHN(+!F$S^G#qMx6p3QGuK*h?ELZ=RxQGX9B|+FOY06bmY=H- zdn)m3tW|ZpXkA?r>*vf>$_7*Ej+Vz0D4^Swc754{tVSW&!?Br1?SsolX5nis1uu%&G-=$4!vRME+DKR2ICE`Kl=kLGVd$N|ht2-Sy0mUw zg5x^urC*gC=y;_M-ON9qgjOzHhtI#Lws0EPMPPi1i>nN}!Id*L;kaqmo{8X08GRwueePfk0~gkHmTl5$o+OBtzpN z4P^VjIRGURzJeq|kfV*(&iM3_ale_)g}d4E*l;Qdz%l`}tv zBrN$~9nBxlQB`l+PS6p{B7!dHDba)z)?4DsVxx^ReU_jy0On~dP0)au*`@TFjt|sp z6)*LS6(AYQ;YFValuuH49Y_p+b-l&wsfdIm)cEl%_@g;VfLv!+zF%if-`PZs?JAZz{|M>WAyao4m93l4V zPQ1=H@JDX`50QidvN`(ngtL$~D(99{`(YB0t^7flt+1iH;1!flm3sDkFyecFD*@m9 z2TBXw8l)1wUARy8yo>q4raz{VGjf~`vX>wdojAK2F5E>is6<4M*Baz@b4rlA_2vuu z`e|BZ&+$`Er959sAmSqu?I|D_*4F{o?E?CcdZqmhQ^8xW3Nn8&)~&iYy_iA?2X}96)x8HRC&H0r zfWQU(4V!{3w{+Y6j(prJ`Sk6<`h0ku85+GbxzzV!d~UjMw8&BvI2Mo<=phjGT*<7Wd~$;m6hj*L_F^IzAUmn z&ZS<+?a!g%o6xdv=p@ti1}I^G4)Qze9zbt6SW+P3DQC$|2oZt zAYV0=me3qrqlIvll6}7W)f915~wH}a! z06k<=rv9gsU3>L4?O~^$vvRu-`g0?Gc?jIddw0oqt+TU@$)NfuY}Bz2HL+WMV<&<0 zM~nUmbno!jA8liNIlR!8IaQFZoawmM>|vExcdP{>{wf_@}JKsVw!dS zQ>3F--NN#1{`jdxSX#b5`D0*a^{6{&2N3`7RlJ(E$dR?BVC+hFekKSaR zck$d5+K68Hqm@aYDlh}bijc38WQT)adV}_T)XSHh-$UA`{=_!D@ulSVdh!?cImdX9 zcZH?yaS^5s>DX^;?}_gJH^Yj1R!OkT~$ z2C8$@q|G6gX8SpP+>5RaP$qXp@_AopY+&#FDTV{>AoGgV84%l5h@&ii8FBNV0 zp`aAw=kNYbmdJj4SxnXymsLqDSZ&Jz`#F1o)4R%;wc4CV%FIjGS$;tB4WfMkPPtjM z&=!&l4LHKP=Q%;*(`SuPQrpwZy(Nv^>*WKmZ?KFCta|uM8l4k}y*AaYu5__N=vzgq znUBJb+aK-76*<1b%%wx40O-F?m#AKKM-H7PzpeSjFBfWB*uPeHmS#_XWb+ri(C&->LG@2IKv& zc-$jpBoPY%>r1IMFyK1wf1ayIwW+o1AJAAHT5R8z1^(T8(cSw;+2hXM_bsd*TZKnLsOq?YyQBXm#Uj}Jyta`mQu^P`=4FbB}sTg z5CW$-{(r8keAI)R3e*ET>JYHNA%AE|??2$fh=<{TKT;9)#C+23gGzSw$YA#frPey; zw{p8b);_7I89K7bpwmVpvAHSvW;p7Ol?jo~kXF^sG2ds3r~vtYevj|~a^L_F^#56d zxww?v1M|q1U7-{%6zVO)viP|HI17VcEW`$ocYQof{h8)pwiA2s<8^r$rBd`uhA zpnPe1O()KRQKi{~k?Nk+YVU%w>aB9~mMcG+OO?-2aYpMZ^bi$op*yX437)vHXM<3t zoMXbD9s2MPH?H_5zj9@-Zan9HXMKspRr+KI`$VjMzw0mg-_Z^=+hJ5CVCH*()>Fgtabo;RjZqW}WVx zI35WDqqUwniap~_{qZ?KYZMHkeW0;20ti?+$%`7Pbe?=Q>y0fIjTn)$Pr>+-1MIWv zY_dHkgXzm@%Z4>RJ(E8oRkiXP^_AV~OBtytk*J!{k6>X6v0b<+qk=DwxFbA951Pri5$ee?& z<);t}_mFh$xG)s;-=8D+B9`}H3}CH%;@oq9`|3WjSJ8uY?(a%E9xO0hVQzfl;qCMU z05nHL$gPNWX)MwXBHexP5A7%tGkLB*v;I=NWcZs#fafLg^el$wCkE-uF_C5=t8jB< z@;AXuRva0YGb3)e2~Ik>6+Bw=-@2{jm93-rhURgD2uYLDf0Z`=_33{R&?=t^rms@t zl-QQ#FjSFXXep$i(Xx^GO7H&0At#m+J$H=ZWXunw*E*9wW^PdfTVTf_Z(nqO zO+X>@a8iz&f-3*3LLB0*VBcb6<{$voX(XXH`&-VUyV=rN7n3pjZ}!WrB;EOAr0RqA zKj?#qleJS%i=3f;lacsGJ1LIeY;xCNTrj|%fw(uNV&eEPF-4ma7O8;#qw)Crt2M{3 zE$Q2*Dr)l&^9?-A2KS|&B~wBpfMB`+`ralL30=OqB}$x;?RlFWOJ2TvDzl7a(b(u%XT_7MkxBLyl9c%{8CMcyAwSO2WdxhHul?P3f6Y*l!< z#pdCxU^GamAnE4tXG0MdFiI^ND)*& z-sarHfU&bfl|0v;FqdgDGk*>(Ay&@Wl=H6grM^Nud0_|nay673dLY~@juG}!aSx`4 zLr;Rx!uBjZf8pajiE)ire0Mn}Z*s4?%~h-v*W7gMSv(hyUueW)%FDyMn8#E(@^Ud_ zOlu>icOj)XeXz^O$mdOZfQ(e^an$qx6U0*T`Cm|`wU~~oav-)4)C&-0kj-`axGh{C z|Cj&QyOB50`Rc;X`c9*NE^Br~%5%}Nb7dLhEpR#|aP}xJ1}LyPgF_v}1D9ZlM%4%3 zqT>3aZdfwSSi~Z}J*D>OJq=A+Zv(yp%rvPAY*A9mMmp=l;)*RFyMc*$QAD-+B_UcR+mljsEjWLKD&e|G31GfWN~ zQ8|34Sf(fd1{H(mM9ZRC{?}qjEQCbve4X}tR!rDDIr?AiwWZh5{y>ZsA>4=Y$$m>RJCQD+!RNx z551ibyXCq2g$DK?psUv3Qc3lAx)~T+>I@~ZnfRaB0g@G=SBU7sGGgZte5UNdFO(L^ zs1#H0%=paO=2Z%5i&U1Ynzo~rrZp-59xMzL00j~jHvGsf`b7^1Ws(30u=mCSB%o~B zYhs22_0l;%1w!T%@8v{Kk?n!_SL*p^Bki)S<4-I6{=<3J%6xQBe-yA@Q@2+CCErN` zyxz0E;ag`lkUNUwYydCpkOVi-6Ba<39C-`Q_(gco@xeE!B^!3UZEQJ?0)-D{#)j)Dl;Df za)%e!k-|d@#OL3Z?5Hu%tyR&^{aN82;dD|# zHpm-LQjrfKVvM&1E|K)bSK<&0N(k^TEjK6L&2XerjkGnEWtdC)3*P+)R}D0D#xMUc zpF`~dOT%92ylGwUeT-W>74jzTAlmBJmLSb!qPKvkwJ;PRuOVF2R@^HfZHRe-&8h^P zR`x$inK7fB>l{xSI;ZFuGf^;BPL9fndAj*(sh8nz6QU{(B+e(W?o&TR+$v_xGbaqo zDBf^c;FJv<60w%fuf02u5plVpu~jZU2`sh$XkWuxMzhY9ju$c;1V~H75B4FMpq#Wr z@5hpnyk=l?4j{&11>q{Q(tV;=s>@ujf0xV4Tz_qtQK$}Na#kyRYSRgclql#zMEbv= z@61vG7e!VN!-@t}&q8WD$nE8H6bQ{y{uiKQD?JJrk|mIx*v2iJ#;g045jk8C#V^i# zn(T-RT|;BGeB*M*d#9AfZP)S2eGpS{%hfU<@F;Lk61qNve+TKb8k|XxXV3v9vEZ9zPEK85bV~Q7TI@ z=JD;Uf==vE&)e}PtXHiCSZyjx#9J`?Fi>$>`d0m4(S3B9Fy9m4Ya(7VH zOL)ka1OgYmx9&1{_0YL&i+kCjhUf=-FhI2baq9K(iTz*R{P6$Jo0oO%OZ}fW|MGu% z^BdgwV>wuAcpnLKJi-5kU~j%cKm(6NVscaX00u`gZ_Vg42Y_a*LvDeSVFU7OtiHug z?8GsfEVbhc(zrH>74*i=eJ3|nrHMyj>eY3ZVyxlzwO%&`iY~=OKFVJF znIj=|Ypoy&6hOR3NFnq>H(3RnvtD>;yXhLI6&)q;7bD>V>5tK_M%gJ>)9`c6W_2~K zj&VoAY>XX{Y8iMAUg0&_jxtD=q*wWxU_n7WoEr4A0sSB5(XssUD+^ z#R}^9DAbI|_+4#SHR4NRn2eej@%LL}a`3{v(&6L(T>1)9vBlD&9=MB|CQ%LsnrJ0T z{;x6*mLWpUPkj7R=TZo_{fFQo>!p7ir4R=~MJG|2__bF{m8?dG$&zLba9TAnlV(tlJ9;Npmge?KZd}3?xyhX+&-IG9 z*0^fQCM~XAmX+4rs@Raeb#t;+Ecob(O?qV@R3mKQ#e>BG(!C}Y#)V@ z5jI|Li)_(={+ml*Yd2E*9vgq_nMi>Ps4Ae|5^lZG*C>FKLQg42lc# zxI_i!E6`w-K@ns@Z*b9Dv2&-OdABpJH_ISB_7)I=2TbE+H(fg6JU_A~#2r2RN3;e< z2=0F}NC^(2td4Ng!O?<-p%_<*<4S9d(MkI~K3Zm$pF-RC7iD{Kvtd5b;K!8pe$ zvdA^g{*xSSi%S@ESVi6+*N=1g-%ILZ6gy-v~_B7?={>f zUxir+`j{pGVwBjoN@Nb!o}pfg`U?u6h5$J3GOppPfd8;o0YB9gB)4R82T=*tBL&Yw zFdl%eKhBWv+YILu*cT-!Po2bwkHTydR@we4VCU#v{m&{-!fOcHzZbSt&BS4ZaxoHd z8b%^t)OSEDuB72UR2&zr(-7gZC(?E9(t^$qXC8SpN`7S?>dgDbL!>8sNSx;1BIfjZ zd`n?VB5X5wAgd>2$P9>-+6~*SNW%GGRj+C%i1TpZn8!62HUG>hQv?v$YO!eSc9Ku( zE{CR86`+^jOsfNrnKdYOjV~4A*${H$H{tosb@LQ>ro;b{PDi*KfEA#z#2nJMq0<61 z?mK?BIc*n}?gvfzmTh7ytv6dRB(&ikS|m{%23=TJGMm}Je9T#VIw$xp+^b8%2TFw43sh(WW}@1e4(24Q5&sU-G(j0|uTf z1(h^qDJ)tA=CN*WLEU@|%J~vV{QF*7rGiMZX8D@Ec|I59^lB3k-|~`QTd0Ytwwq(G zywjiVp_QfX-(SyAT0(mBN$Y>DIdmJmA;+vM+_xKDU0gPQ%IgU9u6n3W7BS%_GKnA= z;b>y24K@^LDQVo~Hy3nKnLpHu(p{uRF~B0pP{|RT?L;N(*~i@9{?%o|P>6jWk|qDG z4w9k{I9(SvubpdR!#7Zh){p5`4LJ6wC5iI#d*1+n-bfH#$Ew>@HT<|g`$l#+&7{(= zU_QgOU9zSh5Z}^?)Y`=9)<4 z=Pt>P2o{C2i@1)6pOGFs5G7D&2G2PMgL3yu1ra21IV0HdMLmut0k{+q+VMG7H1OY@ zlB5;~Y?=>~ux6i-nhVqCvmD=10fi`{ry8bOe6}lhf?N64cDqF%wm4d9mhZ}tu4DFy zk~awXuXxrK&i!PY#b_6Poj3Vs^*4Gh#3QT@WlI} zD>6r2)hf5?-nk;T} zbR^d=qVi)SP+ zOR4gW5WN0I7_cuNa9c`SuqB$727q3q54j}#+P^nDy2bn9zBFI2VXFE4N%=-WT9>Tr zX%PzF_n7#pnEo2&M&v5Ja$bW4+h~ZvaPEL3vZFY6s$f3AN^_;CfYa(K-MN$>!0LD8 z_tJ9ZYis`Xu*0lA57C`)@X?@II+)T6e2YK*m?C>pFiSY~7>tEZx-it|HE1A~IQUTZ z{PUQNt-T7WzX{%t{(;y|dC6pzWlr-1Npk-vD&7|_fk*IOMDYIKgucW7Fw^5E474DX zZ0~=R2nsl5mB?l%YQ3cA+sp2%eH{{Vw1f1Svuk=QXJ1cpRe+ECKH7b2U*~|I>P8#_+jXFn43uHGD%pPB*aHsCS?vKuHd#4dtTzRc%a+aq2NaM z;gm&ppTHYNG`cS!WzjxHGQYGrA0&y#NfK+H#rr}JnruOm@TD6|5FNb4Nr^99MiScw zS&ZAE2xJ&>{=++$M9~iOrK`NzDo0WAO->}+&rsA-#-xg|eQsLPC00Qgr%5o8`x}2O zS2CtAk)$I5`WQLV`)2?Wa>z`!MU|wah(GI@lV*Y1LI*cVq*_-pb zt5wpbBB)329EA30C>kqE4yNLct z}x`jB)E=!y-T%}Tr&Z}0FS|_T{nB}^<)(%pz4BIuC zo8dtce582S*`*Z&|C%0AH?lspgTI`o3#qS+%M*^mSkw9|nY+!`+m70HA_WPFNyi62@Mbu+;T@n-9GE&&Ip2j`91c_*cQ|wI^{;V0F9&pY0^T zDX}`C4%^lk0jN$Lt+^@#0zZZx!m;}FBx=aJ9x>T zX?4xnL}K<`MO1B)@~wTncNEiY`d(N-hOP}GqG)ZM{eNd)-hI@37W$4u{saGB;9jDDE$W zgjk4jmCR~hqM^pTj^EVkV5d!tMw`=;irpahRd7({f6fXt z`Di2w_^_TU#EFJX`E{0;S);x>>?g6VZdqD4O+0zV+B zXGea>121vyJ+XJaY<1WA6SXgJDB9enCEUoRk_JTB3BVy4#w7L=_z3Wb$<+6}_=k@J zkNq8lLuY5dSO@CY*e_fj3-##U7seanDYNxiuK0&%nglA zf?E|SOmDYkq`qFo`qTPZEoX*C_92xqGgombmw2Oywn=SAN>1r@Q#P&><;#W(9Q%YFB5AJF%BEK)iMm-5 zdIU9SM{z?rB+^_t&SCtP(irO`e~tOI?he$81@zvx157BjXRU=}0F z_5{nCMLU86tf+Aoj~i}8z+SwQ`oeX)3DGy_sxTiF3Czdz$0g_8$(u(RcfAc+Q`eRkJ+> zv;PtTuHyUV{ew}qd^F0IEtwPIC!TcI`KH9?E3B;>&baHmfEmAcr@uF-Z>yPho;s0z z@__m1oyNM>>6`)BBtKJ*V0?92ip^F4G-W@GO5XR=p_nl22el~cU(EXwaOZ5!rkA>m zg~AO9PZJ4)mjr~m0VjdWBG-%3*k?a{+Q>NE!GOE7k6%u2ih5hnn%vZu=odgN)b;gs zB<&tj#;01-X{f*=io6~54IRq+LWcyw=NaJbPE=L|(UoFVUid0es8?%g#Bw#dVJ1kZ z))H(wFSw@d&~_#jKGjoqP}b^emem`n4$bQTti%IF|D}Jwk!&3S1SYBA{UyLdZBDs-GwZ@y9;boc92K?^b{nqgVUBm zL;vw*j*J$l&T3Dz*N=BKd{``8(4=SsI<-`*{&D)LN33U@;g+Q?e4$YxnjKxq;teH5 zHmWQ5qpa#=ldFkhaJ(!t%z9zkwZ2?-wq&Hmo**B1_Aja1KQm*ev-dPNlMjLLH3j4d z{}OP9sNSlxzs$>VW~f@|C5TkG3eY|8ZUc2*f~4CSr*C)=JZz-?QYyLx<;%HHUz#4N z5yo__0B%OsPg3QnT|C0Z7*9qy18Grd_ABH!IqXSk3&9jKCxN64TNI;rV6rqjOOI4W z(W)SENiX@UvA|an9!aAe;P7W*WO(fZ+O>(H&q7vk^ezQyV@2X8m=IN8D^%Z*G6%`= z`$>)9hr7Fv!`I)T zdxOI_58I9-+lxIG5I2?#^J%7p#xx|9JARnjF6Ge>)`QfNyUNYdGD^Q)T#MG*a*AN- z(|6)PEV{f$EyC>G*_P0aQv@g)Xf0E>Eqi<(D*J(nBRy;_CItWKTTJ@Kk{*}e&+02W zo#l#V5pklXjRP#mFKQjb1ZU@kCZCx>YbGkwlCn%-mid`1>ZQC)u&L&nTahYfMd(@U zyI4yt6N&PwK+<;2O{fCWXY^V0Kn7S|N!Ef@JtDtjD-DZ{wkN@A6W1+Ej`G3n zEGVV{wV}N0N`3q3tQ}_r+HG-jq^{{1p8CV6p3Msbpw|>^eurLkOneGpmz>W5CL1=jb(x1X;L@T)Te|Kg>&@@dAq{4rt3ww7Cpk6^jzPz zeWApJZoZwYq-5V0O=a^#}~4g6SiFX+I#Yp42CSe) zc~V{}7^ncT#${Ikd*D7sXkpZln!OlnH7K}-^9L^JDQ)0LsoVH4^BW!6qTB0?ypiLy zwBah?epb%rIjwF4-nYT!S2wW;etGskJ^(!UXPb9vo+C10S+2m@+DYm=jeRLK$$2l% z4bj+*>a_AigTzV-6NRLHs%RB;PybVQ1z86W^Ng%6Y#ylubSzJ!;IE35mo;3$Mz>r8 z2&yU-rv6^%bJClzrsU-v1xa*#%{#8&!*(xNDoWC zd_}M#rPlkz5Etaff4tHQY+#ZKb;@t^~I2|B>_XL4`g z?dCCxkw`qjf`GWb5XAQaWO_xV!MSWhEcd0uE^bhqQn{dRo9G zXJ;I_iOgpRm@ir=p24qf zm3~JHM%D=`X_Y4P*4r7^Jn$+&N#&`TmUyxN#L4H=LSrr2sdn*iMPk`)q4tO7%XeQ5 zfyf(NJOB|X)2!^$I(z@_qxH6pB}4t?SZWEO! z5fdTe1ameggvD-3QrAnogvXH^CIfKTLB(B5l=yr=0VIA?>3|IeZ1BX`z;NF01R!wZ z&`VRv2umXnuF%54A{vmylWF3!$hEz200g@O2-cskeE|fnzcC>2BN|2tcL0d{6@HRB4iO@>iEjrUp?;hafCFI&XKM&J;fF^B{tmjYe>6_W&!;9ZH4cbi zKm<>W2$0F`oWt6x(TVEW4G58U2R87S7rRkp6PYrk3raE8M+%Y#(x!IcusC^~L&78* zPX=7DWn8fSZ0$>iS9^26U+xM!Z~;ZhAcn!C5#T8rGN_7%sbG<9+j77KJ7_-m2i~8U z+?9&*$~q}$*KkSZQpdSx)cQwVzdD2?>Z?-gdY*trBMJ!otxZ9WVhuj{aLcj1@|$WzJ<{&U_-yV zr1jP^57@!evYYx3rJH+SOfr@=)|vLZ|15cVd2?T_+rK`=slP8t=A7?Gar&(er0eg| zy#aF0=0MKl%F&kiNg{~P1CJ!BZIgrr5l`b#a{9xQI7NZ8gQ*70?fSms4SGIR&#k%# zrO%-Bd19r{1!ld=&+CcIb6yI$6CNT-V#i)gDWM4*oPO#_!aUAMC`1|su`gsI2M>|m z(fO=DUwZ=;g3b9J1rL&dapF4&6@oY+jKvqj! zF`~Wp6Bn%eb6PjE?n9lme~RL3`)9g%nn_$!i%(wxVL&s?=Tb0^)F$ocs#o6EtL$I2 z68P~c6Q;wN>?hQLBgsvPFKr*hwjdxLjS?2~Byhv%h3DwA-TM<~K z+Z3a}9Dwm64bw<+<_%#>LGbb%k$(U9{$vYINLSO04-QC!1JXJUNVxRA)%gh5(i8e0 z37&8#jeH^~hvO}l9$|iz63L=Oz|j_`K{WUu?VSISV?Ti5eg;9LJMXrK+Ux{MP{0%_>rr5A@baF)wMjO7m7A^-mns$cgn_v%4iK;B69BHuXF>hd!)b6lL5m$ zJBC|AVoTG0%j&m*vJmOHdwD=c+3fhhu}A8EM=`>BCvrzls6IQcdXV6QSU(A$P+=Fi zlu{Nk!UBgA-*>3ax8-|r#5^i#9EXF#Zg&)Rb{yOf_CA|cyfvH$H4ZrMnQ-3vyK!%D z-saxrws1HAJt#O$Y~l++35&v*xJkrZKM;VJlL6=LAbr5;BKw;Hc7Ipix7J7Pn+5;r zBCj`rdYGF{B`4L+y_RwP(#dJt93Kn2u0e9BVgpDx1MH#ci+ic+Q1>RMvu52Syo0Hn-f4WX_$7tl39=c>qENOb^1l3-e$25B!8_V=a7my^5ny`4EU#kII-Z z!PHb$O+XN-TQfksYh)o9EXH1 zW@HwrO=9WWggaguxDoe*MEvlWG~B_6#}6eYf;}_aP*`7RjS5JWTen^thQ6`tuA~M_ zGRd%1LN4?hEINhZwQ?M+anoe=WH~ePa=xxZJX?=2`*96zRk^?bK4yRk<+_OU!vaSx zH?(f^9=D0*1R&R9+-3tddAL%Q9S$AfR0zhaK~K4xwq}@HHK}*ln~6?ihhUWG`Bs0T zAcFs`@!v;h>feiB9xZ-(1iySjRV7V1mjM+d41^@U6fTJaCnSNi6Hj=QCkY+k;#$he zC&r3);N6cEm(SPjsVoC;0Ef?{vRr>x?hQQLLPj;_r?KaGBozrGJ{KNIWD<~wr4i@0 z6WYErz{7a=;NhD#-DVfk^0Ue(taH$wmTj)7C&+MoCTRr+fX>Q`$!yzO93H_1T@`W**U`HXT^tpZ;9NOZnWr#lS|!ybZf5gF>0wP4Sxozy=So|K z$&eQv(H&S5>ApdznqRj7R*F_Ps=O-;lL#8xS+|LTDF*LWm|z*Iga$PeYb7urcZ1cc%LZ9&1 zrNp;gPT&IaK_Yhp&l5q+q%&}V>`bzlwP$NzP=Xt6juKMtiXe;#6R`_}XA2U$VMsXj zc|yI!al(Nh%-un+{xjz`Z73HnOxjUvQT{5+ zb2MNXJq2dH0+BtZ^8yb8G`{Hu0VL252QU2RzJzhMMl;$>jt~BLb#na2AE!no^Rt@9 zgRgP;`j0=z;1CT{yAqjK5grpA0SZR_V z@$z6c+bOe|?|(x;r(u(a-c7SwIagV~OL|ej>e`+m&G+}ikml~bA#MGAx;JQWbDdEH zgJ#>2M{I`yl%{ShW~i{iN|b77b&Q>)|cYAZ$)82ZcK{OuwvfYx=%Gj-1^dX9P~X=TkOSv^4v+J<@# zAoAt8NWt2|A`~(!&3d@$DD};JZ?x)2-DtzA^5QNkIF>cN3`94$;ou~hH(9>miW7Ix z#;N6hKZ~5G$Ff;`Py^R7%$1cAnN~2)rHg9DNHzyE(0)ea9}dX3k<%HAYrj9)4B6_k zar=2%Pa3-T@U`xKS+EA)?rJV%|4*m)cRlHU=)VHns&4LL%A3LF?fx#WU<0CBuX}Q} zDE7~GDYTz4jHdf=rFyxFf3K3`-k-Fd_CD2@yk7cPnJ8qW5#o!#dft2ZSpmTQTEegM zY|+dAzrAm5ZW~wA{Jy_})$?JJDZ>Ft@Rq$)xt;W!%(T;HKb(6 zr)vNEzApe$l&sj1B{{OpnL24p;spdi;CXM)Gp#vJq4wkTWyMEbgF3Pz{CjZ%Jq}l3 z800KYB28k+GT5`FCMnG`k|i<=qD)C1=%Ms@kGKM}`?C3PFYLC$6Kw0{NG~};H=>-$ z!oeJQBy(i_xARcUk#O@;WUxgeds(9XC#b#s%VfXKN=`!qG12bk#A7V zoFOpT#15Gw8^L_H^*u`O)|TIz$PrS7K4!%BzqqSpGx77YvN z>Q@#;5y12&1Jza!)997F5xOQC4DD(RT}}983h?#&Q{lcTc*U8Peu&Y%C`#a;K#(*O zoM`5UA_%l%BHgXv)qoM##fZs0TByq_>4tzX8I(^StKmY)W(VKck9(9INnznYaW3|t@~zhxJ!^{B!kUei`C4H#IjK%&JSqiS4C zD^u)iOD|w+M`Io_hMHmC1-9jqBL#J@q4+G5YK#ZYD=BPqx~J?_RE#n65%V+PLPb>% z3^Y4spb@;eG}FZREUhn_PdMx{#tC?R?fyeBX>qGuG!xY6Yo;X^#}-TSi&rpdh?yC$ zHpGcR=%-1nVKr5L4*$dv@=(pdT|7CIEqKDjkz`$osA4 zveZZ3*^T*#TRMQh=|!!Z|14pP$3S+o(9UD;jk_8GH&fBd%MqO8jd5$lTv}Ds(4O)J z@am*O3Y(=zJ#wmfHzsi+uQe=XV?2J!>kB=#9!k5BqEoY~jgRtz7g$nLOs%iegzw?& z)=vs8HuHI1K>M?n9Q9co6JmuGI@qkX0BCXvxVDB{)<|h`WXpCxV<3XKe} z3UrUGim^nZaH)@>V{Nk}jLMO{sl7qdG70IgvYaWnT#@6nfB{m+-g!0BaMx;vB`H@$ zU5!U(0^x(%E`e*ByPNj^@!`GUc(KFVdLM0XVeTq45zjJwmF;WX@-^+ClYxnnG)uwO1e(nGD)8?rN-?Sk7Fp~+3QWC|m=`x>6!Xv3jp3)#pRg52= zz6Ig?cUcgQ+{}#PX*HhKRkvvq5K2-H|iwV*Pl93SpID5i* zobI(K)_+M4#G=T2wy{N#25C$wV?@eW6GjuvGgk@GzD%VIm=^rmCrGFJNRIyT%?Izr zN9)#oqnj_&YJzF3(@Iu=-?wjLv~YXb*61=4@P1D35Zg9gZS5SJAN%r#E!Sl$#*I0z zMFXd|_}}`jON72=_d#YLdu(nz&~tX7$}pf~BbrNqovLRWc<-hgSuMpB8@vS8ZaDFDVEI_%UVoz$QrQ;l#gpKxr;6d7l=!36C!g$vt z7w&UrfiqL)C?3g|jD69+DMI^}$I0B;3@CJg9$&zQ1e=I4QS5nWI3C#}u<;i#XRi4T zd?oM&!plKl{Czf>bS8{@rcSPX^|N6Acg7CV?!%Er=)E)8?3{B~!x2O)$V@r3gK$<8 z%+;P-Z7y2kdd7g?*~HjGM!*xA17lhI0~O>Qx9L3kVUD&B0EQM`uy=!ghkbz!dE8;+ zxhg$U^dlRDdBY3~f6hlmS#UF2ZeZr@TwaAMUT5$1)a`A%+hEdQUHv%gDh$)?&~2!1 zrgQ5k&azMiB#AN!@C^3XEM<~pT4q9IjOHqO;_2LX8&L1u+J7SD>Ke?aXgj^NJD&Gp zCdxvRU$`{6-IGaqTax7mm{LcNJp<_7$y&I?)_i;UT0Y(N_^0=c|NN1>-*8JhDUC^G zlyO=hy2VM54)*jT+0*MU*oR_I2b+t^=2B8Yb4g?_Qo=%-5YBl@L@IJWQc1uf{p{`O zG~DZg;}2b-pLcGI;vKN{o^-UfEz70%_e#vuxw&nHO)j%%+QQ;inHD20o&+-&rU5`A z?6c;mvtTNb&lY`#uqGqb9n@--$ zVAu=Oq*bK2x0~Vo4QSaTo8^f+uRJ$ucnjIyUAO3=D|_ez#v5G1g_ z4}t_+KtY2f!A>O!G@~ktbJ$I(Mk;`qa4j_vT4!<0BH<^&0E+e=6s+1}ooSoZqTp5rch zZYbr>&DDY|Qgx_MH&N+?|Vhm&B0_PHkk=9|6xB*dsF5$~f zv_L;W!~4x$nZ(gTN`(%Z3Pnl{N z1D!dBm*(x2F+sLO@(}G>*7F_-_*-l47L`4t{SOjTc4wt#yD)oit#0%7#+?o0KGbb) zO!Tq-qI?i`LV8T;=9QZw4W!PK42-NOAT0JJ0lO+DL6U}CsZfVe^6c$|D0(u?ZyyaE z>n1!OXb8A;nHDuqtEy}knO-e<2YwN=HF)BLZWFWd`sfh^OTw(AnDcxy;SKsSvE*>7 zkr~#}d9)5$UJF=nd41ExUoG(nP7?rybNfXUV>oI}OX7T0AlN3*>NdZ;EWX$}#AENI zrMENMY4Cs;QTD*LKzTH4b}Ske*k@I(Ow$ad#b9eZo~`j>nW(rwdsm92Jebw)JMv-U z>^O+nvHS1$WZLe|sL2HlM5;oP_!|9exlaU_iUfY7f-v_J=;VRdc#k;i{N!#}`_awx z?Xi&f$rG?*4$p9XA|pN6Ef2C=)?arI#cuJVjqR3L1XPB8MB+Hl2up+{oP~n$K*nLD ze4(>vPf(b}bpPy@-(3=9Yg-^OVevg`irY_R9d{X-ZDShSm?LYjNK+u`%1Ct!5)kgs z#(XxttZG|pXHRO5Fkuyo?v9KG$DH8I8^IFG$3-);b%y}RCRL3WZSUJ>J2`S08mclt z@#-#P@B7cbDk>1phN{R zC5*)Yp#tg?9T34J-=5poU<>q@)iY__!ktC> zOoctd@ac*YTHfZ~-0Ax<^~i&u@Fny+8rY(mYuSu?51LRw02XeeynfE06Hl(SkJ z{*7_vA`Y^G9qY!uW-oW>6^%0)M1BqyWu#zhpWt2;&5R(!)i&!U->*hbI%0@&1f2CPqPv02C7&o^E%ZFHF*Avv0= zpsAJ&*g5j%Rpp)dwRe(Fk-SP^VYtm=$N`$5mk}@W&qzAlGzEBdkp1iYOGz9K^K95sVu z!c&@&ELM4-IF-I13}yGx{zqUx@abij%(#O%Y|pniM~~3lx?@D;Fz*1Im4LcRWzr(8 zxCF9tI*8c`$`u!vi(t;U6noLxjY6*-Z>oz{TCj$(VEDaugtB8JT5Nn((_RLrVG?k$ zO+yeY^jsj%JSXOS8ZuzO+LcLTwUoFO!pY;-v8J1))2tFmSxLt%i*ae_(`xEsr`%o` z9%qbHLVfzzj&irX(44H+P%SL$D_fQTSy%HWxGsK3)Yodax!&nTePQT}9A4_K$?bqk zSPiWExqE`y1kO?zT~}JnE-nBroA~;)u4eGAz!a=ZuI{%Z!APTDH{HDqzPDlR7JJ(f zvqR)s+x7OGyK3dA9eJXLX@qJks7u$_*neG_sXKu;t9d@82Jp0>TbpViG}vOanz4w7 zEYPsMxk_TD_fU_4>m&5E{%CiL*>3Gz0@~FnjkP{VT+d7mRR59|pSnj;Gb22_j7hBS zgYD(6E^1U+{o`jE-2UO7z>TBZ^BHzKw%yJS{H2>6R(fIj(m})C;apuU998AHJ$i~a z-<^IK6D&-VkdZLSLc(&ziBK#cQo|m^snBVj9e@Jy0a6*H+1-vwyV~O7(^WHm!s^ZK z`6ttC@J~LHe{%iT^iVX3{bXansG=ZGM5c+R3_1^miL*e4B*}dlW=WXwIDGbu=fNHV z#`hCkzS`aS`yG=@@X%hS=3^VFHY(tzwBp#aKNa&b0|ayLM|@&YUNbAEb_>6>y1*W{ zkPXos_P5DYgiBw;1pqisEr}=x_^7mZg~4H46@H6ZoX>Sgnj^0mqXsU14@ef3Sj;IV z(Z4-o-3oRTjv8Z-xtwF-9+Jg~byXJ^SedM?!>eoKVx4-Y;#9ZNPKyF)M}|MkT)dcb zlwzPAFz^%svnf#F<8d{EaX0Ewrak}HbpHRnT^*0rAS;UFEtS`P#Kk#`*7OjIJS8knB;jeS2#*sU zhDj=QlI#|_4gkjc$tQLZIyg7V{l1MUN0@w>FCrqXp5m`tH3j>}-0Sm%F z3<9Wo2w%?6|K`0g#+UYtR>+T5J;esKs;9TYfXC+NE$N=l40(?Y%SkD-2wO@CDNQ@r7ze!2&^ z_IawG2Ent{K8*9N5#H=7#%wJO~P-0-!RC6kohr5 zV4EN;3Vk9(7?C^-1^g0dslTjp&@l>KjouG$Y6(j!Ih60E6`I#j=&E+_Q#${ zIuSU4*gHMHdV3u=bxe-Te2zHsGCL()JCH|AoB0R!k0m69UWL09(yZgq2KchT4tE!A z>y2QLuB!6NrZIF?Tz2Wg5$nO!E+zvwvG0n%>ym9G0Z(_%e#e=L>=JF%plK>u7^OUS zsjf53q-ndz1v{|h5a*?R*dZpc7cqfwcS+YF%avwk4;B=l45fr8aZW_a{V0)n7Q_dT zbUpap_rvf0=<*BcUE}^Mtco=($Y<4+S@*V-ZJ+LV&;$QI{RQKybR6beOtKIB{U7nc z$1wO9?)NbSPr%2p_QrfLK8AR6M!{IiJPuRhi^L}^$pVt8kP^XCmh!~+eX0f@1KU3z z!yoTYy%&EJ^%M=Ixtic;g6aDgFK?#`KC%M>+jmFWBK|zY+%`>D#9myHt_V+};RLmi zvbdW}L^qBlK93ztoEBq~90*VK@y!Qw?MKQJ?8;q+G{M0oU|a&;|M>4-lv29-$Nz>u z`m~z~-;Sp~I1qa4#_I=bcNa^I5=x~=eWG&42#YyKTIPg=VUlEN9)((@haF3OvL21V z&%VpJwFcaltH|NzPr#+|=mstw4BR1zzI_9C{Z;y44BTW3l=&*j<2)uTkHNsz0VAo7 zIEjK-25FFndBC2%ft&52OwviqOgLvc?KA#-mrT+oWTzeRB}ZaFA}@=wqYDBf#d3=_ zm&L>x!V7YfYZ05CEwOmEF-3{ILU=0Jq4fg!K%cruH+{uLIJBr+OBBAnLC(x$?-vZ( zf90b|sga6Rj~B>8e?u!BOZMcZ~DO=^u4{jSN54fe?JhR*8ok-cMgis{dm@UwBYwW(!qIzCem=7;GQXLU9bW@TMe zXtw<}o0e7erQ-RrD;K~irUN*K1R!P zO?QE1Qf+&s9pGE!t#+eFlC{?Iu3+lAnYW7E^)B|-K|gdG+^lwjeU`UZzJZ!`lS(=& zf=qJ3h!R2(#zPd;Nj339kG79*Z$GIM;D$+d+0lj&D?tOyI9G8WQAE3bQFcoabC5Azu!$-nULFFDc4fh2E z(w1Bc6GV}BwVIF;*2&TwqACpBwBi6=GMxzq;c0lxw0*+k#gCoWy*=1vo)Y|@3lbgm zF}LA%N4Zk~lL!J_660J(Y5^pxF@P+9qIzsIJFSqrf%fB@_W2ygf_=jIquIxD0izir zbOcy&V%2fH`8SpHJc(UE`TUuEtNKr z^vLw^3UKA38*n*m8+C12N;7@ZAk0$3VZ7usOoh+W74O*qy*7bfnV-`jr#{KzEGNv5 z6O!g}OlXn@374TzDjT5J4})GGy7_-E`dWV^4+VWCo6ER|g8G@HIZ2}!psS>k2&JJ1 zQ%QYB1MahU@K0v@tHbnbbpd<*;|MU#9a#XnFvjZkd*dsa0my&@ov^%<1YOrf)X`2G zvP_#%veK_}T8-fV1Ahzz>F|-5)s1msdZ+*n*sR13>H&}uitbqndd!sQyEPFhH{xLq41S8I*T+qP!D^G)MwLvLs-H2^kX}N=|Y=3Imb)I+DSFF&+(L ztl%A8h8?SD)Yl%wgK_R`9{%JZ4@8hgLzKF%E^~!hgwzH{KxWQ`9{uef)1&x|iV>J66^LiVe zbwMJGELmA`%(gY`;x?$ZP#N5dDCN!(VJeJsOCEmYUDVZVf~dh2=Nv8Yn)lLFpQ#W} z82+f_%NNUXIz~*VCyvv8?{_LY7|?8gwLYVTlWmeD4!r%kot?{s=HDy&vpeQRSV?2X zVopM)W5U7+cBNcIBu{h7sK|M;Ot(HLf&Wk?@bn%f@DsNJ?m!7V9hATyOKE5Q*YZ%5 z!09IOzY(7_WU5OIyGMQVdhz2!P~p-Q7UAL4h8T47LDy$|atpBVDL=P$I;RHWEU!~P z@v95?k}kfWxGS#uw!o=N|I0Vlm7nye`NLG){K{`&rmwo=|6AId;W$LE-+Szio?_(- zWya_Ox_s(!^Jg)={8wH5Qs`2(ZJ>Q93WM~in(}hhkBy!pgu4YNo6G7N2JMdmolnI- z40JQS(PG`zFFLGCr+hL+PtS@eoW7?05cUIJn3YrZzBgy-whwu8W(C1J7V@=yDF}j> z&j8)V)7NL!KZ>&CucBk>y*R@Z>}l0p{#R2;R(kM-_uIMmAD&M?`|NZ4(xhkWKehPx zV)`lyljAV9kvClH^oaekQ+-VPa zW52VXyXWn7arf22YcAcS@^204J!9f$$6>NjLF?R;_<4q9T%S#Okj0L?d>v^Sa2isQ zgn=Z!uQ_s&#YE>BRaE+UnmvqG_U`*Gt%8%u-2ClZaqz0++W6b}9L!H`_TA%vvc6?# zT)n^Lr*O9~#spY;)4;eKP44g8hwMxDJmOkoobGsxlPuViF}{Qs_Ua{2aYe(}c5!jD7+}Qn zZMFD{gsH{Ly|dm;$3bU`!Q1lgqn7BvXe4%HX%fu(edS`cNAAiCR0;C{plA3C+FFb* z9c@1(6DK3`FQm5-JpI~n^xhn|uf#D*bz&|~0g%K+8xcK!_x8+t)7dQE1UY3af3D4$g0qTojzZ6d5@hEQ z%$PQtV*x!@7clMzKp$g={|h|lYxBPMB8_%VymrreI|K=@o%#%8oKHWS@9h!x=wo~Y zlg^Ke-)lEhZVYQHouncybOb3!E%2^tRTnRrM0K$EVO?1;Z)r#e9 zHB4B4ybcB?gqv$B0~*kRGNJ;Rp&&KDggi_DZRIRiROm2B2bi#jn#v~%UsGP+ct1M= zcz_0P+A^|TpoFeQjgP(CcOP)VfD?9%6L3m2pDj_MMGCtE0ZGC`8LFJ5S~9{EXGA1X zO420FqsUiU@0yu@00HZOfc3}gU_ij;)#`qh`b;GWiG=W>^K$6MER&cG&P0$!GGqe? z$o5baspY17#GT*Wa@g*N?S9AGy`#mt*C)^gvUkVn8c?(?C2S`u4GH5sB4AVo#LqLH zYQfUTXS?Kd9k9SUSYZ9pIv6alxp+Yu_+jp&WI>)_+OHoF&Vzu&0I9N6iX=$YfCboI z#|_T-xR}f=Z{DL}gKyk_015+8*fCI;R$uh^^QbrJ_5m|UDs+^GKG8OMtraY!G$mOq z!Whge#nODh4Eur^)*r2d!3^ofm>~}0FjEQin++o5Dd9m1f5}h;L6T6F1p{V?o@i?2 zhu_XWc^_T+-5Zz6_<-a}bDi(aunfBl%cHHQSlT(%{siY-^MypqA+K`CtK9#*%Fs+T zcZ3QI1Cuz5BG*I^VnN&aFy(ft7QGrIuwM!HZRLyNzNk4QxfNS zLRg>@B4Wu&5^A1Fffylq?g$|X<2^(ONCJttprvMeYu3$QtBYn6;<%Pl7X20yZ_!=f zuFGY0;WblOKO3ZuE1Ef>ze1rOlrS=kN$3`^B1`UyctL%I3d7w3Zn*lvPOPgN+{X2| z0brr8P=5&}p2wa1^E0J?`{7&pnv`sP#WG9scCD|bNG#Zq#I?Wj`l5L)%Ug_clj<6V z>r$8BIK|9*Vx~IG^xbj5sW9|~&=_VGjIfOPB&9qeX^>DQl0b{tf9f1?(VZM{(3x0H z{`QJDt2IR*!UPxXm0m-1jh-R6l;p&#%lOahXctT913;Zep& zm`lb2mWCn|1E@>)57hn5g!tMG_WOmVmO!1oOwGsEduFs)3_?5h>`zAB;g{de&pRbe zqtsx95MhVr<;_1(haNLIxXoDN!U{tmE`)xE7fVh%jRt#StB!eHDD7SGy3lYu0KfLA zrcFu0L?k1t-peaOg?QAGv~uOVRdZKfUex-U12!}=RTzg{FA?fJ1_H|#-CnlOKN~wW zd2STQ5df}eAl$#!jpntyJobKX3=ADtW6~XI%YKcUv+sahp^x%NmM2o_1{=DA0CPW_NkN|Hn&kmIP=t|AgK9kN)kvCXHR;O*P|UaLllO4MCS@O{GI-UtjjJ}#Qky%OOc zd9BMED{1xZCcv(5V>e_RR|z9J~Q~(oC<_-P2ikH&@#_LBI28*NV%(beg0LW>gmL%>{+E$B3o<5s zrqc&PgYT}GAM&Nv%$I^0a(BMer+Q}iM&7`1loi-g-tSWk_7_{soq|RTxl@mnJGK5h zdN9au^Mv?_b0pkK38%S2qDesnr8x;%n1wpaq!RksBfoeL-F7{asIznLw>&p_@t26H zTtd|*$gjsWB+WJFKDsLRazk}9o|ZS>6e*E#H9ae2T{VE^+O{mPD82Zzs@0MA0Snze zV14tE_x7vQ60=3-)r)Y{MJGR6*RKNlJewfU#7czkzF=icoS7Q->O>w?K~K(D%;$u@BhAt6I+TmLnoV4K<~&8g0B}SN4JJ*L+Bny-We;+%->N{FKmJgH z^2AF}3Oket+|6HVtEDFx+&TVI-&Dtqer0d)YQvfn%6!EX^GOyV4|=ErBDf!tC{8KQ zlSm6W)ST=^&B^*Bbtq^f*gSe4&@hX9#z-WYM!wsKa2+X<#F^Gfr*%9meF#VuXQN-Q%vyJ>x}kycV6u7Mak=g4@<*0zeZ77wi+IH|fo%+Y~2u zdi~u^X8e8DjCbft%Ht$TlOQLtN+ZH34~d9qKqOUx&VB0ZEEtIE_KmpCr}sqae?fD^ zERw6A>49D(I>hE5%Zs%Bi+L!xE~K0DnnZCZGbV_Pg(57=Gm;5EAz>6yDMf^uP6JCZ zeJUk2j-csrs)$QdA7arL3JO$hjc(zdqghc-{OvN2mICj{6R@(Xs;V1P9J9I-WhemI zSpi6MYZ48$AKR<_h_V>V2Eu5l{dl^yAKx>G2ZJ&;XDmr6%|n`|B%=u@d)8rmYBFWuv&_()&qiN7Z^0uUlgkHqY66RI|pjJM%mUNbV zE1bl$L@8e1z7RPQENAn}n2FVI*gw zH-?bHch5<{O2`naC%-XI!GcNLc+fFEt%!? zU(D|>7TNMgE~UCH{9Kvue{N=hNq%<6zq}=;B%AtsF4f%-FLosjUGU25!EnO=Pw%~A z|ANaGfca33AAW_h;otE{{e~`I;a6n&dwD-phHs=iRyqm?7P!%FHf zQaM#BB{T~ZVLS~26{Y=9!;V&J*xcSW0QdP8bN|_nMJVpe z{ckshzg5UTwd`HoBwR}mCF%bOglpG-Ne@MaB26~8mw1*XK~9OJX+l_-NRl!5M}~f; zq^2s4*mJj+(tzz@DRl+r$mTK>C!W1fkF*bLBNKzYrAuLt?8t9Sh8@QWft3MOOuhr# zs;X^@yjSD)*J#faDVjJe9AKb=`PqDJ@3|NT?%fyqtn!))ED2chT#6q$PnY=+*9_&( zukR@^L5U%6#G;2T*evw?W&)aaVVuGXY=w?o@f=zQ5T;*DV4}Ou@;vh3idVe8!KXv^ zpt4_^E^m$u5m8ka7dB1N)*F}s!y1U$w6cz2(>_-f(cysxYY)(&3>|x|h3Q;Zaxem* z1O561gVECppJ!eyKU5&>v;v_qvuhdInv_HG$2Myb1VG~Bx|)ou$+4_PuV#}A>!yHK zk0zxi<`rwmv?4h?>&}r@on>tJ_v`&iR>P zP^HGCcl@UQ=f*25>53jq8a!;d_Ws!L77U4-1ucxmU_m&eGz)^`uAYruEYzFu>E$)Q z>EF(1mf^W@$HI8)k!KO^$giqGJ-C(=8!F4fgkF0ZAYCbEF^1gRLTrefK$A%cxbSB!xg!OKe{Fgr=0UV+ z2a`)cu83hx9O1}jON`AQ2)1;S?id434Gz@nshpUXrq4QQet3~lYA7c&8d6*KYPT0lN=XeT zC4H6RA$}4Z`?2}#8=W>k!!J_%P5koP+?I=%aZH!rch$$C!%S2l!&D_iE1eJ~R8EA? zC}AwhXslxyG5YkKxW0dv6W3{vn^8Qq9Qxbw;rjlLeYor%AMRj-}V<>&KJtr=E zfD`v<827D|S*7XS<9-H9WI-;g3Hrdk-fXYXDoqc=b07XVYtt2v+-q;HzcL?)y_xy( z=AQd3l`*D?1%VG;7Gx3OX~>9_Jd`rbm1fUA(;WcQR()e1q%{(&H~IYm&)X%rJJ^0t9{^Tzwya*W{ekO?`W)@SC)dP>C}hN z%Bl=ZoIj~F_F+@?FQ$q{8j>I|_jqCb;d2%sn@Qlp47En{0#91@_?x@Ba$;@EiPsJS ztajWx0j8CHd23x++D1!Egq)ZKCW9G+SdTA^$p~H19sxTr7>`&YS6Q9x!S}vH-}}@} z`c1v;52(>fxF04eiHX#qA}rMb238db5|$)c%#&2or(WG3-w8dtHNiWPOVrMrB#p$o zHaO_rz;k)|-lDld_ut%D$$l_rbZ~3=&6dVG8OD0Z585oIwf;JMC^km0xzGYtsfv6N zl2pl%FrLLEO=$ooN3L=(F=Cpi!N!R9&&K%p=7aa*qgBs*qnj^N>nAbcqL&uE{=hI7 zwyq6S-D=CR`Pm_FdNgJzjdbsm>8lB?L&-P7F~3KI%5(LXz$CWw~v zQBfA$bmVOdsKPg_3kdb9YfSWEo^xdG+?jVS+}3t)*P^9rwZv*oSu4#(9DPGBdI9nec%K$}-HKYEk~y_TU6VJ7!)t&^VYemg=O+r>3qN z%pWzw_t6|}9|sI@ykPGJcw{S8`~^1taTng1kJu2o`*D%GFif*D7j+VwZ)gK?#7uC5|-Dw4p@Ni4#EFs>*Olx0N3GUYMnj3wE#ccoqoTrrNoK+}YOuV!SID73MWei&@FB zx*q)`hLxkf;N#*SriDjyPYh-^Tk9T-cwJn9sXj6>XG2}zB?v>$HdgUwu^CM({AmtY z3W_T*qsxk0%#Qpb*t8q`=GglapK9c&&rBg3%xrbjmf9Vm^9WmoIo!rGpi$WdJyi=$ z!n&`e78xHzdu2m2itS!8aEsa4u1RK2nM)h#Qehkh3Z4qb#kIqgy>XKhUiQ<9kzK#_ zQP_p)$R!Xj&M|Wed}SY1k8yo)N~pCP_|_eG+`HGn}ITSOO&~p zpVJ_xKFQ(?nbqQiqKkkQa?%!*LtUr>6Vuhq^b1NkA z69xZAXeKkTLJ~0HQii;_IgPZ464gm|JXf5?lAVv=_VHNF%0p}8qw%tb##4S+zue3XsQ$Ck$l{W448@9rAl~ABV3s9fe~f*r`@1A^(%&$jC(xiONv|@C1OO`P|xsK z@|0`8n+JiN(ql?DubNH+!Kg?>l29L6x>BE{dG3=ui(-v|cqQq8os#``fc=iat{yja zsjsYuW``cJdxP}j&aq@-ap<_wUjgp{@{*TF-pq#ijDFOZ&ufb@nY$Pj7{Z>fsw+KX zT*_(&C~wNY=*p$uPr6Rf9YMFdRX=9#PHm2Ry{5Zfb4^25QNt7JT8L3O!yS677{dnU zY?AWo>gVYt#_TZEeqo~X?Z}xR{FDS4M2Uzgn%>&0+aNcj$k$0)f38LRG zZM?PMW8*&L?&7dDR`m$G0|p1ja;aw9Gd?;P+q}4#)lR4D06bVW=m=f#*^IpvuNoXz zTXJ0aN$M*aMI@4OjQL+V$y6GUT+*CJDT9qW9UNDC@3>lj7!L(}`CFh!6+V@Dk`g7L z%UIxRl7>Db8B3+_Yc6z_JbUo9j})nAg{&*AG4p<&p?m4=_ySST`IOfV_jK}I)=jZK z5B<0k`NqiA*}1uq$tUwx-~GsI+S_{{s%u@J8wPoM)mF3fkHWO-^q;)8qQ)4&@L>V~ zqIM~f9q2N7PK*5VnAxW%Wp%R0lO5r^!=cCCyBr!W%+*~@tc$=kJ&w_0daHC1F6vxPM-~@Bj~eGC&WZh~4Lo=s zpnD5e`v70aMz(rLg^5wux)X%L_rcJ;8-=6?a>-A536mB!ud*yI3e+7KVyPgCjE9L!sIhh@B#res%KUop(N|DnoDh$E?IG zcu|z-h(l*SUa8dKgB{cr+>FGV(&to$y3)vH43`t@IP^O3m8NluV)lE4e%ba%nrLYf&k z_J1$DHUHwn$M+#jrM+{z z&TOyF+>Zxb`AE2O{rB=10KS)y&)Q);gN%*1`Jc8Q{wna-JE9B*VvzPhQXPPZJ=0=`}N9{g2M) zD)c44Dy*bc8#G5GaN7e5cfI9!ZT85;I`~3&%HjPjC+LDUyz_t7ok0AknABH|wwm*| z=)eE!q`yzitM9$Qz2|lNV%aZWZUK9KljQ6>d?(=nD9axp{0x%2;pZpE(D0^RMZDjq zXcHG(~*oaWS4{Tis;yL9sAd*Q26o)-7@# z{J%R&W$2IX!|`~>iQL{|9wvDG;;)}hU;p)&Ti^fs3vA^-fBQ3LfBiKYnM4UV-S8JL z9|bmP81#;MxjT<@=nEzjKO=b{7_5tVOn4>~$)(Oh8EBrzPrj^*-G%yk3Hx2H`j!A7 z+i``}eS(zj(z#-(+g_Q~p@>sH0RXuEyLvDHaC709C=DVJ3PH3Kk}w6GC#Z}`u7V)e z38yj~c!rX2f5jFK*`9d9(yHjh(>S`o#pL$R`ZrMdI-*@n{t7%_=PJh5U=;M zN=-?(BSt@JlSCc0;_n}S9U$J1gm?=>_*_t4n1-pQIwXD?QNr*a&U~K)I+c;&j0&DU zag=wUqGtZeJcir)R=;3Q`e`-UUOAJ$BAsD?dOLFXt^Ix;4Ak44SBddVhkh(b6#5CK zoeCnT3JA{tKc`A684OS_N%s%xeSn2)Y$SlrDrK>gV~@6qbcHME`5Cs7n-WL>vsYap|E)hCMQX$+p#;7r4n*a!zTbjD0 zajOOF5?lxV%pX#4gjoQu{cq-o+9w7~xVoC2PeomQnP-ryqM4NZ#!`2+Uyk_27^YJD z5#9(xD%F0jnlJ62jh{ zdg}O+hIa;+=Vbd^@*{>jjw$>1;L61%_!qZSZZDkdM^7M)^iUHDp5ovSrp1Fyi}jc0 ULoqGFCDyS252ti$R7;5k0Bqt4ng9R* diff --git a/x-pack/test/siem_cypress/es_archives/prebuilt_rules_loaded/mappings.json b/x-pack/test/siem_cypress/es_archives/prebuilt_rules_loaded/mappings.json index 99ef5863ba6c8..f4278c4d4318f 100644 --- a/x-pack/test/siem_cypress/es_archives/prebuilt_rules_loaded/mappings.json +++ b/x-pack/test/siem_cypress/es_archives/prebuilt_rules_loaded/mappings.json @@ -11,12 +11,13 @@ "migrationMappingPropertyHashes": { "action": "6e96ac5e648f57523879661ea72525b7", "action_task_params": "a9d49f184ee89641044be0ca2950fa3a", + "agent_actions": "ed270b46812f0fa1439366c428a2cf17", "agent_configs": "38abaf89513877745c359e7700c0c66a", "agent_events": "3231653fafe4ef3196fe3b32ab774bf2", - "agents": "75c0f4a11560dbc38b65e5e1d98fc9da", + "agents": "c3eeb7b9d97176f15f6d126370ab23c7", "alert": "7b44fba6773e37c806ce290ea9b7024e", "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd", - "apm-telemetry": "e8619030e08b671291af04c4603b4944", + "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2", "application_usage_totals": "c897e4310c5f24b07caaff3db53ae2c1", "application_usage_transactional": "965839e75f809fefe04f92dc4d99722a", "canvas-element": "7390014e1091044523666d97247392fc", @@ -29,7 +30,7 @@ "dashboard": "d00f614b29a80360e1190193fd333bab", "datasources": "d4bc0c252b2b5683ff21ea32d00acffc", "enrollment_api_keys": "28b91e20b105b6f928e2012600085d8f", - "epm-package": "75d12cd13c867fd713d7dfb27366bc20", + "epm-package": "0be91c6758421dd5d0f1a58e9e5bc7c3", "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e", "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1", "index-pattern": "66eccb05066c5a89924f48a9e9736499", @@ -50,6 +51,7 @@ "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4", "search": "181661168bbadd1eff5902361e2a0d5c", "server": "ec97f1c5da1a19609a60874e5af1100c", + "siem-detection-engine-rule-actions": "90eee2e4635260f4be0a1da8f5bc0aa0", "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0", "siem-ui-timeline": "ac8020190f5950dd3250b6499144e7fb", "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084", @@ -106,6 +108,25 @@ } } }, + "agent_actions": { + "properties": { + "agent_id": { + "type": "keyword" + }, + "created_at": { + "type": "date" + }, + "data": { + "type": "flattened" + }, + "sent_at": { + "type": "date" + }, + "type": { + "type": "keyword" + } + } + }, "agent_configs": { "properties": { "datasources": { @@ -179,26 +200,6 @@ "access_api_key_id": { "type": "keyword" }, - "actions": { - "properties": { - "created_at": { - "type": "date" - }, - "data": { - "type": "text" - }, - "id": { - "type": "keyword" - }, - "sent_at": { - "type": "date" - }, - "type": { - "type": "keyword" - } - }, - "type": "nested" - }, "active": { "type": "boolean" }, @@ -361,7 +362,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -371,23 +372,31 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } }, "language": { "properties": { + "composite": { + "ignore_above": 1024, + "type": "keyword" + }, "name": { - "ignore_above": 256, + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, "type": "keyword" } } @@ -395,15 +404,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -417,7 +426,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -427,15 +436,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -443,15 +452,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -459,15 +468,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -481,7 +490,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -491,15 +500,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -507,15 +516,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -523,15 +532,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -545,7 +554,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -555,15 +564,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -571,15 +580,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -587,15 +596,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -609,7 +618,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -619,15 +628,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -635,15 +644,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -651,15 +660,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -673,7 +682,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -683,15 +692,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -699,15 +708,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -715,15 +724,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -737,7 +746,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -747,15 +756,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -763,15 +772,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -779,15 +788,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -801,7 +810,7 @@ "agent": { "properties": { "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -811,15 +820,15 @@ "framework": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -827,15 +836,15 @@ "language": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -843,15 +852,15 @@ "runtime": { "properties": { "composite": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "name": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" }, "version": { - "ignore_above": 256, + "ignore_above": 1024, "type": "keyword" } } @@ -1565,15 +1574,6 @@ "properties": { "buildNum": { "type": "keyword" - }, - "dateFormat:tz": { - "fields": { - "keyword": { - "ignore_above": 256, - "type": "keyword" - } - }, - "type": "text" } } }, @@ -1750,6 +1750,9 @@ }, "type": "nested" }, + "internal": { + "type": "boolean" + }, "name": { "type": "keyword" }, @@ -2332,6 +2335,36 @@ } } }, + "siem-detection-engine-rule-actions": { + "properties": { + "actions": { + "properties": { + "action_type_id": { + "type": "keyword" + }, + "group": { + "type": "keyword" + }, + "id": { + "type": "keyword" + }, + "params": { + "dynamic": "true", + "type": "object" + } + } + }, + "alertThrottle": { + "type": "keyword" + }, + "ruleAlertId": { + "type": "keyword" + }, + "ruleThrottle": { + "type": "keyword" + } + } + }, "siem-detection-engine-rule-status": { "properties": { "alertId": { @@ -2708,9 +2741,6 @@ } } }, - "spaceId": { - "type": "keyword" - }, "telemetry": { "properties": { "allowChangingOptInStatus": { @@ -2931,2774 +2961,4 @@ } } } -} - -{ - "type": "index", - "value": { - "aliases": { - ".siem-signals-default": { - "is_write_index": true - } - }, - "index": ".siem-signals-default-000001", - "mappings": { - "dynamic": "false", - "properties": { - "@timestamp": { - "type": "date" - }, - "agent": { - "properties": { - "ephemeral_id": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "client": { - "properties": { - "address": { - "ignore_above": 1024, - "type": "keyword" - }, - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "bytes": { - "type": "long" - }, - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "ip": { - "type": "ip" - }, - "mac": { - "ignore_above": 1024, - "type": "keyword" - }, - "nat": { - "properties": { - "ip": { - "type": "ip" - }, - "port": { - "type": "long" - } - } - }, - "packets": { - "type": "long" - }, - "port": { - "type": "long" - }, - "registered_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "top_level_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "user": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "email": { - "ignore_above": 1024, - "type": "keyword" - }, - "full_name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "cloud": { - "properties": { - "account": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "availability_zone": { - "ignore_above": 1024, - "type": "keyword" - }, - "instance": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "machine": { - "properties": { - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "provider": { - "ignore_above": 1024, - "type": "keyword" - }, - "region": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "container": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "image": { - "properties": { - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "tag": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "labels": { - "type": "object" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "runtime": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "destination": { - "properties": { - "address": { - "ignore_above": 1024, - "type": "keyword" - }, - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "bytes": { - "type": "long" - }, - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "ip": { - "type": "ip" - }, - "mac": { - "ignore_above": 1024, - "type": "keyword" - }, - "nat": { - "properties": { - "ip": { - "type": "ip" - }, - "port": { - "type": "long" - } - } - }, - "packets": { - "type": "long" - }, - "port": { - "type": "long" - }, - "registered_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "top_level_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "user": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "email": { - "ignore_above": 1024, - "type": "keyword" - }, - "full_name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "dns": { - "properties": { - "answers": { - "properties": { - "class": { - "ignore_above": 1024, - "type": "keyword" - }, - "data": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "ttl": { - "type": "long" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "header_flags": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "op_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "question": { - "properties": { - "class": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "registered_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "subdomain": { - "ignore_above": 1024, - "type": "keyword" - }, - "top_level_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "resolved_ip": { - "type": "ip" - }, - "response_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "ecs": { - "properties": { - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "error": { - "properties": { - "code": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "message": { - "norms": false, - "type": "text" - }, - "stack_trace": { - "doc_values": false, - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "index": false, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "event": { - "properties": { - "action": { - "ignore_above": 1024, - "type": "keyword" - }, - "category": { - "ignore_above": 1024, - "type": "keyword" - }, - "code": { - "ignore_above": 1024, - "type": "keyword" - }, - "created": { - "type": "date" - }, - "dataset": { - "ignore_above": 1024, - "type": "keyword" - }, - "duration": { - "type": "long" - }, - "end": { - "type": "date" - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "ingested": { - "type": "date" - }, - "kind": { - "ignore_above": 1024, - "type": "keyword" - }, - "module": { - "ignore_above": 1024, - "type": "keyword" - }, - "original": { - "doc_values": false, - "ignore_above": 1024, - "index": false, - "type": "keyword" - }, - "outcome": { - "ignore_above": 1024, - "type": "keyword" - }, - "provider": { - "ignore_above": 1024, - "type": "keyword" - }, - "risk_score": { - "type": "float" - }, - "risk_score_norm": { - "type": "float" - }, - "sequence": { - "type": "long" - }, - "severity": { - "type": "long" - }, - "start": { - "type": "date" - }, - "timezone": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "file": { - "properties": { - "accessed": { - "type": "date" - }, - "attributes": { - "ignore_above": 1024, - "type": "keyword" - }, - "created": { - "type": "date" - }, - "ctime": { - "type": "date" - }, - "device": { - "ignore_above": 1024, - "type": "keyword" - }, - "directory": { - "ignore_above": 1024, - "type": "keyword" - }, - "drive_letter": { - "ignore_above": 1, - "type": "keyword" - }, - "extension": { - "ignore_above": 1024, - "type": "keyword" - }, - "gid": { - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "ignore_above": 1024, - "type": "keyword" - }, - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha512": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "inode": { - "ignore_above": 1024, - "type": "keyword" - }, - "mode": { - "ignore_above": 1024, - "type": "keyword" - }, - "mtime": { - "type": "date" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "owner": { - "ignore_above": 1024, - "type": "keyword" - }, - "path": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "size": { - "type": "long" - }, - "target_path": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "uid": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha512": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "host": { - "properties": { - "architecture": { - "ignore_above": 1024, - "type": "keyword" - }, - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hostname": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "ip": { - "type": "ip" - }, - "mac": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "os": { - "properties": { - "family": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "kernel": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "platform": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "uptime": { - "type": "long" - }, - "user": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "email": { - "ignore_above": 1024, - "type": "keyword" - }, - "full_name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "http": { - "properties": { - "request": { - "properties": { - "body": { - "properties": { - "bytes": { - "type": "long" - }, - "content": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "bytes": { - "type": "long" - }, - "method": { - "ignore_above": 1024, - "type": "keyword" - }, - "referrer": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "response": { - "properties": { - "body": { - "properties": { - "bytes": { - "type": "long" - }, - "content": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "bytes": { - "type": "long" - }, - "status_code": { - "type": "long" - } - } - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "labels": { - "type": "object" - }, - "log": { - "properties": { - "level": { - "ignore_above": 1024, - "type": "keyword" - }, - "logger": { - "ignore_above": 1024, - "type": "keyword" - }, - "origin": { - "properties": { - "file": { - "properties": { - "line": { - "type": "integer" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "function": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "original": { - "doc_values": false, - "ignore_above": 1024, - "index": false, - "type": "keyword" - }, - "syslog": { - "properties": { - "facility": { - "properties": { - "code": { - "type": "long" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "priority": { - "type": "long" - }, - "severity": { - "properties": { - "code": { - "type": "long" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } - }, - "message": { - "norms": false, - "type": "text" - }, - "network": { - "properties": { - "application": { - "ignore_above": 1024, - "type": "keyword" - }, - "bytes": { - "type": "long" - }, - "community_id": { - "ignore_above": 1024, - "type": "keyword" - }, - "direction": { - "ignore_above": 1024, - "type": "keyword" - }, - "forwarded_ip": { - "type": "ip" - }, - "iana_number": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "packets": { - "type": "long" - }, - "protocol": { - "ignore_above": 1024, - "type": "keyword" - }, - "transport": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "observer": { - "properties": { - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hostname": { - "ignore_above": 1024, - "type": "keyword" - }, - "ip": { - "type": "ip" - }, - "mac": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "os": { - "properties": { - "family": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "kernel": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "platform": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "product": { - "ignore_above": 1024, - "type": "keyword" - }, - "serial_number": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "vendor": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "organization": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "os": { - "properties": { - "family": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "kernel": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "platform": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "package": { - "properties": { - "architecture": { - "ignore_above": 1024, - "type": "keyword" - }, - "build_version": { - "ignore_above": 1024, - "type": "keyword" - }, - "checksum": { - "ignore_above": 1024, - "type": "keyword" - }, - "description": { - "ignore_above": 1024, - "type": "keyword" - }, - "install_scope": { - "ignore_above": 1024, - "type": "keyword" - }, - "installed": { - "type": "date" - }, - "license": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "path": { - "ignore_above": 1024, - "type": "keyword" - }, - "reference": { - "ignore_above": 1024, - "type": "keyword" - }, - "size": { - "type": "long" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "process": { - "properties": { - "args": { - "ignore_above": 1024, - "type": "keyword" - }, - "args_count": { - "type": "long" - }, - "command_line": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "executable": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "exit_code": { - "type": "long" - }, - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha512": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "parent": { - "properties": { - "args": { - "ignore_above": 1024, - "type": "keyword" - }, - "args_count": { - "type": "long" - }, - "command_line": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "executable": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "exit_code": { - "type": "long" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "pgid": { - "type": "long" - }, - "pid": { - "type": "long" - }, - "ppid": { - "type": "long" - }, - "start": { - "type": "date" - }, - "thread": { - "properties": { - "id": { - "type": "long" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "title": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "uptime": { - "type": "long" - }, - "working_directory": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "pgid": { - "type": "long" - }, - "pid": { - "type": "long" - }, - "ppid": { - "type": "long" - }, - "start": { - "type": "date" - }, - "thread": { - "properties": { - "id": { - "type": "long" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "title": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "uptime": { - "type": "long" - }, - "working_directory": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "registry": { - "properties": { - "data": { - "properties": { - "bytes": { - "ignore_above": 1024, - "type": "keyword" - }, - "strings": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hive": { - "ignore_above": 1024, - "type": "keyword" - }, - "key": { - "ignore_above": 1024, - "type": "keyword" - }, - "path": { - "ignore_above": 1024, - "type": "keyword" - }, - "value": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "related": { - "properties": { - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "ip": { - "type": "ip" - }, - "user": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "rule": { - "properties": { - "category": { - "ignore_above": 1024, - "type": "keyword" - }, - "description": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "reference": { - "ignore_above": 1024, - "type": "keyword" - }, - "ruleset": { - "ignore_above": 1024, - "type": "keyword" - }, - "uuid": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "server": { - "properties": { - "address": { - "ignore_above": 1024, - "type": "keyword" - }, - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "bytes": { - "type": "long" - }, - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "ip": { - "type": "ip" - }, - "mac": { - "ignore_above": 1024, - "type": "keyword" - }, - "nat": { - "properties": { - "ip": { - "type": "ip" - }, - "port": { - "type": "long" - } - } - }, - "packets": { - "type": "long" - }, - "port": { - "type": "long" - }, - "registered_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "top_level_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "user": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "email": { - "ignore_above": 1024, - "type": "keyword" - }, - "full_name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "service": { - "properties": { - "ephemeral_id": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "node": { - "properties": { - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "state": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "signal": { - "properties": { - "ancestors": { - "properties": { - "depth": { - "type": "long" - }, - "id": { - "type": "keyword" - }, - "rule": { - "type": "keyword" - }, - "type": { - "type": "keyword" - } - } - }, - "original_event": { - "properties": { - "action": { - "type": "keyword" - }, - "category": { - "type": "keyword" - }, - "code": { - "type": "keyword" - }, - "created": { - "type": "date" - }, - "dataset": { - "type": "keyword" - }, - "duration": { - "type": "long" - }, - "end": { - "type": "date" - }, - "hash": { - "type": "keyword" - }, - "id": { - "type": "keyword" - }, - "kind": { - "type": "keyword" - }, - "module": { - "type": "keyword" - }, - "original": { - "doc_values": false, - "index": false, - "type": "keyword" - }, - "outcome": { - "type": "keyword" - }, - "provider": { - "type": "keyword" - }, - "risk_score": { - "type": "float" - }, - "risk_score_norm": { - "type": "float" - }, - "sequence": { - "type": "long" - }, - "severity": { - "type": "long" - }, - "start": { - "type": "date" - }, - "timezone": { - "type": "keyword" - }, - "type": { - "type": "keyword" - } - } - }, - "original_time": { - "type": "date" - }, - "parent": { - "properties": { - "depth": { - "type": "long" - }, - "id": { - "type": "keyword" - }, - "index": { - "type": "keyword" - }, - "rule": { - "type": "keyword" - }, - "type": { - "type": "keyword" - } - } - }, - "rule": { - "properties": { - "created_at": { - "type": "date" - }, - "created_by": { - "type": "keyword" - }, - "description": { - "type": "keyword" - }, - "enabled": { - "type": "keyword" - }, - "false_positives": { - "type": "keyword" - }, - "filters": { - "type": "object" - }, - "from": { - "type": "keyword" - }, - "id": { - "type": "keyword" - }, - "immutable": { - "type": "keyword" - }, - "index": { - "type": "keyword" - }, - "interval": { - "type": "keyword" - }, - "language": { - "type": "keyword" - }, - "max_signals": { - "type": "keyword" - }, - "name": { - "type": "keyword" - }, - "note": { - "type": "text" - }, - "output_index": { - "type": "keyword" - }, - "query": { - "type": "keyword" - }, - "references": { - "type": "keyword" - }, - "risk_score": { - "type": "keyword" - }, - "rule_id": { - "type": "keyword" - }, - "saved_id": { - "type": "keyword" - }, - "severity": { - "type": "keyword" - }, - "size": { - "type": "keyword" - }, - "tags": { - "type": "keyword" - }, - "threat": { - "properties": { - "framework": { - "type": "keyword" - }, - "tactic": { - "properties": { - "id": { - "type": "keyword" - }, - "name": { - "type": "keyword" - }, - "reference": { - "type": "keyword" - } - } - }, - "technique": { - "properties": { - "id": { - "type": "keyword" - }, - "name": { - "type": "keyword" - }, - "reference": { - "type": "keyword" - } - } - } - } - }, - "timeline_id": { - "type": "keyword" - }, - "timeline_title": { - "type": "keyword" - }, - "to": { - "type": "keyword" - }, - "type": { - "type": "keyword" - }, - "updated_at": { - "type": "date" - }, - "updated_by": { - "type": "keyword" - }, - "version": { - "type": "keyword" - } - } - }, - "status": { - "type": "keyword" - } - } - }, - "source": { - "properties": { - "address": { - "ignore_above": 1024, - "type": "keyword" - }, - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "bytes": { - "type": "long" - }, - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "ip": { - "type": "ip" - }, - "mac": { - "ignore_above": 1024, - "type": "keyword" - }, - "nat": { - "properties": { - "ip": { - "type": "ip" - }, - "port": { - "type": "long" - } - } - }, - "packets": { - "type": "long" - }, - "port": { - "type": "long" - }, - "registered_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "top_level_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "user": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "email": { - "ignore_above": 1024, - "type": "keyword" - }, - "full_name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "tags": { - "ignore_above": 1024, - "type": "keyword" - }, - "threat": { - "properties": { - "framework": { - "ignore_above": 1024, - "type": "keyword" - }, - "tactic": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "reference": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "technique": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "reference": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "tls": { - "properties": { - "cipher": { - "ignore_above": 1024, - "type": "keyword" - }, - "client": { - "properties": { - "certificate": { - "ignore_above": 1024, - "type": "keyword" - }, - "certificate_chain": { - "ignore_above": 1024, - "type": "keyword" - }, - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "issuer": { - "ignore_above": 1024, - "type": "keyword" - }, - "ja3": { - "ignore_above": 1024, - "type": "keyword" - }, - "not_after": { - "type": "date" - }, - "not_before": { - "type": "date" - }, - "server_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "subject": { - "ignore_above": 1024, - "type": "keyword" - }, - "supported_ciphers": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "curve": { - "ignore_above": 1024, - "type": "keyword" - }, - "established": { - "type": "boolean" - }, - "next_protocol": { - "ignore_above": 1024, - "type": "keyword" - }, - "resumed": { - "type": "boolean" - }, - "server": { - "properties": { - "certificate": { - "ignore_above": 1024, - "type": "keyword" - }, - "certificate_chain": { - "ignore_above": 1024, - "type": "keyword" - }, - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "issuer": { - "ignore_above": 1024, - "type": "keyword" - }, - "ja3s": { - "ignore_above": 1024, - "type": "keyword" - }, - "not_after": { - "type": "date" - }, - "not_before": { - "type": "date" - }, - "subject": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - }, - "version_protocol": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "trace": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "transaction": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "url": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "extension": { - "ignore_above": 1024, - "type": "keyword" - }, - "fragment": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "original": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "password": { - "ignore_above": 1024, - "type": "keyword" - }, - "path": { - "ignore_above": 1024, - "type": "keyword" - }, - "port": { - "type": "long" - }, - "query": { - "ignore_above": 1024, - "type": "keyword" - }, - "registered_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "scheme": { - "ignore_above": 1024, - "type": "keyword" - }, - "top_level_domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "username": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "user": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "email": { - "ignore_above": 1024, - "type": "keyword" - }, - "full_name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "group": { - "properties": { - "domain": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "hash": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "user_agent": { - "properties": { - "device": { - "properties": { - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "original": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "os": { - "properties": { - "family": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "kernel": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "platform": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "vulnerability": { - "properties": { - "category": { - "ignore_above": 1024, - "type": "keyword" - }, - "classification": { - "ignore_above": 1024, - "type": "keyword" - }, - "description": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "enumeration": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "reference": { - "ignore_above": 1024, - "type": "keyword" - }, - "report_id": { - "ignore_above": 1024, - "type": "keyword" - }, - "scanner": { - "properties": { - "vendor": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "score": { - "properties": { - "base": { - "type": "float" - }, - "environmental": { - "type": "float" - }, - "temporal": { - "type": "float" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "severity": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - }, - "settings": { - "index": { - "lifecycle": { - "name": ".siem-signals-default", - "rollover_alias": ".siem-signals-default" - }, - "number_of_replicas": "1", - "number_of_shards": "1" - } - } - } } \ No newline at end of file From 63c205f62eb902e78c37beb5a3e52ab4a7fb72aa Mon Sep 17 00:00:00 2001 From: Ross Wolf <31489089+rw-access@users.noreply.github.com> Date: Mon, 6 Apr 2020 18:12:44 -0600 Subject: [PATCH 4/8] Remove CR, only CRLF for rules --- .../403_response_to_a_post.json | 46 +++--- .../405_response_method_not_allowed.json | 46 +++--- ..._security_adversary_behavior_detected.json | 38 ++--- ...dpoint_security_cred_dumping_detected.json | 38 ++--- ...point_security_cred_dumping_prevented.json | 38 ++--- ...t_security_cred_manipulation_detected.json | 38 ++--- ..._security_cred_manipulation_prevented.json | 38 ++--- ...ic_endpoint_security_exploit_detected.json | 38 ++--- ...c_endpoint_security_exploit_prevented.json | 38 ++--- ...ic_endpoint_security_malware_detected.json | 38 ++--- ...c_endpoint_security_malware_prevented.json | 38 ++--- ...nt_security_permission_theft_detected.json | 38 ++--- ...t_security_permission_theft_prevented.json | 38 ++--- ...t_security_process_injection_detected.json | 38 ++--- ..._security_process_injection_prevented.json | 38 ++--- ...endpoint_security_ransomware_detected.json | 38 ++--- ...ndpoint_security_ransomware_prevented.json | 38 ++--- ...den_file_attribute_with_via_attribexe.json | 98 ++++++------- .../eql_adobe_hijack_persistence.json | 68 ++++----- .../eql_clearing_windows_event_logs.json | 68 ++++----- ...delete_volume_usn_journal_with_fsutil.json | 68 ++++----- ...deleting_backup_catalogs_with_wbadmin.json | 68 ++++----- .../eql_direct_outbound_smb_connection.json | 68 ++++----- ...ble_windows_firewall_rules_with_netsh.json | 68 ++++----- ...coding_or_decoding_files_via_certutil.json | 68 ++++----- .../eql_local_scheduled_task_commands.json | 74 +++++----- .../eql_local_service_commands.json | 68 ++++----- ...ql_msbuild_making_network_connections.json | 68 ++++----- .../eql_mshta_making_network_connections.json | 74 +++++----- .../eql_psexec_lateral_movement_command.json | 104 +++++++------- ...ql_suspicious_ms_office_child_process.json | 68 ++++----- ...l_suspicious_ms_outlook_child_process.json | 68 ++++----- .../eql_system_shells_via_services.json | 68 ++++----- ...usual_network_connection_via_rundll32.json | 68 ++++----- .../eql_unusual_parentchild_relationship.json | 68 ++++----- ...ql_unusual_process_network_connection.json | 68 ++++----- .../eql_user_account_creation.json | 68 ++++----- ...ume_shadow_copy_deletion_via_vssadmin.json | 68 ++++----- ..._volume_shadow_copy_deletion_via_wmic.json | 68 ++++----- ...l_windows_script_executing_powershell.json | 68 ++++----- .../linux_anomalous_network_activity.json | 46 +++--- ...linux_anomalous_network_port_activity.json | 46 +++--- .../linux_anomalous_network_service.json | 46 +++--- .../linux_anomalous_network_url_activity.json | 46 +++--- .../linux_anomalous_process_all_hosts.json | 46 +++--- .../linux_anomalous_user_name.json | 46 +++--- .../linux_hping_activity.json | 46 +++--- .../linux_iodine_activity.json | 46 +++--- .../linux_kernel_module_activity.json | 80 +++++------ .../linux_mknod_activity.json | 46 +++--- .../linux_netcat_network_connection.json | 50 +++---- .../linux_nmap_activity.json | 46 +++--- .../linux_nping_activity.json | 46 +++--- ...nux_process_started_in_temp_directory.json | 40 +++--- .../linux_shell_activity_by_web_server.json | 80 +++++------ .../linux_socat_activity.json | 46 +++--- .../linux_strace_activity.json | 46 +++--- .../linux_tcpdump_activity.json | 104 +++++++------- .../linux_whoami_commmand.json | 74 +++++----- .../network_dns_directly_to_the_internet.json | 82 +++++------ ...fer_protocol_activity_to_the_internet.json | 104 +++++++------- ...hat_protocol_activity_to_the_internet.json | 104 +++++++------- .../network_nat_traversal_port_activity.json | 74 +++++----- .../network_port_26_activity.json | 112 +++++++-------- ...rk_port_8000_activity_to_the_internet.json | 74 +++++----- ..._to_point_tunneling_protocol_activity.json | 74 +++++----- ...k_proxy_port_activity_to_the_internet.json | 74 +++++----- ...te_desktop_protocol_from_the_internet.json | 134 +++++++++--------- ...mote_desktop_protocol_to_the_internet.json | 104 +++++++------- ...mote_procedure_call_from_the_internet.json | 68 ++++----- ...remote_procedure_call_to_the_internet.json | 68 ++++----- ...file_sharing_activity_to_the_internet.json | 98 ++++++------- .../network_smtp_to_the_internet.json | 104 +++++++------- ..._server_port_activity_to_the_internet.json | 74 +++++----- ...rk_ssh_secure_shell_from_the_internet.json | 134 +++++++++--------- ...work_ssh_secure_shell_to_the_internet.json | 74 +++++----- .../network_telnet_port_activity.json | 134 +++++++++--------- .../network_tor_activity_to_the_internet.json | 104 +++++++------- ...l_network_computing_from_the_internet.json | 104 +++++++------- ...ual_network_computing_to_the_internet.json | 74 +++++----- .../prepackaged_rules/null_user_agent.json | 82 +++++------ .../packetbeat_dns_tunneling.json | 46 +++--- .../packetbeat_rare_dns_question.json | 46 +++--- .../packetbeat_rare_server_domain.json | 46 +++--- .../packetbeat_rare_urls.json | 46 +++--- .../packetbeat_rare_user_agent.json | 46 +++--- .../rare_process_by_host_linux.json | 46 +++--- .../rare_process_by_host_windows.json | 46 +++--- .../prepackaged_rules/sqlmap_user_agent.json | 46 +++--- .../suspicious_login_activity.json | 46 +++--- .../windows_anomalous_network_activity.json | 46 +++--- .../windows_anomalous_path_activity.json | 46 +++--- .../windows_anomalous_process_all_hosts.json | 46 +++--- .../windows_anomalous_process_creation.json | 46 +++--- .../windows_anomalous_script.json | 46 +++--- .../windows_anomalous_service.json | 46 +++--- .../windows_anomalous_user_name.json | 46 +++--- .../windows_certutil_network_connection.json | 68 ++++----- ...and_prompt_connecting_to_the_internet.json | 104 +++++++------- ...s_command_shell_started_by_powershell.json | 98 ++++++------- ...dows_command_shell_started_by_svchost.json | 68 ++++----- .../windows_credential_dumping_msbuild.json | 74 +++++----- .../windows_cve_2020_0601.json | 68 ++++----- ...ws_defense_evasion_via_filter_manager.json | 68 ++++----- ...ecution_msbuild_started_by_office_app.json | 110 +++++++------- ...s_execution_msbuild_started_by_script.json | 104 +++++++------- ...ion_msbuild_started_by_system_process.json | 104 +++++++------- ...ows_execution_msbuild_started_renamed.json | 74 +++++----- ...cution_msbuild_started_unusal_process.json | 80 +++++------ ...dows_execution_via_compiled_html_file.json | 104 +++++++------- ...dows_execution_via_net_com_assemblies.json | 98 ++++++------- ...ution_via_trusted_developer_utilities.json | 104 +++++++------- ...le_program_connecting_to_the_internet.json | 98 ++++++------- .../windows_injection_msbuild.json | 104 +++++++------- ...isc_lolbin_connecting_to_the_internet.json | 98 ++++++------- .../windows_modification_of_boot_config.json | 68 ++++----- .../windows_msxsl_network.json | 68 ++++----- .../windows_net_command_system_account.json | 68 ++++----- ..._persistence_via_application_shimming.json | 98 ++++++------- ...escalation_via_accessibility_features.json | 98 ++++++------- ...rocess_discovery_via_tasklist_command.json | 74 +++++----- .../windows_rare_user_runas_event.json | 46 +++--- ...windows_rare_user_type10_remote_login.json | 46 +++--- ...er_program_connecting_to_the_internet.json | 104 +++++++------- .../windows_suspicious_pdf_reader.json | 68 ++++----- .../windows_uac_bypass_event_viewer.json | 68 ++++----- .../windows_whoami_command_activity.json | 74 +++++----- 127 files changed, 4313 insertions(+), 4313 deletions(-) diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json index 74a9764ea558e..d4118d0686b11 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json @@ -1,24 +1,24 @@ -{ - "description": "A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed", - "false_positives": [ - "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: POST Request Declined", - "query": "http.response.status_code:403 and http.request.method:post", - "references": [ - "https://en.wikipedia.org/wiki/HTTP_403" - ], - "risk_score": 47, - "rule_id": "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 2 +{ + "description": "A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed", + "false_positives": [ + "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: POST Request Declined", + "query": "http.response.status_code:403 and http.request.method:post", + "references": [ + "https://en.wikipedia.org/wiki/HTTP_403" + ], + "risk_score": 47, + "rule_id": "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json index fbbdd0f83e1f1..da27f0a71d281 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json @@ -1,24 +1,24 @@ -{ - "description": "A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource", - "false_positives": [ - "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: Unauthorized Method", - "query": "http.response.status_code:405", - "references": [ - "https://en.wikipedia.org/wiki/HTTP_405" - ], - "risk_score": 47, - "rule_id": "75ee75d8-c180-481c-ba88-ee50129a6aef", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 2 +{ + "description": "A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource", + "false_positives": [ + "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: Unauthorized Method", + "query": "http.response.status_code:405", + "references": [ + "https://en.wikipedia.org/wiki/HTTP_405" + ], + "risk_score": 47, + "rule_id": "75ee75d8-c180-481c-ba88-ee50129a6aef", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json index 7a62ef44838f5..cfc322788d4be 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Adversary Behavior - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and (event.action:rules_engine_event or endgame.event_subtype_full:rules_engine_event)", - "risk_score": 47, - "rule_id": "77a3c3df-8ec4-4da4-b758-878f551dee69", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Adversary Behavior - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and (event.action:rules_engine_event or endgame.event_subtype_full:rules_engine_event)", + "risk_score": 47, + "rule_id": "77a3c3df-8ec4-4da4-b758-878f551dee69", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json index eaa86ea5eac22..0647fe9c9ce10 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Dumping - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)", - "risk_score": 73, - "rule_id": "571afc56-5ed9-465d-a2a9-045f099f6e7e", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Dumping - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)", + "risk_score": 73, + "rule_id": "571afc56-5ed9-465d-a2a9-045f099f6e7e", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json index 5524f5f086430..036c88688d9bd 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Dumping - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)", - "risk_score": 47, - "rule_id": "db8c33a8-03cd-4988-9e2c-d0a4863adb13", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Dumping - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)", + "risk_score": 47, + "rule_id": "db8c33a8-03cd-4988-9e2c-d0a4863adb13", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json index 776c800791996..0fe610d551152 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Manipulation - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)", - "risk_score": 73, - "rule_id": "c0be5f31-e180-48ed-aa08-96b36899d48f", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Manipulation - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)", + "risk_score": 73, + "rule_id": "c0be5f31-e180-48ed-aa08-96b36899d48f", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json index 084914b2a475c..a317c77bcd90a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Credential Manipulation - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)", - "risk_score": 47, - "rule_id": "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Credential Manipulation - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)", + "risk_score": 47, + "rule_id": "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json index 782c9d5e29970..97640c0cea9b2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Exploit - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)", - "risk_score": 73, - "rule_id": "2003cdc8-8d83-4aa5-b132-1f9a8eb48514", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Exploit - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)", + "risk_score": 73, + "rule_id": "2003cdc8-8d83-4aa5-b132-1f9a8eb48514", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json index f656155fa4750..069687a5af00f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Exploit - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)", - "risk_score": 47, - "rule_id": "2863ffeb-bf77-44dd-b7a5-93ef94b72036", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Exploit - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)", + "risk_score": 47, + "rule_id": "2863ffeb-bf77-44dd-b7a5-93ef94b72036", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json index c6f536e1e7f55..a7d3371190ced 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Malware - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)", - "risk_score": 99, - "rule_id": "0a97b20f-4144-49ea-be32-b540ecc445de", - "severity": "critical", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Malware - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)", + "risk_score": 99, + "rule_id": "0a97b20f-4144-49ea-be32-b540ecc445de", + "severity": "critical", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json index 71fec58740995..dd7bf72c34f90 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Malware - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)", - "risk_score": 73, - "rule_id": "3b382770-efbb-44f4-beed-f5e0a051b895", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Malware - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)", + "risk_score": 73, + "rule_id": "3b382770-efbb-44f4-beed-f5e0a051b895", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json index 6829f0f18526f..a8e102cc4619d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Permission Theft - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)", - "risk_score": 73, - "rule_id": "c3167e1b-f73c-41be-b60b-87f4df707fe3", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Permission Theft - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)", + "risk_score": 73, + "rule_id": "c3167e1b-f73c-41be-b60b-87f4df707fe3", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json index a8d3cb31f16a9..c97330f2349eb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Permission Theft - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)", - "risk_score": 47, - "rule_id": "453f659e-0429-40b1-bfdb-b6957286e04b", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Permission Theft - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)", + "risk_score": 47, + "rule_id": "453f659e-0429-40b1-bfdb-b6957286e04b", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json index f8e35b845ae2b..e644c0e8d66eb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Process Injection - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)", - "risk_score": 73, - "rule_id": "80c52164-c82a-402c-9964-852533d58be1", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Process Injection - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)", + "risk_score": 73, + "rule_id": "80c52164-c82a-402c-9964-852533d58be1", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json index 176c71a1cfc70..61cbe267f9a46 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Process Injection - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)", - "risk_score": 47, - "rule_id": "990838aa-a953-4f3e-b3cb-6ddf7584de9e", - "severity": "medium", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Process Injection - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)", + "risk_score": 47, + "rule_id": "990838aa-a953-4f3e-b3cb-6ddf7584de9e", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json index ee90b812a0156..0e88b26cb2c75 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint detected Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Ransomware - Detected - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)", - "risk_score": 99, - "rule_id": "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd", - "severity": "critical", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint detected Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Ransomware - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)", + "risk_score": 99, + "rule_id": "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd", + "severity": "critical", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json index bf5d71c799a25..ba341f059f26d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json @@ -1,20 +1,20 @@ -{ - "description": "Elastic Endpoint prevented Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", - "from": "now-660s", - "index": [ - "endgame-*" - ], - "interval": "10m", - "language": "kuery", - "name": "Ransomware - Prevented - Elastic Endpoint", - "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)", - "risk_score": 73, - "rule_id": "e3c5d5cb-41d5-4206-805c-f30561eae3ac", - "severity": "high", - "tags": [ - "Elastic", - "Endpoint" - ], - "type": "query", - "version": 2 +{ + "description": "Elastic Endpoint prevented Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.", + "from": "now-660s", + "index": [ + "endgame-*" + ], + "interval": "10m", + "language": "kuery", + "name": "Ransomware - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)", + "risk_score": 73, + "rule_id": "e3c5d5cb-41d5-4206-805c-f30561eae3ac", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json index 19bfb78a04df7..25d2232d3f6dc 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json @@ -1,50 +1,50 @@ -{ - "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Adding Hidden File Attribute via Attrib", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:attrib.exe and process.args:+h", - "risk_score": 21, - "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1158", - "name": "Hidden Files and Directories", - "reference": "https://attack.mitre.org/techniques/T1158/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1158", - "name": "Hidden Files and Directories", - "reference": "https://attack.mitre.org/techniques/T1158/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Adding Hidden File Attribute via Attrib", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:attrib.exe and process.args:+h", + "risk_score": 21, + "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1158", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1158/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1158", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1158/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json index 2fb6d32ac097d..3b4d2bc040217 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json @@ -1,35 +1,35 @@ -{ - "description": "Detects writing executable files that will be automatically launched by Adobe on launch.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Adobe Hijack Persistence", - "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexec.exe", - "risk_score": 21, - "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1044", - "name": "File System Permissions Weakness", - "reference": "https://attack.mitre.org/techniques/T1044/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Detects writing executable files that will be automatically launched by Adobe on launch.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Adobe Hijack Persistence", + "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexec.exe", + "risk_score": 21, + "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1044", + "name": "File System Permissions Weakness", + "reference": "https://attack.mitre.org/techniques/T1044/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json index e1307c6bdbc3c..1c73d6c276ce6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Clearing Windows Event Logs", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wevtutil.exe and process.args:cl or process.name:powershell.exe and process.args:Clear-EventLog", - "risk_score": 21, - "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1070", - "name": "Indicator Removal on Host", - "reference": "https://attack.mitre.org/techniques/T1070/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Clearing Windows Event Logs", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wevtutil.exe and process.args:cl or process.name:powershell.exe and process.args:Clear-EventLog", + "risk_score": 21, + "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal on Host", + "reference": "https://attack.mitre.org/techniques/T1070/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json index b42a847c9618c..0bfa18398eada 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Delete Volume USN Journal with Fsutil", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:fsutil.exe and process.args:(deletejournal and usn)", - "risk_score": 21, - "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Delete Volume USN Journal with Fsutil", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:fsutil.exe and process.args:(deletejournal and usn)", + "risk_score": 21, + "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json index 8f77c0c937ced..e7293eda6390f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Deleting Backup Catalogs with Wbadmin", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wbadmin.exe and process.args:(catalog and delete)", - "risk_score": 21, - "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Deleting Backup Catalogs with Wbadmin", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:wbadmin.exe and process.args:(catalog and delete)", + "risk_score": 21, + "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json index 6e695fef9a75e..2896d27e19112 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Direct Outbound SMB Connection", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and destination.port:445 and not process.pid:4 and not destination.ip:(127.0.0.1 or \"::1\")", - "risk_score": 47, - "rule_id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1210", - "name": "Exploitation of Remote Services", - "reference": "https://attack.mitre.org/techniques/T1210/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Direct Outbound SMB Connection", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and destination.port:445 and not process.pid:4 and not destination.ip:(127.0.0.1 or \"::1\")", + "risk_score": 47, + "rule_id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1210", + "name": "Exploitation of Remote Services", + "reference": "https://attack.mitre.org/techniques/T1210/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json index db0e9fbfbcb68..42fe51f4e0373 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Disable Windows Firewall Rules via Netsh", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:netsh.exe and process.args:(disable and firewall and set) or process.args:(advfirewall and off and state)", - "risk_score": 47, - "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1089", - "name": "Disabling Security Tools", - "reference": "https://attack.mitre.org/techniques/T1089/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Disable Windows Firewall Rules via Netsh", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:netsh.exe and process.args:(disable and firewall and set) or process.args:(advfirewall and off and state)", + "risk_score": 47, + "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1089", + "name": "Disabling Security Tools", + "reference": "https://attack.mitre.org/techniques/T1089/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json index e51e78e95c248..eef112503da5b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies the use of certutil.exe to encode or decode data. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to encode or decode base64 data for stealthier command and control or exfiltration.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Encoding or Decoding Files via CertUtil", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:certutil.exe and process.args:(-decode or -encode or /decode or /encode)", - "risk_score": 47, - "rule_id": "fd70c98a-c410-42dc-a2e3-761c71848acf", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1140", - "name": "Deobfuscate/Decode Files or Information", - "reference": "https://attack.mitre.org/techniques/T1140/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies the use of certutil.exe to encode or decode data. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to encode or decode base64 data for stealthier command and control or exfiltration.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Encoding or Decoding Files via CertUtil", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:certutil.exe and process.args:(-decode or -encode or /decode or /encode)", + "risk_score": 47, + "rule_id": "fd70c98a-c410-42dc-a2e3-761c71848acf", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json index bfc3378734772..dbacb2537e60f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json @@ -1,38 +1,38 @@ -{ - "description": "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges.", - "false_positives": [ - "Legitimate scheduled tasks may be created during installation of new software." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Local Scheduled Task Commands", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:schtasks.exe and process.args:(-change or -create or -run or -s or /S or /change or /create or /run)", - "risk_score": 21, - "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1053", - "name": "Scheduled Task", - "reference": "https://attack.mitre.org/techniques/T1053/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Local Scheduled Task Commands", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:schtasks.exe and process.args:(-change or -create or -run or -s or /S or /change or /create or /run)", + "risk_score": 21, + "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json index cb79c1c8f523d..648e83b4a5267 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Local Service Commands", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:sc.exe and process.args:(config or create or failure or start)", - "risk_score": 21, - "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Local Service Commands", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:sc.exe and process.args:(config or create or failure or start)", + "risk_score": 21, + "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json index 5c5b8bd0a434a..5e8b260d44b55 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "MsBuild Making Network Connections", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:MSBuild.exe and not destination.ip:(127.0.0.1 or \"::1\")", - "risk_score": 47, - "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "MsBuild Making Network Connections", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:MSBuild.exe and not destination.ip:(127.0.0.1 or \"::1\")", + "risk_score": 47, + "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json index dea469babeaa9..88bd248e258d8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json @@ -1,38 +1,38 @@ -{ - "description": "Identifies mshta.exe making a network connection. This may indicate adversarial activity as mshta.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Mshta", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:mshta.exe", - "references": [ - "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html" - ], - "risk_score": 47, - "rule_id": "a4ec1382-4557-452b-89ba-e413b22ed4b8", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1170", - "name": "Mshta", - "reference": "https://attack.mitre.org/techniques/T1170/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies mshta.exe making a network connection. This may indicate adversarial activity as mshta.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Mshta", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:mshta.exe", + "references": [ + "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html" + ], + "risk_score": 47, + "rule_id": "a4ec1382-4557-452b-89ba-e413b22ed4b8", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1170", + "name": "Mshta", + "reference": "https://attack.mitre.org/techniques/T1170/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json index 4c7942622aca3..f763d2aa03363 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.", - "false_positives": [ - "PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "PsExec Network Connection", - "query": "process.name:PsExec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\"", - "risk_score": 21, - "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1035", - "name": "Service Execution", - "reference": "https://attack.mitre.org/techniques/T1035/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1035", - "name": "Service Execution", - "reference": "https://attack.mitre.org/techniques/T1035/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.", + "false_positives": [ + "PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "PsExec Network Connection", + "query": "process.name:PsExec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\"", + "risk_score": 21, + "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1035", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1035/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1035", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1035/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json index 31416486f3331..95c9c6b72f8f4 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Suspicious MS Office Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or powerpnt.exe or winword.exe) and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", - "risk_score": 21, - "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Suspicious MS Office Child Process", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or powerpnt.exe or winword.exe) and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", + "risk_score": 21, + "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1193", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1193/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json index 647e48d60e2ef..7f6c9257fabfd 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Suspicious MS Outlook Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:outlook.exe and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", - "risk_score": 21, - "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Suspicious MS Outlook Child Process", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:outlook.exe and process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or wmic.exe or wscript.exe or xwizard.exe)", + "risk_score": 21, + "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1193", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1193/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json index fbe264ff6aba4..f1b1879fc2652 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json @@ -1,35 +1,35 @@ -{ - "description": "Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "System Shells via Services", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:services.exe and process.name:(cmd.exe or powershell.exe)", - "risk_score": 47, - "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1050", - "name": "New Service", - "reference": "https://attack.mitre.org/techniques/T1050/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "System Shells via Services", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:services.exe and process.name:(cmd.exe or powershell.exe)", + "risk_score": 47, + "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1050", + "name": "New Service", + "reference": "https://attack.mitre.org/techniques/T1050/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json index a56838c06126f..2a7960c939d01 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial activity and may identify malicious DLLs.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Unusual Network Connection via RunDLL32", - "query": "process.name:rundll32.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "52aaab7b-b51c-441a-89ce-4387b3aea886", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1085", - "name": "Rundll32", - "reference": "https://attack.mitre.org/techniques/T1085/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial activity and may identify malicious DLLs.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Unusual Network Connection via RunDLL32", + "query": "process.name:rundll32.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "52aaab7b-b51c-441a-89ce-4387b3aea886", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1085", + "name": "Rundll32", + "reference": "https://attack.mitre.org/techniques/T1085/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json index f1f9d2fec379a..9a28c87c77089 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Unusual Parent-Child Relationship", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and (process.name:smss.exe and not process.parent.name:(System or smss.exe) or process.name:csrss.exe and not process.parent.name:(smss.exe or svchost.exe) or process.name:wininit.exe and not process.parent.name:smss.exe or process.name:winlogon.exe and not process.parent.name:smss.exe or process.name:lsass.exe and not process.parent.name:wininit.exe or process.name:LogonUI.exe and not process.parent.name:(wininit.exe or winlogon.exe) or process.name:services.exe and not process.parent.name:wininit.exe or process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or services.exe) or process.name:spoolsv.exe and not process.parent.name:services.exe or process.name:taskhost.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:taskhostw.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:userinit.exe and not process.parent.name:(dwm.exe or winlogon.exe))", - "risk_score": 47, - "rule_id": "35df0dd8-092d-4a83-88c1-5151a804f31b", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1093", - "name": "Process Hollowing", - "reference": "https://attack.mitre.org/techniques/T1093/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Unusual Parent-Child Relationship", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and (process.name:smss.exe and not process.parent.name:(System or smss.exe) or process.name:csrss.exe and not process.parent.name:(smss.exe or svchost.exe) or process.name:wininit.exe and not process.parent.name:smss.exe or process.name:winlogon.exe and not process.parent.name:smss.exe or process.name:lsass.exe and not process.parent.name:wininit.exe or process.name:LogonUI.exe and not process.parent.name:(wininit.exe or winlogon.exe) or process.name:services.exe and not process.parent.name:wininit.exe or process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or services.exe) or process.name:spoolsv.exe and not process.parent.name:services.exe or process.name:taskhost.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:taskhostw.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:userinit.exe and not process.parent.name:(dwm.exe or winlogon.exe))", + "risk_score": 47, + "rule_id": "35df0dd8-092d-4a83-88c1-5151a804f31b", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1093", + "name": "Process Hollowing", + "reference": "https://attack.mitre.org/techniques/T1093/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json index 2d16906e4d149..43a3d6f6af0b2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Unusual Process Network Connection", - "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:(Microsoft.Workflow.Compiler.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or odbcconf.exe or rcsi.exe or xwizard.exe)", - "risk_score": 21, - "rule_id": "610949a1-312f-4e04-bb55-3a79b8c95267", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Unusual Process Network Connection", + "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:(Microsoft.Workflow.Compiler.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or odbcconf.exe or rcsi.exe or xwizard.exe)", + "risk_score": 21, + "rule_id": "610949a1-312f-4e04-bb55-3a79b8c95267", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json index efcbd2f8e0f81..7054e7f67c358 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or domain.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "User Account Creation", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(net.exe or net1.exe) and not process.parent.name:net.exe and process.args:(user and (/ad or /add))", - "risk_score": 21, - "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1136", - "name": "Create Account", - "reference": "https://attack.mitre.org/techniques/T1136/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or domain.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "User Account Creation", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(net.exe or net1.exe) and not process.parent.name:net.exe and process.args:(user and (/ad or /add))", + "risk_score": 21, + "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json index cc7343deaa964..24f1cb72504f3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Volume Shadow Copy Deletion via VssAdmin", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:vssadmin.exe and process.args:(delete and shadows)", - "risk_score": 73, - "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1490", - "name": "Inhibit System Recovery", - "reference": "https://attack.mitre.org/techniques/T1490/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Volume Shadow Copy Deletion via VssAdmin", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:vssadmin.exe and process.args:(delete and shadows)", + "risk_score": 73, + "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json index f36b9280986aa..bad3c65024e42 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Volume Shadow Copy Deletion via WMIC", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:WMIC.exe and process.args:(delete and shadowcopy)", - "risk_score": 73, - "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Volume Shadow Copy Deletion via WMIC", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:WMIC.exe and process.args:(delete and shadowcopy)", + "risk_score": 73, + "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json index 0497f007b6253..52323b169cb22 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Script Executing PowerShell", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(cscript.exe or wscript.exe) and process.name:powershell.exe", - "risk_score": 21, - "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Windows Script Executing PowerShell", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(cscript.exe or wscript.exe) and process.name:powershell.exe", + "risk_score": 21, + "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1193", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1193/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json index 7d96ecbaa3077..1123c1161c4ce 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_activity_ecs", - "name": "Unusual Linux Network Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "52afbdc5-db15-485e-bc24-f5707f820c4b", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_activity_ecs", + "name": "Unusual Linux Network Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-485e-bc24-f5707f820c4b", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json index 82ce2558a1014..19dd643945b17 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_port_activity_ecs", - "name": "Unusual Linux Network Port Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "3c7e32e6-6104-46d9-a06e-da0f8b5795a0", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_port_activity_ecs", + "name": "Unusual Linux Network Port Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "3c7e32e6-6104-46d9-a06e-da0f8b5795a0", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json index 4a757b5acdde2..e2e5803618d06 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies unusual listening ports on Linux instances that can indicate execution of unauthorized services, backdoors, or persistence mechanisms.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_service", - "name": "Unusual Linux Network Service", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "52afbdc5-db15-596e-bc35-f5707f820c4b", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies unusual listening ports on Linux instances that can indicate execution of unauthorized services, backdoors, or persistence mechanisms.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_service", + "name": "Unusual Linux Network Service", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-596e-bc35-f5707f820c4b", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json index f2eb7bd2390bc..40dd2e76c7214 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual web URL request from a Linux host, which can indicate malware delivery and execution. Wget and cURL are commonly used by Linux programs to download code and data. Most of the time, their usage is entirely normal. Generally, because they use a list of URLs, they repeatedly download from the same locations. However, Wget and cURL are sometimes used to deliver Linux exploit payloads, and threat actors use these tools to download additional software and code. For these reasons, unusual URLs can indicate unauthorized downloads or threat activity.", - "false_positives": [ - "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_network_url_activity_ecs", - "name": "Unusual Linux Web Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "52afbdc5-db15-485e-bc35-f5707f820c4c", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual web URL request from a Linux host, which can indicate malware delivery and execution. Wget and cURL are commonly used by Linux programs to download code and data. Most of the time, their usage is entirely normal. Generally, because they use a list of URLs, they repeatedly download from the same locations. However, Wget and cURL are sometimes used to deliver Linux exploit payloads, and threat actors use these tools to download additional software and code. For these reasons, unusual URLs can indicate unauthorized downloads or threat activity.", + "false_positives": [ + "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_network_url_activity_ecs", + "name": "Unusual Linux Web Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-485e-bc35-f5707f820c4c", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json index 05200b4aedbf6..6bac2f25fd7de 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_process_all_hosts_ecs", - "name": "Anomalous Process For a Linux Population", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "647fc812-7996-4795-8869-9c4ea595fe88", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_process_all_hosts_ecs", + "name": "Anomalous Process For a Linux Population", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "647fc812-7996-4795-8869-9c4ea595fe88", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json index 437e67169996c..8b7e6c89482f7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", - "false_positives": [ - "Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "linux_anomalous_user_name_ecs", - "name": "Unusual Linux Username", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "b347b919-665f-4aac-b9e8-68369bf2340c", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", + "false_positives": [ + "Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "linux_anomalous_user_name_ecs", + "name": "Unusual Linux Username", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "b347b919-665f-4aac-b9e8-68369bf2340c", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json index 09a1c34c5cb06..04a56241ea6f6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.", - "false_positives": [ - "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Hping Process Activity", - "query": "process.name:(hping or hping2 or hping3) and event.action:executed", - "references": [ - "https://en.wikipedia.org/wiki/Hping" - ], - "risk_score": 73, - "rule_id": "90169566-2260-4824-b8e4-8615c3b4ed52", - "severity": "high", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.", + "false_positives": [ + "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Hping Process Activity", + "query": "process.name:(hping or hping2 or hping3) and event.action:executed", + "references": [ + "https://en.wikipedia.org/wiki/Hping" + ], + "risk_score": 73, + "rule_id": "90169566-2260-4824-b8e4-8615c3b4ed52", + "severity": "high", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json index d2fc5fc03c1ec..80358cc775e3b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection.", - "false_positives": [ - "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Potential DNS Tunneling via Iodine", - "query": "process.name:(iodine or iodined) and event.action:executed", - "references": [ - "https://code.kryo.se/iodine/" - ], - "risk_score": 73, - "rule_id": "041d4d41-9589-43e2-ba13-5680af75ebc2", - "severity": "high", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection.", + "false_positives": [ + "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Potential DNS Tunneling via Iodine", + "query": "process.name:(iodine or iodined) and event.action:executed", + "references": [ + "https://code.kryo.se/iodine/" + ], + "risk_score": 73, + "rule_id": "041d4d41-9589-43e2-ba13-5680af75ebc2", + "severity": "high", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json index 00396816824b5..b50fcc4c9980b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json @@ -1,41 +1,41 @@ -{ - "description": "Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.", - "false_positives": [ - "Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Persistence via Kernel Module Modification", - "query": "process.name:(insmod or kmod or modprobe or rmod) and event.action:executed", - "references": [ - "https://www.hackers-arise.com/single-post/2017/11/03/Linux-for-Hackers-Part-10-Loadable-Kernel-Modules-LKM" - ], - "risk_score": 21, - "rule_id": "81cc58f5-8062-49a2-ba84-5cc4b4d31c40", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/techniques/TA0003/" - }, - "technique": [ - { - "id": "T1215", - "name": "Kernel Modules and Extensions", - "reference": "https://attack.mitre.org/techniques/T1215/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.", + "false_positives": [ + "Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Persistence via Kernel Module Modification", + "query": "process.name:(insmod or kmod or modprobe or rmod) and event.action:executed", + "references": [ + "https://www.hackers-arise.com/single-post/2017/11/03/Linux-for-Hackers-Part-10-Loadable-Kernel-Modules-LKM" + ], + "risk_score": 21, + "rule_id": "81cc58f5-8062-49a2-ba84-5cc4b4d31c40", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/techniques/TA0003/" + }, + "technique": [ + { + "id": "T1215", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1215/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json index 58d830fbf05b2..d65440e95ff17 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json @@ -1,24 +1,24 @@ -{ - "description": "The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command shell when the traditional version of netcat is not available to the payload.", - "false_positives": [ - "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Mknod Process Activity", - "query": "process.name:mknod and event.action:executed", - "references": [ - "https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem" - ], - "risk_score": 21, - "rule_id": "61c31c14-507f-4627-8c31-072556b89a9c", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command shell when the traditional version of netcat is not available to the payload.", + "false_positives": [ + "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Mknod Process Activity", + "query": "process.name:mknod and event.action:executed", + "references": [ + "https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem" + ], + "risk_score": 21, + "rule_id": "61c31c14-507f-4627-8c31-072556b89a9c", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json index f431cd6103e77..df8e46be7a1c3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json @@ -1,26 +1,26 @@ -{ - "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.", - "false_positives": [ - "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Netcat Network Activity", - "query": "process.name:(nc or ncat or netcat or netcat.openbsd or netcat.traditional) and event.action:(bound-socket or connected-to or socket_opened)", - "references": [ - "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", - "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", - "https://en.wikipedia.org/wiki/Netcat" - ], - "risk_score": 47, - "rule_id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.", + "false_positives": [ + "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Netcat Network Activity", + "query": "process.name:(nc or ncat or netcat or netcat.openbsd or netcat.traditional) and event.action:(bound-socket or connected-to or socket_opened)", + "references": [ + "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", + "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", + "https://en.wikipedia.org/wiki/Netcat" + ], + "risk_score": 47, + "rule_id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json index 3fd1e355adf78..2e5c899ebc625 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks, and identify listening services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.", - "false_positives": [ - "Security testing tools and frameworks may run `Nmap` in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Nmap Process Activity", - "query": "process.name:nmap", - "references": [ - "https://en.wikipedia.org/wiki/Nmap" - ], - "risk_score": 21, - "rule_id": "c87fca17-b3a9-4e83-b545-f30746c53920", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks, and identify listening services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.", + "false_positives": [ + "Security testing tools and frameworks may run `Nmap` in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Nmap Process Activity", + "query": "process.name:nmap", + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "risk_score": 21, + "rule_id": "c87fca17-b3a9-4e83-b545-f30746c53920", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json index 7c6db25832057..168b30121c4bb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.", - "false_positives": [ - "Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Nping Process Activity", - "query": "process.name:nping and event.action:executed", - "references": [ - "https://en.wikipedia.org/wiki/Nmap" - ], - "risk_score": 47, - "rule_id": "0d69150b-96f8-467c-a86d-a67a3378ce77", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.", + "false_positives": [ + "Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Nping Process Activity", + "query": "process.name:nping and event.action:executed", + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "risk_score": 47, + "rule_id": "0d69150b-96f8-467c-a86d-a67a3378ce77", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json index 267bdd151872c..0865ac6c70cb2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json @@ -1,21 +1,21 @@ -{ - "description": "Identifies processes running in a temporary folder. This is sometimes done by adversaries to hide malware.", - "false_positives": [ - "Build systems, like Jenkins, may start processes in the `/tmp` directory. These can be exempted by name or by username." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Unusual Process Execution - Temp", - "query": "process.working_directory:/tmp and event.action:executed", - "risk_score": 47, - "rule_id": "df959768-b0c9-4d45-988c-5606a2be8e5a", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "Identifies processes running in a temporary folder. This is sometimes done by adversaries to hide malware.", + "false_positives": [ + "Build systems, like Jenkins, may start processes in the `/tmp` directory. These can be exempted by name or by username." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Unusual Process Execution - Temp", + "query": "process.working_directory:/tmp and event.action:executed", + "risk_score": 47, + "rule_id": "df959768-b0c9-4d45-988c-5606a2be8e5a", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json index 87e1583af9ebf..e9c4c95bb9284 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json @@ -1,41 +1,41 @@ -{ - "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.", - "false_positives": [ - "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Potential Shell via Web Server", - "query": "process.name:bash and user.name:(apache or www or www-data) and event.action:executed", - "references": [ - "https://pentestlab.blog/tag/web-shell/" - ], - "risk_score": 47, - "rule_id": "231876e7-4d1f-4d63-a47c-47dd1acdc1cb", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/techniques/TA0003/" - }, - "technique": [ - { - "id": "T1100", - "name": "Web Shell", - "reference": "https://attack.mitre.org/techniques/T1100/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.", + "false_positives": [ + "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Potential Shell via Web Server", + "query": "process.name:bash and user.name:(apache or www or www-data) and event.action:executed", + "references": [ + "https://pentestlab.blog/tag/web-shell/" + ], + "risk_score": 47, + "rule_id": "231876e7-4d1f-4d63-a47c-47dd1acdc1cb", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/techniques/TA0003/" + }, + "technique": [ + { + "id": "T1100", + "name": "Web Shell", + "reference": "https://attack.mitre.org/techniques/T1100/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json index 8d8b897665fd8..404fea63aff94 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json @@ -1,24 +1,24 @@ -{ - "description": "A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.", - "false_positives": [ - "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Socat Process Activity", - "query": "process.name:socat and not process.args:-V and event.action:executed", - "references": [ - "https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat" - ], - "risk_score": 47, - "rule_id": "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126", - "severity": "medium", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.", + "false_positives": [ + "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Socat Process Activity", + "query": "process.name:socat and not process.args:-V and event.action:executed", + "references": [ + "https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat" + ], + "risk_score": 47, + "rule_id": "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126", + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json index 62ff74e4ddf49..fbdfa9e66682d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json @@ -1,24 +1,24 @@ -{ - "description": "Strace runs in a privileged context and can be used to escape restrictive environments by instantiating a shell in order to elevate privileges or move laterally.", - "false_positives": [ - "Strace is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or SREs engaged in debugging or system call tracing." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Strace Process Activity", - "query": "process.name:strace and event.action:executed", - "references": [ - "https://en.wikipedia.org/wiki/Strace" - ], - "risk_score": 21, - "rule_id": "d6450d4e-81c6-46a3-bd94-079886318ed5", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "type": "query", - "version": 2 +{ + "description": "Strace runs in a privileged context and can be used to escape restrictive environments by instantiating a shell in order to elevate privileges or move laterally.", + "false_positives": [ + "Strace is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or SREs engaged in debugging or system call tracing." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Strace Process Activity", + "query": "process.name:strace and event.action:executed", + "references": [ + "https://en.wikipedia.org/wiki/Strace" + ], + "risk_score": 21, + "rule_id": "d6450d4e-81c6-46a3-bd94-079886318ed5", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json index e29650f02ed87..82771074e7c29 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json @@ -1,53 +1,53 @@ -{ - "description": "The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a prelude to lateral movement or defense evasion.", - "false_positives": [ - "Some normal use of this command may originate from server or network administrators engaged in network troubleshooting." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "Network Sniffing via Tcpdump", - "query": "process.name:tcpdump and event.action:executed", - "risk_score": 21, - "rule_id": "7a137d76-ce3d-48e2-947d-2747796a78c0", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1040", - "name": "Network Sniffing", - "reference": "https://attack.mitre.org/techniques/T1040/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1040", - "name": "Network Sniffing", - "reference": "https://attack.mitre.org/techniques/T1040/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a prelude to lateral movement or defense evasion.", + "false_positives": [ + "Some normal use of this command may originate from server or network administrators engaged in network troubleshooting." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "Network Sniffing via Tcpdump", + "query": "process.name:tcpdump and event.action:executed", + "risk_score": 21, + "rule_id": "7a137d76-ce3d-48e2-947d-2747796a78c0", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1040", + "name": "Network Sniffing", + "reference": "https://attack.mitre.org/techniques/T1040/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1040", + "name": "Network Sniffing", + "reference": "https://attack.mitre.org/techniques/T1040/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json index 8e762e89e42d0..7e7f041581eb0 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json @@ -1,38 +1,38 @@ -{ - "description": "The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.", - "false_positives": [ - "Security testing tools and frameworks may run this command. Some normal use of this command may originate from automation tools and frameworks." - ], - "index": [ - "auditbeat-*" - ], - "language": "kuery", - "name": "User Discovery via Whoami", - "query": "process.name:whoami and event.action:executed", - "risk_score": 21, - "rule_id": "120559c6-5e24-49f4-9e30-8ffe697df6b9", - "severity": "low", - "tags": [ - "Elastic", - "Linux" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1033", - "name": "System Owner/User Discovery", - "reference": "https://attack.mitre.org/techniques/T1033/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.", + "false_positives": [ + "Security testing tools and frameworks may run this command. Some normal use of this command may originate from automation tools and frameworks." + ], + "index": [ + "auditbeat-*" + ], + "language": "kuery", + "name": "User Discovery via Whoami", + "query": "process.name:whoami and event.action:executed", + "risk_score": 21, + "rule_id": "120559c6-5e24-49f4-9e30-8ffe697df6b9", + "severity": "low", + "tags": [ + "Elastic", + "Linux" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json index 3c69078ec4f37..e08d681d14463 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json @@ -1,42 +1,42 @@ -{ - "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications.", - "false_positives": [ - "Exclude DNS servers from this rule as this is expected behavior. Endpoints usually query local DNS servers defined in their DHCP scopes, but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations. In that case, such devices or networks can be excluded from this rule when this is expected behavior." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "DNS Activity to the Internet", - "query": "destination.port:53 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 169.254.169.254/32 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.251 or 224.0.0.252 or 255.255.255.255 or \"::1\" or \"ff02::fb\")", - "references": [ - "https://www.us-cert.gov/ncas/alerts/TA15-240A", - "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf" - ], - "risk_score": 47, - "rule_id": "6ea71ff0-9e95-475b-9506-2580d1ce6154", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications.", + "false_positives": [ + "Exclude DNS servers from this rule as this is expected behavior. Endpoints usually query local DNS servers defined in their DHCP scopes, but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations. In that case, such devices or networks can be excluded from this rule when this is expected behavior." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "DNS Activity to the Internet", + "query": "destination.port:53 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 169.254.169.254/32 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.251 or 224.0.0.252 or 255.255.255.255 or \"::1\" or \"ff02::fb\")", + "references": [ + "https://www.us-cert.gov/ncas/alerts/TA15-240A", + "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf" + ], + "risk_score": 47, + "rule_id": "6ea71ff0-9e95-475b-9506-2580d1ce6154", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json index 2a39ca23f7fca..24c3bad817227 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects events that may indicate the use of FTP network connections to the Internet. The File Transfer Protocol (FTP) has been around in its current form since the 1980s. It can be a common and efficient procedure on your network to send and receive files. Because of this, adversaries will also often use this protocol to exfiltrate data from your network or download new tools. Additionally, FTP is a plain-text protocol which, if intercepted, may expose usernames and passwords. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.", - "false_positives": [ - "FTP servers should be excluded from this rule as this is expected behavior. Some business workflows may use FTP for data exchange. These workflows often have expected characteristics such as users, sources, and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP workflow or business requirement is often suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "FTP (File Transfer Protocol) Activity to the Internet", - "query": "network.transport:tcp and destination.port:(20 or 21) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "87ec6396-9ac4-4706-bcf0-2ebb22002f43", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may indicate the use of FTP network connections to the Internet. The File Transfer Protocol (FTP) has been around in its current form since the 1980s. It can be a common and efficient procedure on your network to send and receive files. Because of this, adversaries will also often use this protocol to exfiltrate data from your network or download new tools. Additionally, FTP is a plain-text protocol which, if intercepted, may expose usernames and passwords. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.", + "false_positives": [ + "FTP servers should be excluded from this rule as this is expected behavior. Some business workflows may use FTP for data exchange. These workflows often have expected characteristics such as users, sources, and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP workflow or business requirement is often suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "FTP (File Transfer Protocol) Activity to the Internet", + "query": "network.transport:tcp and destination.port:(20 or 21) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "87ec6396-9ac4-4706-bcf0-2ebb22002f43", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json index 455f7b84cfeff..bf286d4cab506 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects events that use common ports for Internet Relay Chat (IRC) to the Internet. IRC is a common protocol that can be used for chat and file transfers. This protocol is also a good candidate for remote control of malware and data transfers to and from a network.", - "false_positives": [ - "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions, such as when a NAT-ed web server replies to a client which has used a port in the range by coincidence. In this case, these servers can be excluded. Some legacy applications may use these ports, but this is very uncommon and usually only appears in local traffic using private IPs, which does not match this rule's conditions." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "IRC (Internet Relay Chat) Protocol Activity to the Internet", - "query": "network.transport:tcp and destination.port:(6667 or 6697) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "c6474c34-4953-447a-903e-9fcb7b6661aa", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that use common ports for Internet Relay Chat (IRC) to the Internet. IRC is a common protocol that can be used for chat and file transfers. This protocol is also a good candidate for remote control of malware and data transfers to and from a network.", + "false_positives": [ + "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions, such as when a NAT-ed web server replies to a client which has used a port in the range by coincidence. In this case, these servers can be excluded. Some legacy applications may use these ports, but this is very uncommon and usually only appears in local traffic using private IPs, which does not match this rule's conditions." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "IRC (Internet Relay Chat) Protocol Activity to the Internet", + "query": "network.transport:tcp and destination.port:(6667 or 6697) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "c6474c34-4953-447a-903e-9fcb7b6661aa", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json index e86ebc64ebdc1..61c1e3d47cf7a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.", - "false_positives": [ - "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "IPSEC NAT Traversal Port Activity", - "query": "network.transport:udp and destination.port:4500", - "risk_score": 21, - "rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.", + "false_positives": [ + "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "IPSEC NAT Traversal Port Activity", + "query": "network.transport:udp and destination.port:4500", + "risk_score": 21, + "rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json index cbd6cb26ade83..a9a39b61884c5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json @@ -1,57 +1,57 @@ -{ - "description": "This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.", - "false_positives": [ - "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SMTP on Port 26/TCP", - "query": "network.transport:tcp and destination.port:26", - "references": [ - "https://unit42.paloaltonetworks.com/unit42-badpatch/", - "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/" - ], - "risk_score": 21, - "rule_id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.", + "false_positives": [ + "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SMTP on Port 26/TCP", + "query": "network.transport:tcp and destination.port:26", + "references": [ + "https://unit42.paloaltonetworks.com/unit42-badpatch/", + "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/" + ], + "risk_score": 21, + "rule_id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json index 7e3fbe92bb7e3..2f1390411f97b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "TCP Port 8000 is commonly used for development environments of web server software. It generally should not be exposed directly to the Internet. If you are running software like this on the Internet, you should consider placing it behind a reverse proxy.", - "false_positives": [ - "Because this port is in the ephemeral range, this rule may false under certain conditions, such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs, which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "TCP Port 8000 Activity to the Internet", - "query": "network.transport:tcp and destination.port:8000 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "08d5d7e2-740f-44d8-aeda-e41f4263efaf", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "TCP Port 8000 is commonly used for development environments of web server software. It generally should not be exposed directly to the Internet. If you are running software like this on the Internet, you should consider placing it behind a reverse proxy.", + "false_positives": [ + "Because this port is in the ephemeral range, this rule may false under certain conditions, such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs, which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "TCP Port 8000 Activity to the Internet", + "query": "network.transport:tcp and destination.port:8000 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "08d5d7e2-740f-44d8-aeda-e41f4263efaf", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json index f1689d3fd1170..f7170d8d33a51 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of connections to tunnel their traffic while avoiding detection.", - "false_positives": [ - "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server replies to a client that used this port by coincidence. This is uncommon but such servers can be excluded." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "PPTP (Point to Point Tunneling Protocol) Activity", - "query": "network.transport:tcp and destination.port:1723", - "risk_score": 21, - "rule_id": "d2053495-8fe7-4168-b3df-dad844046be3", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of connections to tunnel their traffic while avoiding detection.", + "false_positives": [ + "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server replies to a client that used this port by coincidence. This is uncommon but such servers can be excluded." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "PPTP (Point to Point Tunneling Protocol) Activity", + "query": "network.transport:tcp and destination.port:1723", + "risk_score": 21, + "rule_id": "d2053495-8fe7-4168-b3df-dad844046be3", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json index 854a303e66af9..da4319cf15307 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that may describe network events of proxy use to the Internet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically, environments will use an internal IP address for a proxy server. It can also be used to circumvent network controls and detection mechanisms.", - "false_positives": [ - "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "Proxy Port Activity to the Internet", - "query": "network.transport:tcp and destination.port:(1080 or 3128 or 8080) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "ad0e5e75-dd89-4875-8d0a-dfdc1828b5f3", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may describe network events of proxy use to the Internet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically, environments will use an internal IP address for a proxy server. It can also be used to circumvent network controls and detection mechanisms.", + "false_positives": [ + "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "Proxy Port Activity to the Internet", + "query": "network.transport:tcp and destination.port:(1080 or 3128 or 8080) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "ad0e5e75-dd89-4875-8d0a-dfdc1828b5f3", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json index dc2650c63d26d..d3b65a36f084b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json @@ -1,68 +1,68 @@ -{ - "description": "This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RDP (Remote Desktop Protocol) from the Internet", - "query": "network.transport:tcp and destination.port:3389 and not source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RDP (Remote Desktop Protocol) from the Internet", + "query": "network.transport:tcp and destination.port:3389 and not source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json index 47a1addb925bb..79618a867c73f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects network events that may indicate the use of RDP traffic to the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "RDP connections may be made directly to Internet destinations in order to access Windows cloud server instances but such connections are usually made only by engineers. In such cases, only RDP gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RDP (Remote Desktop Protocol) to the Internet", - "query": "network.transport:tcp and destination.port:3389 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "e56993d2-759c-4120-984c-9ec9bb940fd5", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RDP traffic to the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "RDP connections may be made directly to Internet destinations in order to access Windows cloud server instances but such connections are usually made only by engineers. In such cases, only RDP gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RDP (Remote Desktop Protocol) to the Internet", + "query": "network.transport:tcp and destination.port:3389 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "e56993d2-759c-4120-984c-9ec9bb940fd5", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json index 15c2e504c033f..da1e46750f3bd 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json @@ -1,35 +1,35 @@ -{ - "description": "This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RPC (Remote Procedure Call) from the Internet", - "query": "network.transport:tcp and destination.port:135 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 73, - "rule_id": "143cb236-0956-4f42-a706-814bcaa0cf5a", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RPC (Remote Procedure Call) from the Internet", + "query": "network.transport:tcp and destination.port:135 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 73, + "rule_id": "143cb236-0956-4f42-a706-814bcaa0cf5a", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json index 6e5c552045afb..d07d19b8fffee 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json @@ -1,35 +1,35 @@ -{ - "description": "This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "RPC (Remote Procedure Call) to the Internet", - "query": "network.transport:tcp and destination.port:135 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 73, - "rule_id": "32923416-763a-4531-bb35-f33b9232ecdb", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "RPC (Remote Procedure Call) to the Internet", + "query": "network.transport:tcp and destination.port:135 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 73, + "rule_id": "32923416-763a-4531-bb35-f33b9232ecdb", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json index 073f7d7a58c2b..93a4b0ebbbd8e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json @@ -1,50 +1,50 @@ -{ - "description": "This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration.", - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SMB (Windows File Sharing) Activity to the Internet", - "query": "network.transport:tcp and destination.port:(139 or 445) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 73, - "rule_id": "c82b2bd8-d701-420c-ba43-f11a155b681a", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration.", + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SMB (Windows File Sharing) Activity to the Internet", + "query": "network.transport:tcp and destination.port:(139 or 445) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 73, + "rule_id": "c82b2bd8-d701-420c-ba43-f11a155b681a", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json index 4023e63df0ab9..ca287605490ef 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an enterprise network, there is typically a dedicated internal host that performs this function. It is also frequently abused by threat actors for command and control, or data exfiltration.", - "false_positives": [ - "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and personal devices may send email traffic to remote Internet destinations. In this case, such devices or networks can be excluded from this rule if this is expected behavior." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SMTP to the Internet", - "query": "network.transport:tcp and destination.port:(25 or 465 or 587) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "67a9beba-830d-4035-bfe8-40b7e28f8ac4", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0010", - "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0010/" - }, - "technique": [ - { - "id": "T1048", - "name": "Exfiltration Over Alternative Protocol", - "reference": "https://attack.mitre.org/techniques/T1048/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an enterprise network, there is typically a dedicated internal host that performs this function. It is also frequently abused by threat actors for command and control, or data exfiltration.", + "false_positives": [ + "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and personal devices may send email traffic to remote Internet destinations. In this case, such devices or networks can be excluded from this rule if this is expected behavior." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SMTP to the Internet", + "query": "network.transport:tcp and destination.port:(25 or 465 or 587) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "67a9beba-830d-4035-bfe8-40b7e28f8ac4", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json index 6bec24199b3eb..3a5bd5bff98f5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects events that may describe database traffic (MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases should almost never be directly exposed to the Internet, as they are frequently targeted by threat actors to gain initial access to network resources.", - "false_positives": [ - "Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and database instances are accessed directly across the Internet." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SQL Traffic to the Internet", - "query": "network.transport:tcp and destination.port:(1433 or 1521 or 3336 or 5432) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "139c7458-566a-410c-a5cd-f80238d6a5cd", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects events that may describe database traffic (MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases should almost never be directly exposed to the Internet, as they are frequently targeted by threat actors to gain initial access to network resources.", + "false_positives": [ + "Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and database instances are accessed directly across the Internet." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SQL Traffic to the Internet", + "query": "network.transport:tcp and destination.port:(1433 or 1521 or 3336 or 5432) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "139c7458-566a-410c-a5cd-f80238d6a5cd", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json index 7c7aab3da16c9..429a91183e88a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json @@ -1,68 +1,68 @@ -{ - "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SSH (Secure Shell) from the Internet", - "query": "network.transport:tcp and destination.port:22 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 47, - "rule_id": "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SSH (Secure Shell) from the Internet", + "query": "network.transport:tcp and destination.port:22 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 47, + "rule_id": "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json index aa5afd1dcb177..a260245b4dade 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "SSH connections may be made directly to Internet destinations in order to access Linux cloud server instances but such connections are usually made only by engineers. In such cases, only SSH gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "SSH (Secure Shell) to the Internet", - "query": "network.transport:tcp and destination.port:22 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 21, - "rule_id": "6f1500bc-62d7-4eb9-8601-7485e87da2f4", - "severity": "low", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "SSH connections may be made directly to Internet destinations in order to access Linux cloud server instances but such connections are usually made only by engineers. In such cases, only SSH gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "SSH (Secure Shell) to the Internet", + "query": "network.transport:tcp and destination.port:22 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 21, + "rule_id": "6f1500bc-62d7-4eb9-8601-7485e87da2f4", + "severity": "low", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json index 9d9dc31f28320..4cfe15683c825 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json @@ -1,68 +1,68 @@ -{ - "description": "This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embed ed systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.", - "false_positives": [ - "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "Telnet Port Activity", - "query": "network.transport:tcp and destination.port:23", - "risk_score": 47, - "rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embed ed systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.", + "false_positives": [ + "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "Telnet Port Activity", + "query": "network.transport:tcp and destination.port:23", + "risk_score": 47, + "rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json index 57e8dd9e35bdd..8c8bb809c9fec 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects network events that may indicate the use of Tor traffic to the Internet. Tor is a network protocol that sends traffic through a series of encrypted tunnels used to conceal a user's location and usage. Tor may be used by threat actors as an alternate communication pathway to conceal the actor's identity and avoid detection.", - "false_positives": [ - "Tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used one of these ports by coincidence. In this case, such servers can be excluded if desired." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "Tor Activity to the Internet", - "query": "network.transport:tcp and destination.port:(9001 or 9030) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "7d2c38d7-ede7-4bdf-b140-445906e6c540", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1188", - "name": "Multi-hop Proxy", - "reference": "https://attack.mitre.org/techniques/T1188/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of Tor traffic to the Internet. Tor is a network protocol that sends traffic through a series of encrypted tunnels used to conceal a user's location and usage. Tor may be used by threat actors as an alternate communication pathway to conceal the actor's identity and avoid detection.", + "false_positives": [ + "Tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used one of these ports by coincidence. In this case, such servers can be excluded if desired." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "Tor Activity to the Internet", + "query": "network.transport:tcp and destination.port:(9001 or 9030) and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "7d2c38d7-ede7-4bdf-b140-445906e6c540", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1188", + "name": "Multi-hop Proxy", + "reference": "https://attack.mitre.org/techniques/T1188/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json index 18c65dcae6b3d..4204a4fe62e88 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "VNC (Virtual Network Computing) from the Internet", - "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 73, - "rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8", - "severity": "high", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1219", - "name": "Remote Access Tools", - "reference": "https://attack.mitre.org/techniques/T1219/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" - }, - "technique": [ - { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "VNC (Virtual Network Computing) from the Internet", + "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\") and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 73, + "rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8", + "severity": "high", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Tools", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json index 3c155d672bb50..898282e36df19 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json @@ -1,38 +1,38 @@ -{ - "description": "This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", - "false_positives": [ - "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." - ], - "index": [ - "filebeat-*" - ], - "language": "kuery", - "name": "VNC (Virtual Network Computing) to the Internet", - "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", - "risk_score": 47, - "rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf", - "severity": "medium", - "tags": [ - "Elastic", - "Network" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1219", - "name": "Remote Access Tools", - "reference": "https://attack.mitre.org/techniques/T1219/" - } - ] - } - ], - "type": "query", - "version": 3 +{ + "description": "This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector.", + "false_positives": [ + "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "index": [ + "filebeat-*" + ], + "language": "kuery", + "name": "VNC (Virtual Network Computing) to the Internet", + "query": "network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or \"::1\")", + "risk_score": 47, + "rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf", + "severity": "medium", + "tags": [ + "Elastic", + "Network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Tools", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + } + ], + "type": "query", + "version": 3 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json index fc5edbc810530..01246de5595e9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json @@ -1,42 +1,42 @@ -{ - "description": "A request to a web application server contained no identifying user agent string.", - "false_positives": [ - "Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." - ], - "filters": [ - { - "$state": { - "store": "appState" - }, - "exists": { - "field": "user_agent.original" - }, - "meta": { - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "user_agent.original", - "negate": true, - "type": "exists", - "value": "exists" - } - } - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: No User Agent", - "query": "url.path:*", - "references": [ - "https://en.wikipedia.org/wiki/User_agent" - ], - "risk_score": 47, - "rule_id": "43303fd4-4839-4e48-b2b2-803ab060758d", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 2 +{ + "description": "A request to a web application server contained no identifying user agent string.", + "false_positives": [ + "Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity." + ], + "filters": [ + { + "$state": { + "store": "appState" + }, + "exists": { + "field": "user_agent.original" + }, + "meta": { + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "user_agent.original", + "negate": true, + "type": "exists", + "value": "exists" + } + } + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: No User Agent", + "query": "url.path:*", + "references": [ + "https://en.wikipedia.org/wiki/User_agent" + ], + "risk_score": 47, + "rule_id": "43303fd4-4839-4e48-b2b2-803ab060758d", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json index a6fc753c8a3e8..c70725dcb645a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", - "false_positives": [ - "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this signal and such parent domains can be excluded." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_dns_tunneling", - "name": "DNS Tunneling", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "91f02f01-969f-4167-8f66-07827ac3bdd9", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", + "false_positives": [ + "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this signal and such parent domains can be excluded." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_dns_tunneling", + "name": "DNS Tunneling", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8f66-07827ac3bdd9", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json index b73140ad9d87c..3ed40ddf27864 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal. Network activity that occurs rarely, in small quantities, can trigger this signal. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_dns_question", - "name": "Unusual DNS Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "746edc4c-c54c-49c6-97a1-651223819448", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal. Network activity that occurs rarely, in small quantities, can trigger this signal. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_dns_question", + "name": "Unusual DNS Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "746edc4c-c54c-49c6-97a1-651223819448", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json index 3235b5b71fdf2..c49bc95be75d2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", - "false_positives": [ - "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_server_domain", - "name": "Unusual Network Destination Domain Name", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "17e68559-b274-4948-ad0b-f8415bb31126", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", + "false_positives": [ + "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_server_domain", + "name": "Unusual Network Destination Domain Name", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "17e68559-b274-4948-ad0b-f8415bb31126", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json index b70de10dfc6c9..02a4a5f729a16 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic.", - "false_positives": [ - "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_urls", - "name": "Unusual Web Request", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "91f02f01-969f-4167-8f55-07827ac3acc9", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic.", + "false_positives": [ + "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_urls", + "name": "Unusual Web Request", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8f55-07827ac3acc9", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json index f67d6c393c082..76ed6b263a704 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity.", - "false_positives": [ - "Web activity that is uncommon, like security scans, may trigger this signal and may need to be excluded. A new or rarely used program that calls web services may trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "packetbeat_rare_user_agent", - "name": "Unusual Web User Agent", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "91f02f01-969f-4167-8d77-07827ac4cee0", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Packetbeat" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity.", + "false_positives": [ + "Web activity that is uncommon, like security scans, may trigger this signal and may need to be excluded. A new or rarely used program that calls web services may trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "packetbeat_rare_user_agent", + "name": "Unusual Web User Agent", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8d77-07827ac4cee0", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Packetbeat" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json index a731a23ccb96c..048f93e170656 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "rare_process_by_host_linux_ecs", - "name": "Unusual Process For a Linux Host", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "46f804f5-b289-43d6-a881-9387cf594f75", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "rare_process_by_host_linux_ecs", + "name": "Unusual Process For a Linux Host", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "46f804f5-b289-43d6-a881-9387cf594f75", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json index 496c9204c5b44..7bc46cdc04dd2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "rare_process_by_host_windows_ecs", - "name": "Unusual Process For a Windows Host", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "6d448b96-c922-4adb-b51c-b767f1ea5b76", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "rare_process_by_host_windows_ecs", + "name": "Unusual Process For a Windows Host", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "6d448b96-c922-4adb-b51c-b767f1ea5b76", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json index 4f1efa5ada063..10412c19da1b1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json @@ -1,24 +1,24 @@ -{ - "description": "This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.", - "false_positives": [ - "This rule does not indicate that a SQL injection attack occurred, only that the `sqlmap` tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity." - ], - "index": [ - "apm-*-transaction*" - ], - "language": "kuery", - "name": "Web Application Suspicious Activity: sqlmap User Agent", - "query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"", - "references": [ - "http://sqlmap.org/" - ], - "risk_score": 47, - "rule_id": "d49cc73f-7a16-4def-89ce-9fc7127d7820", - "severity": "medium", - "tags": [ - "APM", - "Elastic" - ], - "type": "query", - "version": 2 +{ + "description": "This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.", + "false_positives": [ + "This rule does not indicate that a SQL injection attack occurred, only that the `sqlmap` tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity." + ], + "index": [ + "apm-*-transaction*" + ], + "language": "kuery", + "name": "Web Application Suspicious Activity: sqlmap User Agent", + "query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"", + "references": [ + "http://sqlmap.org/" + ], + "risk_score": 47, + "rule_id": "d49cc73f-7a16-4def-89ce-9fc7127d7820", + "severity": "medium", + "tags": [ + "APM", + "Elastic" + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json index c723d42cc061d..915bc1bcfc051 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies an unusually high number of authentication attempts.", - "false_positives": [ - "Security audits may trigger this signal. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "suspicious_login_activity_ecs", - "name": "Unusual Login Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "4330272b-9724-4bc6-a3ca-f1532b81e5c2", - "severity": "low", - "tags": [ - "Elastic", - "Linux", - "ML" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies an unusually high number of authentication attempts.", + "false_positives": [ + "Security audits may trigger this signal. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "suspicious_login_activity_ecs", + "name": "Unusual Login Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "4330272b-9724-4bc6-a3ca-f1532b81e5c2", + "severity": "low", + "tags": [ + "Elastic", + "Linux", + "ML" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json index f9154551e7e09..72671760c9c8d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", - "false_positives": [ - "A newly installed program or one that rarely uses the network could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_network_activity_ecs", - "name": "Unusual Windows Network Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "ba342eb2-583c-439f-b04d-1fdd7c1417cc", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_network_activity_ecs", + "name": "Unusual Windows Network Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "ba342eb2-583c-439f-b04d-1fdd7c1417cc", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json index 58c407c7f9c6b..082fce438ca9e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware.", - "false_positives": [ - "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_path_activity_ecs", - "name": "Unusual Windows Path Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "445a342e-03fb-42d0-8656-0367eb2dead5", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware.", + "false_positives": [ + "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_path_activity_ecs", + "name": "Unusual Windows Path Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "445a342e-03fb-42d0-8656-0367eb2dead5", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json index fbaa92145899c..93469b5a06223 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_process_all_hosts_ecs", - "name": "Anomalous Process For a Windows Population", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "6e40d56f-5c0e-4ac6-aece-bee96645b172", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_process_all_hosts_ecs", + "name": "Anomalous Process For a Windows Population", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "6e40d56f-5c0e-4ac6-aece-bee96645b172", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json index 39c7965ea8534..1b80e443baae6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners.", - "false_positives": [ - "Users running scripts in the course of technical support operations of software upgrades could trigger this signal. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_process_creation", - "name": "Anomalous Windows Process Creation", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners.", + "false_positives": [ + "Users running scripts in the course of technical support operations of software upgrades could trigger this signal. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_process_creation", + "name": "Anomalous Windows Process Creation", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json index 477222667a504..4de5443bcaf3f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks.", - "false_positives": [ - "Certain kinds of security testing may trigger this signal. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_script", - "name": "Suspicious Powershell Script", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9d60-fc0fa58337b6", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks.", + "false_positives": [ + "Certain kinds of security testing may trigger this signal. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_script", + "name": "Suspicious Powershell Script", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9d60-fc0fa58337b6", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json index 0dc1597627fcc..7e0641fee68c2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.", - "false_positives": [ - "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_service", - "name": "Unusual Windows Service", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9c71-fc0fa58338c7", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_service", + "name": "Unusual Windows Service", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9c71-fc0fa58338c7", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json index b6a54cdad7d0b..217404b6eb474 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", - "false_positives": [ - "Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_anomalous_user_name_ecs", - "name": "Unusual Windows Username", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9c59-fc0fa58336a5", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", + "false_positives": [ + "Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_anomalous_user_name_ecs", + "name": "Unusual Windows Username", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9c59-fc0fa58336a5", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json index db75515684155..52a373e3aeb77 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_network_connection.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Certutil", - "query": "process.name:certutil.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1105", - "name": "Remote File Copy", - "reference": "https://attack.mitre.org/techniques/T1105/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Certutil", + "query": "process.name:certutil.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Remote File Copy", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json index f8b8bcf64d5b7..2bee265a74e11 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL.", - "false_positives": [ - "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Command Prompt Network Connection", - "query": "process.name:cmd.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command-Line Interface", - "reference": "https://attack.mitre.org/techniques/T1059/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1105", - "name": "Remote File Copy", - "reference": "https://attack.mitre.org/techniques/T1105/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL.", + "false_positives": [ + "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Command Prompt Network Connection", + "query": "process.name:cmd.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Remote File Copy", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json index fac5bf924c86e..d8f91dba7dd89 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json @@ -1,50 +1,50 @@ -{ - "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "PowerShell spawning Cmd", - "query": "process.parent.name:powershell.exe and process.name:cmd.exe", - "risk_score": 21, - "rule_id": "0f616aee-8161-4120-857e-742366f5eeb3", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command-Line Interface", - "reference": "https://attack.mitre.org/techniques/T1059/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1086", - "name": "PowerShell", - "reference": "https://attack.mitre.org/techniques/T1086/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "PowerShell spawning Cmd", + "query": "process.parent.name:powershell.exe and process.name:cmd.exe", + "risk_score": 21, + "rule_id": "0f616aee-8161-4120-857e-742366f5eeb3", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1086", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1086/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json index 5c6a7f9f996e3..6fd194ee2fa22 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Svchost spawning Cmd", - "query": "process.parent.name:svchost.exe and process.name:cmd.exe", - "risk_score": 21, - "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command-Line Interface", - "reference": "https://attack.mitre.org/techniques/T1059/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Svchost spawning Cmd", + "query": "process.parent.name:svchost.exe and process.name:cmd.exe", + "risk_score": 21, + "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json index bf5a89b2e1a68..43050e2769a24 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_msbuild.json @@ -1,38 +1,38 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Loading Windows Credential Libraries", - "query": "(winlog.event_data.OriginalFileName: (vaultcli.dll or SAMLib.DLL) or dll.name: (vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe and event.action: \"Image loaded (rule: ImageLoad)\"", - "risk_score": 73, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1003", - "name": "Credential Dumping", - "reference": "https://attack.mitre.org/techniques/T1003/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Loading Windows Credential Libraries", + "query": "(winlog.event_data.OriginalFileName: (vaultcli.dll or SAMLib.DLL) or dll.name: (vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe and event.action: \"Image loaded (rule: ImageLoad)\"", + "risk_score": 73, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json index 878494b902736..f5eb37c70d268 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_cve_2020_0601.json @@ -1,35 +1,35 @@ -{ - "description": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)", - "query": "event.provider:\"Microsoft-Windows-Audit-CVE\" and message:\"[CVE-2020-0601]\"", - "risk_score": 21, - "rule_id": "56557cde-d923-4b88-adee-c61b3f3b5dc3", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1116", - "name": "Code Signing", - "reference": "https://attack.mitre.org/techniques/T1116/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)", + "query": "event.provider:\"Microsoft-Windows-Audit-CVE\" and message:\"[CVE-2020-0601]\"", + "risk_score": 21, + "rule_id": "56557cde-d923-4b88-adee-c61b3f3b5dc3", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1116", + "name": "Code Signing", + "reference": "https://attack.mitre.org/techniques/T1116/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json index d15bc671599f8..0e8c5a5f2f631 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json @@ -1,35 +1,35 @@ -{ - "description": "The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Potential Evasion via Filter Manager", - "query": "event.code:1 and process.name:fltMC.exe", - "risk_score": 21, - "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1222", - "name": "File and Directory Permissions Modification", - "reference": "https://attack.mitre.org/techniques/T1222/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Potential Evasion via Filter Manager", + "query": "event.code:1 and process.name:fltMC.exe", + "risk_score": 21, + "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json index 1c7426ebbf9e1..72e02f8718d03 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_office_app.json @@ -1,56 +1,56 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. It is quite unusual for this program to be started by an Office application like Word or Excel." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started by an Office Application", - "query": "process.name:MSBuild.exe and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or outlook.exe or powerpnt.exe or winword.exe) and event.action: \"Process Create (rule: ProcessCreate)\"", - "references": [ - "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" - ], - "risk_score": 73, - "rule_id": "c5dc3223-13a2-44a2-946c-e9dc0aa0449c", - "severity": "high", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. It is quite unusual for this program to be started by an Office application like Word or Excel." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started by an Office Application", + "query": "process.name:MSBuild.exe and process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or msaccess.exe or mspub.exe or outlook.exe or powerpnt.exe or winword.exe) and event.action: \"Process Create (rule: ProcessCreate)\"", + "references": [ + "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" + ], + "risk_score": 73, + "rule_id": "c5dc3223-13a2-44a2-946c-e9dc0aa0449c", + "severity": "high", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json index 7a390b45a9918..ad519f1516aa6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_script.json @@ -1,53 +1,53 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started by a Script Process", - "query": "process.name:MSBuild.exe and process.parent.name:(cmd.exe or powershell.exe or cscript.exe or wscript.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started by a Script Process", + "query": "process.name:MSBuild.exe and process.parent.name:(cmd.exe or powershell.exe or cscript.exe or wscript.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json index 47ef24a888f6d..1bbce904f2518 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_by_system_process.json @@ -1,53 +1,53 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started by a System Process", - "query": "process.name:MSBuild.exe and process.parent.name:(explorer.exe or wmiprvse.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 47, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3", - "severity": "medium", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started by a System Process", + "query": "process.name:MSBuild.exe and process.parent.name:(explorer.exe or wmiprvse.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 47, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3", + "severity": "medium", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json index c14f134d1365a..eea4b3b4efe10 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_renamed.json @@ -1,38 +1,38 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Using an Alternate Name", - "query": "(pe.original_file_name:MSBuild.exe or winlog.event_data.OriginalFileName: MSBuild.exe) and not process.name: MSBuild.exe and event.action: \"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1036", - "name": "Masquerading", - "reference": "https://attack.mitre.org/techniques/T1036/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Using an Alternate Name", + "query": "(pe.original_file_name:MSBuild.exe or winlog.event_data.OriginalFileName: MSBuild.exe) and not process.name: MSBuild.exe and event.action: \"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json index 920a991e9ed57..81ea14e265388 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_msbuild_started_unusal_process.json @@ -1,41 +1,41 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. If a build system triggers this rule it can be exempted by process, user or host name." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Microsoft Build Engine Started an Unusual Process", - "query": "process.parent.name:MSBuild.exe and process.name:(csc.exe or iexplore.exe or powershell.exe)", - "references": [ - "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" - ], - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1500", - "name": "Compile After Delivery", - "reference": "https://attack.mitre.org/techniques/T1500/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. If a build system triggers this rule it can be exempted by process, user or host name." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Microsoft Build Engine Started an Unusual Process", + "query": "process.parent.name:MSBuild.exe and process.name:(csc.exe or iexplore.exe or powershell.exe)", + "references": [ + "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" + ], + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1500", + "name": "Compile After Delivery", + "reference": "https://attack.mitre.org/techniques/T1500/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json index 9c03844194af4..7755ff0233f7c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json @@ -1,53 +1,53 @@ -{ - "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", - "false_positives": [ - "The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process Activity via Compiled HTML File", - "query": "event.code:1 and process.name:hh.exe", - "risk_score": 21, - "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "false_positives": [ + "The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Process Activity via Compiled HTML File", + "query": "event.code:1 and process.name:hh.exe", + "risk_score": 21, + "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json index ddc9c47a4dbb5..d6acb81c10e3f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json @@ -1,50 +1,50 @@ -{ - "description": "RegSvcs.exe and RegAsm.exe are Windows command line utilities that are used to register .NET Component Object Model (COM) assemblies. Adversaries can use RegSvcs.exe and RegAsm.exe to proxy execution of code through a trusted Windows utility.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Execution via Regsvcs/Regasm", - "query": "process.name:(RegAsm.exe or RegSvcs.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "47f09343-8d1f-4bb5-8bb0-00c9d18f5010", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1121", - "name": "Regsvcs/Regasm", - "reference": "https://attack.mitre.org/techniques/T1121/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1121", - "name": "Regsvcs/Regasm", - "reference": "https://attack.mitre.org/techniques/T1121/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "RegSvcs.exe and RegAsm.exe are Windows command line utilities that are used to register .NET Component Object Model (COM) assemblies. Adversaries can use RegSvcs.exe and RegAsm.exe to proxy execution of code through a trusted Windows utility.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Execution via Regsvcs/Regasm", + "query": "process.name:(RegAsm.exe or RegSvcs.exe) and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "47f09343-8d1f-4bb5-8bb0-00c9d18f5010", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1121", + "name": "Regsvcs/Regasm", + "reference": "https://attack.mitre.org/techniques/T1121/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1121", + "name": "Regsvcs/Regasm", + "reference": "https://attack.mitre.org/techniques/T1121/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json index f0fd1b49a261e..87e38febb0743 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies possibly suspicious activity using trusted Windows developer activity.", - "false_positives": [ - "These programs may be used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Trusted Developer Application Usage", - "query": "event.code:1 and process.name:(MSBuild.exe or msxsl.exe)", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1127", - "name": "Trusted Developer Utilities", - "reference": "https://attack.mitre.org/techniques/T1127/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies possibly suspicious activity using trusted Windows developer activity.", + "false_positives": [ + "These programs may be used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Trusted Developer Application Usage", + "query": "event.code:1 and process.name:(MSBuild.exe or msxsl.exe)", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json index cfc5af3dc82d4..6c8cd0673256a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json @@ -1,50 +1,50 @@ -{ - "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Compiled HTML File", - "query": "process.name:hh.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1223", - "name": "Compiled HTML File", - "reference": "https://attack.mitre.org/techniques/T1223/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Compiled HTML File", + "query": "process.name:hh.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json index 9f6946c46a2c9..c6310c12ed974 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_injection_msbuild.json @@ -1,53 +1,53 @@ -{ - "description": "An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges.", - "false_positives": [ - "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process Injection by the Microsoft Build Engine", - "query": "process.name:MSBuild.exe and event.action:\"CreateRemoteThread detected (rule: CreateRemoteThread)\"", - "risk_score": 21, - "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1055", - "name": "Process Injection", - "reference": "https://attack.mitre.org/techniques/T1055/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1055", - "name": "Process Injection", - "reference": "https://attack.mitre.org/techniques/T1055/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Process Injection by the Microsoft Build Engine", + "query": "process.name:MSBuild.exe and event.action:\"CreateRemoteThread detected (rule: CreateRemoteThread)\"", + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json index 131c7708493e2..a0e311d8eb154 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json @@ -1,50 +1,50 @@ -{ - "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Signed Binary", - "query": "process.name:(expand.exe or extrac.exe or ieexec.exe or makecab.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1218", - "name": "Signed Binary Proxy Execution", - "reference": "https://attack.mitre.org/techniques/T1218/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1218", - "name": "Signed Binary Proxy Execution", - "reference": "https://attack.mitre.org/techniques/T1218/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Signed Binary", + "query": "process.name:(expand.exe or extrac.exe or ieexec.exe or makecab.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json index 98eb3ca8dfb80..045a9789b1260 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_modification_of_boot_config.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Modification of Boot Configuration", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:bcdedit.exe and process.args:(/set and (bootstatuspolicy and ignoreallfailures or no and recoveryenabled))", - "risk_score": 21, - "rule_id": "69c251fb-a5d6-4035-b5ec-40438bd829ff", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1107", - "name": "File Deletion", - "reference": "https://attack.mitre.org/techniques/T1107/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Modification of Boot Configuration", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:bcdedit.exe and process.args:(/set and (bootstatuspolicy and ignoreallfailures or no and recoveryenabled))", + "risk_score": 21, + "rule_id": "69c251fb-a5d6-4035-b5ec-40438bd829ff", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1107", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1107/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json index 633ac503b13ec..e80dcde1e398d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_msxsl_network.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via MsXsl", - "query": "process.name:msxsl.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "b86afe07-0d98-4738-b15d-8d7465f95ff5", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1220", - "name": "XSL Script Processing", - "reference": "https://attack.mitre.org/techniques/T1220/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via MsXsl", + "query": "process.name:msxsl.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "b86afe07-0d98-4738-b15d-8d7465f95ff5", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1220", + "name": "XSL Script Processing", + "reference": "https://attack.mitre.org/techniques/T1220/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json index d538ec7c4d2b7..c2379142df002 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_system_account.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies the SYSTEM account using the Net utility. The Net utility is a component of the Windows operating system. It is used in command line operations for control of users, groups, services, and network connections.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Net command via SYSTEM account", - "query": "(process.name:net.exe or process.name:net1.exe and not process.parent.name:net.exe) and user.name:SYSTEM and event.action:\"Process Create (rule: ProcessCreate)\"", - "risk_score": 21, - "rule_id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1087", - "name": "Account Discovery", - "reference": "https://attack.mitre.org/techniques/T1087/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies the SYSTEM account using the Net utility. The Net utility is a component of the Windows operating system. It is used in command line operations for control of users, groups, services, and network connections.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Net command via SYSTEM account", + "query": "(process.name:net.exe or process.name:net1.exe and not process.parent.name:net.exe) and user.name:SYSTEM and event.action:\"Process Create (rule: ProcessCreate)\"", + "risk_score": 21, + "rule_id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json index c6cfa6d9738ea..2f44727f9e6f0 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json @@ -1,50 +1,50 @@ -{ - "description": "The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Potential Application Shimming via Sdbinst", - "query": "event.code:1 and process.name:sdbinst.exe", - "risk_score": 21, - "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1138", - "name": "Application Shimming", - "reference": "https://attack.mitre.org/techniques/T1138/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1138", - "name": "Application Shimming", - "reference": "https://attack.mitre.org/techniques/T1138/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Potential Application Shimming via Sdbinst", + "query": "event.code:1 and process.name:sdbinst.exe", + "risk_score": 21, + "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1138", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1138/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1138", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1138/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json index 3982c57303ab8..aeff071ed4514 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json @@ -1,50 +1,50 @@ -{ - "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Potential Modification of Accessibility Binaries", - "query": "event.code:1 and process.parent.name:winlogon.exe and process.name:(atbroker.exe or displayswitch.exe or magnify.exe or narrator.exe or osk.exe or sethc.exe or utilman.exe)", - "risk_score": 21, - "rule_id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0003", - "name": "Persistence", - "reference": "https://attack.mitre.org/tactics/TA0003/" - }, - "technique": [ - { - "id": "T1015", - "name": "Accessibility Features", - "reference": "https://attack.mitre.org/techniques/T1015/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1015", - "name": "Accessibility Features", - "reference": "https://attack.mitre.org/techniques/T1015/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Potential Modification of Accessibility Binaries", + "query": "event.code:1 and process.parent.name:winlogon.exe and process.name:(atbroker.exe or displayswitch.exe or magnify.exe or narrator.exe or osk.exe or sethc.exe or utilman.exe)", + "risk_score": 21, + "rule_id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1015", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1015/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1015", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1015/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json index 2b5338a716781..3a883fa51b763 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json @@ -1,38 +1,38 @@ -{ - "description": "Adversaries may attempt to get information about running processes on a system.", - "false_positives": [ - "Administrators may use the tasklist command to display a list of currently running processes. By itself, it does not indicate malicious activity. After obtaining a foothold, it's possible adversaries may use discovery commands like tasklist to get information about running processes." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process Discovery via Tasklist", - "query": "event.code:1 and process.name:tasklist.exe", - "risk_score": 21, - "rule_id": "cc16f774-59f9-462d-8b98-d27ccd4519ec", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1057", - "name": "Process Discovery", - "reference": "https://attack.mitre.org/techniques/T1057/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Adversaries may attempt to get information about running processes on a system.", + "false_positives": [ + "Administrators may use the tasklist command to display a list of currently running processes. By itself, it does not indicate malicious activity. After obtaining a foothold, it's possible adversaries may use discovery commands like tasklist to get information about running processes." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Process Discovery via Tasklist", + "query": "event.code:1 and process.name:tasklist.exe", + "risk_score": 21, + "rule_id": "cc16f774-59f9-462d-8b98-d27ccd4519ec", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json index 01be55e536e6e..3dca119b5a28e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users.", - "false_positives": [ - "Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_rare_user_runas_event", - "name": "Unusual Windows User Privilege Elevation Activity", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9d82-fc0fa58449c8", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users.", + "false_positives": [ + "Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_rare_user_runas_event", + "name": "Unusual Windows User Privilege Elevation Activity", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9d82-fc0fa58449c8", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json index 82ae48e5e8ea0..09ff2a0cedf41 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json @@ -1,24 +1,24 @@ -{ - "anomaly_threshold": 50, - "description": "A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames.", - "false_positives": [ - "Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." - ], - "from": "now-16m", - "interval": "15m", - "machine_learning_job_id": "windows_rare_user_type10_remote_login", - "name": "Unusual Windows Remote User", - "references": [ - "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" - ], - "risk_score": 21, - "rule_id": "1781d055-5c66-4adf-9e93-fc0fa69550c9", - "severity": "low", - "tags": [ - "Elastic", - "ML", - "Windows" - ], - "type": "machine_learning", - "version": 1 +{ + "anomaly_threshold": 50, + "description": "A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames.", + "false_positives": [ + "Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-16m", + "interval": "15m", + "machine_learning_job_id": "windows_rare_user_type10_remote_login", + "name": "Unusual Windows Remote User", + "references": [ + "https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html" + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9e93-fc0fa69550c9", + "severity": "low", + "tags": [ + "Elastic", + "ML", + "Windows" + ], + "type": "machine_learning", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json index bdf51b4538692..1e061f2ef9463 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json @@ -1,53 +1,53 @@ -{ - "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", - "false_positives": [ - "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network Connection via Regsvr", - "query": "process.name:(regsvr32.exe or regsvr64.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 169.254.169.254 or 172.16.0.0/12 or 192.168.0.0/16)", - "risk_score": 21, - "rule_id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1117", - "name": "Regsvr32", - "reference": "https://attack.mitre.org/techniques/T1117/" - } - ] - }, - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0005", - "name": "Defense Evasion", - "reference": "https://attack.mitre.org/tactics/TA0005/" - }, - "technique": [ - { - "id": "T1117", - "name": "Regsvr32", - "reference": "https://attack.mitre.org/techniques/T1117/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Network Connection via Regsvr", + "query": "process.name:(regsvr32.exe or regsvr64.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:(10.0.0.0/8 or 169.254.169.254 or 172.16.0.0/12 or 192.168.0.0/16)", + "risk_score": 21, + "rule_id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1117", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1117/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1117", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1117/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json index cac51f6a50c07..9d4c2438acfb9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_pdf_reader.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Suspicious PDF Reader Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(AcroRd32.exe or Acrobat.exe or FoxitPhantomPDF.exe or FoxitReader.exe) and process.name:(arp.exe or dsquery.exe or dsget.exe or gpresult.exe or hostname.exe or ipconfig.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or ping.exe or qprocess.exe or quser.exe or qwinsta.exe or reg.exe or sc.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or installutil.exe or Microsoft.Workflow.Compiler.exe or msbuild.exe or mshta.exe or msxsl.exe or odbcconf.exe or rcsi.exe or regsvr32.exe or xwizard.exe or atbroker.exe or forfiles.exe or schtasks.exe or regasm.exe or regsvcs.exe or cmd.exe or cscript.exe or powershell.exe or pwsh.exe or wmic.exe or wscript.exe or bitsadmin.exe or certutil.exe or ftp.exe)", - "risk_score": 21, - "rule_id": "53a26770-9cbd-40c5-8b57-61d01a325e14", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1204", - "name": "User Execution", - "reference": "https://attack.mitre.org/techniques/T1204/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Suspicious PDF Reader Child Process", + "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(AcroRd32.exe or Acrobat.exe or FoxitPhantomPDF.exe or FoxitReader.exe) and process.name:(arp.exe or dsquery.exe or dsget.exe or gpresult.exe or hostname.exe or ipconfig.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or nltest.exe or ping.exe or qprocess.exe or quser.exe or qwinsta.exe or reg.exe or sc.exe or systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or installutil.exe or Microsoft.Workflow.Compiler.exe or msbuild.exe or mshta.exe or msxsl.exe or odbcconf.exe or rcsi.exe or regsvr32.exe or xwizard.exe or atbroker.exe or forfiles.exe or schtasks.exe or regasm.exe or regsvcs.exe or cmd.exe or cscript.exe or powershell.exe or pwsh.exe or wmic.exe or wscript.exe or bitsadmin.exe or certutil.exe or ftp.exe)", + "risk_score": 21, + "rule_id": "53a26770-9cbd-40c5-8b57-61d01a325e14", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json index 0796c5904e44e..df7a6fe1285d1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_uac_bypass_event_viewer.json @@ -1,35 +1,35 @@ -{ - "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Bypass UAC via Event Viewer", - "query": "process.parent.name:eventvwr.exe and event.action:\"Process Create (rule: ProcessCreate)\" and not process.executable:(\"C:\\Windows\\SysWOW64\\mmc.exe\" or \"C:\\Windows\\System32\\mmc.exe\")", - "risk_score": 21, - "rule_id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1088", - "name": "Bypass User Account Control", - "reference": "https://attack.mitre.org/techniques/T1088/" - } - ] - } - ], - "type": "query", - "version": 1 +{ + "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Bypass UAC via Event Viewer", + "query": "process.parent.name:eventvwr.exe and event.action:\"Process Create (rule: ProcessCreate)\" and not process.executable:(\"C:\\Windows\\SysWOW64\\mmc.exe\" or \"C:\\Windows\\System32\\mmc.exe\")", + "risk_score": 21, + "rule_id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1088", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1088/" + } + ] + } + ], + "type": "query", + "version": 1 } \ No newline at end of file diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json index b5cff435d4b75..93ce1f83dd64e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json @@ -1,38 +1,38 @@ -{ - "description": "Identifies use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.", - "false_positives": [ - "Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual." - ], - "index": [ - "winlogbeat-*" - ], - "language": "kuery", - "name": "Whoami Process Activity", - "query": "process.name:whoami.exe and event.code:1", - "risk_score": 21, - "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", - "severity": "low", - "tags": [ - "Elastic", - "Windows" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0007", - "name": "Discovery", - "reference": "https://attack.mitre.org/tactics/TA0007/" - }, - "technique": [ - { - "id": "T1033", - "name": "System Owner/User Discovery", - "reference": "https://attack.mitre.org/techniques/T1033/" - } - ] - } - ], - "type": "query", - "version": 2 +{ + "description": "Identifies use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.", + "false_positives": [ + "Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual." + ], + "index": [ + "winlogbeat-*" + ], + "language": "kuery", + "name": "Whoami Process Activity", + "query": "process.name:whoami.exe and event.code:1", + "risk_score": 21, + "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", + "severity": "low", + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "type": "query", + "version": 2 } \ No newline at end of file From affcf46fdbc92fe37468117d93ad790c0ab698d1 Mon Sep 17 00:00:00 2001 From: Craig Date: Mon, 6 Apr 2020 20:32:54 -0400 Subject: [PATCH 5/8] delete two files for Garrett --- .../translations/translations/ja-JP.json | 16848 --------------- .../translations/translations/zh-CN.json | 16853 ---------------- 2 files changed, 33701 deletions(-) delete mode 100644 x-pack/plugins/translations/translations/ja-JP.json delete mode 100644 x-pack/plugins/translations/translations/zh-CN.json diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json deleted file mode 100644 index 023a97274b957..0000000000000 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ /dev/null @@ -1,16848 +0,0 @@ -{ - "formats": { - "number": { - "currency": { - "style": "currency" - }, - "percent": { - "style": "percent" - } - }, - "date": { - "short": { - "month": "numeric", - "day": "numeric", - "year": "2-digit" - }, - "medium": { - "month": "short", - "day": "numeric", - "year": "numeric" - }, - "long": { - "month": "long", - "day": "numeric", - "year": "numeric" - }, - "full": { - "weekday": "long", - "month": "long", - "day": "numeric", - "year": "numeric" - } - }, - "time": { - "short": { - "hour": "numeric", - "minute": "numeric" - }, - "medium": { - "hour": "numeric", - "minute": "numeric", - "second": "numeric" - }, - "long": { - "hour": "numeric", - "minute": "numeric", - "second": "numeric", - "timeZoneName": "short" - }, - "full": { - "hour": "numeric", - "minute": "numeric", - "second": "numeric", - "timeZoneName": "short" - } - }, - "relative": { - "years": { - "units": "year" - }, - "months": { - "units": "month" - }, - "days": { - "units": "day" - }, - "hours": { - "units": "hour" - }, - "minutes": { - "units": "minute" - }, - "seconds": { - "units": "second" - } - } - }, - "messages": { - "advancedSettings.advancedSettingsLabel": "高度な設定", - "advancedSettings.badge.readOnly.text": "読み取り専用", - "advancedSettings.badge.readOnly.tooltip": "高度な設定を保存できません", - "advancedSettings.callOutCautionDescription": "これらの設定は非常に上級ユーザー向けなのでご注意ください。ここでの変更は Kibana の重要な部分に不具合を生じさせる可能性があります。これらの設定は非公開、サポート対象外、または実験的な場合があります。フィールドにデフォルト値がある場合、そのフィールドを未入力のままにするとデフォルトに戻り、他の構成で許容されないことがあります。カスタム設定を削除すると、Kibana の構成から永久に削除されます。", - "advancedSettings.callOutCautionTitle": "注意:不具合につながる可能性があります", - "advancedSettings.categoryNames.dashboardLabel": "ダッシュボード", - "advancedSettings.categoryNames.discoverLabel": "発見", - "advancedSettings.categoryNames.generalLabel": "一般", - "advancedSettings.categoryNames.notificationsLabel": "通知", - "advancedSettings.categoryNames.reportingLabel": "レポート", - "advancedSettings.categoryNames.searchLabel": "検索", - "advancedSettings.categoryNames.siemLabel": "SIEM", - "advancedSettings.categoryNames.timelionLabel": "Timelion", - "advancedSettings.categoryNames.visualizationsLabel": "可視化", - "advancedSettings.categorySearchLabel": "カテゴリー", - "advancedSettings.field.changeImageLinkAriaLabel": "{ariaName} を変更", - "advancedSettings.field.changeImageLinkText": "画像を変更", - "advancedSettings.field.codeEditorSyntaxErrorMessage": "無効な JSON 構文", - "advancedSettings.field.customSettingAriaLabel": "カスタム設定", - "advancedSettings.field.customSettingTooltip": "カスタム設定", - "advancedSettings.field.defaultValueText": "デフォルト: {value}", - "advancedSettings.field.defaultValueTypeJsonText": "デフォルト: {value}", - "advancedSettings.field.deprecationClickAreaLabel": "クリックすると {settingName} のサポート終了に関するドキュメントが表示されます。", - "advancedSettings.field.helpText": "この設定は Kibana サーバーにより上書きされ、変更することはできません。", - "advancedSettings.field.imageChangeErrorMessage": "画像を保存できませんでした", - "advancedSettings.field.imageTooLargeErrorMessage": "画像が大きすぎます。最大サイズは {maxSizeDescription} です", - "advancedSettings.field.invalidIconLabel": "無効", - "advancedSettings.field.offLabel": "オフ", - "advancedSettings.field.onLabel": "オン", - "advancedSettings.field.resetToDefaultLinkAriaLabel": "{ariaName} をデフォルトにリセット", - "advancedSettings.field.resetToDefaultLinkText": "デフォルトにリセット", - "advancedSettings.field.settingIsUnsaved": "設定は現在保存されていません。", - "advancedSettings.field.unsavedIconLabel": "未保存", - "advancedSettings.form.cancelButtonLabel": "変更をキャンセル", - "advancedSettings.form.clearNoSearchResultText": "(検索結果を消去)", - "advancedSettings.form.clearSearchResultText": "(検索結果を消去)", - "advancedSettings.form.countOfSettingsChanged": "{unsavedCount} unsaved {unsavedCount, plural, one {setting} other {settings} }{hiddenCount, plural, =0 {} other {, # hidden} }", - "advancedSettings.form.noSearchResultText": "設定が見つかりませんでした {clearSearch}", - "advancedSettings.form.requiresPageReloadToastButtonLabel": "ページを再読み込み", - "advancedSettings.form.requiresPageReloadToastDescription": "設定を有効にするためにページの再読み込みが必要です。", - "advancedSettings.form.saveButtonLabel": "変更を保存", - "advancedSettings.form.saveButtonTooltipWithInvalidChanges": "保存前に無効な設定を修正してください。", - "advancedSettings.form.saveErrorMessage": "を保存できませんでした", - "advancedSettings.form.searchResultText": "検索用語により {settingsCount} 件の設定が非表示になっています {clearSearch}", - "advancedSettings.pageTitle": "設定", - "advancedSettings.searchBar.unableToParseQueryErrorMessage": "クエリをパースできません", - "advancedSettings.searchBarAriaLabel": "高度な設定を検索", - "advancedSettings.voiceAnnouncement.searchResultScreenReaderMessage": "{query} を検索しました。{sectionLenght, plural, one {# セクション} other {# セクション}}に{optionLenght, plural, one {# オプション} other {# オプション}}があります。", - "charts.colormaps.bluesText": "青", - "charts.colormaps.greensText": "緑", - "charts.colormaps.greenToRedText": "緑から赤", - "charts.colormaps.greysText": "グレー", - "charts.colormaps.redsText": "赤", - "charts.colormaps.yellowToRedText": "黄色から赤", - "common.ui.aggResponse.allDocsTitle": "すべてのドキュメント", - "common.ui.errorAutoCreateIndex.breadcrumbs.errorText": "エラー", - "common.ui.errorAutoCreateIndex.errorDescription": "Elasticsearch クラスターの {autoCreateIndexActionConfig} 設定が原因で、Kibana が保存されたオブジェクトを格納するインデックスを自動的に作成できないようです。Kibana は、保存されたオブジェクトインデックスが適切なマッピング/スキーマを使用し Kibana から Elasticsearch へのポーリングの回数を減らすための最適な手段であるため、この Elasticsearch の機能を使用します。", - "common.ui.errorAutoCreateIndex.errorDisclaimer": "申し訳ございませんが、この問題が解決されるまで Kibana で何も保存することができません。", - "common.ui.errorAutoCreateIndex.errorTitle": "おっと！", - "common.ui.errorAutoCreateIndex.howToFixError.goBackText": "ブラウザの戻るボタンで前の画面に戻ります。", - "common.ui.errorAutoCreateIndex.howToFixError.removeConfigText": "Elasticsearch 構成ファイルから {autoCreateIndexActionConfig} を削除します。", - "common.ui.errorAutoCreateIndex.howToFixError.restartText": "Elasticsearch を再起動します。", - "common.ui.errorAutoCreateIndex.howToFixErrorTitle": "どうすれば良いのでしょう？", - "common.ui.errorAutoCreateIndex.noteImageAriaLabel": "情報", - "common.ui.errorAutoCreateIndex.noteMessage": "{autoCreateIndexActionConfig} は、機能を有効にするパターンのホワイトリストを定義することもできます。Kibana と同じ理由でこの機能を使用する他のプラグイン/操作をすべて把握する必要があるため、この設定のこのような使い方はここでは説明しません。", - "common.ui.errorAutoCreateIndex.noteTitle": "注：", - "common.ui.errorUrlOverflow.breadcrumbs.errorText": "エラー", - "common.ui.errorUrlOverflow.errorDescription": "とても長い URL ですね。残念なお知らせがあります。ご使用のブラウザは Kibana の超巨大 URL に対応していません。問題を避けるため、Kibana はご使用のブラウザでの URL を {urlCharacterLimit} 文字に制限します。", - "common.ui.errorUrlOverflow.errorTitle": "おっと！", - "common.ui.errorUrlOverflow.footnoteText": "脚注:パーティーサイズのキャンディバーはほんのちょこっと。パーティーサイズのロールサンドイッチは巨大。不思議なものですね。", - "common.ui.errorUrlOverflow.howTofixError.doNotUseIEText": "IE は避けましょう。他の対応ブラウザにはこの制限がありません。", - "common.ui.errorUrlOverflow.howTofixError.enableOptionText": "{kibanaSettingsLink} の {storeInSessionStorageConfig} オプションを有効にしてください。これにより URL が長くなるのを避けられますが、若干ポータビリティが損なわれます。", - "common.ui.errorUrlOverflow.howTofixError.enableOptionText.advancedSettingsLinkText": "高度な設定", - "common.ui.errorUrlOverflow.howTofixError.removeStuffFromDashboardText": "ダッシュボードからいくつか項目を取り除きましょう。これにより URL が短くなり、IE の動作が改善されます。", - "common.ui.errorUrlOverflow.howTofixErrorDescription": "これは大抵大規模で複雑なダッシュボードで起こるため、いくつかのオプションがあります。", - "common.ui.errorUrlOverflow.howTofixErrorTitle": "どうすれば良いのでしょう？", - "common.ui.fieldEditor.actions.cancelButton": "キャンセル", - "common.ui.fieldEditor.actions.createButton": "フィールドを作成", - "common.ui.fieldEditor.actions.deleteButton": "削除", - "common.ui.fieldEditor.actions.saveButton": "フィールドを保存", - "common.ui.fieldEditor.color.addColorButton": "色を追加", - "common.ui.fieldEditor.color.backgroundLabel": "背景色", - "common.ui.fieldEditor.color.deleteAria": "削除", - "common.ui.fieldEditor.color.deleteTitle": "色のフォーマットを削除", - "common.ui.fieldEditor.color.exampleLabel": "例", - "common.ui.fieldEditor.color.patternLabel": "パターン (正規表現)", - "common.ui.fieldEditor.color.rangeLabel": "範囲 (min:max)", - "common.ui.fieldEditor.color.textColorLabel": "文字の色", - "common.ui.fieldEditor.createHeader": "スクリプトフィールドを作成", - "common.ui.fieldEditor.date.documentationLabel": "ドキュメント", - "common.ui.fieldEditor.date.momentLabel": "Moment.js のフォーマットパターン (デフォルト: {defaultPattern})", - "common.ui.fieldEditor.defaultErrorMessage": "このフォーマット構成の使用を試みた際にエラーが発生しました: {message}", - "common.ui.fieldEditor.defaultFormatDropDown": "- デフォルト -", - "common.ui.fieldEditor.defaultFormatHeader": "フォーマット (デフォルト: {defaultFormat})", - "common.ui.fieldEditor.deleteField.cancelButton": "キャンセル", - "common.ui.fieldEditor.deleteField.deleteButton": "削除", - "common.ui.fieldEditor.deleteField.deletedHeader": "「{fieldName}」が削除されました", - "common.ui.fieldEditor.deleteField.savedHeader": "「{fieldName}」が保存されました", - "common.ui.fieldEditor.deleteFieldHeader": "フィールド「{fieldName}」を削除", - "common.ui.fieldEditor.deleteFieldLabel": "削除されたフィールドは復元できません。{separator}続行してよろしいですか？", - "common.ui.fieldEditor.disabledCallOutHeader": "スクリプティングが無効です", - "common.ui.fieldEditor.disabledCallOutLabel": "Elasticsearch でのすべてのインラインスクリプティングが無効になっています。Kibana でスクリプトフィールドを使用するには、インラインスクリプティングを有効にする必要があります。", - "common.ui.fieldEditor.duration.decimalPlacesLabel": "小数部分の桁数", - "common.ui.fieldEditor.duration.inputFormatLabel": "インプット形式", - "common.ui.fieldEditor.duration.outputFormatLabel": "アウトプット形式", - "common.ui.fieldEditor.durationErrorMessage": "小数部分の桁数は 0 から 20 までの間で指定する必要があります", - "common.ui.fieldEditor.editHeader": "{fieldName} を編集", - "common.ui.fieldEditor.fieldTypeConflict": "フィールドタイプの矛盾", - "common.ui.fieldEditor.formatHeader": "フォーマット", - "common.ui.fieldEditor.formatLabel": "フォーマットは、特定の値の表示形式を管理できます。また、値を完全に変更したり、ディスカバリでのハイライト機能を無効にしたりすることも可能です。", - "common.ui.fieldEditor.indexNameLabel": "インデックス名", - "common.ui.fieldEditor.labelTemplate.example.idLabel": "ユーザー #{value}", - "common.ui.fieldEditor.labelTemplate.example.output.idLabel": "ユーザー", - "common.ui.fieldEditor.labelTemplate.example.output.pathLabel": "アセットを表示", - "common.ui.fieldEditor.labelTemplate.example.pathLabel": "アセットを表示", - "common.ui.fieldEditor.labelTemplate.examplesHeader": "例", - "common.ui.fieldEditor.labelTemplate.inputHeader": "インプット", - "common.ui.fieldEditor.labelTemplate.labelHeader": "ラベルテンプレート", - "common.ui.fieldEditor.labelTemplate.outputHeader": "アウトプット", - "common.ui.fieldEditor.labelTemplate.urlHeader": "URL テンプレート", - "common.ui.fieldEditor.labelTemplate.urlLabel": "フォーマット済み URL", - "common.ui.fieldEditor.labelTemplate.valueLabel": "フィールド値", - "common.ui.fieldEditor.labelTemplateHeader": "ラベルテンプレート", - "common.ui.fieldEditor.labelTemplateLabel": "このフィールドの URL が長い場合、URL のテキストバージョン用の代替テンプレートを使用すると良いかもしれません。URL の代わりに表示されますが、URL にリンクされます。このフォーマットは、値の投入に二重中括弧の表記 {doubleCurlyBraces} を使用する文字列です。次の値にアクセスできます。", - "common.ui.fieldEditor.languageLabel": "言語", - "common.ui.fieldEditor.mappingConflictLabel.mappingConflictDetail": "{mappingConflict} 既に「{fieldName}」という名前のフィールドが存在します。スクリプトフィールドに同じ名前を付けると、同時に両方のフィールドにクエリが実行できなくなります。", - "common.ui.fieldEditor.mappingConflictLabel.mappingConflictLabel": "マッピングの矛盾:", - "common.ui.fieldEditor.multiTypeLabelDesc": "フィールドのタイプがインデックスごとに変わります。多くの分析機能には使用できません。タイプごとのインデックスは次の通りです:", - "common.ui.fieldEditor.nameErrorMessage": "名前が必要です", - "common.ui.fieldEditor.nameLabel": "名前", - "common.ui.fieldEditor.namePlaceholder": "新規スクリプトフィールド", - "common.ui.fieldEditor.number.documentationLabel": "ドキュメント", - "common.ui.fieldEditor.number.numeralLabel": "Numeral.js のフォーマットパターン (デフォルト: {defaultPattern})", - "common.ui.fieldEditor.popularityLabel": "利用頻度", - "common.ui.fieldEditor.samples.inputHeader": "インプット", - "common.ui.fieldEditor.samples.outputHeader": "アウトプット", - "common.ui.fieldEditor.samplesHeader": "サンプル", - "common.ui.fieldEditor.script.accessWithLabel": "{code} でフィールドにアクセスします。", - "common.ui.fieldEditor.script.getHelpLabel": "構文のヒントを得たり、スクリプトの結果をプレビューしたりできます。", - "common.ui.fieldEditor.scriptInvalidErrorMessage": "スクリプトが無効です。スクリプトのプレビューで詳細を確認", - "common.ui.fieldEditor.scriptLabel": "スクリプト", - "common.ui.fieldEditor.scriptRequiredErrorMessage": "スクリプトが必要です", - "common.ui.fieldEditor.staticLookup.addEntryButton": "エントリーを追加", - "common.ui.fieldEditor.staticLookup.deleteAria": "削除", - "common.ui.fieldEditor.staticLookup.deleteTitle": "エントリーの削除", - "common.ui.fieldEditor.staticLookup.keyLabel": "キー", - "common.ui.fieldEditor.staticLookup.leaveBlankPlaceholder": "値をそのままにするには空欄にします", - "common.ui.fieldEditor.staticLookup.unknownKeyLabel": "不明なキーの値", - "common.ui.fieldEditor.staticLookup.valueLabel": "値", - "common.ui.fieldEditor.string.transformLabel": "変換", - "common.ui.fieldEditor.syntax.default.formatLabel": "doc['some_field'].値", - "common.ui.fieldEditor.syntax.defaultLabel.defaultDetail": "デフォルトで、Kibana のスクリプトフィールドは Elasticsearch での使用を目的に特別に開発されたシンプルでセキュアなスクリプト言語の {painless} を使用します。ドキュメントの値にアクセスするには次のフォーマットを使用します。", - "common.ui.fieldEditor.syntax.defaultLabel.painlessLink": "Painless", - "common.ui.fieldEditor.syntax.kibanaLabel": "Kibana は現在 Painless スクリプトに特別な制限が 1 つあります。Named 関数を含めることができません。", - "common.ui.fieldEditor.syntax.lucene.commonLabel.commonDetail": "Kibana の旧バージョンからのアップグレードですか？お馴染みの {lucene} は引き続きご利用いただけます。Lucene 表現は JavaScript と非常に似ていますが、基本的な計算、ビット処理、比較オペレーション用に開発されたものです。", - "common.ui.fieldEditor.syntax.lucene.commonLabel.luceneLink": "Lucene 表現", - "common.ui.fieldEditor.syntax.lucene.limits.fieldsLabel": "格納されたフィールドは利用できません", - "common.ui.fieldEditor.syntax.lucene.limits.sparseLabel": "フィールドがまばらな (ドキュメントの一部にしか値がない) 場合、値がないドキュメントには 0 の値が入力されます", - "common.ui.fieldEditor.syntax.lucene.limits.typesLabel": "数字、ブール、日付、、geo_point フィールドのみアクセスできます", - "common.ui.fieldEditor.syntax.lucene.limitsLabel": "Lucene 表現には次のいくつかの制限があります。", - "common.ui.fieldEditor.syntax.lucene.operations.arithmeticLabel": "算術演算子: {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.bitwiseLabel": "ビット処理演算子: {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.booleanLabel": "ブール演算子 (三項演算子を含む): {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.comparisonLabel": "比較演算子: {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.distanceLabel": "距離関数: {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.mathLabel": "一般的な関数: {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.miscellaneousLabel": "その他関数: {operators}", - "common.ui.fieldEditor.syntax.lucene.operations.trigLabel": "三角ライブラリ関数: {operators}", - "common.ui.fieldEditor.syntax.lucene.operationsLabel": "Lucene 表現で利用可能なオペレーションは次の通りです。", - "common.ui.fieldEditor.syntax.painlessLabel.javaAPIsLink": "ネイティブ Java API", - "common.ui.fieldEditor.syntax.painlessLabel.painlessDetail": "Painless は非常に強力かつ使いやすい言語です。多くの {javaAPIs} にアクセスすることができます。{syntax} について読めば、すぐに習得することができます！", - "common.ui.fieldEditor.syntax.painlessLabel.syntaxLink": "構文", - "common.ui.fieldEditor.syntaxHeader": "構文", - "common.ui.fieldEditor.testScript.errorMessage": "スクリプト内にエラーがあります", - "common.ui.fieldEditor.testScript.fieldsLabel": "追加フィールド", - "common.ui.fieldEditor.testScript.fieldsPlaceholder": "選択してください…", - "common.ui.fieldEditor.testScript.instructions": "スクリプトを実行すると、最初の検索結果10件をプレビューできます。追加フィールドを選択して結果に含み、コンテクストをさらに加えたり、特定の文書上でフィルタにクエリを追加したりすることもできます。", - "common.ui.fieldEditor.testScript.resultsLabel": "最初の10件", - "common.ui.fieldEditor.testScript.resultsTitle": "結果を表示", - "common.ui.fieldEditor.testScript.submitButtonLabel": "スクリプトを実行", - "common.ui.fieldEditor.truncate.lengthLabel": "フィールドの長さ", - "common.ui.fieldEditor.typeLabel": "タイプ", - "common.ui.fieldEditor.url.heightLabel": "高さ", - "common.ui.fieldEditor.url.labelTemplateHelpText": "ラベルテンプレートのヘルプ", - "common.ui.fieldEditor.url.labelTemplateLabel": "ラベルテンプレート", - "common.ui.fieldEditor.url.offLabel": "オフ", - "common.ui.fieldEditor.url.onLabel": "オン", - "common.ui.fieldEditor.url.openTabLabel": "新規タブで開く", - "common.ui.fieldEditor.url.template.helpLinkText": "URL テンプレートのヘルプ", - "common.ui.fieldEditor.url.typeLabel": "タイプ", - "common.ui.fieldEditor.url.urlTemplateLabel": "URL テンプレート", - "common.ui.fieldEditor.url.widthLabel": "幅", - "common.ui.fieldEditor.urlTemplate.examplesHeader": "例", - "common.ui.fieldEditor.urlTemplate.inputHeader": "インプット", - "common.ui.fieldEditor.urlTemplate.outputHeader": "アウトプット", - "common.ui.fieldEditor.urlTemplate.rawValueLabel": "非エスケープ値", - "common.ui.fieldEditor.urlTemplate.templateHeader": "テンプレート", - "common.ui.fieldEditor.urlTemplate.valueLabel": "URL エスケープ値", - "common.ui.fieldEditor.urlTemplateHeader": "URL テンプレート", - "common.ui.fieldEditor.urlTemplateLabel.fieldDetail": "フィールドに URL の一部のみが含まれている場合、{strongUrlTemplate} でその値を完全な URL としてフォーマットできます。このフォーマットは、値の投入に二重中括弧の表記 {doubleCurlyBraces} を使用する文字列です。次の値にアクセスできます。", - "common.ui.fieldEditor.urlTemplateLabel.strongUrlTemplateLabel": "URL テンプレート", - "common.ui.fieldEditor.warningCallOut.descriptionLabel": "計算値の表示と集約にスクリプトフィールドが使用できます。そのため非常に遅い場合があり、適切に行わないと Kibana が使用できなくなる可能性もあります。この場合安全策はありません。入力ミスがあると、あちこちに予期せぬ例外が起こります！", - "common.ui.fieldEditor.warningCallOutHeader": "十分ご注意ください", - "common.ui.fieldEditor.warningCallOutLabel.callOutDetail": "スクリプトフィールドを使う前に、{scripFields} と {scriptsInAggregation} についてよく理解するようにしてください。", - "common.ui.fieldEditor.warningCallOutLabel.scripFieldsLink": "スクリプトフィールド", - "common.ui.fieldEditor.warningCallOutLabel.scriptsInAggregationLink": "集約におけるスクリプト", - "common.ui.fieldEditor.warningHeader": "廃止警告:", - "common.ui.fieldEditor.warningLabel.painlessLinkLabel": "Painless", - "common.ui.fieldEditor.warningLabel.warningDetail": "{language} は廃止され、Kibana と Elasticsearch の次のメジャーなバージョンではサポートされなくなります。新規スクリプトフィールドには {painlessLink} を使うことをお勧めします。", - "common.ui.flotCharts.aprLabel": "4 月", - "common.ui.flotCharts.augLabel": "8 月", - "common.ui.flotCharts.decLabel": "12 月", - "common.ui.flotCharts.febLabel": "2 月", - "common.ui.flotCharts.friLabel": "金", - "common.ui.flotCharts.janLabel": "1 月", - "common.ui.flotCharts.julLabel": "7 月", - "common.ui.flotCharts.junLabel": "6 月", - "common.ui.flotCharts.marLabel": "3 月", - "common.ui.flotCharts.mayLabel": "5 月", - "common.ui.flotCharts.monLabel": "月", - "common.ui.flotCharts.novLabel": "11 月", - "common.ui.flotCharts.octLabel": "10 月", - "common.ui.flotCharts.pie.unableToDrawLabelsInsideCanvasErrorMessage": "キャンバス内のラベルではパイを作成できません", - "common.ui.flotCharts.satLabel": "土", - "common.ui.flotCharts.sepLabel": "9 月", - "common.ui.flotCharts.sunLabel": "日", - "common.ui.flotCharts.thuLabel": "木", - "common.ui.flotCharts.tueLabel": "火", - "common.ui.flotCharts.wedLabel": "水", - "common.ui.scriptingLanguages.errorFetchingToastDescription": "Elasticsearch から利用可能なスクリプト言語の取得中にエラーが発生しました", - "common.ui.stackManagement.breadcrumb": "管理", - "common.ui.stateManagement.unableToParseUrlErrorMessage": "URL をパースできません", - "common.ui.stateManagement.unableToRestoreUrlErrorMessage": "URL を完全に復元できません。共有機能を使用していることを確認してください。", - "common.ui.stateManagement.unableToStoreHistoryInSessionErrorMessage": "セッションがいっぱいで安全に削除できるアイテムが見つからないため、Kibana は履歴アイテムを保存できません。\n\nこれは大抵新規タブに移動することで解決されますが、より大きな問題が原因である可能性もあります。このメッセージが定期的に表示される場合は、{gitHubIssuesUrl} で問題を報告してください。", - "common.ui.url.replacementFailedErrorMessage": "置換に失敗、未解決の表現式: {expr}", - "common.ui.url.savedObjectIsMissingNotificationMessage": "保存されたオブジェクトがありません", - "common.ui.vis.kibanaMap.leaflet.fitDataBoundsAriaLabel": "データバウンドを合わせる", - "common.ui.vis.kibanaMap.zoomWarning": "ズームレベルが最大に達しました。完全にズームインするには、Elasticsearch と Kibana の {defaultDistribution} にアップグレードしてください。{ems} でより多くのズームレベルが利用できます。または、独自のマップサーバーを構成できます。詳細は { wms } または { configSettings} をご覧ください。", - "console.autocomplete.addMethodMetaText": "メソド", - "console.consoleDisplayName": "コンソール", - "console.consoleMenu.copyAsCurlMessage": "リクエストが URL としてコピーされました", - "console.devToolsDescription": "cURL をスキップしこの JSON インスタンスを使って、データに直接アクセスします。", - "console.devToolsTitle": "コンソール", - "console.exampleOutputTextarea": "開発ツールコンソールエディターの例", - "console.helpPage.keyboardCommands.autoIndentDescription": "現在のリクエストを自動インデントします", - "console.helpPage.keyboardCommands.closeAutoCompleteMenuDescription": "自動入力メニューを閉じます", - "console.helpPage.keyboardCommands.collapseAllScopesDescription": "現在のスコープを除きすべてのスコープを最小表示します。シフトを追加して拡張します。", - "console.helpPage.keyboardCommands.collapseExpandCurrentScopeDescription": "現在のスコープを最小/拡張表示します。", - "console.helpPage.keyboardCommands.jumpToPreviousNextRequestDescription": "前/次のリクエストの開始または終了に移動します。", - "console.helpPage.keyboardCommands.openAutoCompleteDescription": "自動入力を開きます (未入力時を含む)", - "console.helpPage.keyboardCommands.openDocumentationDescription": "現在のリクエストのドキュメントを開きます", - "console.helpPage.keyboardCommands.selectCurrentlySelectedInAutoCompleteMenuDescription": "現在の選択項目または自動入力メニューで最も使用されている用語を選択します", - "console.helpPage.keyboardCommands.submitRequestDescription": "リクエストを送信します", - "console.helpPage.keyboardCommands.switchFocusToAutoCompleteMenuDescription": "自動入力メニューに焦点を切り替えます。矢印でさらに用語を選択します", - "console.helpPage.keyboardCommandsTitle": "キーボードコマンド", - "console.helpPage.pageTitle": "ヘルプ", - "console.helpPage.requestFormatDescription": "ホワイトエディターに 1 つまたは複数のリクエストを入力できます。コンソールはコンパクトなフォーマットのリクエストを理解できます。", - "console.helpPage.requestFormatTitle": "リクエストフォーマット", - "console.historyPage.applyHistoryButtonLabel": "適用", - "console.historyPage.clearHistoryButtonLabel": "消去", - "console.historyPage.closehistoryButtonLabel": "閉じる", - "console.historyPage.itemOfRequestListAriaLabel": "リクエスト: {historyItem}", - "console.historyPage.noHistoryTextMessage": "履歴がありません", - "console.historyPage.pageTitle": "履歴", - "console.historyPage.requestListAriaLabel": "リクエストの送信履歴", - "console.inputTextarea": "開発ツールコンソール", - "console.loadingError.buttonLabel": "コンソールの再読み込み", - "console.loadingError.message": "最新データを取得するために再読み込みを試してください。", - "console.loadingError.title": "コンソールを読み込めません", - "console.outputTextarea": "開発ツールコンソール出力", - "console.pageHeading": "コンソール", - "console.requestInProgressBadgeText": "リクエストが進行中", - "console.requestOptions.autoIndentButtonLabel": "自動インデント", - "console.requestOptions.copyAsUrlButtonLabel": "cURL としてコピー", - "console.requestOptions.openDocumentationButtonLabel": "ドキュメントを開く", - "console.requestOptionsButtonAriaLabel": "リクエストオプション", - "console.requestTimeElapasedBadgeTooltipContent": "経過時間", - "console.sendRequestButtonTooltip": "クリックしてリクエストを送信", - "console.settingsPage.autocompleteLabel": "自動入力", - "console.settingsPage.cancelButtonLabel": "キャンセル", - "console.settingsPage.fieldsLabelText": "フィールド", - "console.settingsPage.fontSizeLabel": "フォントサイズ", - "console.settingsPage.indicesAndAliasesLabelText": "インデックスとエイリアス", - "console.settingsPage.jsonSyntaxLabel": "JSON構文", - "console.settingsPage.pageTitle": "設定", - "console.settingsPage.pollingLabelText": "自動入力候補を自動的に更新", - "console.settingsPage.refreshButtonLabel": "自動入力候補の更新", - "console.settingsPage.refreshingDataDescription": "コンソールは、Elasticsearchをクエリして自動入力候補を更新します。クラスターが大きい場合や、ネットワークの制限がある場合には、自動更新で問題が発生する可能性があります。", - "console.settingsPage.refreshingDataLabel": "自動入力候補を更新しています", - "console.settingsPage.saveButtonLabel": "保存", - "console.settingsPage.templatesLabelText": "テンプレート", - "console.settingsPage.tripleQuotesMessage": "出力ウィンドウでは三重引用符を使用してください", - "console.settingsPage.wrapLongLinesLabelText": "長い行を改行", - "console.topNav.helpTabDescription": "ヘルプ", - "console.topNav.helpTabLabel": "ヘルプ", - "console.topNav.historyTabDescription": "履歴", - "console.topNav.historyTabLabel": "履歴", - "console.topNav.settingsTabDescription": "設定", - "console.topNav.settingsTabLabel": "設定", - "console.welcomePage.closeButtonLabel": "始めましょう", - "console.welcomePage.pageTitle": "コンソールへようこそ", - "console.welcomePage.quickIntroDescription": "コンソール UI は、エディターペイン (左) と応答ペイン (右) の 2 つのペインに分かれています。エディターでリクエストを入力し、Elasticsearch に送信します。結果が右側の応答ペインに表示されます。", - "console.welcomePage.quickIntroTitle": "UI の簡単な説明", - "console.welcomePage.quickTips.cUrlFormatForRequestsDescription": "cURL フォーマットのリクエストを張り付けると、Console 構文に変換されます。", - "console.welcomePage.quickTips.keyboardShortcutsDescription": "ヘルプボタンでキーボードショートカットが学べます。便利な情報が揃っています！", - "console.welcomePage.quickTips.resizeEditorDescription": "間の区切りをドラッグすることで、エディターとアウトプットペインのサイズを変更できます。", - "console.welcomePage.quickTips.submitRequestDescription": "緑の三角形のボタンをクリックして ES にリクエストを送信します。", - "console.welcomePage.quickTips.useWrenchMenuDescription": "レンチメニューで他の便利な機能が使えます。", - "console.welcomePage.quickTipsTitle": "今のうちにいくつか簡単なコツをお教えします", - "console.welcomePage.supportedRequestFormatDescription": "リクエストの入力中、コンソールが候補を提案するので、Enter/Tabを押して確定できます。これらの候補はリクエストの構造、およびインデックス、タイプに基づくものです。", - "console.welcomePage.supportedRequestFormatTitle": "コンソールは cURL と同様に、コンパクトなフォーマットのリクエストを理解できます。", - "core.application.appNotFound.pageDescription": "この URL にアプリケーションが見つかりませんでした。前の画面に戻るか、メニューからアプリを選択してみてください。", - "core.application.appNotFound.title": "アプリケーションが見つかりません", - "core.chrome.legacyBrowserWarning": "ご使用のブラウザが Kibana のセキュリティ要件を満たしていません。", - "core.euiBasicTable.selectAllRows": "すべての行を選択", - "core.euiBasicTable.selectThisRow": "この行を選択", - "core.euiBasicTable.tableDescription": "以下は {itemCount} 件のアイテムの表です。", - "core.euiBottomBar.screenReaderAnnouncement": "ドキュメントの最後にページレベルのコントロールと共に開く新しいメニューがあります。", - "core.euiBreadcrumbs.collapsedBadge.ariaLabel": "すべてのブレッドクラムを表示", - "core.euiCardSelect.select": "選択してください", - "core.euiCardSelect.selected": "利用不可", - "core.euiCardSelect.unavailable": "選択済み", - "core.euiCodeBlock.copyButton": "コピー", - "core.euiCodeEditor.startEditing": "編集を開始するには Enter キーを押してください。", - "core.euiCodeEditor.startInteracting": "コードの操作を開始するには Enter キーを押してください。", - "core.euiCodeEditor.stopEditing": "完了したら Esc キーで編集を終了します。", - "core.euiCodeEditor.stopInteracting": "完了したら Esc キーでコードの操作を終了します。", - "core.euiCollapsedItemActions.allActions": "すべてのアクション", - "core.euiColorPicker.screenReaderAnnouncement": "選択可能な色の範囲を表示するポップアップが開きました。選択可能な色を閲覧するには Tab を押し、Esc でこのポップアップを閉じます。", - "core.euiColorPicker.swatchAriaLabel": "{swatch} を色として選択します", - "core.euiColorStops.screenReaderAnnouncement": "{label}: {readOnly} {disabled}色終了位置ピッカー。各終了には数値と対応するカラー値があります。上下矢印キーを使用して、個別の終了を選択します。Enterキーを押すと、新しい終了を作成します。", - "core.euiColorStopThumb.removeLabel": "この終了を削除", - "core.euiColorStopThumb.screenReaderAnnouncement": "カラー終了編集フォームのポップアップが開きました。Tabを押してフォームコントロールを閲覧するか、Escでこのポップアップを閉じます。", - "core.euiColumnSelector.hideAll": "すべて非表示", - "core.euiColumnSelector.selectAll": "すべて表示", - "core.euiColumnSorting.clearAll": "並び替えを消去", - "core.euiColumnSorting.emptySorting": "現在並び替えられているフィールドはありません", - "core.euiColumnSorting.pickFields": "並び替え基準でフィールドの選択", - "core.euiColumnSorting.sortFieldAriaLabel": "並べ替え基準", - "core.euiColumnSortingDraggable.activeSortLabel": "このデータグリッドを並び替え中", - "core.euiColumnSortingDraggable.defaultSortAsc": "A-Z", - "core.euiColumnSortingDraggable.defaultSortDesc": "Z-A", - "core.euiColumnSortingDraggable.removeSortLabel": "データグリッドの並び替えから削除", - "core.euiColumnSortingDraggable.toggleLegend": "フィールド向け並び替え方法を選択", - "core.euiComboBoxOptionsList.allOptionsSelected": "利用可能なオプションをすべて選択しました", - "core.euiComboBoxOptionsList.alreadyAdded": "{label} は既に追加されています", - "core.euiComboBoxOptionsList.createCustomOption": "{searchValue} をカスタムオプションとして追加するには、{key} を押してください。", - "core.euiComboBoxOptionsList.loadingOptions": "オプションを読み込み中", - "core.euiComboBoxOptionsList.noAvailableOptions": "利用可能なオプションがありません", - "core.euiComboBoxOptionsList.noMatchingOptions": "{searchValue} はどのオプションにも一致していません", - "core.euiComboBoxPill.removeSelection": "グループの選択項目から {children} を削除してください", - "core.euiCommonlyUsedTimeRanges.legend": "頻繁に使用", - "core.euiDataGrid.screenReaderNotice": "セルにはインタラクティブコンテンツが含まれます。", - "core.euiDataGridCell.expandButtonTitle": "クリックするか enter を押すと、セルのコンテンツとインタラクトできます。", - "core.euiDataGridSchema.booleanSortTextAsc": "True-False", - "core.euiDataGridSchema.booleanSortTextDesc": "False-True", - "core.euiDataGridSchema.currencySortTextAsc": "低-高", - "core.euiDataGridSchema.currencySortTextDesc": "高-低", - "core.euiDataGridSchema.dateSortTextAsc": "新-旧", - "core.euiDataGridSchema.dateSortTextDesc": "旧-新", - "core.euiDataGridSchema.jsonSortTextAsc": "小-大", - "core.euiDataGridSchema.jsonSortTextDesc": "大-小", - "core.euiDataGridSchema.numberSortTextAsc": "低-高", - "core.euiDataGridSchema.numberSortTextDesc": "高-低", - "core.euiFilterButton.filterBadge": "${count} ${filterCountLabel} 個のフィルター", - "core.euiForm.addressFormErrors": "フォームのエラーを解決してください。", - "core.euiFormControlLayoutClearButton.label": "インプットを消去", - "core.euiHeaderAlert.dismiss": "閉じる", - "core.euiHeaderLinks.appNavigation": "アプリのナビゲーション", - "core.euiHeaderLinks.openNavigationMenu": "ナビゲーションメニューを開く", - "core.euiHue.label": "HSV カラーモードの「true」値を選択", - "core.euiImage.closeImage": "全画面 {alt} 画像を閉じる", - "core.euiImage.openImage": "全画面 {alt} 画像を開く", - "core.euiLink.external.ariaLabel": "外部リンク", - "core.euiModal.closeModal": "このモーダルウィンドウを閉じます", - "core.euiPagination.jumpToLastPage": "最後のページ {pageCount} に移動します", - "core.euiPagination.nextPage": "次のページ", - "core.euiPagination.pageOfTotal": "{total} ページ中 {page} ページ目", - "core.euiPagination.previousPage": "前のページ", - "core.euiPopover.screenReaderAnnouncement": "これはダイアログです。ダイアログを閉じるには、 escape を押してください。", - "core.euiQuickSelect.applyButton": "適用", - "core.euiQuickSelect.fullDescription": "現在 {timeTense} {timeValue} {timeUnit}に設定されています。", - "core.euiQuickSelect.legendText": "時間範囲を素早く選択", - "core.euiQuickSelect.nextLabel": "次の時間ウインドウ", - "core.euiQuickSelect.previousLabel": "前の時間ウインドウ", - "core.euiQuickSelect.quickSelectTitle": "素早く選択", - "core.euiQuickSelect.tenseLabel": "時間テンス", - "core.euiQuickSelect.unitLabel": "時間単位", - "core.euiQuickSelect.valueLabel": "時間値", - "core.euiRefreshInterval.fullDescription": "現在 {optionValue} {optionText} に設定されています。", - "core.euiRefreshInterval.legend": "以下の感覚ごとに更新", - "core.euiRefreshInterval.start": "開始", - "core.euiRefreshInterval.stop": "停止", - "core.euiRelativeTab.fullDescription": "単位は変更可能です。現在 {unit} に設定されています。", - "core.euiRelativeTab.relativeDate": "{position} 日付", - "core.euiRelativeTab.roundingLabel": "{unit} に四捨五入する", - "core.euiRelativeTab.unitInputLabel": "相対的時間スパン", - "core.euiSaturation.roleDescription": "HSV カラーモード彩度と値の選択", - "core.euiSaturation.screenReaderAnnouncement": "矢印キーで四角いカラーグラデーションを操作します。キーを押すごとに移動する座標が 0 から 1 の範囲で HSV カラーモードの「彩度」と「値」の数字に使用されます。左で「彩度」の値を下げ、右で上げます。上で「値」の値を上げ、下で下げます。", - "core.euiSelectable.loadingOptions": "オプションを読み込み中", - "core.euiSelectable.noAvailableOptions": "利用可能なオプションがありません", - "core.euiSelectable.noMatchingOptions": "{searchValue} はどのオプションにも一致していません", - "core.euiStat.loadingText": "統計を読み込み中です", - "core.euiStep.ariaLabel": "{stepStatus}", - "core.euiStepHorizontal.buttonTitle": "ステップ {step}: {title}{titleAppendix}", - "core.euiStepHorizontal.step": "手順", - "core.euiStepNumber.hasErrors": "エラーがあります", - "core.euiStepNumber.hasWarnings": "警告があります", - "core.euiStepNumber.isComplete": "完了", - "core.euiStyleSelector.buttonText": "密度", - "core.euiSuperDatePicker.showDatesButtonLabel": "日付を表示", - "core.euiSuperSelect.screenReaderAnnouncement": "{optionsCount} 件のアイテムのフォームセレクターを使用中で、1 つのオプションを選択する必要があります。上下の矢印キーで移動するか、Esc キーで閉じます。", - "core.euiSuperSelectControl.selectAnOption": "オプションの選択: {selectedValue} を選択済み", - "core.euiSuperUpdateButton.cannotUpdateTooltip": "アップデートできません", - "core.euiSuperUpdateButton.clickToApplyTooltip": "クリックして適用", - "core.euiSuperUpdateButton.refreshButtonLabel": "更新", - "core.euiSuperUpdateButton.updateButtonLabel": "更新", - "core.euiSuperUpdateButton.updatingButtonLabel": "更新中", - "core.euiTablePagination.rowsPerPage": "ページごとの行数", - "core.euiTablePagination.rowsPerPageOption": "{rowsPerPage} 行", - "core.euiTableSortMobile.sorting": "並べ替え", - "core.euiToast.dismissToast": "トーストを閉じる", - "core.euiToast.newNotification": "新しい通知が表示されます", - "core.euiToast.notification": "通知", - "core.euiTreeView.ariaLabel": "{nodeLabel} {ariaLabel} のチャイルド", - "core.euiTreeView.listNavigationInstructions": "矢印キーを使ってこのリストを素早くナビゲートすることができます。", - "core.fatalErrors.clearYourSessionButtonLabel": "セッションを消去", - "core.fatalErrors.goBackButtonLabel": "戻る", - "core.fatalErrors.somethingWentWrongTitle": "何か問題が発生", - "core.fatalErrors.tryRefreshingPageDescription": "ページを更新してみてください。うまくいかない場合は、前のページに戻るか、セッションデータを消去してください。", - "core.notifications.errorToast.closeModal": "閉じる", - "core.notifications.unableUpdateUISettingNotificationMessageTitle": "UI 設定を更新できません", - "core.toasts.errorToast.seeFullError": "完全なエラーを表示", - "core.ui.analyzeNavList.label": "分析", - "core.ui.chrome.headerGlobalNav.goHomePageIconAriaLabel": "ホームページに移動", - "core.ui.chrome.headerGlobalNav.helpMenuAskElasticTitle": "Elasticに確認する", - "core.ui.chrome.headerGlobalNav.helpMenuButtonAriaLabel": "ヘルプメニュー", - "core.ui.chrome.headerGlobalNav.helpMenuDocumentation": "ドキュメント", - "core.ui.chrome.headerGlobalNav.helpMenuGiveFeedbackOnApp": "{appName} についてのフィードバックを作成する", - "core.ui.chrome.headerGlobalNav.helpMenuGiveFeedbackTitle": "フィードバックを作成する", - "core.ui.chrome.headerGlobalNav.helpMenuKibanaDocumentationTitle": "Kibanaドキュメント", - "core.ui.chrome.headerGlobalNav.helpMenuOpenGitHubIssueTitle": "GitHubで問題を開く", - "core.ui.chrome.headerGlobalNav.helpMenuTitle": "ヘルプ", - "core.ui.chrome.headerGlobalNav.helpMenuVersion": "v {version}", - "core.ui.chrome.headerGlobalNav.toggleSideNavAriaLabel": "サイドナビゲーションを切り替える", - "core.ui.chrome.sideGlobalNav.viewRecentItemsFlyoutTitle": "最近のアイテム", - "core.ui.chrome.sideGlobalNav.viewRecentItemsLabel": "最近閲覧", - "core.ui.legacyBrowserMessage": "この Kibana インストレーションは、現在ご使用のブラウザが満たしていない厳格なセキュリティ要件が有効になっています。", - "core.ui.legacyBrowserTitle": "ブラウザをアップグレードしてください", - "core.ui.managementNavList.label": "管理", - "core.ui.observabilityNavList.label": "オブザーバビリティ", - "core.ui.overlays.banner.attentionTitle": "注意", - "core.ui.overlays.banner.closeButtonLabel": "閉じる", - "core.ui.primaryNav.screenReaderLabel": "プライマリ", - "core.ui.primaryNavList.screenReaderLabel": "プライマリナビゲーションリンク", - "core.ui.recentLinks.linkItem.screenReaderLabel": "{recentlyAccessedItemLinklabel}、タイプ: {pageType}", - "core.ui.recentLinks.screenReaderLabel": "最近閲覧したリンク、ナビゲーション", - "core.ui.securityNavList.label": "セキュリティ", - "core.ui.welcomeErrorMessage": "Elastic Kibana が正常に読み込まれませんでした。詳細はサーバーアウトプットを確認してください。", - "core.ui.welcomeMessage": "Elastic Kibana の読み込み中", - "dashboard.actions.toggleExpandPanelMenuItem.expandedDisplayName": "最小化", - "dashboard.actions.toggleExpandPanelMenuItem.notExpandedDisplayName": "全画面", - "dashboard.addPanel.noMatchingObjectsMessage": "一致するオブジェクトが見つかりませんでした。", - "dashboard.addPanel.savedObjectAddedToContainerSuccessMessageTitle": "{savedObjectName} が追加されました", - "dashboard.dashboardGrid.toast.unableToLoadDashboardDangerMessage": "ダッシュボードが読み込めません。", - "dashboard.factory.displayName": "ダッシュボード", - "dashboard.panel.removePanel.replacePanel": "パネルの交換", - "data.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} と {lt} {to}", - "data.common.kql.errors.endOfInputText": "インプットの終わり", - "data.common.kql.errors.fieldNameText": "フィールド名", - "data.common.kql.errors.literalText": "文字通り", - "data.common.kql.errors.syntaxError": "{expectedList} を期待しましたが {foundInput} が検出されました。", - "data.common.kql.errors.valueText": "値", - "data.common.kql.errors.whitespaceText": "空白類", - "data.fieldFormats.boolean.title": "ブール", - "data.fieldFormats.bytes.title": "バイト", - "data.fieldFormats.color.title": "色", - "data.fieldFormats.date_nanos.title": "日付ナノ", - "data.fieldFormats.date.title": "日付", - "data.fieldFormats.duration.inputFormats.days": "日", - "data.fieldFormats.duration.inputFormats.hours": "時間", - "data.fieldFormats.duration.inputFormats.microseconds": "マイクロ秒", - "data.fieldFormats.duration.inputFormats.milliseconds": "ミリ秒", - "data.fieldFormats.duration.inputFormats.minutes": "分", - "data.fieldFormats.duration.inputFormats.months": "か月", - "data.fieldFormats.duration.inputFormats.nanoseconds": "ナノ秒", - "data.fieldFormats.duration.inputFormats.picoseconds": "ピコ秒", - "data.fieldFormats.duration.inputFormats.seconds": "秒", - "data.fieldFormats.duration.inputFormats.weeks": "週間", - "data.fieldFormats.duration.inputFormats.years": "年", - "data.fieldFormats.duration.negativeLabel": "マイナス", - "data.fieldFormats.duration.outputFormats.asDays": "日", - "data.fieldFormats.duration.outputFormats.asHours": "時間", - "data.fieldFormats.duration.outputFormats.asMilliseconds": "ミリ秒", - "data.fieldFormats.duration.outputFormats.asMinutes": "分", - "data.fieldFormats.duration.outputFormats.asMonths": "か月", - "data.fieldFormats.duration.outputFormats.asSeconds": "秒", - "data.fieldFormats.duration.outputFormats.asWeeks": "週間", - "data.fieldFormats.duration.outputFormats.asYears": "年", - "data.fieldFormats.duration.outputFormats.humanize": "人間に読解可能", - "data.fieldFormats.duration.title": "期間", - "data.fieldFormats.ip.title": "IP アドレス", - "data.fieldFormats.number.title": "数字", - "data.fieldFormats.percent.title": "割合 (%)", - "data.fieldFormats.relative_date.title": "相対日付", - "data.fieldFormats.static_lookup.title": "静的ルックアップ", - "data.fieldFormats.string.title": "文字列", - "data.fieldFormats.string.transformOptions.base64": "Base64 デコード", - "data.fieldFormats.string.transformOptions.lower": "小文字", - "data.fieldFormats.string.transformOptions.none": "- なし -", - "data.fieldFormats.string.transformOptions.short": "短い点線", - "data.fieldFormats.string.transformOptions.title": "タイトルケース", - "data.fieldFormats.string.transformOptions.upper": "大文字", - "data.fieldFormats.string.transformOptions.url": "URL パラメーターデコード", - "data.fieldFormats.truncated_string.title": "切り詰めた文字列", - "data.fieldFormats.url.title": "Url", - "data.fieldFormats.url.types.audio": "音声", - "data.fieldFormats.url.types.img": "画像", - "data.fieldFormats.url.types.link": "リンク", - "data.filter.applyFilterActionTitle": "現在のビューにフィルターを適用", - "data.filter.applyFilters.popupHeader": "適用するフィルターの選択", - "data.filter.applyFiltersPopup.cancelButtonLabel": "キャンセル", - "data.filter.applyFiltersPopup.saveButtonLabel": "適用", - "data.filter.filterBar.addFilterButtonLabel": "フィルターを追加します", - "data.filter.filterBar.deleteFilterButtonLabel": "削除", - "data.filter.filterBar.disabledFilterPrefix": "無効", - "data.filter.filterBar.disableFilterButtonLabel": "一時的に無効にする", - "data.filter.filterBar.editFilterButtonLabel": "フィルターを編集", - "data.filter.filterBar.enableFilterButtonLabel": "再度有効にする", - "data.filter.filterBar.excludeFilterButtonLabel": "結果を除外", - "data.filter.filterBar.fieldNotFound": "インデックスパターン {indexPattern} にフィールド {key} がありません", - "data.filter.filterBar.filterItemBadgeAriaLabel": "フィルターアクション", - "data.filter.filterBar.filterItemBadgeIconAriaLabel": "削除", - "data.filter.filterBar.includeFilterButtonLabel": "結果を含める", - "data.filter.filterBar.indexPatternSelectPlaceholder": "インデックスパターンの選択", - "data.filter.filterBar.labelErrorMessage": "フィルターを表示できませんでした", - "data.filter.filterBar.labelErrorText": "エラー", - "data.filter.filterBar.moreFilterActionsMessage": "フィルター：{innerText}。他のフィルターアクションを使用するには選択してください。", - "data.filter.filterBar.negatedFilterPrefix": "NOT ", - "data.filter.filterBar.pinFilterButtonLabel": "すべてのアプリにピン付け", - "data.filter.filterBar.pinnedFilterPrefix": "ピン付け済み", - "data.filter.filterBar.unpinFilterButtonLabel": "ピンを外す", - "data.filter.filterEditor.cancelButtonLabel": "キャンセル", - "data.filter.filterEditor.createCustomLabelInputLabel": "カスタムラベル", - "data.filter.filterEditor.createCustomLabelSwitchLabel": "カスタムラベルを作成しますか？", - "data.filter.filterEditor.dateFormatHelpLinkLabel": "対応データフォーマット", - "data.filter.filterEditor.doesNotExistOperatorOptionLabel": "存在しません", - "data.filter.filterEditor.editFilterPopupTitle": "フィルターを編集", - "data.filter.filterEditor.editFilterValuesButtonLabel": "フィルター値を編集", - "data.filter.filterEditor.editQueryDslButtonLabel": "クエリ DSL として編集", - "data.filter.filterEditor.existsOperatorOptionLabel": "存在する", - "data.filter.filterEditor.falseOptionLabel": "False", - "data.filter.filterEditor.fieldSelectLabel": "フィールド", - "data.filter.filterEditor.fieldSelectPlaceholder": "フィールドを選択", - "data.filter.filterEditor.indexPatternSelectLabel": "インデックスパターン", - "data.filter.filterEditor.isBetweenOperatorOptionLabel": "is between", - "data.filter.filterEditor.isNotBetweenOperatorOptionLabel": "is not between", - "data.filter.filterEditor.isNotOneOfOperatorOptionLabel": "is not one of", - "data.filter.filterEditor.isNotOperatorOptionLabel": "is not", - "data.filter.filterEditor.isOneOfOperatorOptionLabel": "is one of", - "data.filter.filterEditor.isOperatorOptionLabel": "が", - "data.filter.filterEditor.operatorSelectLabel": "演算子", - "data.filter.filterEditor.operatorSelectPlaceholderSelect": "選択してください", - "data.filter.filterEditor.operatorSelectPlaceholderWaiting": "待機中", - "data.filter.filterEditor.queryDslLabel": "Elasticsearch クエリ DSL", - "data.filter.filterEditor.rangeEndInputPlaceholder": "範囲の終了値", - "data.filter.filterEditor.rangeInputLabel": "範囲", - "data.filter.filterEditor.rangeStartInputPlaceholder": "範囲の開始値", - "data.filter.filterEditor.saveButtonLabel": "保存", - "data.filter.filterEditor.trueOptionLabel": "True", - "data.filter.filterEditor.valueInputLabel": "値", - "data.filter.filterEditor.valueInputPlaceholder": "値を入力", - "data.filter.filterEditor.valueSelectPlaceholder": "値を選択", - "data.filter.filterEditor.valuesSelectLabel": "値", - "data.filter.filterEditor.valuesSelectPlaceholder": "値を選択", - "data.filter.options.changeAllFiltersButtonLabel": "すべてのフィルターの変更", - "data.filter.options.deleteAllFiltersButtonLabel": "すべて削除", - "data.filter.options.disableAllFiltersButtonLabel": "すべて無効にする", - "data.filter.options.enableAllFiltersButtonLabel": "すべて有効にする", - "data.filter.options.invertDisabledFiltersButtonLabel": "有効・無効を反転", - "data.filter.options.invertNegatedFiltersButtonLabel": "含める・除外を反転", - "data.filter.options.pinAllFiltersButtonLabel": "すべてピン付け", - "data.filter.options.unpinAllFiltersButtonLabel": "すべてのピンを外す", - "data.filter.searchBar.changeAllFiltersTitle": "すべてのフィルターの変更", - "data.functions.esaggs.help": "AggConfig 集約を実行します", - "data.functions.esaggs.inspector.dataRequest.description": "このリクエストは Elasticsearch にクエリし、ビジュアライゼーション用のデータを取得します。", - "data.functions.esaggs.inspector.dataRequest.title": "データ", - "data.indexPatterns.fetchFieldErrorTitle": "インデックスパターンのフィールド取得中にエラーが発生 {title} (ID: {id})", - "data.indexPatterns.unableWriteLabel": "インデックスパターンを書き込めません！このインデックスパターンへの最新の変更を取得するには、ページを更新してください。", - "data.indexPatterns.unknownFieldErrorMessage": "インデックスパターン「{title}」のフィールド「{name}」が不明なフィールドタイプを使用しています。", - "data.indexPatterns.unknownFieldHeader": "不明なフィールドタイプ {type}", - "data.parseEsInterval.invalidEsCalendarIntervalErrorMessage": "無効なカレンダー間隔：{interval}、1よりも大きな値が必要です", - "data.parseEsInterval.invalidEsIntervalFormatErrorMessage": "無効な間隔フォーマット：{interval}", - "data.query.queryBar.comboboxAriaLabel": "{pageType} ページの検索とフィルタリング", - "data.query.queryBar.kqlFullLanguageName": "Kibana クエリ言語", - "data.query.queryBar.kqlLanguageName": "KQL", - "data.query.queryBar.KQLNestedQuerySyntaxInfoDocLinkText": "ドキュメント", - "data.query.queryBar.KQLNestedQuerySyntaxInfoOptOutText": "今後表示しない", - "data.query.queryBar.KQLNestedQuerySyntaxInfoTitle": "KQL ネストされたクエリ構文", - "data.query.queryBar.kqlOffLabel": "オフ", - "data.query.queryBar.kqlOnLabel": "オン", - "data.query.queryBar.licenseOptions": "ライセンスオプションに進む", - "data.query.queryBar.longQueryMessage": "ライセンスをアップグレードすれば、リクエストの完了までに十分な時間を確保できます。", - "data.query.queryBar.luceneLanguageName": "Lucene", - "data.query.queryBar.luceneSyntaxWarningMessage": "Lucene クエリ構文を使用しているようですが、Kibana クエリ言語 (KQL) が選択されています。KQL ドキュメント {link} を確認してください。", - "data.query.queryBar.luceneSyntaxWarningOptOutText": "今後表示しない", - "data.query.queryBar.luceneSyntaxWarningTitle": "Lucene 構文警告", - "data.query.queryBar.searchInputAriaLabel": "{pageType} ページの検索とフィルタリングを行うには入力を開始してください", - "data.query.queryBar.searchInputPlaceholder": "検索", - "data.query.queryBar.syntaxOptionsDescription": "{docsLink} (KQL) は、シンプルなクエリ構文とスクリプトフィールドのサポートを提供します。また、KQL はベーシックライセンス以上をご利用の場合、自動入力も提供します。KQL をオフにすると、Kibana は Lucene を使用します。", - "data.query.queryBar.syntaxOptionsDescription.docsLinkText": "こちら", - "data.query.queryBar.syntaxOptionsTitle": "構文オプション", - "data.search.aggs.aggGroups.bucketsText": "バケット", - "data.search.aggs.aggGroups.metricsText": "メトリック", - "data.search.aggs.aggTypes.rangesFormatMessage": "{gte} {from} と {lt} {to}", - "data.search.aggs.aggTypesLabel": "{fieldName} の範囲", - "data.search.aggs.buckets.dateHistogramLabel": "{intervalDescription} ごとの {fieldName}", - "data.search.aggs.buckets.dateHistogramTitle": "日付ヒストグラム", - "data.search.aggs.buckets.dateRangeTitle": "日付範囲", - "data.search.aggs.buckets.filtersTitle": "フィルター", - "data.search.aggs.buckets.filterTitle": "フィルター", - "data.search.aggs.buckets.geohashGridTitle": "ジオハッシュ", - "data.search.aggs.buckets.geotileGridTitle": "ジオタイル", - "data.search.aggs.buckets.histogramTitle": "ヒストグラム", - "data.search.aggs.buckets.intervalOptions.autoDisplayName": "自動", - "data.search.aggs.buckets.intervalOptions.dailyDisplayName": "日ごと", - "data.search.aggs.buckets.intervalOptions.hourlyDisplayName": "1 時間ごと", - "data.search.aggs.buckets.intervalOptions.millisecondDisplayName": "ミリ秒", - "data.search.aggs.buckets.intervalOptions.minuteDisplayName": "分", - "data.search.aggs.buckets.intervalOptions.monthlyDisplayName": "月ごと", - "data.search.aggs.buckets.intervalOptions.secondDisplayName": "秒", - "data.search.aggs.buckets.intervalOptions.weeklyDisplayName": "週ごと", - "data.search.aggs.buckets.intervalOptions.yearlyDisplayName": "年ごと", - "data.search.aggs.buckets.ipRangeLabel": "{fieldName} IP 範囲", - "data.search.aggs.buckets.ipRangeTitle": "IPv4 範囲", - "data.search.aggs.buckets.rangeTitle": "範囲", - "data.search.aggs.buckets.significantTerms.excludeLabel": "除外", - "data.search.aggs.buckets.significantTerms.includeLabel": "含める", - "data.search.aggs.buckets.significantTermsLabel": "{fieldName} のトップ {size} の珍しいアイテム", - "data.search.aggs.buckets.significantTermsTitle": "重要な用語", - "data.search.aggs.buckets.terms.excludeLabel": "除外", - "data.search.aggs.buckets.terms.includeLabel": "含める", - "data.search.aggs.buckets.terms.missingBucketLabel": "欠測値", - "data.search.aggs.buckets.terms.orderAscendingTitle": "昇順", - "data.search.aggs.buckets.terms.orderDescendingTitle": "降順", - "data.search.aggs.buckets.terms.otherBucketDescription": "このリクエストは、データバケットの基準外のドキュメントの数をカウントします。", - "data.search.aggs.buckets.terms.otherBucketLabel": "その他", - "data.search.aggs.buckets.terms.otherBucketTitle": "他のバケット", - "data.search.aggs.buckets.termsTitle": "用語", - "data.search.aggs.histogram.missingMaxMinValuesWarning": "自動スケールヒストグラムバケットから最高値と最低値を取得できません。これによりビジュアライゼーションのパフォーマンスが低下する可能性があります。", - "data.search.aggs.metrics.averageBucketTitle": "平均バケット", - "data.search.aggs.metrics.averageLabel": "平均 {field}", - "data.search.aggs.metrics.averageTitle": "平均", - "data.search.aggs.metrics.countLabel": "カウント", - "data.search.aggs.metrics.countTitle": "カウント", - "data.search.aggs.metrics.cumulativeSumLabel": "累積合計", - "data.search.aggs.metrics.cumulativeSumTitle": "累積合計", - "data.search.aggs.metrics.derivativeLabel": "派生", - "data.search.aggs.metrics.derivativeTitle": "派生", - "data.search.aggs.metrics.geoBoundsLabel": "境界", - "data.search.aggs.metrics.geoBoundsTitle": "境界", - "data.search.aggs.metrics.geoCentroidLabel": "ジオセントロイド", - "data.search.aggs.metrics.geoCentroidTitle": "ジオセントロイド", - "data.search.aggs.metrics.maxBucketTitle": "最高バケット", - "data.search.aggs.metrics.maxLabel": "最高 {field}", - "data.search.aggs.metrics.maxTitle": "最高", - "data.search.aggs.metrics.medianLabel": "中央 {field}", - "data.search.aggs.metrics.medianTitle": "中央", - "data.search.aggs.metrics.metricAggregationsSubtypeTitle": "メトリック集約", - "data.search.aggs.metrics.minBucketTitle": "最低バケット", - "data.search.aggs.metrics.minLabel": "最低 {field}", - "data.search.aggs.metrics.minTitle": "最低", - "data.search.aggs.metrics.movingAvgLabel": "移動平均", - "data.search.aggs.metrics.movingAvgTitle": "移動平均", - "data.search.aggs.metrics.overallAverageLabel": "全体平均", - "data.search.aggs.metrics.overallMaxLabel": "全体最高", - "data.search.aggs.metrics.overallMinLabel": "全体最低", - "data.search.aggs.metrics.overallSumLabel": "全体合計", - "data.search.aggs.metrics.parentPipelineAggregationsSubtypeTitle": "親パイプライン集約", - "data.search.aggs.metrics.percentileRanks.valuePropsLabel": "「{label}」の {format} のパーセンタイル順位", - "data.search.aggs.metrics.percentileRanksLabel": "{field} のパーセンタイル順位", - "data.search.aggs.metrics.percentileRanksTitle": "パーセンタイル順位", - "data.search.aggs.metrics.percentiles.valuePropsLabel": "{label} の {percentile} パーセンタイル", - "data.search.aggs.metrics.percentilesLabel": "{field} のパーセンタイル", - "data.search.aggs.metrics.percentilesTitle": "パーセンタイル", - "data.search.aggs.metrics.serialDiffLabel": "差分の推移", - "data.search.aggs.metrics.serialDiffTitle": "差分の推移", - "data.search.aggs.metrics.siblingPipelineAggregationsSubtypeTitle": "シブリングパイプラインアグリゲーション", - "data.search.aggs.metrics.standardDeviation.keyDetailsLabel": "{fieldDisplayName} の標準偏差", - "data.search.aggs.metrics.standardDeviation.lowerKeyDetailsTitle": "下の{label}", - "data.search.aggs.metrics.standardDeviation.upperKeyDetailsTitle": "上の{label}", - "data.search.aggs.metrics.standardDeviationLabel": "{field} の標準偏差", - "data.search.aggs.metrics.standardDeviationTitle": "標準偏差", - "data.search.aggs.metrics.sumBucketTitle": "合計バケット", - "data.search.aggs.metrics.sumLabel": "{field} の合計", - "data.search.aggs.metrics.sumTitle": "合計", - "data.search.aggs.metrics.topHit.ascendingLabel": "昇順", - "data.search.aggs.metrics.topHit.averageLabel": "平均", - "data.search.aggs.metrics.topHit.concatenateLabel": "連結", - "data.search.aggs.metrics.topHit.descendingLabel": "降順", - "data.search.aggs.metrics.topHit.firstPrefixLabel": "最初", - "data.search.aggs.metrics.topHit.lastPrefixLabel": "最後", - "data.search.aggs.metrics.topHit.maxLabel": "最高", - "data.search.aggs.metrics.topHit.minLabel": "最低", - "data.search.aggs.metrics.topHit.sumLabel": "合計", - "data.search.aggs.metrics.topHitTitle": "トップヒット", - "data.search.aggs.metrics.uniqueCountLabel": "{field} のユニークカウント", - "data.search.aggs.metrics.uniqueCountTitle": "ユニークカウント", - "data.search.aggs.otherBucket.labelForMissingValuesLabel": "欠測値のラベル", - "data.search.aggs.otherBucket.labelForOtherBucketLabel": "他のバケットのラベル", - "data.search.aggs.paramTypes.field.invalidSavedFieldParameterErrorMessage": "保存した {fieldParameter} パラメーターが無効になりました。新しいフィールドを選択してください。", - "data.search.aggs.paramTypes.field.requiredFieldParameterErrorMessage": "{fieldParameter} は必須パラメーターです", - "data.search.aggs.percentageOfLabel": "{label} の割合", - "data.search.aggs.string.customLabel": "カスタムラベル", - "data.search.searchBar.savedQueryDescriptionLabelText": "説明", - "data.search.searchBar.savedQueryDescriptionText": "再度使用するクエリテキストとフィルターを保存します。", - "data.search.searchBar.savedQueryForm.titleConflictText": "タイトルが既に保存されているクエリに使用されています", - "data.search.searchBar.savedQueryForm.titleMissingText": "名前が必要です", - "data.search.searchBar.savedQueryForm.whitespaceErrorText": "タイトルの始めと終わりにはスペースを使用できません", - "data.search.searchBar.savedQueryFormCancelButtonText": "キャンセル", - "data.search.searchBar.savedQueryFormSaveButtonText": "保存", - "data.search.searchBar.savedQueryFormTitle": "クエリを保存", - "data.search.searchBar.savedQueryIncludeFiltersLabelText": "フィルターを含める", - "data.search.searchBar.savedQueryIncludeTimeFilterLabelText": "時間フィルターを含める", - "data.search.searchBar.savedQueryNameHelpText": "名前が必要です。タイトルの始めと終わりにはスペースを使用できません。名前は固有でなければなりません。", - "data.search.searchBar.savedQueryNameLabelText": "名前", - "data.search.searchBar.savedQueryNoSavedQueriesText": "保存されたクエリがありません。", - "data.search.searchBar.savedQueryPopoverButtonText": "保存されたクエリを表示", - "data.search.searchBar.savedQueryPopoverClearButtonAriaLabel": "現在保存されているクエリを消去", - "data.search.searchBar.savedQueryPopoverClearButtonText": "消去", - "data.search.searchBar.savedQueryPopoverConfirmDeletionCancelButtonText": "キャンセル", - "data.search.searchBar.savedQueryPopoverConfirmDeletionConfirmButtonText": "削除", - "data.search.searchBar.savedQueryPopoverConfirmDeletionTitle": "「{savedQueryName}」を削除しますか？", - "data.search.searchBar.savedQueryPopoverDeleteButtonAriaLabel": "保存されたクエリ {savedQueryName} を削除", - "data.search.searchBar.savedQueryPopoverSaveAsNewButtonAriaLabel": "新規保存クエリを保存", - "data.search.searchBar.savedQueryPopoverSaveAsNewButtonText": "新規保存", - "data.search.searchBar.savedQueryPopoverSaveButtonAriaLabel": "新規保存クエリを保存", - "data.search.searchBar.savedQueryPopoverSaveButtonText": "現在のクエリを保存", - "data.search.searchBar.savedQueryPopoverSaveChangesButtonAriaLabel": "{title} への変更を保存", - "data.search.searchBar.savedQueryPopoverSaveChangesButtonText": "変更を保存", - "data.search.searchBar.savedQueryPopoverSavedQueryListItemButtonAriaLabel": "保存クエリボタン {savedQueryName}", - "data.search.searchBar.savedQueryPopoverSavedQueryListItemDescriptionAriaLabel": "{savedQueryName} の説明", - "data.search.searchBar.savedQueryPopoverSavedQueryListItemSelectedButtonAriaLabel": "選択されたクエリボタン {savedQueryName} を保存しました。変更を破棄するには押してください。", - "data.search.searchBar.savedQueryPopoverTitleText": "保存されたクエリ", - "data.search.searchSource.fetch.requestTimedOutNotificationMessage": "リクエストがタイムアウトしたため、データが不完全な可能性があります", - "data.search.searchSource.fetch.shardsFailedModal.close": "閉じる", - "data.search.searchSource.fetch.shardsFailedModal.copyToClipboard": "応答をクリップボードにコピー", - "data.search.searchSource.fetch.shardsFailedModal.failureHeader": "{failureName}で{failureDetails}", - "data.search.searchSource.fetch.shardsFailedModal.showDetails": "詳細を表示", - "data.search.searchSource.fetch.shardsFailedModal.tabHeaderRequest": "リクエスト", - "data.search.searchSource.fetch.shardsFailedModal.tabHeaderResponse": "応答", - "data.search.searchSource.fetch.shardsFailedModal.tabHeaderShardFailures": "シャードエラー", - "data.search.searchSource.fetch.shardsFailedModal.tableColIndex": "インデックス", - "data.search.searchSource.fetch.shardsFailedModal.tableColNode": "ノード", - "data.search.searchSource.fetch.shardsFailedModal.tableColReason": "理由", - "data.search.searchSource.fetch.shardsFailedModal.tableColShard": "シャード", - "data.search.searchSource.fetch.shardsFailedModal.tableRowCollapse": "{rowDescription}を折りたたむ", - "data.search.searchSource.fetch.shardsFailedModal.tableRowExpand": "{rowDescription}を展開する", - "data.search.searchSource.fetch.shardsFailedNotificationDescription": "表示されているデータは不完全か誤りの可能性があります。", - "data.search.searchSource.fetch.shardsFailedNotificationMessage": "{shardsTotal} 件中 {shardsFailed} 件のシャードでエラーが発生しました", - "data.search.searchSource.hitsDescription": "クエリにより返されたドキュメントの数です。", - "data.search.searchSource.hitsLabel": "ヒット数", - "data.search.searchSource.hitsTotalDescription": "クエリに一致するドキュメントの数です。", - "data.search.searchSource.hitsTotalLabel": "ヒット数 (合計)", - "data.search.searchSource.indexPatternDescription": "Elasticsearch インデックスに接続したインデックスパターンです。", - "data.search.searchSource.indexPatternIdDescription": "{kibanaIndexPattern} インデックス内の ID です。", - "data.search.searchSource.indexPatternIdLabel": "インデックスパターン ID", - "data.search.searchSource.indexPatternLabel": "インデックスパターン", - "data.search.searchSource.noSearchStrategyRegisteredErrorMessageDescription": "検索リクエストの検索方法が見つかりませんでした", - "data.search.searchSource.noSearchStrategyRegisteredErrorMessageTitle": "検索方法が登録されていません", - "data.search.searchSource.queryTimeDescription": "クエリの処理の所要時間です。リクエストの送信やブラウザでのパースの時間は含まれません。", - "data.search.searchSource.queryTimeLabel": "クエリ時間", - "data.search.searchSource.queryTimeValue": "{queryTime}ms", - "data.search.searchSource.requestTimeDescription": "ブラウザから Elasticsearch にリクエストが送信され返されるまでの所要時間です。リクエストがキューで待機していた時間は含まれません。", - "data.search.searchSource.requestTimeLabel": "リクエスト時間", - "data.search.searchSource.requestTimeValue": "{requestTime}ms", - "data.search.unableToGetSavedQueryToastTitle": "保存したクエリ {savedQueryId} を読み込めません", - "devTools.badge.readOnly.text": "読み込み専用", - "devTools.badge.readOnly.tooltip": "を保存できませんでした", - "devTools.k7BreadcrumbsDevToolsLabel": "開発ツール", - "discover.docViews.json.codeEditorAriaLabel": "Elasticsearch ドキュメントの JSON ビューのみを読み込む", - "discover.docViews.json.jsonTitle": "JSON", - "discover.docViews.table.fieldNamesBeginningWithUnderscoreUnsupportedAriaLabel": "警告", - "discover.docViews.table.fieldNamesBeginningWithUnderscoreUnsupportedTooltip": "{underscoreSign} で始まるフィールド名はサポートされません", - "discover.docViews.table.filterForFieldPresentButtonAriaLabel": "フィールド表示のフィルター", - "discover.docViews.table.filterForFieldPresentButtonTooltip": "フィールド表示のフィルター", - "discover.docViews.table.filterForValueButtonAriaLabel": "値でフィルター", - "discover.docViews.table.filterForValueButtonTooltip": "値でフィルター", - "discover.docViews.table.filterOutValueButtonAriaLabel": "値を除外", - "discover.docViews.table.filterOutValueButtonTooltip": "値を除外", - "discover.docViews.table.noCachedMappingForThisFieldAriaLabel": "警告", - "discover.docViews.table.noCachedMappingForThisFieldTooltip": "このフィールドのキャッシュされたマッピングがありません。管理 > インデックスパターンページからフィールドリストを更新してください", - "discover.docViews.table.tableTitle": "表", - "discover.docViews.table.toggleColumnInTableButtonAriaLabel": "表の列を切り替える", - "discover.docViews.table.toggleColumnInTableButtonTooltip": "表の列を切り替える", - "discover.docViews.table.toggleFieldDetails": "フィールド詳細を切り替える", - "discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip": "メタフィールドの有無でフィルタリングできません", - "discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip": "スクリプトフィールドの有無でフィルタリングできません", - "discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip": "インデックスされていないフィールドは検索できません", - "discover.fieldNameIcons.booleanAriaLabel": "ブールフィールド", - "discover.fieldNameIcons.conflictFieldAriaLabel": "矛盾フィールド", - "discover.fieldNameIcons.dateFieldAriaLabel": "日付フィールド", - "discover.fieldNameIcons.geoPointFieldAriaLabel": "地理ポイントフィールド", - "discover.fieldNameIcons.geoShapeFieldAriaLabel": "地理情報シェイプフィールド", - "discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP アドレスフィールド", - "discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 フィールド", - "discover.fieldNameIcons.nestedFieldAriaLabel": "入れ子フィールド", - "discover.fieldNameIcons.numberFieldAriaLabel": "数値フィールド", - "discover.fieldNameIcons.sourceFieldAriaLabel": "ソースフィールド", - "discover.fieldNameIcons.stringFieldAriaLabel": "文字列フィールド", - "discover.fieldNameIcons.unknownFieldAriaLabel": "不明なフィールド", - "embeddableApi.actions.applyFilterActionTitle": "現在のビューにフィルターを適用", - "embeddableApi.addPanel.createNewDefaultOption": "新規作成...", - "embeddableApi.addPanel.displayName": "パネルの追加", - "embeddableApi.addPanel.noMatchingObjectsMessage": "一致するオブジェクトが見つかりませんでした。", - "embeddableApi.addPanel.savedObjectAddedToContainerSuccessMessageTitle": "{savedObjectName} が追加されました", - "embeddableApi.addPanel.Title": "パネルの追加", - "embeddableApi.customizePanel.action.displayName": "パネルをカスタマイズ", - "embeddableApi.customizePanel.modal.cancel": "キャンセル", - "embeddableApi.customizePanel.modal.optionsMenuForm.panelTitleFormRowLabel": "パネルタイトル", - "embeddableApi.customizePanel.modal.optionsMenuForm.panelTitleInputAriaLabel": "パネルのカスタムタイトルを入力してください", - "embeddableApi.customizePanel.modal.optionsMenuForm.resetCustomDashboardButtonLabel": "リセット", - "embeddableApi.customizePanel.modal.saveButtonTitle": "保存", - "embeddableApi.customizePanel.modal.showTitle": "パネルタイトルを表示", - "embeddableApi.customizeTitle.optionsMenuForm.panelTitleFormRowLabel": "パネルタイトル", - "embeddableApi.customizeTitle.optionsMenuForm.panelTitleInputAriaLabel": "このインプットへの変更は直ちに適用されます。Enter を押して閉じます。", - "embeddableApi.customizeTitle.optionsMenuForm.resetCustomDashboardButtonLabel": "タイトルをリセット", - "embeddableApi.errors.embeddableFactoryNotFound": "{type} を読み込めません。Elasticsearch と Kibana のデフォルトのディストリビューションを適切なライセンスでアップグレードしてください。", - "embeddableApi.errors.factoryDoesNotExist": "{type} の埋め込み可能なファクトリーは存在しません。必要なプラグインが全てインストールおよび有効化済みであることを確かめてください。", - "embeddableApi.errors.paneldoesNotExist": "パネルが見つかりません", - "embeddableApi.panel.dashboardPanelAriaLabel": "ダッシュボードパネル", - "embeddableApi.panel.editPanel.displayName": "{value} を編集", - "embeddableApi.panel.enhancedDashboardPanelAriaLabel": "ダッシュボードパネル: {title}", - "embeddableApi.panel.inspectPanel.displayName": "検査", - "embeddableApi.panel.optionsMenu.panelOptionsButtonAriaLabel": "パネルオプション", - "embeddableApi.panel.optionsMenu.panelOptionsButtonEnhancedAriaLabel": "{title} のパネルオプション", - "embeddableApi.panel.removePanel.displayName": "ダッシュボードから削除", - "embeddableApi.samples.contactCard.displayName": "連絡先カード", - "embeddableApi.samples.filterableContainer.displayName": "フィルター可能なダッシュボード", - "embeddableApi.samples.filterableEmbeddable.displayName": "フィルター可能", - "esUi.cronEditor.cronDaily.fieldHour.textAtLabel": "に", - "esUi.cronEditor.cronDaily.fieldTimeLabel": "時間", - "esUi.cronEditor.cronDaily.hourSelectLabel": "時間", - "esUi.cronEditor.cronDaily.minuteSelectLabel": "分", - "esUi.cronEditor.cronHourly.fieldMinute.textAtLabel": "に", - "esUi.cronEditor.cronHourly.fieldTimeLabel": "分", - "esUi.cronEditor.cronMonthly.fieldDateLabel": "日付", - "esUi.cronEditor.cronMonthly.fieldHour.textAtLabel": "に", - "esUi.cronEditor.cronMonthly.fieldTimeLabel": "時間", - "esUi.cronEditor.cronMonthly.hourSelectLabel": "時間", - "esUi.cronEditor.cronMonthly.minuteSelectLabel": "分", - "esUi.cronEditor.cronMonthly.textOnTheLabel": "に", - "esUi.cronEditor.cronWeekly.fieldDateLabel": "日", - "esUi.cronEditor.cronWeekly.fieldHour.textAtLabel": "に", - "esUi.cronEditor.cronWeekly.fieldTimeLabel": "時間", - "esUi.cronEditor.cronWeekly.hourSelectLabel": "時間", - "esUi.cronEditor.cronWeekly.minuteSelectLabel": "分", - "esUi.cronEditor.cronWeekly.textOnLabel": "オン", - "esUi.cronEditor.cronYearly.fieldDate.textOnTheLabel": "に", - "esUi.cronEditor.cronYearly.fieldDateLabel": "日付", - "esUi.cronEditor.cronYearly.fieldHour.textAtLabel": "に", - "esUi.cronEditor.cronYearly.fieldMonth.textInLabel": "に", - "esUi.cronEditor.cronYearly.fieldMonthLabel": "月", - "esUi.cronEditor.cronYearly.fieldTimeLabel": "時間", - "esUi.cronEditor.cronYearly.hourSelectLabel": "時間", - "esUi.cronEditor.cronYearly.minuteSelectLabel": "分", - "esUi.cronEditor.day.friday": "金曜日", - "esUi.cronEditor.day.monday": "月曜日", - "esUi.cronEditor.day.saturday": "土曜日", - "esUi.cronEditor.day.sunday": "日曜日", - "esUi.cronEditor.day.thursday": "木曜日", - "esUi.cronEditor.day.tuesday": "火曜日", - "esUi.cronEditor.day.wednesday": "水曜日", - "esUi.cronEditor.fieldFrequencyLabel": "頻度", - "esUi.cronEditor.month.april": "4 月", - "esUi.cronEditor.month.august": "8 月", - "esUi.cronEditor.month.december": "12 月", - "esUi.cronEditor.month.february": "2 月", - "esUi.cronEditor.month.january": "1 月", - "esUi.cronEditor.month.july": "7 月", - "esUi.cronEditor.month.june": "6 月", - "esUi.cronEditor.month.march": "3 月", - "esUi.cronEditor.month.may": "5 月", - "esUi.cronEditor.month.november": "11 月", - "esUi.cronEditor.month.october": "10 月", - "esUi.cronEditor.month.september": "9 月", - "esUi.cronEditor.textEveryLabel": "毎", - "esUi.forms.comboBoxField.placeHolderText": "入力してエンターキーを押してください", - "esUi.forms.fieldValidation.indexNameInvalidCharactersError": "インデックス名に無効な{characterListLength, plural, one {文字} other {文字}} { characterList } が含まれています。", - "esUi.forms.fieldValidation.indexNameSpacesError": "インデックス名にはスペースを使用できません。", - "esUi.forms.fieldValidation.indexNameStartsWithDotError": "インデックス名の始めにピリオド (.) は使用できません。", - "esUi.forms.fieldValidation.indexPatternInvalidCharactersError": "インデックスパターンに無効な{characterListLength, plural, one {文字} other {文字}} { characterList } が含まれています。", - "esUi.forms.fieldValidation.indexPatternSpacesError": "インデックスパターンにはスペースを使用できません。", - "esUi.validation.string.invalidJSONError": "無効なJSON", - "expressions.defaultErrorRenderer.errorTitle": "ビジュアライゼーションエラー", - "expressions.functions.font.args.alignHelpText": "水平テキスト配置", - "expressions.functions.font.args.colorHelpText": "文字の色です。", - "expressions.functions.font.args.familyHelpText": "利用可能な{css}ウェブフォント文字列です", - "expressions.functions.font.args.italicHelpText": "テキストを斜体にしますか？", - "expressions.functions.font.args.lHeightHelpText": "ピクセル単位の行の高さです。", - "expressions.functions.font.args.sizeHelpText": "ピクセル単位のフォントサイズです。", - "expressions.functions.font.args.underlineHelpText": "テキストに下線を引きますか？", - "expressions.functions.font.args.weightHelpText": "フォントの重量です。例えば、{list}、または {end}です。", - "expressions.functions.font.invalidFontWeightErrorMessage": "無効なフォント太さ：'{weight}'", - "expressions.functions.font.invalidTextAlignmentErrorMessage": "無効なテキストアラインメント：'{align}'", - "expressions.functions.fontHelpText": "フォントスタイルを作成します。", - "expressions.functions.kibana_context.filters.help": "Kibana ジェネリックフィルターを指定します", - "expressions.functions.kibana_context.help": "Kibana グローバルコンテキストを更新します", - "expressions.functions.kibana_context.q.help": "自由形式の Kibana テキストクエリを指定します", - "expressions.functions.kibana_context.savedSearchId.help": "クエリとフィルターに使用する保存検索ID を指定します。", - "expressions.functions.kibana_context.timeRange.help": "Kibana 時間範囲フィルターを指定します", - "expressions.functions.kibana.help": "Kibana グローバルコンテキストを取得します", - "expressions.functions.var.help": "Kibana グローバルコンテキストを更新", - "expressions.functions.var.name.help": "変数の名前を指定", - "expressions.functions.varset.help": "Kibana グローバルコンテキストを更新", - "expressions.functions.varset.name.help": "変数の名前を指定", - "expressions.functions.varset.val.help": "変数の値を指定指定がない場合、インプットコンテキストが使用されます", - "expressions.types.number.fromStringConversionErrorMessage": "\"{string}\" ストリンクを数字に変換できません", - "home.addData.apm.addApmButtonLabel": "APM を追加", - "home.addData.apm.nameDescription": "APM は、集約内から自動的に詳細なパフォーマンスメトリックやエラーを収集します。", - "home.addData.apm.nameTitle": "APM", - "home.addData.logging.addLogDataButtonLabel": "ログデータを追加", - "home.addData.logging.nameDescription": "頻繁に使用するデータソースからログを投入し、構成済みのダッシュボードで簡単に可視化できます。", - "home.addData.logging.nameTitle": "ログ", - "home.addData.metrics.addMetricsDataButtonLabel": "メトリックデータを追加", - "home.addData.metrics.nameDescription": "サーバーのオペレーティングシステムと実行中のサービスからメトリックを収集します。", - "home.addData.metrics.nameTitle": "メトリック", - "home.addData.sampleDataLink": "データセットと Kibana ダッシュボードを読み込む", - "home.addData.sampleDataTitle": "サンプルデータの追加", - "home.addData.siem.addSiemEventsButtonLabel": "イベントを追加", - "home.addData.siem.nameDescription": "即利用可能なビジュアライゼーションで、セキュリティイベントをまとめてインタラクティブな調査を可能にします。", - "home.addData.siem.nameTitle": "SIEM", - "home.addData.title.observability": "オブザーバビリティ", - "home.addData.title.security": "セキュリティ", - "home.addData.uploadFileLink": "CSV、NDJSON、またはログファイルをインポート", - "home.addData.uploadFileTitle": "ログファイルからデータをアップロード", - "home.addData.yourDataLink": "Elasticsearch インデックスに接続", - "home.addData.yourDataTitle": "Elasticsearch データの使用", - "home.breadcrumbs.addDataTitle": "データの追加", - "home.breadcrumbs.homeTitle": "ホーム", - "home.dataManagementDisableCollection": " 収集を停止するには、] ", - "home.dataManagementDisableCollectionLink": "ここで使用状況データを無効にします。", - "home.dataManagementDisclaimerPrivacy": "使用状況データがどのように製品とサービスの管理と改善につながるのかに関する詳細については ", - "home.dataManagementDisclaimerPrivacyLink": "プライバシーポリシーをご覧ください。", - "home.dataManagementEnableCollection": " 収集を開始するには、 ", - "home.dataManagementEnableCollectionLink": "ここで使用状況データを有効にします。", - "home.directories.manage.nameTitle": "Elastic Stack の管理", - "home.directories.notFound.description": "お探しのものが見つかりませんでしたか？", - "home.directories.notFound.viewFullButtonLabel": "Kibana プラグインの完全なディレクトリを表示", - "home.directories.visualize.nameTitle": "データの可視化と閲覧", - "home.directory.directoryTitle": "ディレクトリ", - "home.directory.tabs.administrativeTitle": "管理", - "home.directory.tabs.allTitle": "すべて", - "home.directory.tabs.dataTitle": "データの閲覧と可視化", - "home.directory.tabs.otherTitle": "その他", - "home.exploreButtonLabel": "独りで閲覧", - "home.exploreYourDataDescription": "すべてのステップを終えたら、データ閲覧準備の完了です。", - "home.letsStartDescription": "クラスターにデータがありません。サンプルデータやダッシュボードで試すこともできますし、いきなり独自のデータを使用することもできます。", - "home.letsStartTitle": "始めましょう", - "home.loadTutorials.requestFailedErrorMessage": "リクエスト失敗、ステータスコード: {status}", - "home.loadTutorials.unableToLoadErrorMessage": "チュートリアルが読み込めません。", - "home.recentlyAccessed.recentlyViewedTitle": "最近閲覧", - "home.sampleData.ecommerceSpec.averageSalesPerRegionTitle": "[e コマース] 地域ごとの平均売上", - "home.sampleData.ecommerceSpec.averageSalesPriceTitle": "[e コマース] 平均販売価格", - "home.sampleData.ecommerceSpec.averageSoldQuantityTitle": "[e コマース] 平均販売数", - "home.sampleData.ecommerceSpec.controlsTitle": "[e コマース] コントロール", - "home.sampleData.ecommerceSpec.markdownTitle": "[e コマース] マークダウン", - "home.sampleData.ecommerceSpec.ordersTitle": "[e コマース] 注文", - "home.sampleData.ecommerceSpec.promotionTrackingTitle": "[e コマース] プロモーショントラッキング", - "home.sampleData.ecommerceSpec.revenueDashboardDescription": "サンプルの e コマースの注文と収益を分析します", - "home.sampleData.ecommerceSpec.revenueDashboardTitle": "[e コマース] 収益ダッシュボード", - "home.sampleData.ecommerceSpec.salesByCategoryTitle": "[e コマース] カテゴリーごとの売上", - "home.sampleData.ecommerceSpec.salesByGenderTitle": "[e コマース] 性別ごとの売上", - "home.sampleData.ecommerceSpec.soldProductsPerDayTitle": "[e コマース] 1 日の販売製品", - "home.sampleData.ecommerceSpec.topSellingProductsTitle": "[e コマース] トップセラー製品", - "home.sampleData.ecommerceSpec.totalRevenueTitle": "[e コマース] 合計収益", - "home.sampleData.ecommerceSpecDescription": "e コマースの注文をトラッキングするサンプルデータ、ビジュアライゼーション、ダッシュボードです。", - "home.sampleData.ecommerceSpecTitle": "サンプル e コマース注文", - "home.sampleData.flightsSpec.airlineCarrierTitle": "[フライト] 航空会社", - "home.sampleData.flightsSpec.airportConnectionsTitle": "[フライト] 空港乗り継ぎ (空港にカーソルを合わせてください)", - "home.sampleData.flightsSpec.averageTicketPriceTitle": "[フライト] 平均運賃", - "home.sampleData.flightsSpec.controlsTitle": "[フライト] コントロール", - "home.sampleData.flightsSpec.delayBucketsTitle": "[フライト] 遅延バケット", - "home.sampleData.flightsSpec.delaysAndCancellationsTitle": "[フライト] 遅延・欠航", - "home.sampleData.flightsSpec.delayTypeTitle": "[フライト] 遅延タイプ", - "home.sampleData.flightsSpec.destinationWeatherTitle": "[フライト] 目的地の天候", - "home.sampleData.flightsSpec.flightCancellationsTitle": "[フライト] フライト欠航", - "home.sampleData.flightsSpec.flightCountAndAverageTicketPriceTitle": "[フライト] カウントと平均運賃", - "home.sampleData.flightsSpec.flightDelaysTitle": "[フライト] フライトの遅延", - "home.sampleData.flightsSpec.flightLogTitle": "[フライト] 飛行記録", - "home.sampleData.flightsSpec.globalFlightDashboardDescription": "ES-Air、Logstash Airways、Kibana Airlines、JetBeats のサンプル飛行データを分析します", - "home.sampleData.flightsSpec.globalFlightDashboardTitle": "[フライト] グローバルフライトダッシュボード", - "home.sampleData.flightsSpec.markdownInstructionsTitle": "[フライト] マークダウンの指示", - "home.sampleData.flightsSpec.originCountryTicketPricesTitle": "[フライト] 出発国の運賃", - "home.sampleData.flightsSpec.originCountryTitle": "[Flights] 出発国と到着国の比較", - "home.sampleData.flightsSpec.totalFlightCancellationsTitle": "[フライト] フライト欠航合計", - "home.sampleData.flightsSpec.totalFlightDelaysTitle": "[フライト] フライト遅延合計", - "home.sampleData.flightsSpec.totalFlightsTitle": "[フライト] フライト合計", - "home.sampleData.flightsSpecDescription": "飛行ルートを監視するサンプルデータ、ビジュアライゼーション、ダッシュボードです。", - "home.sampleData.flightsSpecTitle": "サンプル飛行データ", - "home.sampleData.logsSpec.fileTypeScatterPlotTitle": "[ログ] ファイルタイプ散布図", - "home.sampleData.logsSpec.goalsTitle": "[ログ] 目標", - "home.sampleData.logsSpec.heatmapTitle": "[ログ] ヒートマップ", - "home.sampleData.logsSpec.hostVisitsBytesTableTitle": "[ログ] ホスト、訪問数、バイト表", - "home.sampleData.logsSpec.inputControlsTitle": "[ログ] インプットコントロール", - "home.sampleData.logsSpec.markdownInstructionsTitle": "[ログ] マークダウンの指示", - "home.sampleData.logsSpec.responseCodesOverTimeTitle": "[ログ] 一定期間の応答コードと注釈", - "home.sampleData.logsSpec.sourceAndDestinationSankeyChartTitle": "[ログ] ソースと行先のサンキーダイアグラム", - "home.sampleData.logsSpec.uniqueVisitorsByCountryTitle": "[ログ] 国ごとのユニークビジター", - "home.sampleData.logsSpec.uniqueVisitorsTitle": "[ログ] ユニークビジターと平均バイトの比較", - "home.sampleData.logsSpec.visitorOSTitle": "[ログ] OS 別のビジター", - "home.sampleData.logsSpec.webTrafficDescription": "Elastic Web サイトのサンプル Webトラフィックログデータを分析します", - "home.sampleData.logsSpec.webTrafficTitle": "[ログ] Web トラフィック", - "home.sampleData.logsSpecDescription": "Web ログを監視するサンプルデータ、ビジュアライゼーション、ダッシュボードです。", - "home.sampleData.logsSpecTitle": "サンプル Web ログ", - "home.sampleDataSet.installedLabel": "{name} がインストールされました", - "home.sampleDataSet.unableToInstallErrorMessage": "サンプルデータセット「{name}」をインストールできません", - "home.sampleDataSet.unableToLoadListErrorMessage": "サンプルデータセットのリストを読み込めません", - "home.sampleDataSet.unableToUninstallErrorMessage": "サンプルデータセット「{name}」をアンインストールできません", - "home.sampleDataSet.uninstalledLabel": "{name} がアンインストールされました", - "home.sampleDataSetCard.addButtonAriaLabel": "{datasetName} を追加", - "home.sampleDataSetCard.addButtonLabel": "データの追加", - "home.sampleDataSetCard.addingButtonAriaLabel": "{datasetName} を追加中", - "home.sampleDataSetCard.addingButtonLabel": "追加中", - "home.sampleDataSetCard.dashboardLinkLabel": "ダッシュボード", - "home.sampleDataSetCard.default.addButtonAriaLabel": "{datasetName} を追加", - "home.sampleDataSetCard.default.addButtonLabel": "データの追加", - "home.sampleDataSetCard.default.unableToVerifyErrorMessage": "データセットステータスを確認できません、エラー: {statusMsg}", - "home.sampleDataSetCard.removeButtonAriaLabel": "{datasetName} を削除", - "home.sampleDataSetCard.removeButtonLabel": "削除", - "home.sampleDataSetCard.removingButtonAriaLabel": "{datasetName} を削除中", - "home.sampleDataSetCard.removingButtonLabel": "削除中", - "home.sampleDataSetCard.viewDataButtonAriaLabel": "{datasetName} を表示", - "home.sampleDataSetCard.viewDataButtonLabel": "データを表示", - "home.tryButtonLabel": "サンプルデータを試す", - "home.tutorial.addDataToKibanaTitle": "データの追加", - "home.tutorial.card.sampleDataDescription": "これらの「ワンクリック」データセットで Kibana の探索を始めましょう。", - "home.tutorial.card.sampleDataTitle": "サンプルデータ", - "home.tutorial.elasticCloudButtonLabel": "Elastic Cloud", - "home.tutorial.instruction.copyButtonLabel": "スニペットをコピー", - "home.tutorial.instructionSet.checkStatusButtonLabel": "ステータスを確認", - "home.tutorial.instructionSet.customizeLabel": "コードスニペットのカスタマイズ", - "home.tutorial.instructionSet.noDataLabel": "データが見つかりません", - "home.tutorial.instructionSet.statusCheckTitle": "ステータス確認", - "home.tutorial.instructionSet.successLabel": "成功", - "home.tutorial.instructionSet.toggleAriaLabel": "コマンドパラメーターの可視性を調整します", - "home.tutorial.introduction.betaLabel": "ベータ", - "home.tutorial.introduction.imageAltDescription": "プライマリダッシュボードのスクリーンショット。", - "home.tutorial.introduction.viewButtonLabel": "エクスポートされたフィールドを表示", - "home.tutorial.noTutorialLabel": "チュートリアル {tutorialId} が見つかりません", - "home.tutorial.savedObject.addedLabel": "{savedObjectsLength} 件の保存されたオブジェクトが追加されました", - "home.tutorial.savedObject.confirmButtonLabel": "上書きを確定", - "home.tutorial.savedObject.defaultButtonLabel": "Kibana オブジェクトを読み込む", - "home.tutorial.savedObject.installLabel": "インデックスパターン、ビジュアライゼーション、事前定義済みのダッシュボードをインポートします。", - "home.tutorial.savedObject.installStatusLabel": "{savedObjectsLength} オブジェクトの {overwriteErrorsLength} が既に存在しますインポートして既存のオブジェクトを上書きするには、「上書きを確定」をクリックしてください。オブジェクトへの変更はすべて失われます。", - "home.tutorial.savedObject.loadTitle": "Kibana オブジェクトを読み込む", - "home.tutorial.savedObject.requestFailedErrorMessage": "リクエスト失敗、エラー: {message}", - "home.tutorial.savedObject.unableToAddErrorMessage": "{savedObjectsLength} 件中 {errorsLength} 件の kibana オブジェクトが追加できません、エラー: {errorMessage}", - "home.tutorial.selfManagedButtonLabel": "自己管理", - "home.tutorial.tabs.allTitle": "すべて", - "home.tutorial.tabs.loggingTitle": "ログ", - "home.tutorial.tabs.metricsTitle": "メトリック", - "home.tutorial.tabs.sampleDataTitle": "サンプルデータ", - "home.tutorial.tabs.siemTitle": "SIEM", - "home.tutorial.unexpectedStatusCheckStateErrorDescription": "予期せぬステータス確認ステータス {statusCheckState}", - "home.tutorial.unhandledInstructionTypeErrorDescription": "予期せぬ指示タイプ {visibleInstructions}", - "home.tutorials.activemqLogs.artifacts.dashboards.linkLabel": "ActiveMQ アプリケーションイベント", - "home.tutorials.activemqLogs.longDescription": "Filebeat で ActiveMQ ログを収集します。[詳細]({learnMoreLink})", - "home.tutorials.activemqLogs.nameTitle": "ActiveMQ ログ", - "home.tutorials.activemqLogs.shortDescription": "Filebeat で ActiveMQ ログを収集します。", - "home.tutorials.activemqMetrics.artifacts.application.label": "発見", - "home.tutorials.activemqMetrics.longDescription": "Metricbeat モジュール「activemq」は、ActiveMQ インスタンスから監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.activemqMetrics.nameTitle": "ActiveMQ メトリック", - "home.tutorials.activemqMetrics.shortDescription": "ActiveMQ インスタンスから監視メトリックを取得します。", - "home.tutorials.aerospikeMetrics.artifacts.application.label": "発見", - "home.tutorials.aerospikeMetrics.longDescription": "Metricbeat モジュール「aerospike」は、Aerospike から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.aerospikeMetrics.nameTitle": "Aerospike メトリック", - "home.tutorials.aerospikeMetrics.shortDescription": "Aerospike サーバーから内部メトリックを取得します。", - "home.tutorials.apacheLogs.artifacts.dashboards.linkLabel": "Apache ログダッシュボード", - "home.tutorials.apacheLogs.longDescription": "apache Filebeat モジュールが、Apache 2 HTTP サーバーにより作成されたアクセスとエラーのログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.apacheLogs.nameTitle": "Apache ログ", - "home.tutorials.apacheLogs.shortDescription": "Apache HTTP サーバーが作成したアクセスとエラーのログを収集しパースします。", - "home.tutorials.apacheMetrics.artifacts.dashboards.linkLabel": "Apache メトリックダッシュボード", - "home.tutorials.apacheMetrics.longDescription": "Metricbeat モジュール「apache」は、Apache 2 HTTP サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.apacheMetrics.nameTitle": "Apache メトリック", - "home.tutorials.apacheMetrics.shortDescription": "Apache 2 HTTP サーバーから内部メトリックを取得します。", - "home.tutorials.auditbeat.artifacts.dashboards.linkLabel": "SIEM アプリ", - "home.tutorials.auditbeat.longDescription": "Auditbeat を使用してホストから監査データを収集します。これらにはプロセス、ユーザー、ログイン、ソケット情報、ファイルアクセス、その他が含まれます。[詳細]({learnMoreLink})。", - "home.tutorials.auditbeat.nameTitle": "Auditbeat", - "home.tutorials.auditbeat.shortDescription": "ホストから監査データを収集します。", - "home.tutorials.awsLogs.artifacts.dashboards.linkLabel": "AWS S3 サーバーアクセスログダッシュボード", - "home.tutorials.awsLogs.longDescription": "SQS 通知設定されている S3 バケットに AWS ログをエクスポートすることで、AWS ログを収集します。[詳細]({learnMoreLink})。", - "home.tutorials.awsLogs.nameTitle": "AWS S3 ベースのログ", - "home.tutorials.awsLogs.shortDescription": "Filebeat で S3 バケットから AWS ログを収集します。", - "home.tutorials.awsMetrics.artifacts.dashboards.linkLabel": "AWS メトリックダッシュボード", - "home.tutorials.awsMetrics.longDescription": "Metricbeat モジュール「aws」は、AWS API と Cloudwatch から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.awsMetrics.nameTitle": "AWS メトリック", - "home.tutorials.awsMetrics.shortDescription": "AWS API と Cloudwatch からの EC2 インスタンスの監視メトリックです。", - "home.tutorials.azureMetrics.artifacts.application.label": "発見", - "home.tutorials.azureMetrics.longDescription": "Metricbeat モジュール「azure」は、Azure から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.azureMetrics.nameTitle": "Azure メトリック", - "home.tutorials.azureMetrics.shortDescription": "Azure 監視メトリックをフェッチします。", - "home.tutorials.cephMetrics.artifacts.application.label": "発見", - "home.tutorials.cephMetrics.longDescription": "Metricbeat モジュール「ceph」は、Ceph から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.cephMetrics.nameTitle": "Ceph メトリック", - "home.tutorials.cephMetrics.shortDescription": "Ceph サーバーから内部メトリックを取得します。", - "home.tutorials.ciscoLogs.artifacts.dashboards.linkLabel": "SIEM アプリ", - "home.tutorials.ciscoLogs.longDescription": "これは Cisco ネットワークデバイスのログ用のモジュールです。現在、syslog 経由またはファイルから読み込まれた Cisco ASA ファイアウォールログの「asa」ファイルセットをサポートしています。[詳細]({learnMoreLink})。", - "home.tutorials.ciscoLogs.nameTitle": "Cisco", - "home.tutorials.ciscoLogs.shortDescription": "Cisco ASA ファイアウォールからのログを収集・解析します。", - "home.tutorials.cloudwatchLogs.longDescription": "Functionbeat を AWS Lambda 関数として実行するようデプロイし、Cloudwatch ログを収集します。[詳細({learnMoreLink})。", - "home.tutorials.cloudwatchLogs.nameTitle": "AWS Cloudwatch ログ", - "home.tutorials.cloudwatchLogs.shortDescription": "Functionbeat で Cloudwatch ログを収集します。", - "home.tutorials.cockroachdbMetrics.artifacts.dashboards.linkLabel": "CockroachDB メトリックダッシュボード", - "home.tutorials.cockroachdbMetrics.longDescription": "Metricbeat モジュール「cockroachdb」は、CockroachDB から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.cockroachdbMetrics.nameTitle": "CockroachDB メトリック", - "home.tutorials.cockroachdbMetrics.shortDescription": "CockroachDB サーバーから監視メトリックを取得します。", - "home.tutorials.common.auditbeat.cloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.auditbeat.premCloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.auditbeat.premInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.auditbeatCloudInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.auditbeatCloudInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatCloudInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.auditbeatCloudInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.auditbeatCloudInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatCloudInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.auditbeatCloudInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.auditbeatCloudInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatCloudInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.auditbeatCloudInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.auditbeatCloudInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatCloudInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.auditbeatInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.auditbeatInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.auditbeatInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.auditbeatInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.auditbeatInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.auditbeatInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.auditbeatInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.auditbeatInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.auditbeatInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.auditbeatInstructions.install.debTextPost": "32 ビットパッケージをお探しですか？[ダウンロードページ]({linkUrl}) をご覧ください。", - "home.tutorials.common.auditbeatInstructions.install.debTextPre": "Auditbeat は初めてですか？[入門ガイド]({linkUrl}) をご覧ください。", - "home.tutorials.common.auditbeatInstructions.install.debTitle": "Auditbeat のダウンロードとインストール", - "home.tutorials.common.auditbeatInstructions.install.osxTextPre": "Auditbeat は初めてですか？[入門ガイド]({linkUrl}) をご覧ください。", - "home.tutorials.common.auditbeatInstructions.install.osxTitle": "Auditbeat のダウンロードとインストール", - "home.tutorials.common.auditbeatInstructions.install.rpmTextPost": "32 ビットパッケージをお探しですか？[ダウンロードページ]({linkUrl}) をご覧ください。", - "home.tutorials.common.auditbeatInstructions.install.rpmTextPre": "Auditbeat は初めてですか？[入門ガイド]({linkUrl}) をご覧ください。", - "home.tutorials.common.auditbeatInstructions.install.rpmTitle": "Auditbeat のダウンロードとインストール", - "home.tutorials.common.auditbeatInstructions.install.windowsTextPost": "{auditbeatPath} ファイルの {propertyName} を Elasticsearch のインストールに設定します。", - "home.tutorials.common.auditbeatInstructions.install.windowsTextPre": "Auditbeat は初めてですか？[入門ガイド]({guideLinkUrl}) をご覧ください。\n 1.[ダウンロード]({auditbeatLinkUrl}) ページから Auditbeat Windows zip ファイルをダウンロードします。\n 2.zip ファイルのコンテンツを {folderPath} に解凍します。\n 3.「{directoryName}」ディレクトリの名前を「Auditbeat」に変更します。\n 4.管理者として PowerShell プロンプトを開きます (PowerShell アイコンを右クリックして「管理者として実行」を選択します)。Windows XP をご使用の場合、PowerShell のダウンロードとインストールが必要な場合があります。\n 5.PowerShell プロンプトで次のコマンドを実行し、Auditbeat を Windows サービスとしてインストールします。", - "home.tutorials.common.auditbeatInstructions.install.windowsTitle": "Auditbeat のダウンロードとインストール", - "home.tutorials.common.auditbeatInstructions.start.debTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.auditbeatInstructions.start.debTitle": "Auditbeat を起動", - "home.tutorials.common.auditbeatInstructions.start.osxTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.auditbeatInstructions.start.osxTitle": "Auditbeat を起動", - "home.tutorials.common.auditbeatInstructions.start.rpmTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.auditbeatInstructions.start.rpmTitle": "Auditbeat を起動", - "home.tutorials.common.auditbeatInstructions.start.windowsTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.auditbeatInstructions.start.windowsTitle": "Auditbeat を起動", - "home.tutorials.common.auditbeatStatusCheck.buttonLabel": "データを確認してください", - "home.tutorials.common.auditbeatStatusCheck.errorText": "まだデータを受信していません", - "home.tutorials.common.auditbeatStatusCheck.successText": "データを受信しました", - "home.tutorials.common.auditbeatStatusCheck.text": "Auditbeat からデータを受け取ったことを確認してください。", - "home.tutorials.common.auditbeatStatusCheck.title": "ステータス", - "home.tutorials.common.filebeat.cloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.filebeat.premCloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.filebeat.premInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.filebeatCloudInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.filebeatCloudInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatCloudInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.filebeatCloudInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.filebeatCloudInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatCloudInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.filebeatCloudInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.filebeatCloudInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatCloudInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.filebeatCloudInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.filebeatCloudInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatCloudInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.filebeatEnableInstructions.debTextPost": "「/etc/filebeat/modules.d/{moduleName}.yml」ファイルで設定を変更します。", - "home.tutorials.common.filebeatEnableInstructions.debTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.filebeatEnableInstructions.osxTextPost": "「modules.d/{moduleName}.yml」」ファイルで設定を変更します。", - "home.tutorials.common.filebeatEnableInstructions.osxTextPre": "インストールディレクトリから次のファイルを実行します:", - "home.tutorials.common.filebeatEnableInstructions.osxTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.filebeatEnableInstructions.rpmTextPost": "「/etc/filebeat/modules.d/{moduleName}.yml」ファイルで設定を変更します。", - "home.tutorials.common.filebeatEnableInstructions.rpmTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.filebeatEnableInstructions.windowsTextPost": "「modules.d/{moduleName}.yml」」ファイルで設定を変更します。", - "home.tutorials.common.filebeatEnableInstructions.windowsTextPre": "「{path}」フォルダから次のファイルを実行します:", - "home.tutorials.common.filebeatEnableInstructions.windowsTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.filebeatInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.filebeatInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.filebeatInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.filebeatInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.filebeatInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.filebeatInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.filebeatInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.filebeatInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.filebeatInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.filebeatInstructions.install.debTextPost": "32 ビットパッケージをお探しですか？[ダウンロードページ]({linkUrl}) をご覧ください。", - "home.tutorials.common.filebeatInstructions.install.debTextPre": "Filebeat は初めてですか？[入門ガイド]({linkUrl}) をご覧ください。", - "home.tutorials.common.filebeatInstructions.install.debTitle": "Filebeat のダウンロードとインストール", - "home.tutorials.common.filebeatInstructions.install.osxTextPre": "Filebeat は初めてですか？[入門ガイド]({linkUrl}) をご覧ください。", - "home.tutorials.common.filebeatInstructions.install.osxTitle": "Filebeat のダウンロードとインストール", - "home.tutorials.common.filebeatInstructions.install.rpmTextPost": "32 ビットパッケージをお探しですか？[ダウンロードページ]({linkUrl}) をご覧ください。", - "home.tutorials.common.filebeatInstructions.install.rpmTextPre": "Filebeat は初めてですか？[入門ガイド]({linkUrl}) をご覧ください。", - "home.tutorials.common.filebeatInstructions.install.rpmTitle": "Filebeat のダウンロードとインストール", - "home.tutorials.common.filebeatInstructions.install.windowsTextPost": "{filebeatPath} ファイルの {propertyName} を Elasticsearch のインストールに設定します。", - "home.tutorials.common.filebeatInstructions.install.windowsTextPre": "Filebeat は初めてですか？[入門ガイド]({guideLinkUrl}) をご覧ください。\n 1.[ダウンロード]({filebeatLinkUrl}) ページから Auditbeat Windows zip ファイルをダウンロードします。\n 2.zip ファイルのコンテンツを {folderPath} に解凍します。\n 3.「{directoryName}」ディレクトリの名前を「Filebeat」に変更します。\n 4.管理者として PowerShell プロンプトを開きます (PowerShell アイコンを右クリックして「管理者として実行」を選択します)。Windows XP をご使用の場合、PowerShell のダウンロードとインストールが必要な場合があります。\n 5.PowerShell プロンプトで次のコマンドを実行し、Filebeat を Windows サービスとしてインストールします。", - "home.tutorials.common.filebeatInstructions.install.windowsTitle": "Filebeat のダウンロードとインストール", - "home.tutorials.common.filebeatInstructions.start.debTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.filebeatInstructions.start.debTitle": "Filebeat を起動します", - "home.tutorials.common.filebeatInstructions.start.osxTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.filebeatInstructions.start.osxTitle": "Filebeat を起動", - "home.tutorials.common.filebeatInstructions.start.rpmTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.filebeatInstructions.start.rpmTitle": "Filebeat を起動", - "home.tutorials.common.filebeatInstructions.start.windowsTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.filebeatInstructions.start.windowsTitle": "Filebeat を起動", - "home.tutorials.common.filebeatStatusCheck.buttonLabel": "データを確認してください", - "home.tutorials.common.filebeatStatusCheck.errorText": "モジュールからまだデータを受け取っていません", - "home.tutorials.common.filebeatStatusCheck.successText": "このモジュールからデータを受け取りました", - "home.tutorials.common.filebeatStatusCheck.text": "Filebeat の「{moduleName}」モジュールからデータを受け取ったことを確認してください。", - "home.tutorials.common.filebeatStatusCheck.title": "モジュールステータス", - "home.tutorials.common.functionbeat.cloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.functionbeat.premCloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.functionbeat.premInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.functionbeatAWSInstructions.textPost": "「」と「」がアカウント資格情報、「us-east-1」がご希望の地域です。", - "home.tutorials.common.functionbeatAWSInstructions.textPre": "環境で AWS アカウント認証情報を設定します。", - "home.tutorials.common.functionbeatAWSInstructions.title": "AWS 認証情報の設定", - "home.tutorials.common.functionbeatCloudInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.functionbeatCloudInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.functionbeatCloudInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.functionbeatCloudInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.functionbeatCloudInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.functionbeatCloudInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.functionbeatEnableOnPremInstructions.defaultTextPost": "「」が投入するロググループの名前で、「」が Functionbeat デプロイのステージングに使用されるが有効な S3 バケット名です。", - "home.tutorials.common.functionbeatEnableOnPremInstructions.defaultTitle": "Cloudwatch ロググループの構成", - "home.tutorials.common.functionbeatEnableOnPremInstructionsOSXLinux.textPre": "「functionbeat.yml」ファイルで設定を変更します。", - "home.tutorials.common.functionbeatEnableOnPremInstructionsWindows.textPre": "{path} ファイルで設定を変更します。", - "home.tutorials.common.functionbeatInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.functionbeatInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.functionbeatInstructions.config.osxTitle": "Elastic クラスターの構成", - "home.tutorials.common.functionbeatInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.functionbeatInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.functionbeatInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.functionbeatInstructions.deploy.osxTextPre": "これにより Functionbeat が Lambda 関数としてインストールされます「setup」コマンドで Elasticsearch の構成を確認し、Kibana インデックスパターンを読み込みます。通常このコマンドを省いても大丈夫です。", - "home.tutorials.common.functionbeatInstructions.deploy.osxTitle": "Functionbeat を AWS Lambda にデプロイ", - "home.tutorials.common.functionbeatInstructions.deploy.windowsTextPre": "これにより Functionbeat が Lambda 関数としてインストールされます「setup」コマンドで Elasticsearch の構成を確認し、Kibana インデックスパターンを読み込みます。通常このコマンドを省いても大丈夫です。", - "home.tutorials.common.functionbeatInstructions.deploy.windowsTitle": "Functionbeat を AWS Lambda にデプロイ", - "home.tutorials.common.functionbeatInstructions.install.linuxTextPre": "Functionbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.functionbeatInstructions.install.linuxTitle": "Functionbeat のダウンロードとインストール", - "home.tutorials.common.functionbeatInstructions.install.osxTextPre": "Functionbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.functionbeatInstructions.install.osxTitle": "Functionbeat のダウンロードとインストール", - "home.tutorials.common.functionbeatInstructions.install.windowsTextPre": "Functionbeat は初めてですか？[入門ガイド]({functionbeatLink}) をご覧ください。\n 1.[ダウンロード]({elasticLink}) ページから Functionbeat Windows zip ファイルをダウンロードします。\n 2.zip ファイルのコンテンツを {folderPath} に解凍します。\n 3.「{directoryName} ディレクトリの名前を「Functionbeat」に変更します。\n 4.管理者として PowerShell プロンプトを開きます (PowerShell アイコンを右クリックして「管理者として実行」を選択します)。Windows XP をご使用の場合、PowerShell のダウンロードとインストールが必要な場合があります。\n 5.PowerShell プロンプトから、Functionbeat ディレクトリに移動します:", - "home.tutorials.common.functionbeatInstructions.install.windowsTitle": "Functionbeat のダウンロードとインストール", - "home.tutorials.common.functionbeatStatusCheck.buttonLabel": "データを確認してください", - "home.tutorials.common.functionbeatStatusCheck.errorText": "Functionbeat からまだデータを受け取っていません", - "home.tutorials.common.functionbeatStatusCheck.successText": "Functionbeat からデータを受け取りました", - "home.tutorials.common.functionbeatStatusCheck.text": "Functionbeat からデータを受け取ったことを確認してください。", - "home.tutorials.common.functionbeatStatusCheck.title": "Functionbeat ステータス", - "home.tutorials.common.heartbeat.cloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.heartbeat.premCloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.heartbeat.premInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.heartbeatCloudInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.heartbeatCloudInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatCloudInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.heartbeatCloudInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.heartbeatCloudInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatCloudInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.heartbeatCloudInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.heartbeatCloudInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatCloudInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.heartbeatCloudInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.heartbeatCloudInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatCloudInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.heartbeatEnableCloudInstructions.debTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableCloudInstructions.defaultTextPost": "Heartbeat の監視を構成する手順の詳細は、[Heartbeat 構成ドキュメント]({configureLink}) をご覧ください。", - "home.tutorials.common.heartbeatEnableCloudInstructions.defaultTitle": "構成を変更 - 監視を追加", - "home.tutorials.common.heartbeatEnableCloudInstructions.osxTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableCloudInstructions.rpmTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableCloudInstructions.windowsTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableOnPremInstructions.debTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableOnPremInstructions.defaultTextPost": "{hostTemplate} は監視対象の URL です。Heartbeat の監視を構成する手順の詳細は、[Heartbeat 構成ドキュメント]({configureLink}) をご覧ください。", - "home.tutorials.common.heartbeatEnableOnPremInstructions.defaultTitle": "構成を変更 - 監視を追加", - "home.tutorials.common.heartbeatEnableOnPremInstructions.osxTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableOnPremInstructions.rpmTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatEnableOnPremInstructions.windowsTextPre": "「heartbeat.yml」ファイルの「heartbeat.monitors」設定を変更します。", - "home.tutorials.common.heartbeatInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.heartbeatInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.heartbeatInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.heartbeatInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.heartbeatInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.heartbeatInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.heartbeatInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.heartbeatInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.heartbeatInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.heartbeatInstructions.install.debTextPost": "32 ビットパッケージをお探しですか？[ダウンロードページ]({link}) をご覧ください。", - "home.tutorials.common.heartbeatInstructions.install.debTextPre": "Heartbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.heartbeatInstructions.install.debTitle": "Heartbeat のダウンロードとインストール", - "home.tutorials.common.heartbeatInstructions.install.osxTextPre": "Heartbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.heartbeatInstructions.install.osxTitle": "Heartbeat のダウンロードとインストール", - "home.tutorials.common.heartbeatInstructions.install.rpmTextPre": "Heartbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.heartbeatInstructions.install.rpmTitle": "Heartbeat のダウンロードとインストール", - "home.tutorials.common.heartbeatInstructions.install.windowsTextPre": "Heartbeat は初めてですか？[入門ガイド]({heartbeatLink}) をご覧ください。\n 1.[ダウンロード]({elasticLink}) ページから Heartbeat Windows zip ファイルをダウンロードします。\n 2.zip ファイルのコンテンツを {folderPath} に解凍します。\n 3.「{directoryName} ディレクトリの名前を「Heartbeat」に変更します。\n 4.管理者として PowerShell プロンプトを開きます (PowerShell アイコンを右クリックして「管理者として実行」を選択します)。Windows XP をご使用の場合、PowerShell のダウンロードとインストールが必要な場合があります。\n 5.PowerShell プロンプトで次のコマンドを実行し、Heartbeat を Windows サービスとしてインストールします。", - "home.tutorials.common.heartbeatInstructions.install.windowsTitle": "Heartbeat のダウンロードとインストール", - "home.tutorials.common.heartbeatInstructions.start.debTextPre": "「setup」コマンドで Kibana のインデックスパターンを読み込みます。", - "home.tutorials.common.heartbeatInstructions.start.debTitle": "Heartbeat を起動します", - "home.tutorials.common.heartbeatInstructions.start.osxTextPre": "「setup」コマンドで Kibana のインデックスパターンを読み込みます。", - "home.tutorials.common.heartbeatInstructions.start.osxTitle": "Heartbeat を起動します", - "home.tutorials.common.heartbeatInstructions.start.rpmTextPre": "「setup」コマンドで Kibana のインデックスパターンを読み込みます。", - "home.tutorials.common.heartbeatInstructions.start.rpmTitle": "Heartbeat を起動します", - "home.tutorials.common.heartbeatInstructions.start.windowsTextPre": "「setup」コマンドで Kibana のインデックスパターンを読み込みます。", - "home.tutorials.common.heartbeatInstructions.start.windowsTitle": "Heartbeat を起動します", - "home.tutorials.common.heartbeatStatusCheck.buttonLabel": "データを確認してください", - "home.tutorials.common.heartbeatStatusCheck.errorText": "Heartbeat からまだデータを受け取っていません", - "home.tutorials.common.heartbeatStatusCheck.successText": "Heartbeat からデータを受け取りました", - "home.tutorials.common.heartbeatStatusCheck.text": "Heartbeat からデータを受け取ったことを確認してください。", - "home.tutorials.common.heartbeatStatusCheck.title": "Heartbeat のステータス", - "home.tutorials.common.logstashInstructions.install.java.osxTextPre": "[こちら]({link}) のインストール手順に従ってください。", - "home.tutorials.common.logstashInstructions.install.java.osxTitle": "Java Runtime Environment のダウンロードとインストール", - "home.tutorials.common.logstashInstructions.install.java.windowsTextPre": "[こちら]({link}) のインストール手順に従ってください。", - "home.tutorials.common.logstashInstructions.install.java.windowsTitle": "Java Runtime Environment のダウンロードとインストール", - "home.tutorials.common.logstashInstructions.install.logstash.osxTextPre": "Logstash は初めてですか？ [入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.logstashInstructions.install.logstash.osxTitle": "Logstash のダウンロードとインストール", - "home.tutorials.common.logstashInstructions.install.logstash.windowsTextPre": "Logstash は初めてですか？ [入門ガイド]({logstashLink}) をご覧ください。\n 1. Logstash Windows zip ファイルを [ダウンロード]({elasticLink}) します。\n 2.zip ファイルのコンテンツを展開します。", - "home.tutorials.common.logstashInstructions.install.logstash.windowsTitle": "Logstash のダウンロードとインストール", - "home.tutorials.common.metricbeat.cloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.metricbeat.premCloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.metricbeat.premInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.metricbeatCloudInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.metricbeatCloudInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatCloudInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.metricbeatCloudInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.metricbeatCloudInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatCloudInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.metricbeatCloudInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.metricbeatCloudInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatCloudInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.metricbeatCloudInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.metricbeatCloudInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatCloudInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.metricbeatEnableInstructions.debTextPost": "「/etc/metricbeat/modules.d/{moduleName}.yml」ファイルで設定を変更します。", - "home.tutorials.common.metricbeatEnableInstructions.debTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.metricbeatEnableInstructions.osxTextPost": "「modules.d/{moduleName}.yml」」ファイルで設定を変更します。", - "home.tutorials.common.metricbeatEnableInstructions.osxTextPre": "インストールディレクトリから次のファイルを実行します:", - "home.tutorials.common.metricbeatEnableInstructions.osxTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.metricbeatEnableInstructions.rpmTextPost": "「/etc/metricbeat/modules.d/{moduleName}.yml」ファイルで設定を変更します。", - "home.tutorials.common.metricbeatEnableInstructions.rpmTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.metricbeatEnableInstructions.windowsTextPost": "「modules.d/{moduleName}.yml」」ファイルで設定を変更します。", - "home.tutorials.common.metricbeatEnableInstructions.windowsTextPre": "「{path}」フォルダから次のファイルを実行します:", - "home.tutorials.common.metricbeatEnableInstructions.windowsTitle": "{moduleName} モジュールを有効にし構成します", - "home.tutorials.common.metricbeatInstructions.config.debTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.metricbeatInstructions.config.debTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatInstructions.config.debTitle": "構成を編集する", - "home.tutorials.common.metricbeatInstructions.config.osxTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.metricbeatInstructions.config.osxTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatInstructions.config.osxTitle": "構成を編集する", - "home.tutorials.common.metricbeatInstructions.config.rpmTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.metricbeatInstructions.config.rpmTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatInstructions.config.rpmTitle": "構成を編集する", - "home.tutorials.common.metricbeatInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.metricbeatInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.metricbeatInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.metricbeatInstructions.install.debTextPost": "32 ビットパッケージをお探しですか？[ダウンロードページ]({link}) をご覧ください。", - "home.tutorials.common.metricbeatInstructions.install.debTextPre": "Metricbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.metricbeatInstructions.install.debTitle": "Metricbeat のダウンロードとインストール", - "home.tutorials.common.metricbeatInstructions.install.osxTextPre": "Metricbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.metricbeatInstructions.install.osxTitle": "Metricbeat のダウンロードとインストール", - "home.tutorials.common.metricbeatInstructions.install.rpmTextPre": "Metricbeat は初めてですか？[入門ガイド]({link}) をご覧ください。", - "home.tutorials.common.metricbeatInstructions.install.rpmTitle": "Metricbeat のダウンロードとインストール", - "home.tutorials.common.metricbeatInstructions.install.windowsTextPost": "{path} ファイルの「output.elasticsearch」を Elasticsearch のインストールに設定します。", - "home.tutorials.common.metricbeatInstructions.install.windowsTextPre": "Metricbeat は初めてですか？[入門ガイド]({metricbeatLink}) をご覧ください。\n 1.[ダウンロード]({elasticLink}) ページから Metricbeat Windows zip ファイルをダウンロードします。\n 2.zip ファイルのコンテンツを {folderPath} に解凍します。\n 3.「{directoryName} ディレクトリの名前を「Metricbeat」に変更します。\n 4.管理者として PowerShell プロンプトを開きます (PowerShell アイコンを右クリックして「管理者として実行」を選択します)。Windows XP をご使用の場合、PowerShell のダウンロードとインストールが必要な場合があります。\n 5.PowerShell プロンプトで次のコマンドを実行し、Metricbeat を Windows サービスとしてインストールします。", - "home.tutorials.common.metricbeatInstructions.install.windowsTitle": "Metricbeat のダウンロードとインストール", - "home.tutorials.common.metricbeatInstructions.start.debTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.metricbeatInstructions.start.debTitle": "Metricbeat を起動します", - "home.tutorials.common.metricbeatInstructions.start.osxTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.metricbeatInstructions.start.osxTitle": "Metricbeat を起動します", - "home.tutorials.common.metricbeatInstructions.start.rpmTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.metricbeatInstructions.start.rpmTitle": "Metricbeat を起動します", - "home.tutorials.common.metricbeatInstructions.start.windowsTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.metricbeatInstructions.start.windowsTitle": "Metricbeat を起動します", - "home.tutorials.common.metricbeatStatusCheck.buttonLabel": "データを確認してください", - "home.tutorials.common.metricbeatStatusCheck.errorText": "モジュールからまだデータを受け取っていません", - "home.tutorials.common.metricbeatStatusCheck.successText": "このモジュールからデータを受け取りました", - "home.tutorials.common.metricbeatStatusCheck.text": "Metricbeat の「{moduleName}」モジュールからデータを受け取ったことを確認してください", - "home.tutorials.common.metricbeatStatusCheck.title": "モジュールステータス", - "home.tutorials.common.premCloudInstructions.option1.textPre": "[Elastic Cloud]({link}) にアクセスします。アカウントをお持ちでない場合は新規登録してください。14 日間の無料トライアルがご利用いただけます。\n\nElastic Cloud コンソールにログインします\n\nElastic Cloud コンソールで次の手順に従ってクラスターを作成します。\n 1.［デプロイを作成］を選択して［デプロイ名］を指定します\n 2.必要に応じて他のデプロイオプションを変更します (デフォルトも使い始めるのに有効です)\n 3.「デプロイを作成」をクリックします\n 4.デプロイの作成が完了するまで待ちます\n 5.新規クラウド Kibana インスタンスにアクセスし、Kibana ホームの手順に従います。", - "home.tutorials.common.premCloudInstructions.option1.title": "オプション 1:Elastic Cloud でお試しください", - "home.tutorials.common.premCloudInstructions.option2.textPre": "この Kibana インスタンスをマネージド Elasticsearch インスタンスに対して実行している場合は、手動セットアップを行います。\n\n「Elasticsearch」エンドポイントを {urlTemplate} として保存し、クラスターの「パスワード」を {passwordTemplate} として保存します。", - "home.tutorials.common.premCloudInstructions.option2.title": "オプション 2:Kibana を Cloud インスタンスに接続", - "home.tutorials.common.winlogbeat.cloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.winlogbeat.premCloudInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.winlogbeat.premInstructions.gettingStarted.title": "はじめに", - "home.tutorials.common.winlogbeatCloudInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワードです。", - "home.tutorials.common.winlogbeatCloudInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.winlogbeatCloudInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.winlogbeatInstructions.config.windowsTextPost": "{passwordTemplate} が「Elastic」ユーザーのパスワード、{esUrlTemplate} が Elasticsearch の URL、{kibanaUrlTemplate} が Kibana の URL です。", - "home.tutorials.common.winlogbeatInstructions.config.windowsTextPre": "{path} を変更して Elastic Cloud への接続情報を設定します:", - "home.tutorials.common.winlogbeatInstructions.config.windowsTitle": "構成を編集する", - "home.tutorials.common.winlogbeatInstructions.install.windowsTextPost": "{path} ファイルの「output.elasticsearch」を Elasticsearch のインストールに設定します。", - "home.tutorials.common.winlogbeatInstructions.install.windowsTextPre": "Winlogbeat は初めてですか？[入門ガイド]({winlogbeatLink}) をご覧ください。\n 1.[ダウンロード]({elasticLink}) ページから Winlogbeat Windows zip ファイルをダウンロードします。\n 2.zip ファイルのコンテンツを {folderPath} に解凍します。\n 3.「{directoryName} ディレクトリの名前を「Winlogbeat」に変更します。\n 4.管理者として PowerShell プロンプトを開きます (PowerShell アイコンを右クリックして「管理者として実行」を選択します)。Windows XP をご使用の場合、PowerShell のダウンロードとインストールが必要な場合があります。\n 5.PowerShell プロンプトで次のコマンドを実行し、Winlogbeat を Windows サービスとしてインストールします。", - "home.tutorials.common.winlogbeatInstructions.install.windowsTitle": "Winlogbeat のダウンロードとインストール", - "home.tutorials.common.winlogbeatInstructions.start.windowsTextPre": "「setup」コマンドで Kibana のダッシュボードを読み込みます。ダッシュボードが既にセットアップされている場合、このコマンドは省略します。", - "home.tutorials.common.winlogbeatInstructions.start.windowsTitle": "Winlogbeat を起動", - "home.tutorials.common.winlogbeatStatusCheck.buttonLabel": "データを確認してください", - "home.tutorials.common.winlogbeatStatusCheck.errorText": "まだデータを受信していません", - "home.tutorials.common.winlogbeatStatusCheck.successText": "データを受信しました", - "home.tutorials.common.winlogbeatStatusCheck.text": "Winlogbeat からデータを受け取ったことを確認してください。", - "home.tutorials.common.winlogbeatStatusCheck.title": "モジュールステータス", - "home.tutorials.consulMetrics.artifacts.dashboards.linkLabel": "Consul メトリックダッシュボード", - "home.tutorials.consulMetrics.longDescription": "Metricbeat モジュール「consul」は、Consul から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.consulMetrics.nameTitle": "Consul メトリック", - "home.tutorials.consulMetrics.shortDescription": "CouchdB サーバーから監視メトリックを取得します。", - "home.tutorials.corednsLogs.artifacts.dashboards.linkLabel": "CoreDNS ログダッシュボード", - "home.tutorials.corednsLogs.longDescription": "「coredns」Filebeat モジュールは、[CoreDNS](https://coredns.io/manual/toc/) からログを収集します。[詳細]({learnMoreLink})。", - "home.tutorials.corednsLogs.nameTitle": "CoreDNS ログ", - "home.tutorials.corednsLogs.shortDescription": "Coredns により作成されたログを収集します。", - "home.tutorials.corednsMetrics.artifacts.application.label": "発見", - "home.tutorials.corednsMetrics.longDescription": "Metricbeat モジュール「coredns」は、CoreDNS から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.corednsMetrics.nameTitle": "CoreDNS メトリック", - "home.tutorials.corednsMetrics.shortDescription": "CoreDNS サーバーから監視メトリックを取得します。", - "home.tutorials.couchbaseMetrics.artifacts.application.label": "発見", - "home.tutorials.couchbaseMetrics.longDescription": "Metricbeat モジュール「couchbase」は、Couchbase から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.couchbaseMetrics.nameTitle": "Couchbase メトリック", - "home.tutorials.couchbaseMetrics.shortDescription": "Couchbase から内部メトリックを取得します。", - "home.tutorials.couchdbMetrics.artifacts.dashboards.linkLabel": "CouchDB メトリックダッシュボード", - "home.tutorials.couchdbMetrics.longDescription": "Metricbeat モジュール「couchdb」は、CouchDB から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.couchdbMetrics.nameTitle": "CouchDB メトリック", - "home.tutorials.couchdbMetrics.shortDescription": "CouchdB サーバーから監視メトリックを取得します。", - "home.tutorials.dockerMetrics.artifacts.dashboards.linkLabel": "Docker メトリックダッシュボード", - "home.tutorials.dockerMetrics.longDescription": "Metricbeat モジュール「docker」 は、Docker サーバーからメトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.dockerMetrics.nameTitle": "Docker メトリック", - "home.tutorials.dockerMetrics.shortDescription": "Docker コンテナーに関するメトリックを取得します。", - "home.tutorials.dropwizardMetrics.artifacts.application.label": "発見", - "home.tutorials.dropwizardMetrics.longDescription": "Metricbeat モジュール「dropwizard」は、Dropwizard Java アプリケーション から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.dropwizardMetrics.nameTitle": "Dropwizard メトリック", - "home.tutorials.dropwizardMetrics.shortDescription": "Dropwizard Java アプリケーションから内部メトリックを取得します。", - "home.tutorials.elasticsearchLogs.artifacts.application.label": "発見", - "home.tutorials.elasticsearchLogs.longDescription": "「elasticsearch」Filebeat モジュールが、Elasticsearch により作成されたログをパースします。[詳細({learnMoreLink})。", - "home.tutorials.elasticsearchLogs.nameTitle": "Elasticsearch ログ", - "home.tutorials.elasticsearchLogs.shortDescription": "Elasticsearch により作成されたログを収集しパースします。", - "home.tutorials.elasticsearchMetrics.artifacts.application.label": "発見", - "home.tutorials.elasticsearchMetrics.longDescription": "Metricbeat モジュール「elasticsearch」は、Elasticsearch から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.elasticsearchMetrics.nameTitle": "Elasticsearch メトリック", - "home.tutorials.elasticsearchMetrics.shortDescription": "Elasticsearch から内部メトリックを取得します。", - "home.tutorials.envoyproxyLogs.artifacts.dashboards.linkLabel": "SIEM アプリ", - "home.tutorials.envoyproxyLogs.longDescription": "これは [Envoy proxy access log](https://www.envoyproxy.io/docs/envoy/v1.10.0/configuration/access_log) 用の Filebeatモジュールです。Kubernetes でのスタンドアロンのデプロイメントと Envoy プロキシデプロイメントの両方をサポートします。[詳細]({learnMoreLink})。", - "home.tutorials.envoyproxyLogs.nameTitle": "Envoyproxy", - "home.tutorials.envoyproxyLogs.shortDescription": "Envoy プロキシからのログを収集・解析します。", - "home.tutorials.envoyproxyMetrics.longDescription": "Metricbeat モジュール「envoyproxy」は、Envoy Proxy から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.envoyproxyMetrics.nameTitle": "Envoy Proxy メトリック", - "home.tutorials.envoyproxyMetrics.shortDescription": "Envoy Proxy サーバーから監視メトリックを取得します。", - "home.tutorials.etcdMetrics.artifacts.application.label": "発見", - "home.tutorials.etcdMetrics.longDescription": "Metricbeat モジュール「etcd」は、Etcd から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.etcdMetrics.nameTitle": "Etcd メトリック", - "home.tutorials.etcdMetrics.shortDescription": "Etcd サーバーから内部メトリックを取得します。", - "home.tutorials.golangMetrics.artifacts.dashboards.linkLabel": "Golang メトリックダッシュボード", - "home.tutorials.golangMetrics.longDescription": "Metricbeat モジュール「{moduleName}」は、Golang アプリから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.golangMetrics.nameTitle": "Golang メトリック", - "home.tutorials.golangMetrics.shortDescription": "Golang アプリから内部メトリックを取得します。", - "home.tutorials.haproxyMetrics.artifacts.application.label": "発見", - "home.tutorials.haproxyMetrics.longDescription": "Metricbeat モジュール「haproxy」は、HAProxy アプリから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.haproxyMetrics.nameTitle": "HAProxy メトリック", - "home.tutorials.haproxyMetrics.shortDescription": "HAProxy サーバーから内部メトリックを取得します。", - "home.tutorials.ibmmqLogs.artifacts.dashboards.linkLabel": "IBM MQ イベント", - "home.tutorials.ibmmqLogs.longDescription": "Filebeat で IBM MQ ログを収集します。[詳細]({learnMoreLink})", - "home.tutorials.ibmmqLogs.nameTitle": "IBM MQ ログ", - "home.tutorials.ibmmqLogs.shortDescription": "Filebeat で IBM MQ ログを収集します。", - "home.tutorials.ibmmqMetrics.artifacts.application.label": "発見", - "home.tutorials.ibmmqMetrics.longDescription": "Metricbeat モジュール「ibmmq」は、IBM MQ インスタンスから監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.ibmmqMetrics.nameTitle": "IBM MQ メトリック", - "home.tutorials.ibmmqMetrics.shortDescription": "IBM MQ インスタンスから監視メトリックを取得します。", - "home.tutorials.iisLogs.artifacts.dashboards.linkLabel": "IIS ログダッシュボード", - "home.tutorials.iisLogs.longDescription": "「iis」Filebeat モジュールが、Nginx HTTP サーバーにより作成されたアクセスとエラーのログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.iisLogs.nameTitle": "IIS ログ", - "home.tutorials.iisLogs.shortDescription": "IIS HTTP サーバーにより作成されたアクセスとエラーのログを収集しパースします。", - "home.tutorials.iptablesLogs.artifacts.dashboards.linkLabel": "SIEM アプリ", - "home.tutorials.iptablesLogs.longDescription": "これは iptables と ip6tables ログ用のモジュールです。ネットワーク上で受信した syslog ログ経由や、ファイルからのログをパースします。また、ルールセット名、ルール番号、トラフィックに実行されたアクション (許可/拒否) を含む、Ubiquiti ファイアウォールにより追加された接頭辞も認識できます。[詳細]({learnMoreLink})。", - "home.tutorials.iptablesLogs.nameTitle": "Iptables / Ubiquiti", - "home.tutorials.iptablesLogs.shortDescription": "iptables と ip6tables ログ、または Ubiqiti からのログを収集・解析します。", - "home.tutorials.kafkaLogs.artifacts.dashboards.linkLabel": "Kafka ログダッシュボード", - "home.tutorials.kafkaLogs.longDescription": "「kafka」Filebeat モジュールは、Kafka が作成したログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.kafkaLogs.nameTitle": "Kafka ログ", - "home.tutorials.kafkaLogs.shortDescription": "Kafka が作成したログを収集しパースします。", - "home.tutorials.kafkaMetrics.artifacts.application.label": "発見", - "home.tutorials.kafkaMetrics.longDescription": "Metricbeat モジュール「kafka」は、Kafka から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.kafkaMetrics.nameTitle": "Kafka メトリック", - "home.tutorials.kafkaMetrics.shortDescription": "Kafka サーバーから内部メトリックを取得します。", - "home.tutorials.kibanaMetrics.artifacts.application.label": "発見", - "home.tutorials.kibanaMetrics.longDescription": "Metricbeat モジュール「kibana」は、Kibana から内部メトリックを取得します。 [詳細]({learnMoreLink})。", - "home.tutorials.kibanaMetrics.nameTitle": "Kibana メトリック", - "home.tutorials.kibanaMetrics.shortDescription": "Kibana から内部メトリックを取得します。", - "home.tutorials.kubernetesMetrics.artifacts.dashboards.linkLabel": "Kubernetes メトリックダッシュボード", - "home.tutorials.kubernetesMetrics.longDescription": "Metricbeat モジュール「kubernetes」は、Kubernetes API からメトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.kubernetesMetrics.nameTitle": "Kubernetes メトリック", - "home.tutorials.kubernetesMetrics.shortDescription": "Kubernetes からメトリックを取得します。", - "home.tutorials.logstashLogs.artifacts.dashboards.linkLabel": "Logstash ログダッシュボード", - "home.tutorials.logstashLogs.longDescription": "「logstash」Filebeat モジュールが、Logstash 自体により作成されたデバッグとスローログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.logstashLogs.nameTitle": "Logstash ログ", - "home.tutorials.logstashLogs.shortDescription": "Logstash 自体により作成されたデバッグとスローログをパースします。", - "home.tutorials.logstashMetrics.artifacts.application.label": "発見", - "home.tutorials.logstashMetrics.longDescription": "Metricbeat モジュール「{moduleName}」は、Logstash サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.logstashMetrics.nameTitle": "Logstash メトリック", - "home.tutorials.logstashMetrics.shortDescription": "Logstash サーバーから内部メトリックを取得します。", - "home.tutorials.memcachedMetrics.artifacts.application.label": "発見", - "home.tutorials.memcachedMetrics.longDescription": "Metricbeat モジュール「memcached」は、Memcached から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.memcachedMetrics.nameTitle": "Memcached メトリック", - "home.tutorials.memcachedMetrics.shortDescription": "Memcached サーバーから内部メトリックを取得します。", - "home.tutorials.mongodbMetrics.artifacts.dashboards.linkLabel": "MongoDB メトリックダッシュボード", - "home.tutorials.mongodbMetrics.longDescription": "Metricbeat モジュール「mongodb」は、MongoDB サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.mongodbMetrics.nameTitle": "MongoDB メトリック", - "home.tutorials.mongodbMetrics.shortDescription": "MongoDB から内部メトリックを取得します。", - "home.tutorials.mssqlMetrics.artifacts.dashboards.linkLabel": "Microsoft SQL Server メトリックダッシュボード", - "home.tutorials.mssqlMetrics.longDescription": "Metricbeat モジュール「mssql」は、Microsoft SQL Server インスタンスからの監視、ログ、パフォーマンスメトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.mssqlMetrics.nameTitle": "Microsoft SQL Server Metrics", - "home.tutorials.mssqlMetrics.shortDescription": "Microsoft SQL Server インスタンスから監視メトリックを取得します。", - "home.tutorials.muninMetrics.artifacts.application.label": "発見", - "home.tutorials.muninMetrics.longDescription": "Metricbeat モジュール「munin」は、Munin から内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.muninMetrics.nameTitle": "Munin メトリック", - "home.tutorials.muninMetrics.shortDescription": "Munin サーバーから内部メトリックを取得します。", - "home.tutorials.mysqlLogs.artifacts.dashboards.linkLabel": "MySQL ログダッシュボード", - "home.tutorials.mysqlLogs.longDescription": "「mysql」Filebeat モジュールは、MySQL が作成したエラーとスローログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.mysqlLogs.nameTitle": "MySQL ログ", - "home.tutorials.mysqlLogs.shortDescription": "MySQL が作成したエラーとスローログを収集しパースします。", - "home.tutorials.mysqlMetrics.artifacts.dashboards.linkLabel": "MySQL メトリックダッシュボード", - "home.tutorials.mysqlMetrics.longDescription": "Metricbeat モジュール「mysql」は、MySQL サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.mysqlMetrics.nameTitle": "MySQL メトリック", - "home.tutorials.mysqlMetrics.shortDescription": "MySQL から内部メトリックを取得します。", - "home.tutorials.natsLogs.artifacts.dashboards.linkLabel": "Nats ログダッシュボード", - "home.tutorials.natsLogs.longDescription": "「nats」Filebeat モジュールが、Nats により作成されたログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.natsLogs.nameTitle": "Nats ログ", - "home.tutorials.natsLogs.shortDescription": "Nats により作成されたログを収集しパースします。", - "home.tutorials.natsMetrics.artifacts.dashboards.linkLabel": "Nats メトリックダッシュボード", - "home.tutorials.natsMetrics.longDescription": "Metricbeat モジュール「nats」は、Nats から監視メトリックを取得します。[詳細] {learnMoreLink})。", - "home.tutorials.natsMetrics.nameTitle": "Nats メトリック", - "home.tutorials.natsMetrics.shortDescription": "Nats サーバーから監視メトリックを取得します。", - "home.tutorials.netflow.common.config.elasticCloud.osxTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.elasticCloud.osxTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.elasticCloud.osxTitle": "構成を編集する", - "home.tutorials.netflow.common.config.elasticCloud.windowsTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.elasticCloud.windowsTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.elasticCloud.windowsTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPrem.osxTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートです。", - "home.tutorials.netflow.common.config.onPrem.osxTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPrem.osxTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPrem.windowsTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートです。", - "home.tutorials.netflow.common.config.onPrem.windowsTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPrem.windowsTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{esUrl} は Elastic Cloud で実行中の Elasticsearch の URL で、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{esUrl} は Elastic Cloud で実行中の Elasticsearch の URL で、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTitle": "構成を編集する", - "home.tutorials.netflow.common.setup.osxTextPost": "{setupOption} オプションは Elasticsearch で {netflowPrefix} インデックスパターンを作成し、Kibana のダッシュボードとビジュアライゼーションをインポートします。以降の実行時に既存のダッシュボードに上書きしないよう、このオプションを省略します。", - "home.tutorials.netflow.common.setup.osxTextPre": "実行:", - "home.tutorials.netflow.common.setup.osxTitle": "Netflow モジュールを実行", - "home.tutorials.netflow.common.setup.windowsTextPost": "{setupOption} オプションは Elasticsearch で {netflowPrefix} インデックスパターンを作成し、Kibana のダッシュボードとビジュアライゼーションをインポートします。以降の実行時に既存のダッシュボードに上書きしないよう、このオプションを省略します。", - "home.tutorials.netflow.common.setup.windowsTextPre": "実行:", - "home.tutorials.netflow.common.setup.windowsTitle": "Netflow モジュールを実行", - "home.tutorials.netflow.elasticCloudInstructions.title": "はじめに", - "home.tutorials.netflow.onPremElasticCloudInstructions.title": "はじめに", - "home.tutorials.netflow.onPremInstructions.title": "はじめに", - "home.tutorials.netflow.tutorialLongDescription": "Logstash NetFlow モジュールは、ネットワークフローデータを収集してパースしたり、イベントを Elasticsearch でインデックスしたり、Kibana ダッシュボードをインストールしたりできます。このモジュールは Netflow バージョン 5 と 9 をサポートしています。[詳細]({linkUrl})。", - "home.tutorials.netflow.tutorialShortDescription": "Netflow エクスポーターが送信した Netflow の記録を収集します。", - "home.tutorials.nginxLogs.artifacts.dashboards.linkLabel": "Nginx ログダッシュボード", - "home.tutorials.nginxLogs.longDescription": "「nginx」Filebeat モジュールは、Nginx HTTP サーバーが作成したアクセスとエラーのログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.nginxLogs.nameTitle": "Nginx ログ", - "home.tutorials.nginxLogs.shortDescription": "Nginx HTTP サーバーが作成したアクセスとエラーのログを収集しパースします。", - "home.tutorials.nginxMetrics.artifacts.dashboards.linkLabel": "Nginx メトリックダッシュボード", - "home.tutorials.nginxMetrics.longDescription": "Metricbeat モジュール「nginx」は、Nginx サーバーから内部メトリックを取得します。このモジュールは {statusModuleLink} で生成したウェブページからサーバーステータスデータを収集しますが、これは Nginx で有効にする必要があります。[詳細]({learnMoreLink})。", - "home.tutorials.nginxMetrics.nameTitle": "Nginx メトリック", - "home.tutorials.nginxMetrics.shortDescription": "Nginx HTTP サーバーから内部メトリックを取得します。", - "home.tutorials.openmetricsMetrics.longDescription": "Metricbeat モジュール「openmetrics」は、OpenMetrics の形式でメトリックを提供するエンドポイントからメトリックをフェッチします。[詳細]({learnMoreLink}）。", - "home.tutorials.openmetricsMetrics.nameTitle": "OpenMetrics メトリック", - "home.tutorials.openmetricsMetrics.shortDescription": "OpenMetrics 形式でメトリックを提供するエンドポイントからメトリックを取得します。", - "home.tutorials.osqueryLogs.artifacts.dashboards.linkLabel": "Osquery ログダッシュボード", - "home.tutorials.osqueryLogs.longDescription": "「osquery」Filebeat モジュールは、「osqueryd」が作成した JSON 結果ページを収集します。[詳細]({learnMoreLink})。", - "home.tutorials.osqueryLogs.nameTitle": "Osquery ログ", - "home.tutorials.osqueryLogs.shortDescription": "osqueryd により作成されたログを収集します。", - "home.tutorials.phpFpmMetrics.longDescription": "Metricbeat モジュール「php_fpm」は、PHP-FPM サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.phpFpmMetrics.nameTitle": "PHP-FPM メトリック", - "home.tutorials.phpFpmMetrics.shortDescription": "PHP-FPM から内部メトリックを取得します。", - "home.tutorials.postgresqlLogs.artifacts.dashboards.linkLabel": "PostgreSQL ログダッシュボード", - "home.tutorials.postgresqlLogs.longDescription": "「postgresql」Filebeat モジュールが、PostgreSQL により作成されたエラーとスローログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.postgresqlLogs.nameTitle": "PostgreSQL ログ", - "home.tutorials.postgresqlLogs.shortDescription": "PostgreSQL により作成されたエラーとスローログを収集しパースします。", - "home.tutorials.postgresqlMetrics.longDescription": "Metricbeat モジュール「postgresql」は、PostgreSQL サーバーから内部メトリックを取得します。 [詳細]({learnMoreLink})。", - "home.tutorials.postgresqlMetrics.nameTitle": "PostgreSQL メトリック", - "home.tutorials.postgresqlMetrics.shortDescription": "PostgreSQL から内部メトリックを取得します。", - "home.tutorials.prometheusMetrics.artifacts.application.label": "発見", - "home.tutorials.prometheusMetrics.longDescription": "Metricbeat モジュール「{moduleName}」は、Prometheus エンドポイントからメトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.prometheusMetrics.nameTitle": "Prometheus メトリック", - "home.tutorials.prometheusMetrics.shortDescription": "Prometheus エクスポーターからメトリックを取得します。.", - "home.tutorials.rabbitmqMetrics.artifacts.dashboards.linkLabel": "RabbitMQ メトリックダッシュボード", - "home.tutorials.rabbitmqMetrics.longDescription": "Metricbeat モジュール「rabbitmq」は、RabbitMQ サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.rabbitmqMetrics.nameTitle": "RabbitMQ メトリック", - "home.tutorials.rabbitmqMetrics.shortDescription": "RabbitMQ サーバーから内部メトリックを取得します。", - "home.tutorials.redisenterpriseMetrics.artifacts.application.label": "発見", - "home.tutorials.redisenterpriseMetrics.longDescription": "Metricbeat モジュール「redisenterprise」は Redis Enterprise Server 監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.redisenterpriseMetrics.nameTitle": "Redis Enterprise メトリック", - "home.tutorials.redisenterpriseMetrics.shortDescription": "Redis Enterprise Server から監視メトリックを取得します。", - "home.tutorials.redisLogs.artifacts.dashboards.linkLabel": "Redis ログダッシュボード", - "home.tutorials.redisLogs.longDescription": "「redis」Filebeat モジュールは、Redis が作成したエラーとスローログをパースします。Redis がエラーログを作成するには、Redis 構成ファイルの「logfile」オプションが「redis-server.log」に設定されていることを確認してください。スローログは「SLOWLOG」コマンドで Redis から直接的に読み込まれます。Redis でスローログを記録するには、「slowlog-log-slower-than」オプションが設定されていることを確認してください。「slowlog」ファイルセットは実験的なものであることに注意してください。[詳細]({learnMoreLink})。", - "home.tutorials.redisLogs.nameTitle": "Redis ログ", - "home.tutorials.redisLogs.shortDescription": "Redis が作成したエラーとスローログを収集しパースします。", - "home.tutorials.redisMetrics.artifacts.dashboards.linkLabel": "Redis メトリックダッシュボード", - "home.tutorials.redisMetrics.longDescription": "Metricbeat モジュール「redis」は、Redis サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.redisMetrics.nameTitle": "Redis メトリック", - "home.tutorials.redisMetrics.shortDescription": "Redis から内部メトリックを取得します。", - "home.tutorials.stanMetrics.artifacts.dashboards.linkLabel": "Stan メトリックダッシュボード", - "home.tutorials.stanMetrics.longDescription": "Metricbeat モジュール「stan」は、STAN から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.stanMetrics.nameTitle": "STAN メトリック", - "home.tutorials.stanMetrics.shortDescription": "STAN サーバーから監視メトリックを取得します。", - "home.tutorials.statsdMetrics.longDescription": "Metricbeat モジュール「statsd」は、statsd から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.statsdMetrics.nameTitle": "statsd メトリック", - "home.tutorials.statsdMetrics.shortDescription": "statsd から監視メトリックを取得します。", - "home.tutorials.suricataLogs.artifacts.dashboards.linkLabel": "Suricata ログダッシュボード", - "home.tutorials.suricataLogs.longDescription": "「suricata」Filebeat モジュールは、[Suricata Eve JSON アウトプット](https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html) からログを収集します。[詳細]({learnMoreLink})。", - "home.tutorials.suricataLogs.nameTitle": "Suricata ログ", - "home.tutorials.suricataLogs.shortDescription": "Suricata IDS/IPS/NSM が作成したログを収集します。", - "home.tutorials.systemLogs.artifacts.dashboards.linkLabel": "システムログダッシュボード", - "home.tutorials.systemLogs.longDescription": "「system」Filebeat モジュールは、一般的な Unix/Linux ベースのディストリビューションのシステムログサービスが作成したログを収集しパースします。このモジュールは Windows では利用できません。[詳細]({learnMoreLink})。", - "home.tutorials.systemLogs.nameTitle": "システムログ", - "home.tutorials.systemLogs.shortDescription": "ローカル Syslog サーバーが作成したログを収集しパースします。", - "home.tutorials.systemMetrics.artifacts.dashboards.linkLabel": "システムメトリックダッシュボード", - "home.tutorials.systemMetrics.longDescription": "Metricbeat モジュール「system」は、ホストから CPU、メモリー、ネットワーク、ディスクの統計を収集します。システム全体の統計とプロセスやファイルシステムごとの統計を収集します。[詳細]({learnMoreLink})。", - "home.tutorials.systemMetrics.nameTitle": "システムメトリック", - "home.tutorials.systemMetrics.shortDescription": "ホストから CPU、メモリー、ネットワーク、ディスクの統計を収集します。", - "home.tutorials.traefikLogs.artifacts.dashboards.linkLabel": "Traefik ログダッシュボード", - "home.tutorials.traefikLogs.longDescription": "「traefik」Filebeat モジュールが、Traefik により作成されたアクセスログをパースします。[詳細]({learnMoreLink})。", - "home.tutorials.traefikLogs.nameTitle": "Traefik ログ", - "home.tutorials.traefikLogs.shortDescription": "Traefik Proxy により作成されたアクセスログを収集しパースします。", - "home.tutorials.traefikMetrics.longDescription": "Metricbeat モジュール「traefik」は、Traefik から監視メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.traefikMetrics.nameTitle": "Traefik メトリック", - "home.tutorials.traefikMetrics.shortDescription": "Traefik から監視メトリックを取得します。", - "home.tutorials.uptimeMonitors.artifacts.dashboards.linkLabel": "Uptime アプリ", - "home.tutorials.uptimeMonitors.longDescription": "アクティブなプロービングでサービスの稼働状況を監視します。 Heartbeat は URL のリストに基づいて質問します。稼働していますか？ [詳細]({learnMoreLink})。", - "home.tutorials.uptimeMonitors.nameTitle": "稼働状況監視", - "home.tutorials.uptimeMonitors.shortDescription": "サービスの稼働状況を監視します。", - "home.tutorials.uwsgiMetrics.artifacts.dashboards.linkLabel": "uWSGI メトリックダッシュボード", - "home.tutorials.uwsgiMetrics.longDescription": "Metricbeat モジュール「uwsgi」は、uWSGI サーバーから内部メトリックを取得します。[詳細]({learnMoreLink})。", - "home.tutorials.uwsgiMetrics.nameTitle": "uWSGI メトリック", - "home.tutorials.uwsgiMetrics.shortDescription": "uWSGI サーバーから内部メトリックを取得します。", - "home.tutorials.vsphereMetrics.artifacts.application.label": "発見", - "home.tutorials.vsphereMetrics.longDescription": "「vsphere」Metricbeat モジュールは、vSphere クラスターから内部メトリックを取得します。 [詳細]({learnMoreLink})。", - "home.tutorials.vsphereMetrics.nameTitle": "vSphere メトリック", - "home.tutorials.vsphereMetrics.shortDescription": "vSphere から内部メトリックを取得します。", - "home.tutorials.windowsEventLogs.artifacts.application.label": "SIEM アプリ", - "home.tutorials.windowsEventLogs.longDescription": "Winlogbeat を使用して Windows イベントログからログを収集します。[詳細]({learnMoreLink})。", - "home.tutorials.windowsEventLogs.nameTitle": "Windows イベントログ", - "home.tutorials.windowsEventLogs.shortDescription": "Windows イベントログからイベントを取得します。", - "home.tutorials.windowsMetrics.artifacts.application.label": "発見", - "home.tutorials.windowsMetrics.longDescription": "「windows」Metricbeat モジュールは、Windows から内部メトリックを取得します。 [詳細]({learnMoreLink})。", - "home.tutorials.windowsMetrics.nameTitle": "Windows メトリック", - "home.tutorials.windowsMetrics.shortDescription": "Windows から内部メトリックを取得します。", - "home.tutorials.zeekLogs.artifacts.dashboards.linkLabel": "Zeek ログダッシュボード", - "home.tutorials.zeekLogs.longDescription": "「zeek」Filebeat モジュールが、[Zeek](https://www.zeek.org//documentation/index.html) からログを収集します。[詳細]({learnMoreLink})。", - "home.tutorials.zeekLogs.nameTitle": "Zeek ログ", - "home.tutorials.zeekLogs.shortDescription": "Zeek/Bro により作成されたログを収集します。", - "home.tutorials.zookeeperMetrics.artifacts.application.label": "発見", - "home.tutorials.zookeeperMetrics.longDescription": "「{moduleName}」Metricbeat モジュールは、Zookeeper サーバーから内部メトリックを取得します。 [詳細]({learnMoreLink})。", - "home.tutorials.zookeeperMetrics.nameTitle": "Zookeeper メトリック", - "home.tutorials.zookeeperMetrics.shortDescription": "Zookeeper サーバーから内部メトリックを取得します。", - "home.welcomeDescription": "Elastic Stack への入口", - "home.welcomeHomePageHeader": "Kibana ホーム", - "home.welcomeTitle": "Elastic Kibana へようこそ", - "inputControl.control.noIndexPatternTooltip": "index-pattern id が見つかりませんでした: {indexPatternId}.", - "inputControl.control.notInitializedTooltip": "コントロールが初期化されていません", - "inputControl.control.noValuesDisableTooltip": "「{indexPatternName}」インデックスパターンでいずれのドキュメントにも存在しない「{fieldName}」フィールドがフィルターの対象になっています。異なるフィールドを選択するか、このフィールドに値が入力されているドキュメントをインデックスしてください。", - "inputControl.editor.controlEditor.controlLabel": "コントロールラベル", - "inputControl.editor.controlEditor.moveControlDownAriaLabel": "コントロールを下に移動", - "inputControl.editor.controlEditor.moveControlUpAriaLabel": "コントロールを上に移動", - "inputControl.editor.controlEditor.removeControlAriaLabel": "コントロールを削除", - "inputControl.editor.controlsTab.addButtonLabel": "追加", - "inputControl.editor.controlsTab.select.addControlAriaLabel": "コントロールを追加", - "inputControl.editor.controlsTab.select.controlTypeAriaLabel": "コントロールタイプを選択してください", - "inputControl.editor.controlsTab.select.listDropDownOptionLabel": "オプションリスト", - "inputControl.editor.controlsTab.select.rangeDropDownOptionLabel": "範囲スライダー", - "inputControl.editor.fieldSelect.fieldLabel": "フィールド", - "inputControl.editor.fieldSelect.selectFieldPlaceholder": "フィールドを選択してください...", - "inputControl.editor.indexPatternSelect.patternLabel": "インデックスパターン", - "inputControl.editor.indexPatternSelect.patternPlaceholder": "インデックスパターンを選択してください", - "inputControl.editor.listControl.dynamicOptions.stringFieldDescription": "「文字列」フィールドでのみ利用可能", - "inputControl.editor.listControl.dynamicOptions.updateDescription": "ユーザーインプットに対する更新オプション", - "inputControl.editor.listControl.dynamicOptionsLabel": "ダイナミックオプション", - "inputControl.editor.listControl.multiselectDescription": "複数選択を許可", - "inputControl.editor.listControl.multiselectLabel": "複数選択", - "inputControl.editor.listControl.parentDescription": "オプションは親コントロールの値がベースになっています。親が設定されていない場合は無効です。", - "inputControl.editor.listControl.parentLabel": "親コントロール", - "inputControl.editor.listControl.sizeDescription": "オプション数", - "inputControl.editor.listControl.sizeLabel": "サイズ", - "inputControl.editor.optionsTab.pinFiltersLabel": "すべてのアプリケーションのフィルターをピン付け", - "inputControl.editor.optionsTab.updateFilterLabel": "変更するごとに Kibana フィルターを更新", - "inputControl.editor.optionsTab.useTimeFilterLabel": "時間フィルターを使用", - "inputControl.editor.rangeControl.decimalPlacesLabel": "小数部分の桁数", - "inputControl.editor.rangeControl.stepSizeLabel": "ステップサイズ", - "inputControl.function.help": "インプットコントロールビジュアライゼーション", - "inputControl.listControl.disableTooltip": "「{label}」が設定されるまで無効です。", - "inputControl.listControl.unableToFetchTooltip": "用語を取得できません、エラー: {errorMessage}", - "inputControl.rangeControl.unableToFetchTooltip": "範囲 (最低値と最高値) を取得できません、エラー: {errorMessage}", - "inputControl.register.controlsDescription": "ダッシュボードを簡単に操作できるように、インタラクティブなコントロールを作成します。", - "inputControl.register.controlsTitle": "コントロール", - "inputControl.register.tabs.controlsTitle": "コントロール", - "inputControl.register.tabs.optionsTitle": "オプション", - "inputControl.vis.inputControlVis.applyChangesButtonLabel": "変更を適用", - "inputControl.vis.inputControlVis.cancelChangesButtonLabel": "変更をキャンセル", - "inputControl.vis.inputControlVis.clearFormButtonLabel": "用語を消去", - "inputControl.vis.listControl.partialResultsWarningMessage": "リクエストに長くかかり過ぎているため、用語リストが不完全な可能性があります。完全な結果を得るには、kibana.yml の自動完了設定を調整してください。", - "inputControl.vis.listControl.selectPlaceholder": "選択してください…", - "inputControl.vis.listControl.selectTextPlaceholder": "選択してください…", - "inspector.closeButton": "インスペクターを閉じる", - "inspector.data.dataDescriptionTooltip": "ビジュアライゼーションの元のデータを表示", - "inspector.data.dataTitle": "データ", - "inspector.data.downloadCSVButtonLabel": "CSV をダウンロード", - "inspector.data.downloadCSVToggleButtonLabel": "CSV をダウンロード", - "inspector.data.downloadOptionsUnsavedFilename": "(未保存)", - "inspector.data.filterForValueButtonAriaLabel": "値でフィルタリング", - "inspector.data.filterForValueButtonTooltip": "値でフィルタリング", - "inspector.data.filterOutValueButtonAriaLabel": "値を除外", - "inspector.data.filterOutValueButtonTooltip": "値を除外", - "inspector.data.formattedCSVButtonLabel": "フォーマット済み CSV", - "inspector.data.formattedCSVButtonTooltip": "データを表形式でダウンロード", - "inspector.data.gatheringDataLabel": "データを収集中", - "inspector.data.noDataAvailableDescription": "エレメントがデータを提供しませんでした。", - "inspector.data.noDataAvailableTitle": "利用可能なデータがありません", - "inspector.data.rawCSVButtonLabel": "CSV", - "inspector.data.rawCSVButtonTooltip": "日付をタイムスタンプとしてなど、提供されたデータをそのままダウンロードします", - "inspector.reqTimestampDescription": "リクエストの開始が記録された時刻です", - "inspector.reqTimestampKey": "リクエストのタイムスタンプ", - "inspector.requests.descriptionRowIconAriaLabel": "説明", - "inspector.requests.failedLabel": " (失敗)", - "inspector.requests.noRequestsLoggedDescription.elementHasNotLoggedAnyRequestsText": "エレメントが (まだ) リクエストを記録していません。", - "inspector.requests.noRequestsLoggedDescription.whatDoesItUsuallyMeanText": "これは通常、データを取得する必要がないか、エレメントがまだデータの取得を開始していないことを意味します。", - "inspector.requests.noRequestsLoggedTitle": "リクエストが記録されていません", - "inspector.requests.requestFailedTooltipTitle": "リクエストに失敗しました", - "inspector.requests.requestInProgressAriaLabel": "リクエスト進行中", - "inspector.requests.requestLabel": "リクエスト", - "inspector.requests.requestsDescriptionTooltip": "データを収集したリクエストを表示します", - "inspector.requests.requestsTitle": "リクエスト", - "inspector.requests.requestSucceededTooltipTitle": "リクエスト成功", - "inspector.requests.requestTabLabel": "リクエスト", - "inspector.requests.requestTimeLabel": "{requestTime}ms", - "inspector.requests.requestTooltipDescription": "リクエストの合計所要時間です。", - "inspector.requests.requestWasMadeDescription": "{requestsCount, plural, one {# リクエストが} other {# リクエストが} } 行われました{failedRequests}", - "inspector.requests.requestWasMadeDescription.requestHadFailureText": "、{failedCount} 件に失敗がありました", - "inspector.requests.responseTabLabel": "応答", - "inspector.requests.statisticsTabLabel": "統計", - "inspector.title": "インスペクター", - "inspector.view": "{viewName} を表示", - "kbn.advancedSettings.context.defaultSizeText": "コンテキストビューに表示される周りのエントリーの数", - "kbn.advancedSettings.context.defaultSizeTitle": "コンテキストサイズ", - "kbn.advancedSettings.context.sizeStepText": "コンテキストサイズを増減させる際の最低単位です", - "kbn.advancedSettings.context.sizeStepTitle": "コンテキストサイズのステップ", - "kbn.advancedSettings.context.tieBreakerFieldsText": "同じタイムスタンプ値のドキュメントを区別するためのコンマ区切りのフィールドのリストです。このリストから、現在のインデックスパターンに含まれ並べ替え可能な初めのフィールドが使用されます。", - "kbn.advancedSettings.context.tieBreakerFieldsTitle": "タイブレーカーフィールド", - "kbn.advancedSettings.courier.batchSearchesText": "無効の場合、ダッシュボードパネルは個々に読み込まれ、検索リクエストはユーザーが移動するか\n クエリを更新すると停止します。有効の場合、ダッシュボードパネルはすべてのデータが読み込まれると同時に読み込まれ、\n 検索は停止しません。", - "kbn.advancedSettings.courier.batchSearchesTextDeprecation": "この設定はサポートが終了し、Kibana 8.0 では削除されます。", - "kbn.advancedSettings.courier.batchSearchesTitle": "同時検索のバッチ処理", - "kbn.advancedSettings.courier.customRequestPreference.requestPreferenceLinkText": "リクエスト設定", - "kbn.advancedSettings.courier.customRequestPreferenceText": "{setRequestReferenceSetting} が {customSettingValue} に設定されている時に使用される {requestPreferenceLink} です。", - "kbn.advancedSettings.courier.customRequestPreferenceTitle": "カスタムリクエスト設定", - "kbn.advancedSettings.courier.ignoreFilterText": "この構成は、似ていないインデックスにアクセスするビジュアライゼーションを含むダッシュボードのサポートを強化します。無効にすると、すべてのフィルターがすべてのビジュアライゼーションに適用されます。有効にすると、ビジュアライゼーションのインデックスにフィルター対象のフィールドが含まれていない場合、ビジュアライゼーションの際にフィルターが無視されます。", - "kbn.advancedSettings.courier.ignoreFilterTitle": "フィルターの無視", - "kbn.advancedSettings.courier.maxRequestsText": "Kibana から送信された _msearch requests リクエストに使用される {maxRequestsLink} 設定を管理します。この構成を無効にして Elasticsearch のデフォルトを使用するには、0 に設定します。", - "kbn.advancedSettings.courier.maxRequestsTitle": "最大同時シャードリクエスト", - "kbn.advancedSettings.courier.requestPreferenceCustom": "カスタム", - "kbn.advancedSettings.courier.requestPreferenceNone": "なし", - "kbn.advancedSettings.courier.requestPreferenceSessionId": "セッション ID", - "kbn.advancedSettings.courier.requestPreferenceText": "どのシャードが検索リクエストを扱うかを設定できます。
    \n
  • {sessionId}: 同じシャードのすべての検索リクエストを実行するため、オペレーションを制限します。\n これにはリクエスト間でシャードのキャッシュを共有できるというメリットがあります。
    • \n
  • {custom}: 独自の設定が可能になります。\n couriercustomRequestPreference で設定値をカスタマイズします。
    • \n
  • {none}: 設定されていないことを意味します。\n これにより、リクエストが全シャードコピー間に分散されるため、パフォーマンスが改善される可能性があります。\n ただし、シャードによって更新ステータスが異なる場合があるため、結果に矛盾が生じる可能性があります。
    • \n
", - "kbn.advancedSettings.courier.requestPreferenceTitle": "リクエスト設定", - "kbn.advancedSettings.csv.quoteValuesText": "csv エクスポートに値を引用するかどうかです", - "kbn.advancedSettings.csv.quoteValuesTitle": "CSV の値を引用", - "kbn.advancedSettings.csv.separatorText": "エクスポートされた値をこの文字列で区切ります", - "kbn.advancedSettings.csv.separatorTitle": "CSV セパレーター", - "kbn.advancedSettings.darkModeText": "Kibana UI のダークモードを有効にします。この設定を適用するにはページの更新が必要です。", - "kbn.advancedSettings.darkModeTitle": "ダークモード", - "kbn.advancedSettings.dateFormat.dayOfWeekText": "週の初めの曜日を設定します", - "kbn.advancedSettings.dateFormat.dayOfWeekTitle": "曜日", - "kbn.advancedSettings.dateFormat.optionsLinkText": "フォーマット", - "kbn.advancedSettings.dateFormat.scaled.intervalsLinkText": "ISO8601 間隔", - "kbn.advancedSettings.dateFormat.scaledText": "時間ベースのデータが順番にレンダリングされ、フォーマットされたタイムスタンプが測定値の間隔に適応すべき状況で使用されるフォーマットを定義する値です。キーは {intervalsLink}。", - "kbn.advancedSettings.dateFormat.scaledTitle": "スケーリングされたデータフォーマットです", - "kbn.advancedSettings.dateFormat.timezoneText": "使用されるタイムゾーンです。{defaultOption} ではご使用のブラウザにより検知されたタイムゾーンが使用されます。", - "kbn.advancedSettings.dateFormat.timezoneTitle": "データフォーマットのタイムゾーン", - "kbn.advancedSettings.dateFormatText": "きちんとフォーマットされたデータを表示する際、この {formatLink} を使用します", - "kbn.advancedSettings.dateFormatTitle": "データフォーマット", - "kbn.advancedSettings.dateNanosFormatText": "Elasticsearch の {dateNanosLink} データタイプに使用されます", - "kbn.advancedSettings.dateNanosFormatTitle": "ナノ秒フォーマットでの日付", - "kbn.advancedSettings.dateNanosLinkTitle": "date_nanos", - "kbn.advancedSettings.defaultColumnsText": "デフォルトでディスカバリタブに表示される列です", - "kbn.advancedSettings.defaultColumnsTitle": "デフォルトの列", - "kbn.advancedSettings.defaultIndexText": "インデックスが設定されていない時にアクセスするインデックスです", - "kbn.advancedSettings.defaultIndexTitle": "デフォルトのインデックス", - "kbn.advancedSettings.defaultRoute.defaultRouteIsRelativeValidationMessage": "相対 URL でなければなりません。", - "kbn.advancedSettings.defaultRoute.defaultRouteText": "この設定は、Kibana 起動時のデフォルトのルートを設定します。この設定で、Kibana 起動時のランディングページを変更できます。経路は相対 URL でなければなりません。", - "kbn.advancedSettings.defaultRoute.defaultRouteTitle": "デフォルトのルート", - "kbn.advancedSettings.disableAnimationsText": "Kibana UI の不要なアニメーションをオフにします。変更を適用するにはページを更新してください。", - "kbn.advancedSettings.disableAnimationsTitle": "アニメーションを無効にする", - "kbn.advancedSettings.discover.aggsTermsSizeText": "「可視化」ボタンをクリックした際に、フィールドドロップダウンやディスカバリサイドバーに可視化される用語の数を設定します。", - "kbn.advancedSettings.discover.aggsTermsSizeTitle": "用語数", - "kbn.advancedSettings.discover.sampleSizeText": "表に表示する行数です", - "kbn.advancedSettings.discover.sampleSizeTitle": "行数", - "kbn.advancedSettings.discover.searchOnPageLoadText": "ディスカバリの最初の読み込み時に検索を実行するかを制御します。この設定は、保存された検索の読み込み時には影響しません。", - "kbn.advancedSettings.discover.searchOnPageLoadTitle": "ページの読み込み時の検索", - "kbn.advancedSettings.discover.sortDefaultOrderText": "ディスカバリアプリのインデックスパターンに基づく時刻のデフォルトの並べ替え方向をコントロールします。", - "kbn.advancedSettings.discover.sortDefaultOrderTitle": "デフォルトの並べ替え方向", - "kbn.advancedSettings.discover.sortOrderAsc": "昇順", - "kbn.advancedSettings.discover.sortOrderDesc": "降順", - "kbn.advancedSettings.docTableHideTimeColumnText": "ディスカバリと、ダッシュボードのすべての保存された検索で、「時刻」列を非表示にします。", - "kbn.advancedSettings.docTableHideTimeColumnTitle": "「時刻」列を非表示", - "kbn.advancedSettings.docTableHighlightText": "ディスカバリと保存された検索ダッシュボードの結果をハイライトします。ハイライトすることで、大きなドキュメントを扱う際にリクエストが遅くなります。", - "kbn.advancedSettings.docTableHighlightTitle": "結果をハイライト", - "kbn.advancedSettings.fieldsPopularLimitText": "最も頻繁に使用されるフィールドのトップ N を表示します", - "kbn.advancedSettings.fieldsPopularLimitTitle": "頻繁に使用されるフィールドの制限", - "kbn.advancedSettings.format.bytesFormat.numeralFormatLinkText": "数字フォーマット", - "kbn.advancedSettings.format.bytesFormatText": "「バイト」フォーマットのデフォルト {numeralFormatLink} です", - "kbn.advancedSettings.format.bytesFormatTitle": "バイトフォーマット", - "kbn.advancedSettings.format.currencyFormat.numeralFormatLinkText": "数字フォーマット", - "kbn.advancedSettings.format.currencyFormatText": "「通貨」フォーマットのデフォルト {numeralFormatLink} です", - "kbn.advancedSettings.format.currencyFormatTitle": "通貨フォーマット", - "kbn.advancedSettings.format.defaultTypeMapText": "各フィールドタイプにデフォルトで使用するフォーマット名のマップです。フィールドタイプが特に指定されていない場合は {defaultFormat} が使用されます", - "kbn.advancedSettings.format.defaultTypeMapTitle": "フィールドタイプフォーマット名", - "kbn.advancedSettings.format.formattingLocale.numeralLanguageLinkText": "数字言語", - "kbn.advancedSettings.format.formattingLocaleText": "{numeralLanguageLink} ロケール", - "kbn.advancedSettings.format.formattingLocaleTitle": "フォーマットロケール", - "kbn.advancedSettings.format.numberFormat.numeralFormatLinkText": "数字フォーマット", - "kbn.advancedSettings.format.numberFormatText": "「数字」フォーマットのデフォルト {numeralFormatLink} です", - "kbn.advancedSettings.format.numberFormatTitle": "数字フォーマット", - "kbn.advancedSettings.format.percentFormat.numeralFormatLinkText": "数字フォーマット", - "kbn.advancedSettings.format.percentFormatText": "「パーセント」フォーマットのデフォルト {numeralFormatLink} です", - "kbn.advancedSettings.format.percentFormatTitle": "パーセントフォーマット", - "kbn.advancedSettings.histogram.barTargetText": "日付ヒストグラムで「自動」間隔を使用する際、この数に近いバーの作成を試みます", - "kbn.advancedSettings.histogram.barTargetTitle": "目標バー数", - "kbn.advancedSettings.histogram.maxBarsText": "日付ヒストグラムに表示されるバーの数の上限です。必要に応じて値をスケーリングしてください", - "kbn.advancedSettings.histogram.maxBarsTitle": "最高バー数", - "kbn.advancedSettings.historyLimitText": "履歴があるフィールド (例: クエリインプット) に個の数の最近の値が表示されます", - "kbn.advancedSettings.historyLimitTitle": "履歴制限数", - "kbn.advancedSettings.indexPatternPlaceholderText": "「管理 > インデックスパターン > インデックスパターンを作成」で使用される「インデックスパターン名」フィールドのプレースホルダーです。", - "kbn.advancedSettings.indexPatternPlaceholderTitle": "インデックスパターンのプレースホルダー", - "kbn.advancedSettings.maxBucketsText": "1 つのデータソースが返せるバケットの最大数です", - "kbn.advancedSettings.maxBucketsTitle": "バケットの最大数", - "kbn.advancedSettings.maxCellHeightText": "表のセルが使用する高さの上限です。この切り捨てを無効にするには 0 に設定します", - "kbn.advancedSettings.maxCellHeightTitle": "表のセルの高さの上限", - "kbn.advancedSettings.metaFieldsText": "_source の外にあり、ドキュメントが表示される時に融合されるフィールドです", - "kbn.advancedSettings.metaFieldsTitle": "メタフィールド", - "kbn.advancedSettings.notifications.banner.markdownLinkText": "マークダウン対応", - "kbn.advancedSettings.notifications.bannerLifetimeText": "バナー通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定するとカウントダウンが無効になります。", - "kbn.advancedSettings.notifications.bannerLifetimeTitle": "バナー通知時間", - "kbn.advancedSettings.notifications.bannerText": "すべてのユーザーへの一時的な通知を目的としたカスタムバナーです。{markdownLink}", - "kbn.advancedSettings.notifications.bannerTitle": "カスタムバナー通知", - "kbn.advancedSettings.notifications.errorLifetimeText": "エラー通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定すると無効になります。", - "kbn.advancedSettings.notifications.errorLifetimeTitle": "エラー通知時間", - "kbn.advancedSettings.notifications.infoLifetimeText": "情報通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定すると無効になります。", - "kbn.advancedSettings.notifications.infoLifetimeTitle": "情報通知時間", - "kbn.advancedSettings.notifications.warningLifetimeText": "警告通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定すると無効になります。", - "kbn.advancedSettings.notifications.warningLifetimeTitle": "警告通知時間", - "kbn.advancedSettings.pinFiltersText": "フィルターがデフォルトでグローバル (ピン付けされた状態) になるかの設定です", - "kbn.advancedSettings.pinFiltersTitle": "フィルターをデフォルトでピン付けする", - "kbn.advancedSettings.query.allowWildcardsText": "設定すると、クエリ句の頭に * が使えるようになります。現在クエリバーで実験的クエリ機能が有効になっている場合にのみ適用されます。基本的な Lucene クエリでリーディングワイルドカードを無効にするには、{queryStringOptionsPattern} を使用します。", - "kbn.advancedSettings.query.allowWildcardsTitle": "クエリでリーディングワイルドカードを許可する", - "kbn.advancedSettings.query.queryStringOptions.optionsLinkText": "オプション", - "kbn.advancedSettings.query.queryStringOptionsText": "Lucene クエリ文字列パーサーの {optionsLink}「{queryLanguage}」が {luceneLanguage} に設定されている時にのみ使用されます。", - "kbn.advancedSettings.query.queryStringOptionsTitle": "クエリ文字列のオプション", - "kbn.advancedSettings.savedObjects.listingLimitText": "一覧ページ用に取得するオブジェクトの数です", - "kbn.advancedSettings.savedObjects.listingLimitTitle": "オブジェクト取得制限", - "kbn.advancedSettings.savedObjects.perPageText": "読み込みダイアログで表示されるページごとのオブジェクトの数です", - "kbn.advancedSettings.savedObjects.perPageTitle": "ページごとのオブジェクト数", - "kbn.advancedSettings.searchQueryLanguageKql": "KQL", - "kbn.advancedSettings.searchQueryLanguageLucene": "Lucene", - "kbn.advancedSettings.searchQueryLanguageText": "クエリバーで使用されるクエリ言語です。KQL は Kibana 用に特別に開発された新しい言語です。", - "kbn.advancedSettings.searchQueryLanguageTitle": "クエリ言語", - "kbn.advancedSettings.shortenFieldsText": "長いフィールドを短くします。例: foo.bar.baz の代わりに f.b.baz と表示", - "kbn.advancedSettings.shortenFieldsTitle": "フィールドの短縮", - "kbn.advancedSettings.sortOptions.optionsLinkText": "オプション", - "kbn.advancedSettings.sortOptionsText": "Elasticsearch の並べ替えパラメーターの {optionsLink}", - "kbn.advancedSettings.sortOptionsTitle": "並べ替えオプション", - "kbn.advancedSettings.storeUrlText": "URL は長くなりすぎてブラウザが対応できない場合があります。セッションストレージに URL の一部を保存することがで　この問題に対処できるかテストしています。結果を教えてください！", - "kbn.advancedSettings.storeUrlTitle": "セッションストレージに URL を格納", - "kbn.advancedSettings.suggestFilterValuesText": "フィルターエディターがフィールドの値の候補を表示しないようにするには、このプロパティを false にしてください。", - "kbn.advancedSettings.suggestFilterValuesTitle": "フィルターエディターの候補値", - "kbn.advancedSettings.timepicker.last15Minutes": "過去 15 分間", - "kbn.advancedSettings.timepicker.last1Hour": "過去 1 時間", - "kbn.advancedSettings.timepicker.last1Year": "過去 1 年間", - "kbn.advancedSettings.timepicker.last24Hours": "過去 24 時間", - "kbn.advancedSettings.timepicker.last30Days": "過去 30 日間", - "kbn.advancedSettings.timepicker.last30Minutes": "過去 30 分間", - "kbn.advancedSettings.timepicker.last7Days": "過去 7 日間", - "kbn.advancedSettings.timepicker.last90Days": "過去 90 日間", - "kbn.advancedSettings.timepicker.quickRanges.acceptedFormatsLinkText": "対応フォーマット", - "kbn.advancedSettings.timepicker.quickRangesText": "タイムピッカーのクイックセクションに表示される範囲のリストです。それぞれのオブジェクトに「開始」、「終了」({acceptedFormatsLink} を参照)、「表示」(表示するタイトル) が含まれるオブジェクトの配列です。", - "kbn.advancedSettings.timepicker.quickRangesTitle": "タイムピッカーのクイック範囲", - "kbn.advancedSettings.timepicker.refreshIntervalDefaultsText": "時間フィルターのデフォルト更新間隔", - "kbn.advancedSettings.timepicker.refreshIntervalDefaultsTitle": "タイムピッカーの更新間隔", - "kbn.advancedSettings.timepicker.thisWeek": "今週", - "kbn.advancedSettings.timepicker.timeDefaultsText": "時間フィルターが選択されずに Kibana が起動した際に使用される時間フィルターです", - "kbn.advancedSettings.timepicker.timeDefaultsTitle": "デフォルトのタイムピッカー", - "kbn.advancedSettings.timepicker.today": "今日", - "kbn.advancedSettings.visualization.colorMappingText": "ビジュアライゼーション内の特定の色のマップ値です", - "kbn.advancedSettings.visualization.colorMappingTitle": "カラーマッピング", - "kbn.advancedSettings.visualization.dimmingOpacityText": "チャートの別のエレメントが選択された時に暗くなるチャート項目の透明度です。この数字が小さければ小さいほど、ハイライトされたエレメントが目立ちます。0 と 1 の間の数字で設定します。", - "kbn.advancedSettings.visualization.dimmingOpacityTitle": "減光透明度", - "kbn.advancedSettings.visualization.heatmap.maxBucketsText": "1 つのデータソースが返せるバケットの最大数です。値が大きいとブラウザのレンダリング速度が下がる可能性があります。", - "kbn.advancedSettings.visualization.heatmap.maxBucketsTitle": "ヒートマップの最大バケット数", - "kbn.advancedSettings.visualization.loadingDelayText": "クエリの際にビジュアライゼーションを暗くするまでの時間です", - "kbn.advancedSettings.visualization.loadingDelayTitle": "読み込み遅延", - "kbn.advancedSettings.visualization.showRegionMapWarningsText": "用語がマップの形に合わない場合に地域マップに警告を表示するかどうかです。", - "kbn.advancedSettings.visualization.showRegionMapWarningsTitle": "地域マップに警告を表示", - "kbn.advancedSettings.visualization.tileMap.maxPrecision.cellDimensionsLinkText": "ディメンションの説明", - "kbn.advancedSettings.visualization.tileMap.maxPrecisionText": "マップに表示されるジオハッシュの最高精度です。7 が高い、10 が非常に高い、12 が最高を意味します。{cellDimensionsLink}", - "kbn.advancedSettings.visualization.tileMap.maxPrecisionTitle": "タイルマップの最高精度", - "kbn.advancedSettings.visualization.tileMap.wmsDefaults.propertiesLinkText": "プロパティ", - "kbn.advancedSettings.visualization.tileMap.wmsDefaultsText": "座標マップの WMS マップサーバーサポートのデフォルトの {propertiesLink} です。", - "kbn.advancedSettings.visualization.tileMap.wmsDefaultsTitle": "デフォルトの WMS プロパティ", - "kbn.advancedSettings.visualizeEnableLabsText": "ユーザーが実験的なビジュアライゼーションを作成、表示、編集できるようになります。無効の場合、\n ユーザーは本番準備が整ったビジュアライゼーションのみを利用できます。", - "kbn.advancedSettings.visualizeEnableLabsTitle": "実験的なビジュアライゼーションを有効にする", - "kbn.context.breadcrumb": "{indexPatternTitle}#{docId} のコンテキスト", - "kbn.context.failedToLoadAnchorDocumentDescription": "別ののドキュメントの読み込みに失敗しました", - "kbn.context.failedToLoadAnchorDocumentErrorDescription": "別のドキュメントの読み込みに失敗しました。", - "kbn.context.loadButtonLabel": "読み込み", - "kbn.context.loadingDescription": "読み込み中…", - "kbn.context.newerDocumentsAriaLabel": "新しいドキュメントの数", - "kbn.context.newerDocumentsDescription": "新しいドキュメント", - "kbn.context.newerDocumentsWarning": "アンカーよりも新しいドキュメントは {docCount} 件しか見つかりませんでした。", - "kbn.context.newerDocumentsWarningZero": "アンカーよりも新しいドキュメントは見つかりませんでした。", - "kbn.context.noSearchableTiebreakerFieldDescription": "インデックスパターン {indexPatternId} で検索可能なタイブレーカーフィールドが見つかりませんでした。高度な設定 {tieBreakerFields} tを変更してこのインデックスパターンの有効なフィールドを含めてください。", - "kbn.context.olderDocumentsAriaLabel": "古いドキュメントの数", - "kbn.context.olderDocumentsDescription": "古いドキュメント", - "kbn.context.olderDocumentsWarning": "アンカーよりも古いドキュメントは {docCount} 件しか見つかりませんでした。", - "kbn.context.olderDocumentsWarningZero": "アンカーよりも古いドキュメントは見つかりませんでした。", - "kbn.context.reloadPageDescription.discoverLinkText": "ディスカバリ", - "kbn.context.reloadPageDescription.reloadOrVisitTextMessage": "再読み込みするか", - "kbn.context.reloadPageDescription.selectValidAnchorDocumentTextMessage": "にアクセスして有効な別のドキュメントを選択してください。", - "kbn.context.unableToLoadAnchorDocumentDescription": "別のドキュメントが読み込めません", - "kbn.context.unableToLoadDocumentDescription": "ドキュメントが読み込めません", - "kbn.dashboard.listing.table.descriptionColumnName": "説明", - "kbn.dashboard.panel.unableToMigratePanelDataForSixOneZeroErrorMessage": "「6.1.0」のダッシュボードの互換性のため、パネルデータを移行できませんでした。パネルには想定された列または行フィールドがありません", - "kbn.dashboard.panel.unableToMigratePanelDataForSixThreeZeroErrorMessage": "「6.3.0」のダッシュボードの互換性のため、パネルデータを移行できませんでした。パネルに必要なフィールドがありません: {key}", - "kbn.dashboard.savedDashboardsTitle": "ダッシュボード", - "kbn.dashboardTitle": "ダッシュボード", - "kbn.devToolsTitle": "開発ツール", - "kbn.discover.backToTopLinkText": "最上部へ戻る。", - "kbn.discover.badge.readOnly.text": "読み込み専用", - "kbn.discover.badge.readOnly.tooltip": "検索を保存できません", - "kbn.discover.bucketIntervalTooltip": "この間隔は選択された時間範囲に表示される {bucketsDescription} が作成されるため、{bucketIntervalDescription} にスケーリングされています。", - "kbn.discover.bucketIntervalTooltip.tooLargeBucketsText": "大きすぎるバケット", - "kbn.discover.bucketIntervalTooltip.tooManyBucketsText": "バケットが多すぎます", - "kbn.discover.discoverBreadcrumbTitle": "ディスカバリ", - "kbn.discover.discoverDescription": "ドキュメントにクエリをかけたりフィルターを適用することで、データをインタラクティブに閲覧できます。", - "kbn.discover.discoverTitle": "ディスカバー", - "kbn.discover.docTable.pager.toolbarPagerButtons.nextButtonAriaLabel": "表内の次ページ", - "kbn.discover.docTable.pager.toolbarPagerButtons.previousButtonAriaLabel": "表内の前ページ", - "kbn.discover.documentsAriaLabel": "ドキュメント", - "kbn.discover.errorLoadingData": "データの読み込み中にエラーが発生", - "kbn.discover.fetchError.howToAddressErrorDescription": "このエラーは、{scriptedFields} タブにある {managementLink} の {fetchErrorScript} フィールドを編集することで解決できます。", - "kbn.discover.fetchError.managmentLinkText": "管理 > インデックスパターン", - "kbn.discover.fetchError.scriptedFieldsText": "「スクリプトフィールド」", - "kbn.discover.fieldChooser.detailViews.emptyStringText": "空の文字列", - "kbn.discover.fieldChooser.detailViews.recordsText": "記録", - "kbn.discover.fieldChooser.detailViews.topValuesInRecordsDescription": "次の記録のトップ 5 の値", - "kbn.discover.fieldChooser.detailViews.visualizeLinkText": "可視化", - "kbn.discover.fieldChooser.discoverField.addButtonLabel": "追加", - "kbn.discover.fieldChooser.discoverField.removeButtonLabel": "削除", - "kbn.discover.fieldChooser.discoverField.scriptedFieldsTakeLongExecuteDescription": "スクリプトフィールドは実行に時間がかかる場合があります。", - "kbn.discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForGeoFieldsErrorMessage": "ジオフィールドは分析できません。", - "kbn.discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForObjectFieldsErrorMessage": "オブジェクトフィールドは分析できません。", - "kbn.discover.fieldChooser.fieldCalculator.fieldIsNotPresentInDocumentsErrorMessage": "このフィールドは Elasticsearch マッピングに表示されますが、ドキュメントテーブルの {hitsLength} 件のドキュメントには含まれません。可視化や検索は可能な場合があります。", - "kbn.discover.fieldChooser.fieldFilterFacetButtonLabel": "フィルタリングされたフィールド", - "kbn.discover.fieldChooser.filter.aggregatableLabel": "集約可能", - "kbn.discover.fieldChooser.filter.availableFieldsTitle": "利用可能なフィールド", - "kbn.discover.fieldChooser.filter.fieldSelectorLabel": "{id} フィルターオプションの選択", - "kbn.discover.fieldChooser.filter.filterByTypeLabel": "タイプでフィルタリング", - "kbn.discover.fieldChooser.filter.hideMissingFieldsLabel": "未入力のフィールドを非表示", - "kbn.discover.fieldChooser.filter.indexAndFieldsSectionAriaLabel": "インデックスとフィールド", - "kbn.discover.fieldChooser.filter.popularTitle": "人気", - "kbn.discover.fieldChooser.filter.searchableLabel": "検索可能", - "kbn.discover.fieldChooser.filter.selectedFieldsTitle": "スクリプトフィールド", - "kbn.discover.fieldChooser.filter.typeLabel": "タイプ", - "kbn.discover.fieldChooser.indexPattern.changeIndexPatternTitle": "インデックスパターンを変更", - "kbn.discover.fieldChooser.searchPlaceHolder": "検索フィールド", - "kbn.discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "フィールド設定を非表示", - "kbn.discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "フィールド設定を表示", - "kbn.discover.helpMenu.appName": "ディスカバー", - "kbn.discover.histogram.partialData.bucketTooltipText": "選択された時間範囲にはこのバケット全体は含まれていませんが、一部データが含まれている可能性があります。", - "kbn.discover.histogramOfFoundDocumentsAriaLabel": "発見されたドキュメントのヒストグラム", - "kbn.discover.hitsPluralTitle": "{hits, plural, one {ヒット} other {ヒット}}", - "kbn.discover.howToChangeTheTimeTooltip": "時刻を変更するには、ナビゲーションバーのカレンダーアイコンをクリックします", - "kbn.discover.howToSeeOtherMatchingDocumentsDescription": "これらは検索条件に一致した初めの {sampleSize} 件のドキュメントです。他の結果を表示するには検索条件を絞ってください。 ", - "kbn.discover.inspectorRequestDataTitle": "データ", - "kbn.discover.inspectorRequestDescription": "このリクエストは Elasticsearch にクエリをかけ、検索データを取得します。", - "kbn.discover.localMenu.inspectTitle": "検査", - "kbn.discover.localMenu.localMenu.newSearchTitle": "新規", - "kbn.discover.localMenu.newSearchDescription": "新規検索", - "kbn.discover.localMenu.openInspectorForSearchDescription": "検索用にインスペクターを開きます", - "kbn.discover.localMenu.openSavedSearchDescription": "保存された検索を開きます", - "kbn.discover.localMenu.openTitle": "開く", - "kbn.discover.localMenu.saveSaveSearchDescription": "ビジュアライゼーションとダッシュボードで使用できるようにディスカバリの検索を保存します", - "kbn.discover.localMenu.saveSearchDescription": "検索を保存します", - "kbn.discover.localMenu.saveTitle": "保存", - "kbn.discover.localMenu.shareSearchDescription": "検索を共有します", - "kbn.discover.localMenu.shareTitle": "共有", - "kbn.discover.noResults.addressShardFailuresTitle": "シャードエラーの解決", - "kbn.discover.noResults.expandYourTimeRangeTitle": "時間範囲を拡大", - "kbn.discover.noResults.indexFailureIndexText": "インデックス {failureIndex}", - "kbn.discover.noResults.indexFailureShardText": "{index}、シャード {failureShard}", - "kbn.discover.noResults.queryMayNotMatchTitle": "表示されているインデックスの 1 つまたは複数にデータフィールドが含まれています。クエリが現在の時間範囲のデータと一致しないか、現在選択された時間範囲にデータが全く存在しない可能性があります。データが存在する時間範囲に変えることができます。", - "kbn.discover.noResults.searchExamples.400to499StatusCodeExampleTitle": "400-499 のすべてのステータスコードを検索", - "kbn.discover.noResults.searchExamples.400to499StatusCodeWithPhpExtensionExampleTitle": "400-499 の php 拡張子のステータスコードを検索", - "kbn.discover.noResults.searchExamples.400to499StatusCodeWithPhpOrHtmlExtensionExampleTitle": "400-499 の php または html 拡張子のステータスコードを検索", - "kbn.discover.noResults.searchExamples.anyField200StatusCodeExampleTitle": "いずれかのフィールドに数字 200 が含まれているリクエストを検索", - "kbn.discover.noResults.searchExamples.howTosearchForWebServerLogsDescription": "画面上部の検索バーは、Elasticsearch の Lucene {queryStringSyntaxLink} サポートを利用します。新規フィールドにパースされたウェブサーバーログの検索方法の例は、次の通りです。", - "kbn.discover.noResults.searchExamples.noResultsMatchSearchCriteriaTitle": "検索条件と一致する結果がありません。", - "kbn.discover.noResults.searchExamples.queryStringSyntaxLinkText": "クエリ文字列の構文", - "kbn.discover.noResults.searchExamples.refineYourQueryTitle": "クエリの調整", - "kbn.discover.noResults.searchExamples.statusField200StatusCodeExampleTitle": "ステータスフィールドの 200 を検索", - "kbn.discover.noResults.shardFailuresDescription": "次のシャードエラーが発生しました:", - "kbn.discover.notifications.notSavedSearchTitle": "検索「{savedSearchTitle}」は保存されませんでした。", - "kbn.discover.notifications.savedSearchTitle": "検索「{savedSearchTitle}」が保存されました。", - "kbn.discover.painlessError.painlessScriptedFieldErrorMessage": "Painless スクリプトのフィールド「{script}」のエラー.", - "kbn.discover.reloadSavedSearchButton": "検索をリセット", - "kbn.discover.rootBreadcrumb": "ディスカバリ", - "kbn.discover.savedSearch.savedObjectName": "保存された検索", - "kbn.discover.scaledToDescription": "{bucketIntervalDescription} にスケーリング済み", - "kbn.discover.searchingTitle": "検索中", - "kbn.discover.showingDefaultIndexPatternWarningDescription": "デフォルトのインデックスパターン「{loadedIndexPatternTitle}」 ({loadedIndexPatternId}) を表示中", - "kbn.discover.showingSavedIndexPatternWarningDescription": "保存されたインデックスパターン「{ownIndexPatternTitle}」 ({ownIndexPatternId}) を表示中", - "kbn.discover.skipToBottomButtonLabel": "最下部に移動", - "kbn.discover.topNav.openSearchPanel.manageSearchesButtonLabel": "検索の管理", - "kbn.discover.topNav.openSearchPanel.noSearchesFoundDescription": "一致する検索が見つかりませんでした。", - "kbn.discover.topNav.openSearchPanel.openSearchTitle": "検索を開く", - "kbn.discover.uninitializedRefreshButtonText": "データを更新", - "kbn.discover.uninitializedText": "クエリを作成、フィルターを追加、または [更新] をクリックして、現在のクエリの結果を取得します。", - "kbn.discover.uninitializedTitle": "検索開始", - "kbn.discover.valueIsNotConfiguredIndexPatternIDWarningTitle": "{stateVal} は設定されたインデックスパターン ID ではありません", - "kbn.discoverTitle": "ディスカバリ", - "kbn.doc.couldNotFindDocumentsDescription": "その ID に一致するドキュメントがありません。", - "kbn.doc.failedToExecuteQueryDescription": "クエリの実行に失敗しました", - "kbn.doc.failedToLocateDocumentDescription": "ドキュメントが見つかりませんでした", - "kbn.doc.failedToLocateIndexPattern": "ID {indexPatternId} に一致するインデックスパターンがありません", - "kbn.doc.loadingDescription": "読み込み中…", - "kbn.doc.somethingWentWrongDescription": "{indexName} が欠けています。", - "kbn.doc.somethingWentWrongDescriptionAddon": "インデックスが存在することを確認してください。", - "kbn.docTable.limitedSearchResultLabel": "{resultCount} 件の結果に制限。検索結果の絞り込み。", - "kbn.docTable.noResultsTitle": "結果が見つかりませんでした", - "kbn.docTable.pagerControl.pagesCountLabel": "{startItem}–{endItem} of {totalItems}", - "kbn.docTable.tableHeader.moveColumnLeftButtonAriaLabel": "{columnName} 列を左に移動", - "kbn.docTable.tableHeader.moveColumnLeftButtonTooltip": "列を左に移動", - "kbn.docTable.tableHeader.moveColumnRightButtonAriaLabel": "{columnName} 列を右に移動", - "kbn.docTable.tableHeader.moveColumnRightButtonTooltip": "列を右に移動", - "kbn.docTable.tableHeader.removeColumnButtonAriaLabel": "{columnName} 列を削除", - "kbn.docTable.tableHeader.removeColumnButtonTooltip": "列の削除", - "kbn.docTable.tableHeader.sortByColumnAscendingAriaLabel": "{columnName} を昇順に並べ替える", - "kbn.docTable.tableHeader.sortByColumnDescendingAriaLabel": "{columnName} を降順に並べ替える", - "kbn.docTable.tableHeader.sortByColumnUnsortedAriaLabel": "{columnName} で並べ替えを止める", - "kbn.docTable.tableRow.detailHeading": "拡張ドキュメント", - "kbn.docTable.tableRow.filterForValueButtonAriaLabel": "値でフィルタリング", - "kbn.docTable.tableRow.filterForValueButtonTooltip": "値でフィルタリング", - "kbn.docTable.tableRow.filterOutValueButtonAriaLabel": "値を除外", - "kbn.docTable.tableRow.filterOutValueButtonTooltip": "値を除外", - "kbn.docTable.tableRow.toggleRowDetailsButtonAriaLabel": "行の詳細を切り替える", - "kbn.docTable.tableRow.viewSingleDocumentLinkText": "単一のドキュメントを表示", - "kbn.docTable.tableRow.viewSurroundingDocumentsLinkText": "周りのドキュメントを表示", - "kbn.embeddable.errorTitle": "データの取得中にエラーが発生", - "kbn.embeddable.inspectorRequestDataTitle": "データ", - "kbn.embeddable.inspectorRequestDescription": "このリクエストは Elasticsearch にクエリをかけ、検索データを取得します。", - "kbn.embeddable.search.displayName": "検索", - "kbn.management.createIndexPattern.betaLabel": "ベータ", - "kbn.management.createIndexPattern.emptyState.checkDataButton": "新規データを確認", - "kbn.management.createIndexPattern.emptyStateHeader": "Elasticsearch データが見つかりませんでした", - "kbn.management.createIndexPattern.emptyStateLabel.emptyStateDetail": "{needToIndex} {learnHowLink} または {getStartedLink}", - "kbn.management.createIndexPattern.emptyStateLabel.getStartedLink": "サンプルデータで始めましょう。", - "kbn.management.createIndexPattern.emptyStateLabel.learnHowLink": "方法を学習", - "kbn.management.createIndexPattern.emptyStateLabel.needToIndexLabel": "インデックスパターンを作成する前に、Elasticsearch へのデータのインデックスが必要です。", - "kbn.management.createIndexPattern.includeSystemIndicesToggleSwitchLabel": "システムインデックスを含める", - "kbn.management.createIndexPattern.loadClustersFailMsg": "リモートクラスターの読み込みに失敗", - "kbn.management.createIndexPattern.loadIndicesFailMsg": "インデックスの読み込みに失敗", - "kbn.management.createIndexPattern.loadingState.checkingLabel": "Elasticsearch データを確認中", - "kbn.management.createIndexPattern.step.indexPattern.allowLabel": "インデックスパターンでワイルドカードとして {asterisk} を使用できます。", - "kbn.management.createIndexPattern.step.indexPattern.disallowLabel": "スペースや {characterList} は使用できません。", - "kbn.management.createIndexPattern.step.indexPatternLabel": "インデックスパターン", - "kbn.management.createIndexPattern.step.indexPatternPlaceholder": "index-name-*", - "kbn.management.createIndexPattern.step.invalidCharactersErrorMessage": "{indexPatternName} にはスペースや {characterList} は使えません。", - "kbn.management.createIndexPattern.step.loadingHeader": "一致するインデックスを検索中…", - "kbn.management.createIndexPattern.step.loadingLabel": "お待ちください…", - "kbn.management.createIndexPattern.step.nextStepButton": "次のステップ", - "kbn.management.createIndexPattern.step.pagingLabel": "ページごとの行数: {perPage}", - "kbn.management.createIndexPattern.step.status.matchAnyLabel.matchAnyDetail": "インデックスパターンは下の{strongIndices} の いずれかに一致します。", - "kbn.management.createIndexPattern.step.status.noSystemIndicesLabel": "パターンに一致する Elasticsearch インデックスがありません。", - "kbn.management.createIndexPattern.step.status.noSystemIndicesWithPromptLabel": "パターンに一致する Elasticsearch インデックスがありません。一致するシステムインデックスを表示するには、右上のスイッチを切り替えます。", - "kbn.management.createIndexPattern.step.status.notMatchLabel.allIndicesLabel": "{indicesLength, plural, one {# インデックス} other {# インデックス}}", - "kbn.management.createIndexPattern.step.status.notMatchLabel.notMatchDetail": "入力されたインデックスパターンがどのインデックスにも一致しません。下の {indicesLength, plural, one {} other {}}{strongIndices} と一致させることができます。", - "kbn.management.createIndexPattern.step.status.partialMatchLabel.partialMatchDetail": "インデックスパターンがどのインデックスとも一致ませんが、似た {matchedIndicesLength, plural, one {} other {}}{strongIndices} があります。", - "kbn.management.createIndexPattern.step.status.partialMatchLabel.strongIndicesLabel": "{matchedIndicesLength, plural, one {# インデックス} other {# インデックス}}", - "kbn.management.createIndexPattern.step.status.successLabel.strongIndicesLabel": "{indicesLength, plural, one {# インデックス} other {# インデックス}}", - "kbn.management.createIndexPattern.step.status.successLabel.strongSuccessLabel": "成功！", - "kbn.management.createIndexPattern.step.status.successLabel.successDetail": "{strongSuccess} インデックスパターンが {strongIndices} と一致しています。", - "kbn.management.createIndexPattern.step.warningHeader": "既に {query} という名前のインデックスパターンがあります。", - "kbn.management.createIndexPattern.stepHeader": "ステップ 1/2:インデックスパターンの定義", - "kbn.management.createIndexPattern.stepTime.backButton": "戻る", - "kbn.management.createIndexPattern.stepTime.createPatternButton": "インデックスパターンを作成", - "kbn.management.createIndexPattern.stepTime.creatingLabel": "インデックスパターンを作成中…", - "kbn.management.createIndexPattern.stepTime.error": "エラー", - "kbn.management.createIndexPattern.stepTime.field.loadingDropDown": "読み込み中…", - "kbn.management.createIndexPattern.stepTime.field.noTimeFieldsLabel": "このインデックスパターンに一致するインデックスには時間フィールドがありません。", - "kbn.management.createIndexPattern.stepTime.fieldHeader": "時間フィルターのフィールド名", - "kbn.management.createIndexPattern.stepTime.fieldLabel": "時間フィルターはこのフィールドを使って時間でフィールドを絞ります。", - "kbn.management.createIndexPattern.stepTime.fieldWarningLabel": "時間フィールドを使わないこともできますが、その場合データを時間範囲で絞ることができません。", - "kbn.management.createIndexPattern.stepTime.noTimeFieldOptionLabel": "時間フィルターを使用しない", - "kbn.management.createIndexPattern.stepTime.noTimeFieldsLabel": "このインデックスパターンに一致するインデックスには時間フィールドがありません。", - "kbn.management.createIndexPattern.stepTime.options.hideButton": "高度なオプションを非表示", - "kbn.management.createIndexPattern.stepTime.options.patternHeader": "カスタムインデックスパターン ID", - "kbn.management.createIndexPattern.stepTime.options.patternLabel": "Kibana はそれぞれのインデックスパターンに固有の識別子を割り当てます。固有 ID を使用しない場合は、カスタム ID を入力してください。", - "kbn.management.createIndexPattern.stepTime.options.patternPlaceholder": "custom-index-pattern-id", - "kbn.management.createIndexPattern.stepTime.options.showButton": "高度なオプションを表示", - "kbn.management.createIndexPattern.stepTime.patterAlreadyExists": "カスタムインデックスパターン ID が既に存在します。", - "kbn.management.createIndexPattern.stepTime.refreshButton": "更新", - "kbn.management.createIndexPattern.stepTimeHeader": "ステップ 2/2:設定の変更", - "kbn.management.createIndexPattern.stepTimeLabel": "{indexPattern} を {indexPatternName} に定義しました。次に、作成前に他の設定を行うことができます。", - "kbn.management.createIndexPatternHeader": "{indexPatternName} の作成", - "kbn.management.createIndexPatternLabel": "Kibana は、可視化などを目的に Elasticsearch インデックスからデータを取得するために、インデックスパターンを使用します。", - "kbn.management.editIndexPattern.deleteButton": "削除", - "kbn.management.editIndexPattern.deleteFieldButton": "削除", - "kbn.management.editIndexPattern.deleteHeader": "インデックスパターンを削除しますか？", - "kbn.management.editIndexPattern.detailsAria": "インデックスパターンの詳細", - "kbn.management.editIndexPattern.editFieldButton": "編集", - "kbn.management.editIndexPattern.fields.allLangsDropDown": "すべての言語", - "kbn.management.editIndexPattern.fields.allTypesDropDown": "すべてのフィールドタイプ", - "kbn.management.editIndexPattern.fields.filterAria": "フィルター", - "kbn.management.editIndexPattern.fields.filterPlaceholder": "フィルター", - "kbn.management.editIndexPattern.fields.table.additionalInfoAriaLabel": "追加フィールド情報", - "kbn.management.editIndexPattern.fields.table.aggregatableDescription": "これらのフィールドはビジュアライゼーションの集約に使用できます", - "kbn.management.editIndexPattern.fields.table.aggregatableLabel": "集約可能", - "kbn.management.editIndexPattern.fields.table.editDescription": "編集", - "kbn.management.editIndexPattern.fields.table.editLabel": "編集", - "kbn.management.editIndexPattern.fields.table.excludedDescription": "取得の際に _source から除外されるフィールドです", - "kbn.management.editIndexPattern.fields.table.excludedLabel": "除外", - "kbn.management.editIndexPattern.fields.table.formatHeader": "フォーマット", - "kbn.management.editIndexPattern.fields.table.isAggregatableAria": "は集約可能です", - "kbn.management.editIndexPattern.fields.table.isExcludedAria": "は除外されています", - "kbn.management.editIndexPattern.fields.table.isSearchableAria": "は検索可能です", - "kbn.management.editIndexPattern.fields.table.multiTypeAria": "複数タイプのフィールド", - "kbn.management.editIndexPattern.fields.table.multiTypeTooltip": "フィールドのタイプがインデックスごとに変わります。多くの分析機能には使用できません。", - "kbn.management.editIndexPattern.fields.table.nameHeader": "名前", - "kbn.management.editIndexPattern.fields.table.primaryTimeAriaLabel": "プライマリ時間フィールド", - "kbn.management.editIndexPattern.fields.table.primaryTimeTooltip": "このフィールドはイベントの発生時刻を表します。", - "kbn.management.editIndexPattern.fields.table.searchableDescription": "これらのフィールドはフィルターバーで使用できます", - "kbn.management.editIndexPattern.fields.table.searchableHeader": "検索可能", - "kbn.management.editIndexPattern.fields.table.typeHeader": "タイプ", - "kbn.management.editIndexPattern.mappingConflictHeader": "マッピングの矛盾", - "kbn.management.editIndexPattern.mappingConflictLabel": "{conflictFieldsLength, plural, one {フィールドが} other {# フィールドが}}このパターンと一致するインデックスの間で異なるタイプ (文字列、整数など) に定義されています。これらの矛盾したフィールドは Kibana の一部で使用できますが、Kibana がタイプを把握しなければならない機能には使用できません。この問題を修正するにはデータのレンダリングが必要です。", - "kbn.management.editIndexPattern.notDateErrorMessage": "このフィールドは日付ではなく {fieldType} です。", - "kbn.management.editIndexPattern.refreshAria": "フィールドリストを再度読み込みます", - "kbn.management.editIndexPattern.refreshButton": "更新", - "kbn.management.editIndexPattern.refreshHeader": "フィールドリストを更新しますか？", - "kbn.management.editIndexPattern.refreshLabel": "この操作は各フィールドの使用頻度をリセットします。", - "kbn.management.editIndexPattern.refreshTooltip": "フィールドリストを更新", - "kbn.management.editIndexPattern.removeAria": "インデックスパターンを削除", - "kbn.management.editIndexPattern.removeTooltip": "インデックスパターンを削除います", - "kbn.management.editIndexPattern.scripted.addFieldButton": "スクリプトフィールドを追加", - "kbn.management.editIndexPattern.scripted.deleteField.cancelButton": "キャンセル", - "kbn.management.editIndexPattern.scripted.deleteField.deleteButton": "削除", - "kbn.management.editIndexPattern.scripted.deleteFieldLabel": "スクリプトフィールド「{fieldName}」を削除しますか？", - "kbn.management.editIndexPattern.scripted.deprecationLangHeader": "廃止された言語が使用されています", - "kbn.management.editIndexPattern.scripted.deprecationLangLabel.deprecationLangDetail": "次の廃止された言語が使用されています: {deprecatedLangsInUse}これらの言語は、Kibana と Elasticsearch の次のメジャーなバージョンでサポートされなくなります。問題を避けるため、スクリプトフィールドを {link} に変換してください。", - "kbn.management.editIndexPattern.scripted.deprecationLangLabel.painlessDescription": "パターン", - "kbn.management.editIndexPattern.scripted.newFieldPlaceholder": "新規スクリプトフィールド", - "kbn.management.editIndexPattern.scripted.noFieldLabel": "「{indexPatternTitle}」インデックスパターンには「{fieldName}」というスクリプトフィールドがありません", - "kbn.management.editIndexPattern.scripted.table.deleteDescription": "このフィールドを削除します", - "kbn.management.editIndexPattern.scripted.table.deleteHeader": "削除", - "kbn.management.editIndexPattern.scripted.table.editDescription": "このフィールドを編集します", - "kbn.management.editIndexPattern.scripted.table.editHeader": "編集", - "kbn.management.editIndexPattern.scripted.table.formatDescription": "フィールドに使用されているフォーマットです", - "kbn.management.editIndexPattern.scripted.table.formatHeader": "フォーマット", - "kbn.management.editIndexPattern.scripted.table.langDescription": "フィールドに使用されている言語です", - "kbn.management.editIndexPattern.scripted.table.langHeader": "言語", - "kbn.management.editIndexPattern.scripted.table.nameDescription": "フィールドの名前です", - "kbn.management.editIndexPattern.scripted.table.nameHeader": "名前", - "kbn.management.editIndexPattern.scripted.table.scriptDescription": "フィールドのスクリプトです", - "kbn.management.editIndexPattern.scripted.table.scriptHeader": "スクリプト", - "kbn.management.editIndexPattern.scripted.unknownModeErrorMessage": "不明なフィールド設定モード {mode}", - "kbn.management.editIndexPattern.scriptedHeader": "スクリプトフィールド", - "kbn.management.editIndexPattern.scriptedLabel": "ビジュアライゼーションにスクリプトフィールドを使用し、ドキュメントに表示させることができます。但し、スクリプトフィールドは検索できません。", - "kbn.management.editIndexPattern.setDefaultAria": "デフォルトのインデックスに設定", - "kbn.management.editIndexPattern.setDefaultTooltip": "デフォルトのインデックスに設定します", - "kbn.management.editIndexPattern.source.addButtonLabel": "追加", - "kbn.management.editIndexPattern.source.deleteFilter.cancelButtonLabel": "キャンセル", - "kbn.management.editIndexPattern.source.deleteFilter.deleteButtonLabel": "削除", - "kbn.management.editIndexPattern.source.deleteSourceFilterLabel": "ソースフィルター「{value}」を削除しますか？", - "kbn.management.editIndexPattern.source.noteLabel": "下の表で、マルチフィールドが一致として誤って表示されます。これらのフィルターは、オリジナルのソースドキュメントの\\フィールドのみに適用されるため、一致するマルチフィールドはフィルタリングされません。", - "kbn.management.editIndexPattern.source.table.cancelAria": "キャンセル", - "kbn.management.editIndexPattern.source.table.deleteAria": "削除", - "kbn.management.editIndexPattern.source.table.editAria": "編集", - "kbn.management.editIndexPattern.source.table.filterDescription": "フィルター名", - "kbn.management.editIndexPattern.source.table.filterHeader": "フィルター", - "kbn.management.editIndexPattern.source.table.matchesDescription": "フィールドに使用されている言語です", - "kbn.management.editIndexPattern.source.table.matchesHeader": "一致", - "kbn.management.editIndexPattern.source.table.notMatchedLabel": "ソースフィルターが既知のフィールドと一致しません。", - "kbn.management.editIndexPattern.source.table.saveAria": "保存", - "kbn.management.editIndexPattern.sourceHeader": "ソースフィルター", - "kbn.management.editIndexPattern.sourceLabel": "ソースフィルターは、ドキュメントソースの取得時に 1 つまたは複数のフィールドを除外するのに使用される場合もあります。これはディスカバリアプリでのドキュメントの表示中、またはダッシュボードアプリの保存された検索の結果を表示する表で起こります。それぞれの行は 1 つのドキュメントのソースで作成されており、ドキュメントに大きなフィールドや重要ではないフィールドが含まれている場合、このレベルでフィルターで除外すると良いかもしれません。", - "kbn.management.editIndexPattern.sourcePlaceholder": "ソースフィルター、ワイルドカード使用可 (例: 「user」と入力して「user」で始まるフィールドをフィルタリング)", - "kbn.management.editIndexPattern.tabs.fieldsHeader": "フィールド", - "kbn.management.editIndexPattern.tabs.scriptedHeader": "スクリプトフィールド", - "kbn.management.editIndexPattern.tabs.sourceHeader": "ソースフィルター", - "kbn.management.editIndexPattern.timeFilterHeader": "時間フィルターフィールド名: {timeFieldName}", - "kbn.management.editIndexPattern.timeFilterLabel.mappingAPILink": "マッピング API", - "kbn.management.editIndexPattern.timeFilterLabel.timeFilterDetail": "このページは {indexPatternTitle} インデックス内のすべてのフィールドと、Elasticsearch に記録された各フィールドのコアタイプを一覧表示します。フィールドタイプを変更するには Elasticsearch を使用します", - "kbn.management.editIndexPatternLiveRegionAriaLabel": "インデックスパターン", - "kbn.management.indexPattern.confirmOverwriteButton": "上書き", - "kbn.management.indexPattern.confirmOverwriteLabel": "「{title}」に上書きしてよろしいですか？", - "kbn.management.indexPattern.confirmOverwriteTitle": "{type} を上書きしますか？", - "kbn.management.indexPattern.goToPatternButtonLabel": "既存のパターンに移動", - "kbn.management.indexPattern.sectionsHeader": "インデックスパターン", - "kbn.management.indexPattern.titleExistsLabel": "「{title}」というタイトルのインデックスパターンが既に存在します。", - "kbn.management.indexPatternList.createButton.betaLabel": "ベータ", - "kbn.management.indexPatternPrompt.exampleOne": "チャートを作成したりコンテンツを素早くクエリできるように log-west-001 という名前の単一のデータソースをインデックスします。", - "kbn.management.indexPatternPrompt.exampleOneTitle": "単一のデータソース", - "kbn.management.indexPatternPrompt.examplesTitle": "インデックスパターンの例", - "kbn.management.indexPatternPrompt.exampleThree": "比較目的に履歴の動向を集約できるよう、これらのログのアーカイブされた月々のロールアップメトリックスを指定通りに別々のインデックスパターンにグループ分けします。", - "kbn.management.indexPatternPrompt.exampleThreeTitle": "カスタムグルーピング", - "kbn.management.indexPatternPrompt.exampleTwo": "すべての西海岸のサーバーログに対してクエリを実行できるように、頭に「log-west」の付いたすべての受信データソースをグループ化します。", - "kbn.management.indexPatternPrompt.exampleTwoTitle": "複数データソース", - "kbn.management.indexPatternPrompt.subtitle": "インデックスパターンは、Kibana で共有フィールドにクエリを実行できるよう、種類の異なるデータソースをバケットにまとめることができます。", - "kbn.management.indexPatternPrompt.title": "インデックスパターンについて", - "kbn.management.indexPatterns.badge.readOnly.text": "読み込み専用", - "kbn.management.indexPatterns.badge.readOnly.tooltip": "インデックスパターンを保存できません", - "kbn.management.indexPatterns.createBreadcrumb": "インデックスパターンを作成", - "kbn.management.indexPatterns.createFieldBreadcrumb": "フィールドを作成", - "kbn.management.indexPatterns.listBreadcrumb": "インデックスパターン", - "kbn.management.indexPatternTable.createBtn": "インデックスパターンの作成", - "kbn.management.indexPatternTable.title": "インデックスパターン", - "kbn.management.landing.header": "Kibana {version} 管理", - "kbn.management.landing.subhead": "インデックス、インデックスパターン、保存されたオブジェクト、Kibana の設定、その他を管理します。", - "kbn.management.landing.text": "アプリの一覧は左側のメニューにあります。", - "kbn.management.objects.confirmModalOptions.deleteButtonLabel": "削除", - "kbn.management.objects.confirmModalOptions.modalDescription": "このアクションはオブジェクトを Kibana から永久に削除します。", - "kbn.management.objects.confirmModalOptions.modalTitle": "「{title}」を削除しますか？", - "kbn.management.objects.deleteSavedObjectsConfirmModalDescription": "この操作は次の保存されたオブジェクトを削除します:", - "kbn.management.objects.field.offLabel": "オフ", - "kbn.management.objects.field.onLabel": "オン", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModal.cancelButtonLabel": "キャンセル", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModal.deleteButtonLabel": "削除", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModal.deleteProcessButtonLabel": "削除中…", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModal.idColumnName": "ID", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModal.titleColumnName": "タイトル", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModal.typeColumnName": "タイプ", - "kbn.management.objects.objectsTable.deleteSavedObjectsConfirmModalTitle": "保存されたオブジェクトの削除", - "kbn.management.objects.objectsTable.export.dangerNotification": "エクスポートを生成できません", - "kbn.management.objects.objectsTable.export.successNotification": "ファイルはバックグラウンドでダウンロード中です", - "kbn.management.objects.objectsTable.export.successWithMissingRefsNotification": "ファイルはバックグラウンドでダウンロード中です。一部の関連オブジェクトが見つかりませんでした。足りないオブジェクトの一覧は、エクスポートされたファイルの最後の行をご覧ください。", - "kbn.management.objects.objectsTable.exportObjectsConfirmModal.cancelButtonLabel": "キャンセル", - "kbn.management.objects.objectsTable.exportObjectsConfirmModal.exportAllButtonLabel": "すべてエクスポート:", - "kbn.management.objects.objectsTable.exportObjectsConfirmModal.exportOptionsLabel": "オプション", - "kbn.management.objects.objectsTable.exportObjectsConfirmModal.includeReferencesDeepLabel": "関連オブジェクトを含める", - "kbn.management.objects.objectsTable.exportObjectsConfirmModalDescription": "エクスポートするタイプを選択してください", - "kbn.management.objects.objectsTable.exportObjectsConfirmModalTitle": "{filteredItemCount, plural, one{# オブジェクト} other {# オブジェクト}}をエクスポート", - "kbn.management.objects.objectsTable.flyout.confirmLegacyImport.resolvingConflictsLoadingMessage": "矛盾を解決中…", - "kbn.management.objects.objectsTable.flyout.confirmLegacyImport.retryingFailedObjectsLoadingMessage": "失敗したオブジェクトを再試行中…", - "kbn.management.objects.objectsTable.flyout.confirmLegacyImport.savedSearchAreLinkedProperlyLoadingMessage": "保存された検索が正しくリンクされていることを確認してください…", - "kbn.management.objects.objectsTable.flyout.confirmLegacyImport.savingConflictsLoadingMessage": "矛盾を保存中…", - "kbn.management.objects.objectsTable.flyout.confirmOverwriteBody": "{title} を上書きしてよろしいですか？", - "kbn.management.objects.objectsTable.flyout.confirmOverwriteCancelButtonText": "キャンセル", - "kbn.management.objects.objectsTable.flyout.confirmOverwriteOverwriteButtonText": "上書き", - "kbn.management.objects.objectsTable.flyout.confirmOverwriteTitle": "{type} を上書きしますか？", - "kbn.management.objects.objectsTable.flyout.errorCalloutTitle": "申し訳ございませんが、エラーが発生しました", - "kbn.management.objects.objectsTable.flyout.import.cancelButtonLabel": "キャンセル", - "kbn.management.objects.objectsTable.flyout.import.confirmButtonLabel": "インポート", - "kbn.management.objects.objectsTable.flyout.importFailedDescription": "{totalImportCount} 個中 {failedImportCount} 個のオブジェクトのインポートに失敗しました。インポート失敗", - "kbn.management.objects.objectsTable.flyout.importFailedMissingReference": "{type} [id={id}] は {refType} [id={refId}] を見つけられませんでした", - "kbn.management.objects.objectsTable.flyout.importFailedTitle": "インポート失敗", - "kbn.management.objects.objectsTable.flyout.importFailedUnsupportedType": "{type} [id={id}] サポートされていないタイプ", - "kbn.management.objects.objectsTable.flyout.importFileErrorMessage": "ファイルを処理できませんでした。", - "kbn.management.objects.objectsTable.flyout.importLegacyFileErrorMessage": "ファイルを処理できませんでした。", - "kbn.management.objects.objectsTable.flyout.importPromptText": "インポート", - "kbn.management.objects.objectsTable.flyout.importSavedObjectTitle": "保存されたオブジェクトのインポート", - "kbn.management.objects.objectsTable.flyout.importSuccessful.confirmAllChangesButtonLabel": "すべての変更を確定", - "kbn.management.objects.objectsTable.flyout.importSuccessful.confirmButtonLabel": "完了", - "kbn.management.objects.objectsTable.flyout.importSuccessfulCallout.noObjectsImportedTitle": "オブジェクトがインポートされませんでした", - "kbn.management.objects.objectsTable.flyout.importSuccessfulDescription": "{importCount} 個のオブジェクトがインポートされました。", - "kbn.management.objects.objectsTable.flyout.importSuccessfulTitle": "インポート成功", - "kbn.management.objects.objectsTable.flyout.indexPatternConflictsCalloutLinkText": "新規インデックスパターンを作成", - "kbn.management.objects.objectsTable.flyout.indexPatternConflictsDescription": "次の保存されたオブジェクトは、存在しないインデックスパターンを使用しています。別のデックスパターンを選択してください。必要に応じて {indexPatternLink} できます。", - "kbn.management.objects.objectsTable.flyout.indexPatternConflictsTitle": "インデックスパターンの矛盾", - "kbn.management.objects.objectsTable.flyout.invalidFormatOfImportedFileErrorMessage": "保存されたオブジェクトのファイル形式が無効なため、インポートできません。", - "kbn.management.objects.objectsTable.flyout.legacyFileUsedBody": "最新のレポートで NDJSON ファイルを作成すれば完了です。", - "kbn.management.objects.objectsTable.flyout.legacyFileUsedTitle": "JSON ファイルのサポートが終了します", - "kbn.management.objects.objectsTable.flyout.overwriteSavedObjectsLabel": "すべての保存されたオブジェクトを自動的に上書きしますか？", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnCountDescription": "影響されるオブジェクトの数です", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnCountName": "カウント", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnIdDescription": "インデックスパターンの ID です", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnIdName": "ID", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnNewIndexPatternName": "新規インデックスパターン", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnSampleOfAffectedObjectsDescription": "影響されるオブジェクトのサンプルです", - "kbn.management.objects.objectsTable.flyout.renderConflicts.columnSampleOfAffectedObjectsName": "影響されるオブジェクトのサンプル", - "kbn.management.objects.objectsTable.flyout.resolveImportErrorsFileErrorMessage": "ファイルを処理できませんでした。", - "kbn.management.objects.objectsTable.flyout.selectFileToImportFormRowLabel": "インポートするファイルを選択してください", - "kbn.management.objects.objectsTable.header.exportButtonLabel": "{filteredCount, plural, one{# オブジェクト} other {# オブジェクト}}をエクスポート", - "kbn.management.objects.objectsTable.header.importButtonLabel": "インポート", - "kbn.management.objects.objectsTable.header.refreshButtonLabel": "更新", - "kbn.management.objects.objectsTable.header.savedObjectsTitle": "保存されたオブジェクト", - "kbn.management.objects.objectsTable.howToDeleteSavedObjectsDescription": "ここから保存された検索などの保存されたオブジェクトを削除できます。保存されたオブジェクトの生データを編集することもできます。通常、オブジェクトは関連アプリケーションでのみ編集され、こｎ画面で編集するよりもそちらのほうが賢明です。", - "kbn.management.objects.objectsTable.relationships.columnActions.inspectActionDescription": "この保存されたオブジェクトを確認してください", - "kbn.management.objects.objectsTable.relationships.columnActions.inspectActionName": "検査", - "kbn.management.objects.objectsTable.relationships.columnActionsName": "アクション", - "kbn.management.objects.objectsTable.relationships.columnRelationship.childAsValue": "子", - "kbn.management.objects.objectsTable.relationships.columnRelationship.parentAsValue": "ペアレント", - "kbn.management.objects.objectsTable.relationships.columnRelationshipName": "直接関係", - "kbn.management.objects.objectsTable.relationships.columnTitleDescription": "保存されたオブジェクトのタイトルです", - "kbn.management.objects.objectsTable.relationships.columnTitleName": "タイトル", - "kbn.management.objects.objectsTable.relationships.columnTypeDescription": "保存されたオブジェクトのタイプです", - "kbn.management.objects.objectsTable.relationships.columnTypeName": "タイプ", - "kbn.management.objects.objectsTable.relationships.relationshipsTitle": "{title} に関連する保存されたオブジェクトはこちらです。この {type} を削除すると、親オブジェクトに影響がありますが、子オブジェクトには影響はありません。", - "kbn.management.objects.objectsTable.relationships.renderErrorMessage": "エラー", - "kbn.management.objects.objectsTable.relationships.search.filters.relationship.childAsValue.view": "子", - "kbn.management.objects.objectsTable.relationships.search.filters.relationship.name": "直接関係", - "kbn.management.objects.objectsTable.relationships.search.filters.relationship.parentAsValue.view": "親", - "kbn.management.objects.objectsTable.relationships.search.filters.type.name": "タイプ", - "kbn.management.objects.objectsTable.searchBar.unableToParseQueryErrorMessage": "クエリをパースできません", - "kbn.management.objects.objectsTable.table.columnActions.inspectActionDescription": "この保存されたオブジェクトを確認してください", - "kbn.management.objects.objectsTable.table.columnActions.inspectActionName": "検査", - "kbn.management.objects.objectsTable.table.columnActions.viewRelationshipsActionDescription": "この保存されたオブジェクトと他の保存されたオブジェクトとの関係性を表示します", - "kbn.management.objects.objectsTable.table.columnActions.viewRelationshipsActionName": "関係性", - "kbn.management.objects.objectsTable.table.columnActionsName": "アクション", - "kbn.management.objects.objectsTable.table.columnTitleDescription": "保存されたオブジェクトのタイトルです", - "kbn.management.objects.objectsTable.table.columnTitleName": "タイトル", - "kbn.management.objects.objectsTable.table.columnTypeDescription": "保存されたオブジェクトのタイプです", - "kbn.management.objects.objectsTable.table.columnTypeName": "タイプ", - "kbn.management.objects.objectsTable.table.deleteButtonLabel": "削除", - "kbn.management.objects.objectsTable.table.deleteButtonTitle": "保存されたオブジェクトを削除できません", - "kbn.management.objects.objectsTable.table.exportButtonLabel": "エクスポート", - "kbn.management.objects.objectsTable.table.exportPopoverButtonLabel": "エクスポート", - "kbn.management.objects.objectsTable.table.typeFilterName": "タイプ", - "kbn.management.objects.objectsTable.unableFindSavedObjectsNotificationMessage": "保存されたオブジェクトが見つかりません", - "kbn.management.objects.parsingFieldErrorMessage": "{fieldName} をインデックスパターン {indexName} 用にパース中にエラーが発生しました: {errorMessage}", - "kbn.management.objects.savedObjectsSectionLabel": "保存されたオブジェクト", - "kbn.management.objects.view.cancelButtonAriaLabel": "キャンセル", - "kbn.management.objects.view.cancelButtonLabel": "キャンセル", - "kbn.management.objects.view.deleteItemButtonLabel": "{title} を削除", - "kbn.management.objects.view.editItemTitle": "{title} の編集", - "kbn.management.objects.view.fieldDoesNotExistErrorMessage": "このオブジェクトに関連付けられたフィールドは、現在このインデックスパターンに存在しません。", - "kbn.management.objects.view.howToFixErrorDescription": "このエラーの原因がわかる場合は修正してください。わからない場合は上の削除ボタンをクリックしてください。", - "kbn.management.objects.view.howToModifyObjectDescription": "オブジェクトの編集は上級ユーザー向けです。オブジェクトのプロパティが検証されておらず、無効なオブジェクトはエラー、データ損失、またはそれ以上の問題の原因となります。コードを熟知した人に指示されていない限り、この設定は変更しない方が無難です。", - "kbn.management.objects.view.howToModifyObjectTitle": "十分ご注意ください！", - "kbn.management.objects.view.indexPatternDoesNotExistErrorMessage": "このオブジェクトに関連付けられたインデックスパターンは現在存在しません。", - "kbn.management.objects.view.saveButtonAriaLabel": "{ title } オブジェクトを保存", - "kbn.management.objects.view.saveButtonLabel": "{ title } オブジェクトを保存", - "kbn.management.objects.view.savedObjectProblemErrorMessage": "この保存されたオブジェクトに問題があります", - "kbn.management.objects.view.savedSearchDoesNotExistErrorMessage": "このオブジェクトに関連付けられた保存された検索は現在存在しません。", - "kbn.management.objects.view.viewItemButtonLabel": "{title} を表示", - "kbn.management.objects.view.viewItemTitle": "{title} を表示", - "kbn.management.savedObjects.editBreadcrumb": "{savedObjectType} を編集", - "kbn.management.savedObjects.indexBreadcrumb": "保存されたオブジェクト", - "kbn.managementTitle": "管理", - "kbn.topNavMenu.openInspectorButtonLabel": "検査", - "kbn.topNavMenu.refreshButtonLabel": "更新", - "kbn.topNavMenu.saveVisualizationButtonLabel": "保存", - "kbn.topNavMenu.shareVisualizationButtonLabel": "共有", - "kbn.visualize.badge.readOnly.text": "読み込み専用", - "kbn.visualize.badge.readOnly.tooltip": "ビジュアライゼーションを保存できません", - "kbn.visualize.createVisualization.noIndexPatternOrSavedSearchIdErrorMessage": "indexPattern または savedSearchId が必要です", - "kbn.visualize.editor.createBreadcrumb": "作成", - "kbn.visualize.experimentalVisInfoText": "このビジュアライゼーションは実験的なものです。", - "kbn.visualize.helpMenu.appName": "可視化", - "kbn.visualize.linkedToSearch.unlinkSuccessNotificationText": "保存された検索「{searchTitle}」からリンクが解除されました", - "kbn.visualize.listing.betaTitle": "ベータ", - "kbn.visualize.listing.betaTooltip": "このビジュアライゼーションはベータ段階で、変更される可能性があります。デザインとコードはオフィシャル GA 機能よりも完成度が低く、現状のまま保証なしで提供されています。ベータ機能にはオフィシャル GA 機能の SLA が適用されません", - "kbn.visualize.listing.breadcrumb": "可視化", - "kbn.visualize.listing.createNew.createButtonLabel": "新規ビジュアライゼーションを追加", - "kbn.visualize.listing.createNew.description": "データに基づき異なるビジュアライゼーションを作成できます。", - "kbn.visualize.listing.createNew.title": "最初のビジュアライゼーションの作成", - "kbn.visualize.listing.experimentalTitle": "実験的", - "kbn.visualize.listing.experimentalTooltip": "このビジュアライゼーションは今後のリリースで変更または削除される可能性があり、SLA のサポート対象になりません。", - "kbn.visualize.listing.noItemsMessage": "ビジュアライゼーションがないようです。", - "kbn.visualize.listing.table.entityName": "ビジュアライゼーション", - "kbn.visualize.listing.table.entityNamePlural": "ビジュアライゼーション", - "kbn.visualize.listing.table.listTitle": "ビジュアライゼーション", - "kbn.visualize.listing.table.titleColumnName": "タイトル", - "kbn.visualize.listing.table.typeColumnName": "タイプ", - "kbn.visualize.pageHeading": "{chartName} {chartType} ビジュアライゼーション", - "kbn.visualize.saveDialog.saveAndAddToDashboardButtonLabel": "保存してダッシュボードに追加", - "kbn.visualize.topNavMenu.openInspectorButtonAriaLabel": "ビジュアライゼーションのインスペクターを開く", - "kbn.visualize.topNavMenu.openInspectorDisabledButtonTooltip": "このビジュアライゼーションはインスペクターをサポートしていません。", - "kbn.visualize.topNavMenu.refreshButtonAriaLabel": "更新", - "kbn.visualize.topNavMenu.saveVisualization.failureNotificationText": "「{visTitle}」の保存中にエラーが発生しました", - "kbn.visualize.topNavMenu.saveVisualization.successNotificationText": "「{visTitle}」が保存されました", - "kbn.visualize.topNavMenu.saveVisualizationButtonAriaLabel": "ビジュアライゼーションを保存", - "kbn.visualize.topNavMenu.saveVisualizationDisabledButtonTooltip": "保存する前に変更を適用または破棄", - "kbn.visualize.topNavMenu.shareVisualizationButtonAriaLabel": "ビジュアライゼーションを共有", - "kbn.visualize.visualizationTypeInvalidNotificationMessage": "無効なビジュアライゼーションタイプ", - "kbn.visualize.visualizeDescription": "ビジュアライゼーションを作成して Elasticsearch インデックスに保存されたデータを集約します。", - "kbn.visualize.visualizeListingBreadcrumbsTitle": "可視化", - "kbn.visualize.visualizeListingDeleteErrorTitle": "ビジュアライゼーションの削除中にエラーが発生", - "kbn.visualize.wizard.step1Breadcrumb": "作成", - "kbn.visualize.wizard.step2Breadcrumb": "作成", - "kbn.visualizeTitle": "可視化", - "kibana_legacy.bigUrlWarningNotificationMessage": "{advancedSettingsLink}で{storeInSessionStorageParam}オプションを有効にするか、オンスクリーンビジュアルを簡素化してください。", - "kibana_legacy.bigUrlWarningNotificationMessage.advancedSettingsLinkText": "高度な設定", - "kibana_legacy.bigUrlWarningNotificationTitle": "URLが大きく、Kibanaの動作が停止する可能性があります", - "kibana_legacy.notify.fatalError.errorStatusMessage": "エラー {errStatus} {errStatusText}: {errMessage}", - "kibana_legacy.notify.fatalError.unavailableServerErrorMessage": "HTTP リクエストで接続に失敗しました。Kibana サーバーが実行されていて、ご使用のブラウザの接続が正常に動作していることを確認するか、システム管理者にお問い合わせください。", - "kibana_legacy.notify.toaster.errorMessage": "エラー: {errorMessage}\n {errorStack}", - "kibana_legacy.notify.toaster.errorStatusMessage": "エラー {errStatus} {errStatusText}: {errMessage}", - "kibana_legacy.notify.toaster.unavailableServerErrorMessage": "HTTP リクエストで接続に失敗しました。Kibana サーバーが実行されていて、ご使用のブラウザの接続が正常に動作していることを確認するか、システム管理者にお問い合わせください。", - "kibana_legacy.paginate.controls.pageSizeLabel": "ページサイズ", - "kibana_legacy.paginate.controls.scrollTopButtonLabel": "最上部に移動", - "kibana_legacy.paginate.size.allDropDownOptionLabel": "すべて", - "kibana_utils.defaultFeedbackMessage": "フィードバックがありますか？{link} で問題を報告してください。", - "kibana_utils.history.savedObjectIsMissingNotificationMessage": "保存されたオブジェクトがありません", - "kibana_utils.indexPattern.bannerLabel": "Kibanaでデータの可視化と閲覧を行うには、Elasticsearchからデータを取得するためのインデックスパターンの作成が必要です。", - "kibana_utils.stateManagement.stateHash.unableToRestoreUrlErrorMessage": "URL を完全に復元できません。共有機能を使用していることを確認してください。", - "kibana_utils.stateManagement.stateHash.unableToStoreHistoryInSessionErrorMessage": "セッションがいっぱいで安全に削除できるアイテムが見つからないため、Kibana は履歴アイテムを保存できません。\n\nこれは大抵新規タブに移動することで解決されますが、より大きな問題が原因である可能性もあります。このメッセージが定期的に表示される場合は、{gitHubIssuesUrl} で問題を報告してください。", - "kibana-react.dualRangeControl.mustSetBothErrorMessage": "下と上の値の両方を設定する必要があります", - "kibana-react.dualRangeControl.outsideOfRangeErrorMessage": "値は {min} と {max} の間でなければなりません", - "kibana-react.dualRangeControl.upperValidErrorMessage": "上の値は下の値以上でなければなりません", - "kibana-react.exitFullScreenButton.exitFullScreenModeButtonAriaLabel": "全画面モードを終了", - "kibana-react.exitFullScreenButton.exitFullScreenModeButtonText": "全画面を終了", - "kibana-react.exitFullScreenButton.exitFullScreenModeButtonTitle": "Elastic Kibana", - "kibana-react.exitFullScreenButton.fullScreenModeDescription": "ESC キーで全画面モードを終了します。", - "kibana-react.splitPanel.adjustPanelSizeAriaLabel": "左右のキーを押してパネルサイズを調整します", - "kibana-react.tableListView.listing.createNewItemButtonLabel": "Create {entityName}", - "kibana-react.tableListView.listing.deleteButtonMessage": "{itemCount} 件の {entityName} を削除", - "kibana-react.tableListView.listing.deleteConfirmModalDescription": "削除された {entityNamePlural} は復元できません。", - "kibana-react.tableListView.listing.deleteSelectedConfirmModal.title": "{itemCount} 件の {entityName} を削除", - "kibana-react.tableListView.listing.deleteSelectedItemsConfirmModal.cancelButtonLabel": "キャンセル", - "kibana-react.tableListView.listing.deleteSelectedItemsConfirmModal.confirmButtonLabel": "削除", - "kibana-react.tableListView.listing.deleteSelectedItemsConfirmModal.confirmButtonLabelDeleting": "削除中", - "kibana-react.tableListView.listing.listingLimitExceeded.advancedSettingsLinkText": "高度な設定", - "kibana-react.tableListView.listing.listingLimitExceededDescription": "{totalItems} 件の {entityNamePlural} がありますが、{listingLimitText} の設定により {listingLimitValue} 件までしか下の表に表示できません。この設定は {advancedSettingsLink} で変更できます。{advancedSettingsLink} の下でこの設定を変更できます。", - "kibana-react.tableListView.listing.listingLimitExceededTitle": "リスティング制限超過", - "kibana-react.tableListView.listing.noAvailableItemsMessage": "利用可能な {entityNamePlural} がありません。", - "kibana-react.tableListView.listing.noMatchedItemsMessage": "検索条件に一致する {entityNamePlural} がありません。", - "kibana-react.tableListView.listing.table.actionTitle": "アクション", - "kibana-react.tableListView.listing.table.editActionDescription": "編集", - "kibana-react.tableListView.listing.table.editActionName": "編集", - "kibana-react.tableListView.listing.unableToDeleteDangerMessage": "{entityName} を削除できません", - "management.breadcrumb": "管理", - "management.connectDataDisplayName": "データに接続", - "management.displayName": "管理", - "management.editIndexPattern.createIndex.defaultButtonDescription": "すべてのデータに完全集約を実行", - "management.editIndexPattern.createIndex.defaultButtonText": "標準インデックスパターン", - "management.editIndexPattern.createIndex.defaultTypeName": "インデックスパターン", - "management.editIndexPattern.list.defaultIndexPatternListName": "デフォルト", - "management.indexPatternHeader": "インデックスパターン", - "management.indexPatternLabel": "Elasticsearch からのデータの取得に役立つインデックスパターンを管理します。", - "management.nav.label": "管理", - "management.nav.menu": "管理メニュー", - "management.stackManagement.managementDescription": "Elastic Stack の管理を行うセンターコンソールです。", - "newsfeed.emptyPrompt.noNewsText": "Kibanaインスタンスがインターネットにアクセスできない場合、管理者にこの機能を無効にするように依頼してください。そうでない場合は、ニュースを取り込み続けます。", - "newsfeed.emptyPrompt.noNewsTitle": "ニュースがない場合", - "newsfeed.flyoutList.closeButtonLabel": "閉じる", - "newsfeed.flyoutList.versionTextLabel": "{version}", - "newsfeed.flyoutList.whatsNewTitle": "Elastic の新機能", - "newsfeed.loadingPrompt.gettingNewsText": "最新ニュースを取得しています...", - "regionMap.choroplethLayer.downloadingVectorData404ErrorMessage": "{name} の取得時にサーバーから「404」が返されます。指定された場所にファイルが存在することを確認してください。", - "regionMap.choroplethLayer.downloadingVectorDataErrorMessage": "{name} ファイルをダウンロードできません。サーバーの CORS 構成で、このホストの Kibana アプリケーションからのリクエストが許可されていることを確認してください。", - "regionMap.choroplethLayer.downloadingVectorDataErrorMessageTitle": "ベクトルデータのダウンロード中にエラーが発生しました", - "regionMap.choroplethLayer.unrecognizedFormatErrorMessage": "認識されないフォーマット {formatType}", - "regionMap.function.help": "地域マップビジュアライゼーション", - "regionMap.mapVis.regionMapDescription": "マップにメトリックを表示します。提供されたベースマップを使用するか、独自のマップを追加できます。暗い色は大きな値を意味します。", - "regionMap.mapVis.regionMapEditorConfig.schemas.metricTitle": "値", - "regionMap.mapVis.regionMapEditorConfig.schemas.segmentTitle": "フィールドのシェイプ", - "regionMap.mapVis.regionMapTitle": "地域マップ", - "regionMap.visParams.colorSchemaLabel": "カラー図表", - "regionMap.visParams.displayWarningsLabel": "警告を表示", - "regionMap.visParams.joinFieldLabel": "フィールドを結合", - "regionMap.visParams.layerSettingsTitle": "レイヤー設定", - "regionMap.visParams.outlineWeightLabel": "境界の太さ", - "regionMap.visParams.previewOnEMSLinkText": "EMS でプレビュー", - "regionMap.visParams.previewOnEMSLinkTitle": "Elastic Maps Service で {selectedLayerName} をプレビュー", - "regionMap.visParams.showAllShapesLabel": "すべてのシェイプを表示", - "regionMap.visParams.styleSettingsLabel": "スタイル設定", - "regionMap.visParams.switchWarningsTipText": "警告のオン・オフを切り替えます。オンの場合、結合フィールドに基づきベクトルレイヤーのシェイプと一致しない用語ごとに警告が表示されます。オフにすると、これらの警告がオフになります。", - "regionMap.visParams.turnOffShowingAllShapesTipText": "この設定をオフにすると、対応する用語と一致したシェイプのみが表示されます。", - "regionMap.visParams.vectorMapLabel": "ベクトルマップ", - "regionMap.visualization.unableToShowMismatchesWarningText": "次の各用語がシェイプの結合フィールドのシェイプと一致することを確認してください: {mismatches}", - "regionMap.visualization.unableToShowMismatchesWarningTitle": "{mismatchesLength} {oneMismatch, plural, one { 件の結果} other { 件の結果}}をマップに表示できません", - "savedObjects.confirmModal.cancelButtonLabel": "キャンセル", - "savedObjects.confirmModal.overwriteButtonLabel": "上書き", - "savedObjects.confirmModal.overwriteConfirmationMessage": "{title} を上書きしてよろしいですか？", - "savedObjects.confirmModal.overwriteTitle": "{name} を上書きしますか？", - "savedObjects.confirmModal.saveDuplicateButtonLabel": "{name} を保存", - "savedObjects.confirmModal.saveDuplicateConfirmationMessage": "「{title}」というタイトルの {name} が既に存在します保存しますか？", - "savedObjects.finder.filterButtonLabel": "タイプ", - "savedObjects.finder.searchPlaceholder": "検索...", - "savedObjects.finder.sortAsc": "昇順", - "savedObjects.finder.sortAuto": "ベストマッチ", - "savedObjects.finder.sortButtonLabel": "並べ替え", - "savedObjects.finder.sortDesc": "降順", - "savedObjects.overwriteRejectedDescription": "上書き確認が拒否されました", - "savedObjects.saveDuplicateRejectedDescription": "重複ファイルの保存確認が拒否されました", - "savedObjects.saveModal.cancelButtonLabel": "キャンセル", - "savedObjects.saveModal.descriptionLabel": "説明", - "savedObjects.saveModal.duplicateTitleDescription": "{confirmSaveLabel} をクリックすると {objectType} がこの重複したタイトルで保存されます。", - "savedObjects.saveModal.duplicateTitleLabel": "「{title}」というタイトルの {objectType} が既に存在します", - "savedObjects.saveModal.saveAsNewLabel": "新しい {objectType} として保存", - "savedObjects.saveModal.saveButtonLabel": "保存", - "savedObjects.saveModal.saveTitle": "{objectType} を保存", - "savedObjects.saveModal.titleLabel": "タイトル", - "server.stats.notReadyMessage": "まだ統計が準備できていません。後程再試行してください", - "server.status.disabledTitle": "無効", - "server.status.greenTitle": "緑", - "server.status.redTitle": "赤", - "server.status.uninitializedTitle": "アンインストールしました", - "server.status.yellowTitle": "黄色", - "share.contextMenu.embedCodeLabel": "埋め込みコード", - "share.contextMenu.embedCodePanelTitle": "埋め込みコード", - "share.contextMenu.permalinkPanelTitle": "パーマリンク", - "share.contextMenu.permalinksLabel": "パーマリンク", - "share.contextMenuTitle": "この {objectType} を共有", - "share.urlGenerators.error.createUrlFnProvided": "このジェネレーターは非推奨とマークされています。createUrl fn を付けないでください。", - "share.urlGenerators.error.migrateCalledNotDeprecated": "非推奨以外のジェネレーターで migrate を呼び出すことはできません。", - "share.urlGenerators.error.migrationFnGivenNotDeprecated": "移行機能を提供する場合、このジェネレーターに非推奨マークを付ける必要があります", - "share.urlGenerators.error.noCreateUrlFnProvided": "このジェネレーターには非推奨のマークがありません。createUrl fn を付けてください。", - "share.urlGenerators.error.noMigrationFnProvided": "アクセスリンクジェネレーターに非推奨マークが付いている場合、移行機能を提供する必要があります。", - "share.urlGenerators.errors.noGeneratorWithId": "{id} という ID のジェネレーターはありません", - "share.urlPanel.canNotShareAsSavedObjectHelpText": "{objectType} が保存されるまで保存されたオブジェクトを共有することはできません。", - "share.urlPanel.copyIframeCodeButtonLabel": "iFrame コードをコピー", - "share.urlPanel.copyLinkButtonLabel": "リンクをコピー", - "share.urlPanel.generateLinkAsLabel": "名前を付けてリンクを生成", - "share.urlPanel.savedObjectDescription": "この URL を共有することで、他のユーザーがこの {objectType} の最も最近保存されたバージョンを読み込めるようになります。", - "share.urlPanel.savedObjectLabel": "保存されたオブジェクト", - "share.urlPanel.shortUrlHelpText": "互換性が最も高くなるよう、短いスナップショット URL を共有することをお勧めします。Internet Explorer は URL の長さに制限があり、一部の wiki やマークアップパーサーは長い完全なスナップショット URL に対応していませんが、短い URL は正常に動作するはずです。", - "share.urlPanel.shortUrlLabel": "短い URL", - "share.urlPanel.snapshotDescription": "スナップショット URL には、{objectType} の現在の状態がエンコードされています。保存された {objectType} への編集内容はこの URL には反映されません。.", - "share.urlPanel.snapshotLabel": "スナップショット", - "share.urlPanel.unableCreateShortUrlErrorMessage": "短い URL を作成できません。エラー: {errorMessage}", - "statusPage.loadStatus.serverIsDownErrorMessage": "サーバーステータスのリクエストに失敗しました。サーバーがダウンしている可能性があります。", - "statusPage.loadStatus.serverStatusCodeErrorMessage": "サーバーステータスのリクエストに失敗しました。ステータスコード: {responseStatus}", - "statusPage.metricsTiles.columns.heapTotalHeader": "ヒープ合計", - "statusPage.metricsTiles.columns.heapUsedHeader": "使用ヒープ", - "statusPage.metricsTiles.columns.loadHeader": "読み込み", - "statusPage.metricsTiles.columns.requestsPerSecHeader": "1 秒あたりのリクエスト", - "statusPage.metricsTiles.columns.resTimeAvgHeader": "平均応答時間", - "statusPage.metricsTiles.columns.resTimeMaxHeader": "最長応答時間", - "statusPage.serverStatus.statusTitle": "Kibana のステータス: {kibanaStatus}", - "statusPage.statusApp.loadingErrorText": "ステータスの読み込み中にエラーが発生しました", - "statusPage.statusApp.statusActions.buildText": "{buildNum} を作成", - "statusPage.statusApp.statusActions.commitText": "{buildSha} を確定", - "statusPage.statusApp.statusTitle": "プラグインステータス", - "statusPage.statusTable.columns.idHeader": "ID", - "statusPage.statusTable.columns.statusHeader": "ステータス", - "telemetry.callout.appliesSettingTitle": "この設定に加えた変更は {allOfKibanaText} に適用され、自動的に保存されます。", - "telemetry.callout.appliesSettingTitle.allOfKibanaText": "Kibana のすべて", - "telemetry.callout.clusterStatisticsDescription": "これは収集される基本的なクラスター統計の例です。インデックス、シャード、ノードの数が含まれます。監視がオンになっているかどうかなどのハイレベルの使用統計も含まれます。", - "telemetry.callout.clusterStatisticsTitle": "クラスター統計", - "telemetry.callout.errorLoadingClusterStatisticsDescription": "クラスター統計の取得中に予期せぬエラーが発生しました。Elasticsearch、Kibana、またはネットワークのエラーが原因の可能性があります。Kibana を確認し、ページを再読み込みして再試行してください。", - "telemetry.callout.errorLoadingClusterStatisticsTitle": "クラスター統計の読み込みエラー", - "telemetry.callout.errorUnprivilegedUserDescription": "暗号化されていないクラスター統計を表示するアクセス権がありません。", - "telemetry.callout.errorUnprivilegedUserTitle": "クラスター統計の表示エラー", - "telemetry.optInErrorToastText": "使用状況統計設定の設定中にエラーが発生しました。", - "telemetry.optInErrorToastTitle": "エラー", - "telemetry.optInNoticeSeenErrorTitle": "エラー", - "telemetry.optInNoticeSeenErrorToastText": "通知の消去中にエラーが発生しました", - "telemetry.optInSuccessOff": "使用状況データ収集がオフです。", - "telemetry.optInSuccessOn": "使用状況データ収集がオンです。", - "telemetry.provideUsageStatisticsAriaName": "使用統計を提供", - "telemetry.provideUsageStatisticsTitle": "使用統計を提供", - "telemetry.readOurUsageDataPrivacyStatementLinkText": "プライバシーポリシー", - "telemetry.seeExampleOfWhatWeCollectLinkText": "収集されるデータの例を見る", - "telemetry.telemetryBannerDescription": "Elastic Stackの改善にご協力ください使用状況データの収集は現在無効です。使用状況データの収集を有効にすると、製品とサービスを管理して改善することができます。詳細については、{privacyStatementLink}をご覧ください。", - "telemetry.telemetryConfigAndLinkDescription": "使用状況データの収集を有効にすると、製品とサービスを管理して改善することができます。詳細については、{privacyStatementLink}をご覧ください。", - "telemetry.telemetryConfigDescription": "基本的な機能の利用状況に関する統計情報を提供して、Elastic Stack の改善にご協力ください。このデータは Elastic 社外と共有されません。", - "telemetry.telemetryOptedInDisableUsage": "ここで使用状況データを無効にする", - "telemetry.telemetryOptedInDismissMessage": "閉じる", - "telemetry.telemetryOptedInNoticeDescription": "使用状況データがどのように製品とサービスの管理と改善につながるのかに関する詳細については、{privacyStatementLink}をご覧ください。収集を停止するには、{disableLink}。", - "telemetry.telemetryOptedInNoticeTitle": "Elastic Stack の改善にご協力ください", - "telemetry.telemetryOptedInPrivacyStatement": "プライバシーポリシー", - "telemetry.usageDataTitle": "使用データ", - "telemetry.welcomeBanner.disableButtonLabel": "無効にする", - "telemetry.welcomeBanner.enableButtonLabel": "有効にする", - "telemetry.welcomeBanner.telemetryConfigDetailsDescription.telemetryPrivacyStatementLinkText": "遠隔測定に関するプライバシーステートメント", - "telemetry.welcomeBanner.title": "Elastic Stack の改善にご協力ください", - "tileMap.baseMapsVisualization.childShouldImplementMethodErrorMessage": "子は data-update に対応できるようこのメソドを導入する必要があります", - "tileMap.function.help": "タイルマップのビジュアライゼーションです", - "tileMap.geohashLayer.mapTitle": "{mapType} マップタイプが認識されません", - "tileMap.tooltipFormatter.latitudeLabel": "緯度", - "tileMap.tooltipFormatter.longitudeLabel": "経度", - "tileMap.vis.editorConfig.legendPositions.bottomLeftText": "左下", - "tileMap.vis.editorConfig.legendPositions.bottomRightText": "右下", - "tileMap.vis.editorConfig.legendPositions.topLeftText": "左上", - "tileMap.vis.editorConfig.legendPositions.topRightText": "右上", - "tileMap.vis.editorConfig.mapTypes.heatmapText": "ヒートマップ", - "tileMap.vis.editorConfig.mapTypes.scaledCircleMarkersText": "スケーリングされた円マーカー", - "tileMap.vis.editorConfig.mapTypes.shadedCircleMarkersText": "影付き円マーカー", - "tileMap.vis.editorConfig.mapTypes.shadedGeohashGridText": "影付きジオハッシュグリッド", - "tileMap.vis.map.editorConfig.schemas.geoCoordinatesTitle": "座標", - "tileMap.vis.map.editorConfig.schemas.metricTitle": "値", - "tileMap.vis.mapDescription": "マップ上に緯度と経度の座標を表示します。", - "tileMap.vis.mapTitle": "座標マップ", - "tileMap.visParams.clusterSizeLabel": "クラスターサイズ", - "tileMap.visParams.colorSchemaLabel": "カラー図表", - "tileMap.visParams.desaturateTilesLabel": "タイルを不飽和化", - "tileMap.visParams.mapTypeLabel": "マップタイプ", - "tileMap.visParams.reduceVibrancyOfTileColorsTip": "色の鮮明度を下げます。この機能は Internet Explorer ではバージョンにかかわらず利用できません。", - "tileMap.wmsOptions.attributionStringTip": "右下角の属性文字列", - "tileMap.wmsOptions.baseLayerSettingsTitle": "ベースレイヤー設定", - "tileMap.wmsOptions.imageFormatToUseTip": "通常画像/png または画像/jpeg です。サーバーが透明レイヤーを返す場合は png を使用します。", - "tileMap.wmsOptions.layersLabel": "レイヤー", - "tileMap.wmsOptions.listOfLayersToUseTip": "使用するレイヤーのコンマ区切りのリストです。", - "tileMap.wmsOptions.mapLoadFailDescription": "このパラメーターが正しくないと、マップが正常に読み込まれません。", - "tileMap.wmsOptions.urlOfWMSWebServiceTip": "WMS web サービスの URL です。", - "tileMap.wmsOptions.useWMSCompliantMapTileServerTip": "WMS 対応のマップタイルサーバーを使用します。上級者向けです。", - "tileMap.wmsOptions.versionOfWMSserverSupportsTip": "サーバーがサポートしている WMS のバージョンです。", - "tileMap.wmsOptions.wmsAttributionLabel": "WMS 属性", - "tileMap.wmsOptions.wmsDescription": "WMS は、マップイメージサービスの {wmsLink} です。", - "tileMap.wmsOptions.wmsFormatLabel": "WMS フォーマット", - "tileMap.wmsOptions.wmsLayersLabel": "WMS レイヤー", - "tileMap.wmsOptions.wmsLinkText": "OGC スタンダード", - "tileMap.wmsOptions.wmsMapServerLabel": "WMS マップサーバー", - "tileMap.wmsOptions.wmsServerSupportedStylesListTip": "WMS サーバーがサポートしている使用スタイルのコンマ区切りのリストです。大抵は空白のままです。", - "tileMap.wmsOptions.wmsStylesLabel": "WMS スタイル", - "tileMap.wmsOptions.wmsUrlLabel": "WMS URL", - "tileMap.wmsOptions.wmsVersionLabel": "WMS バージョン", - "timelion.badge.readOnly.text": "読み込み専用", - "timelion.badge.readOnly.tooltip": "Timelion シートを保存できません", - "timelion.breadcrumbs.create": "作成", - "timelion.breadcrumbs.root": "Timelion", - "timelion.cells.actions.fullscreenAriaLabel": "全画面チャート", - "timelion.cells.actions.fullscreenTooltip": "全画面", - "timelion.cells.actions.removeAriaLabel": "リモートスタート", - "timelion.cells.actions.removeTooltip": "削除", - "timelion.cells.actions.reorderAriaLabel": "ドラッグして並べ替え", - "timelion.cells.actions.reorderTooltip": "ドラッグして並べ替え", - "timelion.chart.seriesList.noSchemaWarning": "次のパネルタイプは存在しません: {renderType}", - "timelion.emptyExpressionErrorMessage": "Timelion エラー式が入力されていません", - "timelion.expressionInputAriaLabel": "Timelion 式", - "timelion.expressionInputPlaceholder": "{esQuery} でのクエリを試してみてください。", - "timelion.expressionSuggestions.arg.infoTitle": "情報", - "timelion.expressionSuggestions.arg.listTitle": "引数:", - "timelion.expressionSuggestions.arg.nameTitle": "引数名", - "timelion.expressionSuggestions.arg.typesTitle": "対応タイプ", - "timelion.expressionSuggestions.argument.description.acceptsText": "受け入れ", - "timelion.expressionSuggestions.func.description.chainableHelpText": "連鎖可能", - "timelion.expressionSuggestions.func.description.chainableText": "{help} (連鎖可能)", - "timelion.expressionSuggestions.func.description.dataSourceHelpText": "データソース", - "timelion.expressionSuggestions.func.description.dataSourceText": "{help} (データソース)", - "timelion.fitFunctions.carry.downSampleErrorMessage": "ダウンサンプルには「carry」フィットメソドを使用せず、「scale」または「average」を使用してください", - "timelion.fullscreen.exitAriaLabel": "全画面を終了", - "timelion.fullscreen.exitTooltip": "全画面を終了", - "timelion.function.help": "Timelion のビジュアライゼーションです。", - "timelion.help.configuration.firstTimeConfigurationLinkText": "初回構成", - "timelion.help.configuration.notValid.advancedSettingsPathText": "管理 / Kibana / 高度な設定", - "timelion.help.configuration.notValid.notValidSettingsErrorMessage": "Elasticsearch の設定を確認できませんでした: {reason}。高度な設定を確認して再試行してください。({count})", - "timelion.help.configuration.notValid.paragraph1": "Logstash を使用している場合、Timelion でのログデータの探索開始に何も構成する必要はありません。他のインデックスを検索するには、{advancedSettingsPath} に移動してインデックスと一致するよう {esDefaultIndex} と {esTimefield} を設定します。", - "timelion.help.configuration.notValid.paragraph2": "他の Timelion 設定もあります。今のところ他の設定は気にしなくて大丈夫です。後程、必要に応じていつでも設定できることがわかります。", - "timelion.help.configuration.notValid.validateButtonLabel": "構成を検証", - "timelion.help.configuration.notValidTitle": "初回構成", - "timelion.help.configuration.valid.advancedSettingsPathText": "管理/Kibana/高度な設定", - "timelion.help.configuration.valid.intervalIsAutoText": "準備完了です！", - "timelion.help.configuration.valid.intervals.content.intervalIsNotAutoText": "Timelion が適切な間隔を選択できるよう、{auto} に設定します。", - "timelion.help.configuration.valid.intervalsTextPart1": "インプットバーの右にある間隔設定は、サンプリングの頻度をコントロールできます。現在 {interval} に設定されています。", - "timelion.help.configuration.valid.intervalsTextPart2": "Timelion が選択された時間範囲と間隔の組み合わせによりデータポイントが多くなりすぎると判断した場合、エラーが発生します。{advancedSettingsPath} の {maxBuckets} を構成することでこの制限を調整できます。", - "timelion.help.configuration.valid.intervalsTitle": "間隔", - "timelion.help.configuration.valid.paragraph1Part1": "デフォルトのインデックスと時間フィールドを検証し、すべて問題なさそうです。{statsMin} から {statsMax} までのデータが見つかりました。恐らく準備完了です。何か問題がある場合は、", - "timelion.help.configuration.valid.paragraph1Part2": "で Elasticsearch データソースの構成に関する詳細をご覧ください。", - "timelion.help.configuration.valid.paragraph2": "既にチャートが 1 つ表示されていますが、興味深いデータを得るにはいくつか調整が必要な可能性があります。", - "timelion.help.configuration.valid.paragraph3": "これで、一定期間のデータポイントの数を示す折れ線グラフが表示されるはずです。", - "timelion.help.configuration.valid.timeRangeText": "Kibana ツールバーのタイムピッカーで可視化するデータを含む期間を選択します。上記のすべてまたは一部の時間範囲を含む時間範囲を選択するようにしてください。", - "timelion.help.configuration.valid.timeRangeTitle": "時間範囲", - "timelion.help.configuration.validTitle": "良いお知らせです。Elasticsearch が正しく構成されました！", - "timelion.help.dataTransforming.functionReferenceLinkText": "機能リファレンス", - "timelion.help.dataTransforming.paragraph1": "基本を覚えたところで、Timelion の実力を発揮させましょう。エータのサブセットが、一定期間における全体の何パーセントを表しているか見てみましょう。例えば、Web トラフィックの何パーセントが米国からのものでしょう？", - "timelion.help.dataTransforming.paragraph2": "まず初めに、米国を含むすべてのイベントを見つけます: {esUsQuery}。", - "timelion.help.dataTransforming.paragraph3": "次に、全体に対する米国のイベントの比率を割り出します。{us} を全体で割るには、{divide} 関数を使用します: {divideDataQuery}。", - "timelion.help.dataTransforming.paragraph4": "まぁまぁですが、これでは 0 から 1 までの値になってしまいます。パーセンテージに変換するには、100 を掛けます: {multiplyDataQuery}。", - "timelion.help.dataTransforming.paragraph5": "これでトラフィックの何パーセントが米国からのものなのか分かり、一定期間内にどのように変化したのか見ることができます！Timelion には、{sum}、{subtract}、{multiply}、{divide} などのいくつもの演算機能が搭載されています。これらの多くが数列や数字を扱えます。また、{movingaverage}、{abs}、{derivative} といった他の便利な変換機能もあります。", - "timelion.help.dataTransforming.paragraph6Part1": "構文を学んだところで、", - "timelion.help.dataTransforming.paragraph6Part2": "で、Timelion で利用できるすべての機能の使い方をご覧ください。Kibana ツールバーの \\{ドキュメント\\} をクリックしていつでもリファレンスを参照することができます。このチュートリアルに戻るには、リファレンスの上にある \\{チュートリアル\\} リンクをクリックします。", - "timelion.help.dataTransformingTitle": "データの変換: お楽しみの始まりです！", - "timelion.help.dontShowHelpButtonLabel": "今後表示しない", - "timelion.help.expressions.examples.customStylingDescription": "{descriptionTitle}初めの数列を赤くし、2 つ目の数列に 1 ピクセル幅のバーを使用します。", - "timelion.help.expressions.examples.customStylingDescriptionTitle": "カスタムスタイリング。", - "timelion.help.expressions.examples.groupedExpressionsDescription": "{descriptionTitle}式のグループを関数に連結させることもできます。ここでは両方の数列が線ではなく点で表示されています。", - "timelion.help.expressions.examples.groupedExpressionsDescriptionTitle": "式のグループ化。", - "timelion.help.expressions.examples.namedArgumentsDescription": "{descriptionTitle}引数の指定順序を覚える必要はありません。名前付き引数を使えば、式の読み書きが楽になります。", - "timelion.help.expressions.examples.namedArgumentsDescriptionTitle": "名前付き引数。", - "timelion.help.expressions.examples.twoExpressionsDescription": "{descriptionTitle}同じチャートに 2 つの式が使えます。", - "timelion.help.expressions.examples.twoExpressionsDescriptionTitle": "2 倍の楽しみ。", - "timelion.help.expressions.functionReferenceLinkText": "関数リファレンス", - "timelion.help.expressions.paragraph1": "それぞれの式はデータソース関数で始まります。ここから、新しい関数をデータソースに追加して変換や強化ができます。", - "timelion.help.expressions.paragraph2": "ところで、ここから先はデータの持ち主が一番よくご存知なのではないでしょうか。サンプルクエリをより有意義なものと自由に置き換えてみてください。", - "timelion.help.expressions.paragraph3": "Kibana ツールバーの {strongAdd} をクリックして、他のチャートをいくつか追加してみみましょう。そして、チャートを選択して次の式の内の 1 つをコピーし、インプットバーに貼り付けて、Enter を押します。リセットして繰り返し、他の式を試してみましょう。", - "timelion.help.expressions.paragraph4": "Timelion は、チャートの見た目をカスタマイズするための他のビュー変換機能も搭載しています。完全なリストは次のリソースをご覧ください", - "timelion.help.expressions.strongAddText": "追加", - "timelion.help.expressionsTitle": "式を使って式を定義", - "timelion.help.functions.absHelpText": "数列リストの各値の絶対値を返します", - "timelion.help.functions.aggregate.args.functionHelpText": "{functions} の 1 つ", - "timelion.help.functions.aggregateHelpText": "数列のすべての点の処理結果に基づく線を作成します。利用可能な関数: {functions}", - "timelion.help.functions.bars.args.stackHelpText": "バーがスタックした場合はデフォルトで true にする", - "timelion.help.functions.bars.args.widthHelpText": "バーの幅 (ピクセル)", - "timelion.help.functions.barsHelpText": "seriesList をバーとして表示", - "timelion.help.functions.color.args.colorHelpText": "ヘックスとしての数列の色です。例: #c6c6c6 はかわいいライトグレー。複数の色を指定し、複数数列がある場合、グラデーションになります。例: 「#00B1CC:#00FF94:#FF3A39:#CC1A6F」", - "timelion.help.functions.colorHelpText": "数列の色を変更します", - "timelion.help.functions.common.args.fitHelpText": "ターゲットの期間と間隔に数列を合わせるためのアルゴリズムです。利用可能: {fitFunctions}", - "timelion.help.functions.common.args.offsetHelpText": "日付表現による数列の取得をオフセットします。例: 1 か月前からイベントを作成する -1M tは現在のように表示されます。「 timerange」によって、チャートの全体的な時間範囲に関連した数列をオフセットします。例: 「timerange:-2」は過去に対する全体的なチャート時間範囲の 2 倍をオフセットします。", - "timelion.help.functions.condition.args.elseHelpText": "比較が false の場合に点が設定される値です。ここで seriesList を引き渡した場合、初めの数列が使用されます。", - "timelion.help.functions.condition.args.ifHelpText": "点が比較される値です。ここで seriesList を引き渡した場合、初めの数列が使用されます。", - "timelion.help.functions.condition.args.operator.suggestions.eqHelpText": "equal", - "timelion.help.functions.condition.args.operator.suggestions.gteHelpText": "超過", - "timelion.help.functions.condition.args.operator.suggestions.gtHelpText": "以上", - "timelion.help.functions.condition.args.operator.suggestions.lteHelpText": "未満", - "timelion.help.functions.condition.args.operator.suggestions.ltHelpText": "以下", - "timelion.help.functions.condition.args.operator.suggestions.neHelpText": "not equal", - "timelion.help.functions.condition.args.operatorHelpText": "比較に使用する比較演算子、有効な演算子は eq (=)、ne (≠), lt (<), lte (≦), gt (>), gte (≧)", - "timelion.help.functions.condition.args.thenHelpText": "比較が true の場合に点が設定される値です。ここで seriesList を引き渡した場合、初めの数列が使用されます。", - "timelion.help.functions.conditionHelpText": "演算子を使って各点を数字、または別の数列の同じ点と比較し、true の場合値を結果の値に設定し、オプションとして else が使用されます。", - "timelion.help.functions.cusum.args.baseHelpText": "開始の数字です。基本的に、数列の初めにこの数字が追加されます", - "timelion.help.functions.cusumHelpText": "ベースから始め、数列の累積和を返します。", - "timelion.help.functions.derivativeHelpText": "一定期間の値の変化をプロットします。", - "timelion.help.functions.divide.args.divisorHelpText": "割る数字または数列です。複数数列を含む seriesList はラベルに適用されます。", - "timelion.help.functions.divideHelpText": "seriesList の 1 つまたは複数の数列の値をインプット seriesList の各数列のそれぞれの配置に割けます。", - "timelion.help.functions.es.args.indexHelpText": "クエリを実行するインデックスで、ワイルドカードが使えます。「metrics」、「split」、「timefield」引数のスクリプトフィールドのフィールド名のインデックスパターン名とフィールド名の入力候補を提供します。", - "timelion.help.functions.es.args.intervalHelpText": "**これは使用しないでください**。fit 関数のデバッグは楽しいですが、間隔ピッカーを使用すべきです。", - "timelion.help.functions.es.args.kibanaHelpText": "Kibana ダッシュボードでフィルターを適用します。Kibana ダッシュボードの使用時にのみ適用されます。", - "timelion.help.functions.es.args.metricHelpText": "Elasticsearch メトリック集約: avg、sum、min、max、percentiles、または基数、後ろにフィールドを付けます。例: 「sum:bytes」、「percentiles:bytes:95,99,99.9」、「count」", - "timelion.help.functions.es.args.qHelpText": "Lucene クエリ文字列の構文のクエリ", - "timelion.help.functions.es.args.splitHelpText": "分割する Elasticsearch フィールドと制限です。例: トップ 10 のホスト名を割り出す「{hostnameSplitArg}」", - "timelion.help.functions.es.args.timefieldHelpText": "X 軸にフィールドタイプ「date」を使用", - "timelion.help.functions.esHelpText": "Elasticsearch インスタンスからデータを取得します", - "timelion.help.functions.firstHelpText": "これは単純に input seriesList を返す内部機能です。この機能は使わないでください", - "timelion.help.functions.fit.args.modeHelpText": "数列をターゲットに合わせるためのアルゴリズムです。{fitFunctions} の 1 つ", - "timelion.help.functions.fitHelpText": "定義された fit 関数を使用して空値を入力します", - "timelion.help.functions.graphite.args.metricHelpText": "取得する Graphite メトリック、例: {metricExample}", - "timelion.help.functions.graphiteHelpText": "[実験的] Graphite からデータを取得します。Kibana の高度な設定で Graphite サーバーを構成します", - "timelion.help.functions.hide.args.hideHelpText": "数列の表示と非表示を切り替えます", - "timelion.help.functions.hideHelpText": "デフォルトで数列を非表示にします", - "timelion.help.functions.holt.args.alphaHelpText": "\n 0 から 1 の平滑化加重です。\n アルファを上げると新しい数列がオリジナルにさらに近くなります。\n 下げると数列がスムーズになります", - "timelion.help.functions.holt.args.betaHelpText": "\n 0 から 1 の傾向加重です。\n ベータを上げると線の上下の動きが長くなります。\n 下げると新しい傾向をより早く反映するようになります", - "timelion.help.functions.holt.args.gammaHelpText": "\n 0 から 1 のシーズン加重です。データが波のようになっていますか？\n この数字を上げると、最近のシーズンの重要性が高まり、波形の動きを速くします。\n 下げると新しいシーズンの重要性が下がり、過去がより重要視されます。\n ", - "timelion.help.functions.holt.args.sampleHelpText": "\n シーズン数列の「予測」を開始する前にサンプリングするシーズンの数です。\n (gamma でのみ有効、デフォルト: all)", - "timelion.help.functions.holt.args.seasonHelpText": "シーズンの長さです、例: パターンが毎週繰り返される場合は 1w。(gamma でのみ有効)", - "timelion.help.functions.holtHelpText": "\n 数列の始めをサンプリングし、\n いくつかのオプションパラメーターを使用して何が起こるか予測します。基本的に、この機能は未来を予測するのではなく、\n 過去のデータに基づき現在何が起きているべきかを予測します。\n この情報は異常検知に役立ちます。null には予測値が入力されます。", - "timelion.help.functions.label.args.labelHelpText": "数列の凡例値です。文字列で $1、$2 などを使用して、正規表現の捕捉グループに合わせることができます。", - "timelion.help.functions.label.args.regexHelpText": "捕捉グループをサポートする正規表現です", - "timelion.help.functions.labelHelpText": "数列のラベルを変更します。%s で既存のラベルを参照します", - "timelion.help.functions.legend.args.columnsHelpText": "凡例を分ける列の数です", - "timelion.help.functions.legend.args.position.suggestions.falseHelpText": "凡例を無効にします", - "timelion.help.functions.legend.args.position.suggestions.neHelpText": "北東の角に凡例を配置します", - "timelion.help.functions.legend.args.position.suggestions.nwHelpText": "北西の角に凡例を配置します", - "timelion.help.functions.legend.args.position.suggestions.seHelpText": "南東の角に凡例を配置します", - "timelion.help.functions.legend.args.position.suggestions.swHelpText": "南西の角に凡例を配置します", - "timelion.help.functions.legend.args.positionHelpText": "凡例を配置する角: nw、ne、se、または sw。false で凡例を無効にすることもできます", - "timelion.help.functions.legend.args.showTimeHelpText": "グラフにカーソルを合わせた時、凡例の時間値を表示します。デフォルト: true", - "timelion.help.functions.legend.args.timeFormatHelpText": "moment.js フォーマットパターンです。デフォルト: {defaultTimeFormat}", - "timelion.help.functions.legendHelpText": "プロットの凡例の位置とスタイルを設定します", - "timelion.help.functions.lines.args.fillHelpText": "0 と 10 の間の数字です。エリアチャートの作成に使用します。", - "timelion.help.functions.lines.args.showHelpText": "線の表示と非表示を切り替えます", - "timelion.help.functions.lines.args.stackHelpText": "線をスタックします。よく誤解を招きます。この機能を使用する際は塗りつぶしを使うようにしましょう。", - "timelion.help.functions.lines.args.stepsHelpText": "線をステップとして表示します。つまり、点の間に中間値を挿入しません。", - "timelion.help.functions.lines.args.widthHelpText": "線の太さです", - "timelion.help.functions.linesHelpText": "seriesList を線として表示します", - "timelion.help.functions.log.args.baseHelpText": "対数のベースを設定します、デフォルトは 10 です", - "timelion.help.functions.logHelpText": "数列リストの各値の対数値を返します (デフォルトのベース:10)", - "timelion.help.functions.max.args.valueHelpText": "点を既存の値と引き渡された値のどちらか高い方に設定します。seriesList を引き渡す場合、数列がちょうど 1 つでなければなりません。", - "timelion.help.functions.maxHelpText": "インプット seriesList の各数列のそれぞれの配置の seriesList の 1 つまたは複数の数列の最高値です", - "timelion.help.functions.min.args.valueHelpText": "点を既存の値と引き渡された値のどちらか低い方に設定します。seriesList を引き渡す場合、数列がちょうど 1 つでなければなりません。", - "timelion.help.functions.minHelpText": "インプット seriesList の各数列のそれぞれの配置の seriesList の 1 つまたは複数の数列の最低値です", - "timelion.help.functions.movingaverage.args.positionHelpText": "結果時間に比較した平均点の配置です。{validPositions} の 1 つ", - "timelion.help.functions.movingaverage.args.windowHelpText": "平均を出す点の数、または日付計算式 (例: 1d、1M) です。日付計算式が指定された場合、この機能は現在選択された間隔でできるだけ近づけます。日付計算式が間隔で均等に分けられない場合、結果に異常が出る場合があります。", - "timelion.help.functions.movingaverageHelpText": "特定期間の移動平均を計算します。ばらばらの数列を滑らかにするのに有効です。", - "timelion.help.functions.movingstd.args.positionHelpText": "結果時間に比較した期間スライスの配置です。オプションは {positions} です。デフォルト: {defaultPosition}", - "timelion.help.functions.movingstd.args.windowHelpText": "標準偏差を計算する点の数です。", - "timelion.help.functions.movingstdHelpText": "特定期間の移動標準偏差を計算します。ネイティブ two-pass アルゴリズムを使用します。非常に長い数列や、非常に大きな数字を含む数列では、四捨五入による誤差がより明らかになる可能性があります。", - "timelion.help.functions.multiply.args.multiplierHelpText": "掛ける数字または数列です。複数数列を含む seriesList はラベルに適用されます。", - "timelion.help.functions.multiplyHelpText": "seriesList の 1 つまたは複数の数列の値をインプット seriesList の各数列のそれぞれの配置に掛けます。", - "timelion.help.functions.notAllowedGraphiteUrl": "この Graphite URL は kibana.yml ファイルで構成されていません。\n 「'timelion.graphiteUrls」で kibana.yml ファイルの Graphite サーバーリストを構成して\n Kibana の高度な設定で選択してください", - "timelion.help.functions.points.args.fillColorHelpText": "点を塗りつぶす色です。", - "timelion.help.functions.points.args.fillHelpText": "塗りつぶしの透明度を表す 0 から 10 までの数字です", - "timelion.help.functions.points.args.radiusHelpText": "点のサイズです", - "timelion.help.functions.points.args.showHelpText": "点の表示・非表示です", - "timelion.help.functions.points.args.symbolHelpText": "点のシンボルです。{validSymbols} の 1 つ", - "timelion.help.functions.points.args.weightHelpText": "点の周りの太さです", - "timelion.help.functions.pointsHelpText": "数列を点として表示します", - "timelion.help.functions.precision.args.precisionHelpText": "各値を切り捨てる桁数です", - "timelion.help.functions.precisionHelpText": "値の小数点以下を切り捨てる桁数です", - "timelion.help.functions.props.args.globalHelpText": "各数列に対し、seriesList にプロップを設定します", - "timelion.help.functions.propsHelpText": "数列に任意のプロパティを設定するため、自己責任で行ってください。例: {example}", - "timelion.help.functions.quandl.args.codeHelpText": "プロットする Quandl コードです。これらは quandl.com に掲載されています。", - "timelion.help.functions.quandl.args.positionHelpText": "Quandl ソースによっては、複数数列を返すものがあります。どれを使用しますか？1 ベースインデックス", - "timelion.help.functions.quandlHelpText": "\n [実験的]\n Quandl コードで quandl.com からデータを取得します。{quandlKeyField} を Kibana の空いている API キーに設定します。\n 高度な設定です。API は、キーなしでは非常に低いレート制限があります。", - "timelion.help.functions.range.args.maxHelpText": "新しい最高値です", - "timelion.help.functions.range.args.minHelpText": "新しい最低値です", - "timelion.help.functions.rangeHelpText": "同じシェイプを維持しつつ数列の最高値と最低値を変更します", - "timelion.help.functions.scaleInterval.args.intervalHelpText": "新しい間隔の日付計算表記です。例: 1 秒 = 1s。1m、5m、1M、1w、1y など。", - "timelion.help.functions.scaleIntervalHelpText": "変更すると、値 (通常合計またはカウント) が新しい間隔にスケーリングされます。例: 毎秒のレート", - "timelion.help.functions.static.args.labelHelpText": "数列のラベルを簡単に設定する方法です。.label() 関数を使用することもできます。", - "timelion.help.functions.static.args.valueHelpText": "表示する単一の値です。複数の値が引き渡された場合、指定された時間範囲に均等に挿入されます。", - "timelion.help.functions.staticHelpText": "チャートに 1 つの値を挿入します", - "timelion.help.functions.subtract.args.termHelpText": "インプットから引く数字または数列です。複数数列を含む seriesList はラベルに適用されます。", - "timelion.help.functions.subtractHelpText": "seriesList の 1 つまたは複数の数列の値をインプット seriesList の各数列のそれぞれの配置から引きます。", - "timelion.help.functions.sum.args.termHelpText": "インプット数列に足す数字または数列です。複数数列を含む seriesList はラベルに適用されます。", - "timelion.help.functions.sumHelpText": "seriesList の 1 つまたは複数の数列の値をインプット seriesList の各数列のそれぞれの配置に足します。", - "timelion.help.functions.title.args.titleHelpText": "プロットのタイトルです。", - "timelion.help.functions.titleHelpText": "プロットの上部にタイトルを追加します。複数の seriesList がコールされた場合、最後のコールが使用されます。", - "timelion.help.functions.trend.args.endHelpText": "始めまたは終わりからの計算を修了する場所です。例えば、-10 の場合終わりから 10 点目で計算が終了し、+15 の場合始めから 15 点目で終了します。デフォルト:0", - "timelion.help.functions.trend.args.modeHelpText": "傾向線の生成に使用するアルゴリズムです。{validRegressions} の 1 つ", - "timelion.help.functions.trend.args.startHelpText": "始めまたは終わりからの計算を開始する場所です。例えば、-10 の場合終わりから 10 点目から計算を開始し、+15 の場合始めから 15 点目から開始します。デフォルト:0", - "timelion.help.functions.trendHelpText": "指定された回帰アルゴリズムで傾向線を描きます", - "timelion.help.functions.trim.args.endHelpText": "数列の終わりから切り取るバケットです。デフォルト:1", - "timelion.help.functions.trim.args.startHelpText": "数列の始めから切り取るバケットです。デフォルト:1", - "timelion.help.functions.trimHelpText": "「部分的バケットの問題」に合わせて、数列の始めか終わりの N 個のバケットを無効化するように設定します。", - "timelion.help.functions.worldbank.args.codeHelpText": "Worldbank API パスです。これは通常ドメインの後ろからクエリ文字列までのすべてです。例: {apiPathExample}。", - "timelion.help.functions.worldbankHelpText": "\n [experimental]\n 数列のパスを使用して {worldbankUrl} からデータを取得します。\n Worldbank は主に年間データを提供し、現在の年のデータがないことがよくあります。\n 最近の期間範囲のデータが取得できない場合は、{offsetQuery} をお試しください。", - "timelion.help.functions.worldbankIndicators.args.countryHelpText": "Worldbank の国 ID です。通常は国の 2 文字のコートです", - "timelion.help.functions.worldbankIndicators.args.indicatorHelpText": "使用するインジケーターコードです。{worldbankUrl} で調べる必要があります。多くが分かりずらいものです。例えば、人口は {indicatorExample} です。", - "timelion.help.functions.worldbankIndicatorsHelpText": "\n [experimental]\n 国名とインジケーターを使って {worldbankUrl} からデータを取得します。Worldbank は\n 主に年間データを提供し、現在の年のデータがないことがよくあります。最近の期間のデータが取得できない場合は、{offsetQuery} をお試しください\n 時間範囲", - "timelion.help.functions.yaxis.args.colorHelpText": "軸ラベルの色です", - "timelion.help.functions.yaxis.args.labelHelpText": "軸のラベルです", - "timelion.help.functions.yaxis.args.maxHelpText": "最高値", - "timelion.help.functions.yaxis.args.minHelpText": "最低値", - "timelion.help.functions.yaxis.args.positionHelpText": "左から右", - "timelion.help.functions.yaxis.args.tickDecimalsHelpText": "y 軸とティックラベルの小数点以下の桁数です。", - "timelion.help.functions.yaxis.args.unitsHelpText": "Y 軸のラベルのフォーマットに使用する機能です。{formatters} の 1 つ", - "timelion.help.functions.yaxis.args.yaxisHelpText": "この数列をプロットする数字の Y 軸です。例: 2 本目の Y 軸は .yaxis(2) になります。", - "timelion.help.functions.yaxisHelpText": "様々な Y 軸のオプションを構成します。恐らく最も重要なのは、N 本目 (例: 2 本目) の Y 軸を追加する機能です。", - "timelion.help.mainPage.functionReference.detailsTable.acceptedTypesColumnLabel": "対応タイプ", - "timelion.help.mainPage.functionReference.detailsTable.argumentNameColumnLabel": "引数名", - "timelion.help.mainPage.functionReference.detailsTable.informationColumnLabel": "情報", - "timelion.help.mainPage.functionReference.gettingStartedText": "関数をクリックすると詳細が表示されます。初心者の方ですか？", - "timelion.help.mainPage.functionReference.noArgumentsFunctionErrorMessage": "この関数には引数を使用できません。簡単でしょう？", - "timelion.help.mainPage.functionReference.welcomePageLinkText": "チュートリアルをご覧ください", - "timelion.help.mainPage.functionReferenceTitle": "関数リファレンス", - "timelion.help.mainPage.keyboardTips.autoComplete.downArrowDescription": "自動入力メニューに焦点を切り替えます。矢印でさらに用語を選択します", - "timelion.help.mainPage.keyboardTips.autoComplete.downArrowLabel": "下矢印", - "timelion.help.mainPage.keyboardTips.autoComplete.enterTabDescription": "現在の選択項目または自動入力メニューで最も使用されている用語を選択します", - "timelion.help.mainPage.keyboardTips.autoComplete.escDescription": "自動入力メニューを閉じます", - "timelion.help.mainPage.keyboardTips.autoCompleteTitle": "自動入力が有効な場合", - "timelion.help.mainPage.keyboardTips.generalEditing.submitRequestText": "リクエストを送信します", - "timelion.help.mainPage.keyboardTips.generalEditingTitle": "一般編集", - "timelion.help.mainPage.keyboardTipsTitle": "キーボードのヒント", - "timelion.help.mainPageTitle": "ヘルプ", - "timelion.help.nextPageButtonLabel": "次へ", - "timelion.help.previousPageButtonLabel": "前へ", - "timelion.help.querying.countMetricAggregationLinkText": "Elasticsearch メトリック集約", - "timelion.help.querying.countTextPart1": "イベントをカウントするのも良いですが、Elasticsearch のデータソースは単独の値を返す", - "timelion.help.querying.countTextPart2": "もサポートしています。最も便利なものには {min}、{max}、{avg}、{sum}、{cardinality} などがあります。{srcIp}フィールドのユニークカウントを求めたいとしましょう。{cardinality} メトリックを使うだけです: {esCardinalityQuery}{bytes}フィールドの平均を求めるには、{avg} メトリックが使えます: {esAvgQuery}", - "timelion.help.querying.countTitle": "カウントを超えて", - "timelion.help.querying.esAsteriskQueryDescriptionText": "Elasticsearch、デフォルトインデックスのすべてを計算", - "timelion.help.querying.esIndexQueryDescriptionText": "* を logstash-* インデックスの q (クエリ) として使用します", - "timelion.help.querying.luceneQueryLinkText": "Lucene クエリ文字列", - "timelion.help.querying.paragraph1": "Elasticsearch データソースが利用可能であることを確認済みなので、クエリの送信ができます。手始めに、インプットバーに {esPattern} と入力し Enter を押してみましょう。", - "timelion.help.querying.paragraph2Part1": "{esAsteriskQueryDescription} が返されます。サブセットを把握したい場合は、{htmlQuery} で {html} に一致するイベントをカウントしたり、{bobQuery} で {user} フィールドに {bob} を含み、{bytes} フィールドが 100 より大きな値のイベントを検索したりできます。このクエリはシングルクォートで囲まれています。スペースを含むためです。いずれかの", - "timelion.help.querying.paragraph2Part2": "を {esQuery} 関数の初めの引数として入力することができます。", - "timelion.help.querying.passingArgumentsText": "Timelion には一般的な操作を簡単に行えるよう、いくつものショートカットがあります。スペースや特殊文字を含まないシンプルな引数用のものがその一つで、クォートを使う必要はありません。また、多くの関数にデフォルトがあります。例えば、{esEmptyQuery} と {esStarQuery} の動作は同じです。引数には名前も付いているため、特定の順序で指定する必要はありません。例えば、{esLogstashQuery} と入力して Elasticsearch データソースに {esIndexQueryDescription} させることができます。", - "timelion.help.querying.passingArgumentsTitle": "引数の受け渡し", - "timelion.help.queryingTitle": "Elasticsearch データソースにクエリを実行中", - "timelion.help.unknownErrorMessage": "不明なエラー", - "timelion.help.welcome.content.emphasizedEverythingText": "すべて", - "timelion.help.welcome.content.functionReferenceLinkText": "関数リファレンスに移動", - "timelion.help.welcome.content.paragraph1": "Timelion は時系列に関する {emphasizedEverything} を司る、全知全能のツールです。データストアから提供された時系列データは、Timelion にお任せください。Timelion は複数データソースのデータセットを、覚えやすい式構文で比較、結合、整理できます。このチュートリアルは Elasticsearch が中心となりますが、ここで学んだことは Timelion がサポートするすべてのデータソースに適用できます。", - "timelion.help.welcome.content.paragraph2": "準備はいいですか？{strongNext} をクリックしてください。チュートリアルをスキップしてドキュメントを表示しますか？", - "timelion.help.welcome.content.strongNextText": "次へ", - "timelion.help.welcomeTitle": "{strongTimelionLabel} へようこそ！", - "timelion.intervals.customIntervalAriaLabel": "カスタム間隔", - "timelion.intervals.selectIntervalAriaLabel": "間隔を選択", - "timelion.noFunctionErrorMessage": "そのような関数はありません: {name}", - "timelion.panels.noRenderFunctionErrorMessage": "パネルにはレンダリング関数が必要です", - "timelion.panels.timechart.unknownIntervalErrorMessage": "不明な間隔", - "timelion.requestHandlerErrorTitle": "Timelion リクエストエラー", - "timelion.savedObjectFinder.addNewItemButtonLabel": "新規{item}を追加", - "timelion.savedObjectFinder.manageItemsButtonLabel": "{items}の管理", - "timelion.savedObjectFinder.noMatchesFoundDescription": "一致する{items}が見つかりません。", - "timelion.savedObjectFinder.pageItemsFromHitCountDescription": "{hitCount} 件中 {pageFirstItem}-{pageLastItem} 件目", - "timelion.savedObjectFinder.sortByButtonLabeAscendingScreenReaderOnly": "昇順", - "timelion.savedObjectFinder.sortByButtonLabeDescendingScreenReaderOnly": "降順", - "timelion.savedObjectFinder.sortByButtonLabel": "名前", - "timelion.savedObjectFinder.sortByButtonLabelScreenReaderOnly": "並べ替え基準", - "timelion.savedObjects.howToSaveAsNewDescription": "以前のバージョンの Kibana では、{savedObjectName} の名前を変更すると新しい名前でコピーが作成されました。現在のバージョンで同じように保存するには、［新規 {savedObjectName} として保存］チェックボックスを使用します。", - "timelion.savedObjects.saveAsNewLabel": "新規 {savedObjectName} として保存", - "timelion.saveExpression.successNotificationText": "保存された式「{title}」", - "timelion.saveSheet.successNotificationText": "保存されたシート「{title}」", - "timelion.search.submitAriaLabel": "検索", - "timelion.searchErrorTitle": "Timelion リクエストエラー", - "timelion.serverSideErrors.argumentsOverflowErrorMessage": "{functionName} に引き渡された引数が多すぎます", - "timelion.serverSideErrors.bucketsOverflowErrorMessage": "バケットの最高数を超過: {maxBuckets} 個中 {bucketCount} 個が使用できます。より広い間隔または短い期間を選択してください", - "timelion.serverSideErrors.colorFunction.colorNotProvidedErrorMessage": "色が指定されていません", - "timelion.serverSideErrors.conditionFunction.unknownOperatorErrorMessage": "不明な演算子", - "timelion.serverSideErrors.conditionFunction.wrongArgTypeErrorMessage": "数字または seriesList でなければなりません", - "timelion.serverSideErrors.esFunction.indexNotFoundErrorMessage": "Elasticsearch インデックス {index} が見つかりません", - "timelion.serverSideErrors.holtFunction.missingParamsErrorMessage": "シーズンの長さとサンプルサイズ >= 2 を指定する必要があります", - "timelion.serverSideErrors.holtFunction.notEnoughPointsErrorMessage": "二重指数平滑化を使用するには最低 2 つの点が必要です", - "timelion.serverSideErrors.movingaverageFunction.notValidPositionErrorMessage": "有効な配置: {validPositions}", - "timelion.serverSideErrors.movingstdFunction.notValidPositionErrorMessage": "有効な配置: {validPositions}", - "timelion.serverSideErrors.pointsFunction.notValidSymbolErrorMessage": "有効なシンボル: {validSymbols}", - "timelion.serverSideErrors.quandlFunction.unsupportedIntervalErrorMessage": "quandl() でサポートされていない間隔: {interval}. quandl() でサポートされている間隔: {intervals}", - "timelion.serverSideErrors.sheetParseErrorMessage": "予想: 文字 {column} で {expectedDescription}。", - "timelion.serverSideErrors.unknownArgumentErrorMessage": "{functionName} への不明な引数: {argumentName}", - "timelion.serverSideErrors.unknownArgumentTypeErrorMessage": "引数タイプがサポートされていません: {argument}", - "timelion.serverSideErrors.worldbankFunction.noDataErrorMessage": "Worldbank へのリクエストは成功しましたが、{code} のデータがありませんでした", - "timelion.serverSideErrors.wrongFunctionArgumentTypeErrorMessage": "{functionName} ({argumentName}) は {requiredTypes} の内の 1 つでなければなりません。{actualType} を入手", - "timelion.serverSideErrors.yaxisFunction.notSupportedUnitTypeErrorMessage": "{units} はサポートされているユニットタイプではありません。.", - "timelion.serverSideErrors.yaxisFunction.notValidCurrencyFormatErrorMessage": "通貨は 3 文字のコードでなければなりません", - "timelion.timelionDescription": "関数式で時系列チャートを作成します。", - "timelion.topNavMenu.addChartButtonAriaLabel": "チャートを追加", - "timelion.topNavMenu.addChartButtonLabel": "追加", - "timelion.topNavMenu.delete.modal.confirmButtonLabel": "削除", - "timelion.topNavMenu.delete.modal.successNotificationText": "「{title}」が削除されました", - "timelion.topNavMenu.delete.modal.warningText": "削除されたシートは復元できません。", - "timelion.topNavMenu.delete.modalTitle": "Timelion シート「{title}」を削除しますか？", - "timelion.topNavMenu.deleteSheetButtonAriaLabel": "現在のシートを削除", - "timelion.topNavMenu.deleteSheetButtonLabel": "削除", - "timelion.topNavMenu.helpButtonAriaLabel": "ヘルプ", - "timelion.topNavMenu.helpButtonLabel": "ヘルプ", - "timelion.topNavMenu.newSheetButtonAriaLabel": "新規シート", - "timelion.topNavMenu.newSheetButtonLabel": "新規", - "timelion.topNavMenu.openSheetButtonAriaLabel": "シートを開く", - "timelion.topNavMenu.openSheetButtonLabel": "開く", - "timelion.topNavMenu.openSheetTitle": "シートを開く", - "timelion.topNavMenu.options.columnsCountLabel": "列 (列カウントは 12 できっかりと割れる必要があります)", - "timelion.topNavMenu.options.rowsCountLabel": "行 (これは現在のウィンドウの縦の長さに基づく目標値です)。", - "timelion.topNavMenu.optionsButtonAriaLabel": "オプション", - "timelion.topNavMenu.optionsButtonLabel": "オプション", - "timelion.topNavMenu.save.saveAsDashboardPanel.inputPlaceholder": "このパネルに名前を付ける", - "timelion.topNavMenu.save.saveAsDashboardPanel.selectedExpressionLabel": "現在選択されている式", - "timelion.topNavMenu.save.saveAsDashboardPanel.submitButtonLabel": "保存", - "timelion.topNavMenu.save.saveAsDashboardPanelDescription": "Kibana ダッシュボードにチャートの追加が必要ですか？できます！このオプションは、現在選択されている式を、他のオブジェクトの追加と同じように Kibana ダッシュボードに追加可能なパネルとして保存します。他のパネルへのリファレンスが使用されている場合、リファレンスの表現を直接保存する表現にコピーして、リファレンスを削除する必要があります。他の表現式を保存するよう選択すrには、チャートをクリックします。", - "timelion.topNavMenu.save.saveAsDashboardPanelLabel": "式に名前を付けて保存", - "timelion.topNavMenu.save.saveAsDashboardPanelTitle": "現在の式を Kibana ダッシュボードのパネルとして保存", - "timelion.topNavMenu.save.saveEntireSheet.inputAriaLabel": "名前", - "timelion.topNavMenu.save.saveEntireSheet.inputPlaceholder": "このシートに名前を付ける…", - "timelion.topNavMenu.save.saveEntireSheet.submitButtonLabel": "保存", - "timelion.topNavMenu.save.saveEntireSheetDescription": "Timelion 式を主に Timelion アプリで使用し、Kibana のダッシュボードに Timelion のチャートを追加する必要がない場合は、このオプションを使用します。他のパネルへのリファレンスを使用する場合もこのオプションを使用します。", - "timelion.topNavMenu.save.saveEntireSheetLabel": "シートに名前を付けて保存", - "timelion.topNavMenu.save.saveEntireSheetTitle": "Timelion シート全体の保存", - "timelion.topNavMenu.saveSheetButtonAriaLabel": "シートを保存", - "timelion.topNavMenu.saveSheetButtonLabel": "保存", - "timelion.topNavMenu.sheetOptionsTitle": "シートオプション", - "timelion.topNavMenu.statsDescription": "クエリ時間 {queryTime}ms / 処理時間 {processingTime}ms", - "timelion.uiSettings.defaultColumnsDescription": "デフォルトの Timelion シートの列数です", - "timelion.uiSettings.defaultColumnsLabel": "デフォルトの列", - "timelion.uiSettings.defaultIndexDescription": "{esParam} で検索するデフォルトの Elasticsearch インデックスです", - "timelion.uiSettings.defaultIndexLabel": "デフォルトのインデックス", - "timelion.uiSettings.defaultRowsDescription": "デフォルトの Timelion シートの行数です", - "timelion.uiSettings.defaultRowsLabel": "デフォルトの行", - "timelion.uiSettings.experimentalLabel": "実験的", - "timelion.uiSettings.graphiteURLDescription": "{experimentalLabel}Graphite ホストの URL です", - "timelion.uiSettings.graphiteURLLabel": "Graphite URL", - "timelion.uiSettings.maximumBucketsDescription": "1 つのデータソースが返せるバケットの最大数です", - "timelion.uiSettings.maximumBucketsLabel": "バケットの最大数", - "timelion.uiSettings.minimumIntervalDescription": "「auto」を使用時に計算される最小の間隔です", - "timelion.uiSettings.minimumIntervalLabel": "最低間隔", - "timelion.uiSettings.quandlKeyDescription": "{experimentalLabel} www.quandl.com からの API キーです", - "timelion.uiSettings.quandlKeyLabel": "Quandl キー", - "timelion.uiSettings.showTutorialDescription": "Timelion アプリの起動時にデフォルトでチュートリアルを表示しますか？", - "timelion.uiSettings.showTutorialLabel": "チュートリアルを表示", - "timelion.uiSettings.targetBucketsDescription": "自動間隔の使用時に目標となるバケット数です。", - "timelion.uiSettings.targetBucketsLabel": "目標バケット数", - "timelion.uiSettings.timeFieldDescription": "{esParam} の使用時にタイムスタンプを含むデフォルトのフィールドです", - "timelion.uiSettings.timeFieldLabel": "時間フィールド", - "timelion.vis.expressionLabel": "Timelion 式", - "timelion.vis.interval.auto": "自動", - "timelion.vis.interval.day": "1日", - "timelion.vis.interval.hour": "1時間", - "timelion.vis.interval.minute": "1分", - "timelion.vis.interval.month": "1か月", - "timelion.vis.interval.second": "1秒", - "timelion.vis.interval.week": "1週間", - "timelion.vis.interval.year": "1年", - "timelion.vis.intervalLabel": "間隔", - "timelion.vis.invalidIntervalErrorMessage": "無効な間隔フォーマット。", - "timelion.vis.selectIntervalHelpText": "オプションを選択するかカスタム値を作成します。例30s、20m、24h、2d、1w、1M", - "timelion.vis.selectIntervalPlaceholder": "間隔を選択", - "uiActions.actionPanel.title": "オプション", - "uiActions.errors.incompatibleAction": "操作に互換性がありません", - "visDefaultEditor.advancedToggle.advancedLinkLabel": "高度な設定", - "visDefaultEditor.agg.disableAggButtonTooltip": "集約を無効にする", - "visDefaultEditor.agg.enableAggButtonTooltip": "集約を有効にする", - "visDefaultEditor.agg.errorsAriaLabel": "集約にエラーがあります", - "visDefaultEditor.agg.modifyPriorityButtonTooltip": "ドラッグして優先順位を変更します", - "visDefaultEditor.agg.removeDimensionButtonTooltip": "次元を削除", - "visDefaultEditor.agg.toggleEditorButtonAriaLabel": "{schema} エディターを切り替える", - "visDefaultEditor.aggAdd.addButtonLabel": "追加", - "visDefaultEditor.aggAdd.addGroupButtonLabel": "{groupNameLabel} を追加", - "visDefaultEditor.aggAdd.addSubGroupButtonLabel": "サブ {groupNameLabel} を追加", - "visDefaultEditor.aggAdd.bucketLabel": "バケット", - "visDefaultEditor.aggAdd.metricLabel": "メトリック", - "visDefaultEditor.aggParams.errors.aggWrongRunOrderErrorMessage": "「{schema}」集約は他のバケットの前に実行する必要があります！", - "visDefaultEditor.aggSelect.aggregationLabel": "集約", - "visDefaultEditor.aggSelect.helpLinkLabel": "{aggTitle}のヘルプ", - "visDefaultEditor.aggSelect.noCompatibleAggsDescription": "インデックスパターン{indexPatternTitle}には集約可能なフィールドが含まれていません。", - "visDefaultEditor.aggSelect.selectAggPlaceholder": "集約を選択してください", - "visDefaultEditor.aggSelect.subAggregationLabel": "サブ集約", - "visDefaultEditor.buckets.mustHaveBucketErrorMessage": "「日付ヒストグラム」または「ヒストグラム」集約のバケットを追加します。", - "visDefaultEditor.controls.aggNotValidLabel": "- 無効な集約 -", - "visDefaultEditor.controls.aggregateWith.noAggsErrorTooltip": "選択されたフィールドには互換性のある集約がありません。", - "visDefaultEditor.controls.aggregateWithLabel": "集約:", - "visDefaultEditor.controls.aggregateWithTooltip": "複数ヒットまたは複数値のフィールドを 1 つのメトリックにまとめる方法を選択します。", - "visDefaultEditor.controls.changePrecisionLabel": "マップズームの精度を変更", - "visDefaultEditor.controls.columnsLabel": "列", - "visDefaultEditor.controls.customMetricLabel": "カスタムメトリック", - "visDefaultEditor.controls.dateRanges.acceptedDateFormatsLinkText": "許容可能な日付形式", - "visDefaultEditor.controls.dateRanges.addRangeButtonLabel": "範囲を追加", - "visDefaultEditor.controls.dateRanges.errorMessage": "各範囲は1つ以上の有効な日付にしてください。", - "visDefaultEditor.controls.dateRanges.fromColumnLabel": "開始:", - "visDefaultEditor.controls.dateRanges.removeRangeButtonAriaLabel": "{from}から{to}の範囲を削除", - "visDefaultEditor.controls.dateRanges.toColumnLabel": "終了:", - "visDefaultEditor.controls.definiteMetricLabel": "メトリック: {metric}", - "visDefaultEditor.controls.dotSizeRatioHelpText": "最小の点から最大の点までの半径の比率を変更します。", - "visDefaultEditor.controls.dotSizeRatioLabel": "点サイズ率", - "visDefaultEditor.controls.dropPartialBucketsLabel": "不完全なバケットをドロップ", - "visDefaultEditor.controls.dropPartialBucketsTooltip": "時間範囲外にわたるバケットを削除してヒストグラムが不完全なバケットで開始・終了しないようにします。", - "visDefaultEditor.controls.extendedBounds.errorMessage": "最低値は最大値以下でなければなりません。", - "visDefaultEditor.controls.extendedBounds.maxLabel": "最高", - "visDefaultEditor.controls.extendedBounds.minLabel": "最低", - "visDefaultEditor.controls.extendedBoundsLabel": "拡張された境界", - "visDefaultEditor.controls.extendedBoundsTooltip": "最低値と最高値は結果を絞るのではなく、結果セットのバウンドを拡張します", - "visDefaultEditor.controls.field.fieldLabel": "フィールド", - "visDefaultEditor.controls.field.noCompatibleFieldsDescription": "インデックスパターン` {indexPatternTitle} に次の互換性のあるフィールドタイプが 1 つも含まれていません: {fieldTypes}", - "visDefaultEditor.controls.field.selectFieldPlaceholder": "フィールドの選択", - "visDefaultEditor.controls.filters.addFilterButtonLabel": "フィルターを追加します", - "visDefaultEditor.controls.filters.definiteFilterLabel": "{index} ラベルでフィルタリング", - "visDefaultEditor.controls.filters.filterLabel": "{index} でフィルタリング", - "visDefaultEditor.controls.filters.labelPlaceholder": "ラベル", - "visDefaultEditor.controls.filters.removeFilterButtonAriaLabel": "このフィルターを削除", - "visDefaultEditor.controls.filters.toggleFilterButtonAriaLabel": "フィルターラベルを切り替える", - "visDefaultEditor.controls.ipRanges.addRangeButtonLabel": "範囲を追加", - "visDefaultEditor.controls.ipRanges.cidrMaskAriaLabel": "CIDR マスク: {mask}", - "visDefaultEditor.controls.ipRanges.cidrMasksButtonLabel": "CIDR マスク", - "visDefaultEditor.controls.ipRanges.fromToButtonLabel": "開始/終了", - "visDefaultEditor.controls.ipRanges.ipRangeFromAriaLabel": "IP 範囲の開始値: {value}", - "visDefaultEditor.controls.ipRanges.ipRangeToAriaLabel": "IP 範囲の終了値: {value}", - "visDefaultEditor.controls.ipRanges.removeCidrMaskButtonAriaLabel": "{mask} の CIDR マスクの値を削除", - "visDefaultEditor.controls.ipRanges.removeEmptyCidrMaskButtonAriaLabel": "CIDR マスクのデフォルトの値を削除", - "visDefaultEditor.controls.ipRanges.removeRangeAriaLabel": "{from}から{to}の範囲を削除", - "visDefaultEditor.controls.ipRangesAriaLabel": "IP 範囲", - "visDefaultEditor.controls.jsonInputLabel": "JSON インプット", - "visDefaultEditor.controls.jsonInputTooltip": "ここに追加された JSON 形式のプロパティは、すべてこのセクションの Elasticsearch 集約定義に融合されます。用語集約における「shard_size」がその例です。", - "visDefaultEditor.controls.metricLabel": "メトリック", - "visDefaultEditor.controls.metrics.bucketTitle": "バケット", - "visDefaultEditor.controls.metrics.metricTitle": "メトリック", - "visDefaultEditor.controls.numberInterval.minimumIntervalLabel": "最低間隔", - "visDefaultEditor.controls.numberInterval.minimumIntervalTooltip": "入力された値により高度な設定の {histogramMaxBars} で指定されたよりも多くのバケットが作成される場合、間隔は自動的にスケーリングされます。", - "visDefaultEditor.controls.numberInterval.selectIntervalPlaceholder": "間隔を入力", - "visDefaultEditor.controls.numberList.addUnitButtonLabel": "{unitName} を追加", - "visDefaultEditor.controls.numberList.duplicateValueErrorMessage": "重複値。", - "visDefaultEditor.controls.numberList.enterValuePlaceholder": "値を入力", - "visDefaultEditor.controls.numberList.invalidAscOrderErrorMessage": "値は昇順になっていません。", - "visDefaultEditor.controls.numberList.invalidRangeErrorMessage": "値は {min} から {max} の範囲でなければなりません。", - "visDefaultEditor.controls.numberList.removeUnitButtonAriaLabel": "{value} のランク値を削除", - "visDefaultEditor.controls.onlyRequestDataAroundMapExtentLabel": "マップ範囲のデータのみリクエストしてください", - "visDefaultEditor.controls.onlyRequestDataAroundMapExtentTooltip": "geo_bounding_box フィルター集約を適用して、襟付きのマップビューボックスにサブジェクトエリアを絞ります", - "visDefaultEditor.controls.orderAgg.alphabeticalLabel": "アルファベット順", - "visDefaultEditor.controls.orderAgg.orderByLabel": "並び順", - "visDefaultEditor.controls.orderLabel": "順序", - "visDefaultEditor.controls.otherBucket.groupValuesLabel": "他の値を別のバケットにまとめる", - "visDefaultEditor.controls.otherBucket.groupValuesTooltip": "トップ N 以外の値はこのバケットにまとめられます。欠測値があるドキュメントを含めるには、「欠測値を表示」を有効にしてください。", - "visDefaultEditor.controls.otherBucket.showMissingValuesLabel": "欠測値を表示", - "visDefaultEditor.controls.otherBucket.showMissingValuesTooltip": "「文字列」タイプのフィールドにのみ使用できます。有効にすると、欠測値があるドキュメントが検索に含まれます。バケットがトップ N の場合、チャートに表示されます。トップ N ではなく、「他の値を別のバケットにまとえる」が有効な場合、Elasticsearch は欠測値を「他」のバケットに追加します。", - "visDefaultEditor.controls.percentileRanks.percentUnitNameText": "パーセント", - "visDefaultEditor.controls.percentileRanks.valuesLabel": "値", - "visDefaultEditor.controls.percentileRanks.valueUnitNameText": "値", - "visDefaultEditor.controls.percentiles.percentsLabel": "パーセント", - "visDefaultEditor.controls.placeMarkersOffGridLabel": "グリッド外にマーカーを配置 (ジオセントロイドを使用)", - "visDefaultEditor.controls.precisionLabel": "精度", - "visDefaultEditor.controls.ranges.addRangeButtonLabel": "範囲を追加", - "visDefaultEditor.controls.ranges.fromLabel": "開始:", - "visDefaultEditor.controls.ranges.greaterThanOrEqualPrepend": "≧", - "visDefaultEditor.controls.ranges.greaterThanOrEqualTooltip": "よりも大きいまたは等しい", - "visDefaultEditor.controls.ranges.lessThanPrepend": "<", - "visDefaultEditor.controls.ranges.lessThanTooltip": "より小さい", - "visDefaultEditor.controls.ranges.removeRangeButtonAriaLabel": "{from}から{to}の範囲を削除", - "visDefaultEditor.controls.ranges.toLabel": "終了:", - "visDefaultEditor.controls.rowsLabel": "行", - "visDefaultEditor.controls.scaleMetricsLabel": "メトリック値のスケーリング (非推奨)", - "visDefaultEditor.controls.scaleMetricsTooltip": "これを有効にすると、手動最低間隔を選択し、広い間隔が使用された場合、カウントと合計メトリックが手動で選択された間隔にスケーリングされます。", - "visDefaultEditor.controls.showEmptyBucketsLabel": "空のバケットを表示", - "visDefaultEditor.controls.showEmptyBucketsTooltip": "結果のあるバケットだけでなくすべてのバケットを表示します", - "visDefaultEditor.controls.sizeLabel": "サイズ", - "visDefaultEditor.controls.sizeTooltip": "トップ K のヒットをリクエスト。複数ヒットは「集約基準」でまとめられます。", - "visDefaultEditor.controls.sortOnLabel": "並べ替えオン", - "visDefaultEditor.controls.splitByLegend": "行または列でチャートを分割します。", - "visDefaultEditor.controls.timeInterval.createsTooLargeBucketsTooltip": "この間隔は、選択された時間範囲に表示するには大きすぎるバケットが作成されるため、にスケーリングされています。", - "visDefaultEditor.controls.timeInterval.createsTooManyBucketsTooltip": "この間隔は選択された時間範囲に表示しきれない数のバケットが作成されるため、にスケーリングされています。", - "visDefaultEditor.controls.timeInterval.invalidFormatErrorMessage": "無効な間隔フォーマット。", - "visDefaultEditor.controls.timeInterval.minimumIntervalLabel": "最低間隔", - "visDefaultEditor.controls.timeInterval.scaledHelpText": "現在 {bucketDescription} にスケーリングされています", - "visDefaultEditor.controls.timeInterval.selectIntervalPlaceholder": "間隔を選択", - "visDefaultEditor.controls.timeInterval.selectOptionHelpText": "オプションを選択するかカスタム値を作成します。例30s、20m、24h、2d、1w、1M", - "visDefaultEditor.editorConfig.dateHistogram.customInterval.helpText": "構成間隔の倍数でなければなりません: {interval}", - "visDefaultEditor.editorConfig.histogram.interval.helpText": "構成間隔の倍数でなければなりません: {interval}", - "visDefaultEditor.metrics.wrongLastBucketTypeErrorMessage": "「{type}」メトリック集約を使用する場合、最後のバケット集約は「Date Histogram」または「Histogram」でなければなりません。", - "visDefaultEditor.sidebar.autoApplyChangesAriaLabel": "エディターの変更を自動適用します", - "visDefaultEditor.sidebar.autoApplyChangesOffLabel": "自動適用がオフです", - "visDefaultEditor.sidebar.autoApplyChangesOnLabel": "自動適用がオンです", - "visDefaultEditor.sidebar.autoApplyChangesTooltip": "変更されるごとにビジュアライゼーションを自動的に更新します。", - "visDefaultEditor.sidebar.collapseButtonAriaLabel": "サイドバーを切り替える", - "visDefaultEditor.sidebar.discardChangesButtonLabel": "破棄", - "visDefaultEditor.sidebar.errorButtonTooltip": "ハイライトされたフィールドのエラーを解決する必要があります。", - "visDefaultEditor.sidebar.indexPatternAriaLabel": "インデックスパターン: {title}", - "visDefaultEditor.sidebar.savedSearch.goToDiscoverButtonText": "Discover にこの検索を表示", - "visDefaultEditor.sidebar.savedSearch.linkButtonAriaLabel": "保存された検索へのリンク。クリックして詳細を確認するかリンクを解除します。", - "visDefaultEditor.sidebar.savedSearch.popoverHelpText": "保存したこの検索に今後加える修正は、ビジュアライゼーションに反映されます。自動更新を無効にするには、リンクを削除します。", - "visDefaultEditor.sidebar.savedSearch.popoverTitle": "保存された検索にリンクされています", - "visDefaultEditor.sidebar.savedSearch.titleAriaLabel": "保存された検索: {title}", - "visDefaultEditor.sidebar.savedSearch.unlinkSavedSearchButtonText": "保存された検索へのリンクを削除", - "visDefaultEditor.sidebar.tabs.dataLabel": "データ", - "visDefaultEditor.sidebar.tabs.optionsLabel": "オプション", - "visDefaultEditor.sidebar.updateChartButtonLabel": "更新", - "visTypeMarkdown.function.font.help": "フォント設定です。", - "visTypeMarkdown.function.help": "マークダウンビジュアライゼーション", - "visTypeMarkdown.function.markdown.help": "レンダリングするマークダウン", - "visTypeMarkdown.function.openLinksInNewTab.help": "新規タブでリンクを開きます", - "visTypeMarkdown.markdownDescription": "マークダウン構文でドキュメントを作成します", - "visTypeMarkdown.params.fontSizeLabel": "ポイント単位のベースフォントサイズです。", - "visTypeMarkdown.params.helpLinkLabel": "ヘルプ", - "visTypeMarkdown.params.openLinksLabel": "新規タブでリンクを開く", - "visTypeMarkdown.tabs.dataText": "データ", - "visTypeMarkdown.tabs.optionsText": "オプション", - "visTypeMetric.colorModes.backgroundOptionLabel": "背景", - "visTypeMetric.colorModes.labelsOptionLabel": "ラベル", - "visTypeMetric.colorModes.noneOptionLabel": "なし", - "visTypeMetric.function.bgFill.help": "html 16 進数コード (#123456)、html 色 (red、blue)、または rgba 値 (rgba(255,255,255,1))。", - "visTypeMetric.function.bucket.help": "バケットディメンションの構成です。", - "visTypeMetric.function.colorMode.help": "色を変更するメトリックの部分", - "visTypeMetric.function.colorRange.help": "別の色が適用される値のグループを指定する範囲オブジェクト。", - "visTypeMetric.function.colorSchema.help": "使用する配色", - "visTypeMetric.function.font.help": "フォント設定です。", - "visTypeMetric.function.help": "メトリックビジュアライゼーション", - "visTypeMetric.function.invertColors.help": "色範囲を反転します", - "visTypeMetric.function.metric.help": "メトリックディメンションの構成です。", - "visTypeMetric.function.percentageMode.help": "百分率モードでメトリックを表示します。colorRange を設定する必要があります。", - "visTypeMetric.function.showLabels.help": "メトリック値の下にラベルを表示します。", - "visTypeMetric.function.subText.help": "メトリックの下に表示するカスタムテキスト", - "visTypeMetric.function.useRanges.help": "有効な色範囲です。", - "visTypeMetric.metricDescription": "計算結果を単独の数字として表示します。", - "visTypeMetric.metricTitle": "メトリック", - "visTypeMetric.params.color.useForLabel": "使用する色", - "visTypeMetric.params.percentageModeLabel": "パーセンテージモード", - "visTypeMetric.params.rangesTitle": "範囲", - "visTypeMetric.params.settingsTitle": "設定", - "visTypeMetric.params.showTitleLabel": "タイトルを表示", - "visTypeMetric.params.style.fontSizeLabel": "ポイント単位のメトリックフォントサイズ", - "visTypeMetric.params.style.styleTitle": "スタイル", - "visTypeMetric.schemas.metricTitle": "メトリック", - "visTypeMetric.schemas.splitGroupTitle": "グループを分割", - "visTypeTable.aggTable.exportLabel": "エクスポート:", - "visTypeTable.aggTable.formattedLabel": "フォーマット済み", - "visTypeTable.aggTable.rawLabel": "生", - "visTypeTable.directives.tableCellFilter.filterForValueTooltip": "値でフィルタリング", - "visTypeTable.directives.tableCellFilter.filterOutValueTooltip": "値を除外", - "visTypeTable.function.help": "表ビジュアライゼーション", - "visTypeTable.params.defaultPercentageCol": "非表示", - "visTypeTable.params.PercentageColLabel": "パーセンテージ列", - "visTypeTable.params.percentageTableColumnName": "{title} パーセント", - "visTypeTable.params.perPageLabel": "ページごとの行数", - "visTypeTable.params.showMetricsLabel": "すべてのバケット/レベルのメトリックを表示", - "visTypeTable.params.showPartialRowsLabel": "部分的な行を表示", - "visTypeTable.params.showPartialRowsTip": "部分データのある行を表示。表示されていなくてもすべてのバケット/レベルのメトリックが計算されます。", - "visTypeTable.params.showTotalLabel": "合計を表示", - "visTypeTable.params.totalFunctionLabel": "合計機能", - "visTypeTable.tableVisDescription": "テーブルに値を表示します。", - "visTypeTable.tableVisEditorConfig.schemas.bucketTitle": "行を分割", - "visTypeTable.tableVisEditorConfig.schemas.metricTitle": "メトリック", - "visTypeTable.tableVisEditorConfig.schemas.splitTitle": "テーブルを分割", - "visTypeTable.tableVisTitle": "データテーブル", - "visTypeTable.totalAggregations.averageText": "平均", - "visTypeTable.totalAggregations.countText": "カウント", - "visTypeTable.totalAggregations.maxText": "最高", - "visTypeTable.totalAggregations.minText": "最低", - "visTypeTable.totalAggregations.sumText": "合計", - "visTypeTable.vis.noResultsFoundTitle": "結果が見つかりませんでした", - "visTypeTagCloud.feedbackMessage.tooSmallContainerDescription": "コンテナーが小さすぎてクラウド全体を表示できません。タグが切り取られたか省略されている可能性があります。", - "visTypeTagCloud.feedbackMessage.truncatedTagsDescription": "描写時間が長くなるのを防ぐため、タグの数が切り捨てられています。", - "visTypeTagCloud.function.bucket.help": "バケットディメンションの構成です。", - "visTypeTagCloud.function.help": "タグクラウドのビジュアライゼーションです。", - "visTypeTagCloud.function.metric.help": "メトリックディメンションの構成です。", - "visTypeTagCloud.function.orientation.help": "タグクラウド内の単語の方向です。", - "visTypeTagCloud.function.scale.help": "単語のフォントサイズを決定するスケールです", - "visTypeTagCloud.vis.editorConfig.orientations.multipleText": "複数", - "visTypeTagCloud.vis.editorConfig.orientations.rightAngledText": "直角", - "visTypeTagCloud.vis.editorConfig.orientations.singleText": "単一", - "visTypeTagCloud.vis.editorConfig.scales.linearText": "直線", - "visTypeTagCloud.vis.editorConfig.scales.logText": "ログ", - "visTypeTagCloud.vis.editorConfig.scales.squareRootText": "平方根", - "visTypeTagCloud.vis.schemas.metricTitle": "タグサイズ", - "visTypeTagCloud.vis.schemas.segmentTitle": "タグ", - "visTypeTagCloud.vis.tagCloudDescription": "重要度に基づき大きさを変えた単語のグループ表示です。", - "visTypeTagCloud.vis.tagCloudTitle": "タグクラウド", - "visTypeTagCloud.visParams.fontSizeLabel": "フォントサイズ範囲 (ピクセル)", - "visTypeTagCloud.visParams.orientationsLabel": "方向", - "visTypeTagCloud.visParams.showLabelToggleLabel": "ラベルを表示", - "visTypeTagCloud.visParams.textScaleLabel": "テキストスケール", - "visTypeTimeseries.addDeleteButtons.addButtonDefaultTooltip": "追加", - "visTypeTimeseries.addDeleteButtons.cloneButtonDefaultTooltip": "クローンを作成", - "visTypeTimeseries.addDeleteButtons.deleteButtonDefaultTooltip": "削除", - "visTypeTimeseries.addDeleteButtons.reEnableTooltip": "再度有効にする", - "visTypeTimeseries.addDeleteButtons.temporarilyDisableTooltip": "一時的に無効にする", - "visTypeTimeseries.aggLookup.averageLabel": "平均", - "visTypeTimeseries.aggLookup.calculationLabel": "計算", - "visTypeTimeseries.aggLookup.cardinalityLabel": "基数", - "visTypeTimeseries.aggLookup.countLabel": "カウント", - "visTypeTimeseries.aggLookup.cumulativeSumLabel": "累積合計", - "visTypeTimeseries.aggLookup.derivativeLabel": "派生", - "visTypeTimeseries.aggLookup.deviationLabel": "標準偏差", - "visTypeTimeseries.aggLookup.filterRatioLabel": "フィルターレート", - "visTypeTimeseries.aggLookup.mathLabel": "数学処理", - "visTypeTimeseries.aggLookup.maxLabel": "最高", - "visTypeTimeseries.aggLookup.minLabel": "最低", - "visTypeTimeseries.aggLookup.movingAverageLabel": "移動平均", - "visTypeTimeseries.aggLookup.overallAverageLabel": "全体平均", - "visTypeTimeseries.aggLookup.overallMaxLabel": "全体最高", - "visTypeTimeseries.aggLookup.overallMinLabel": "全体最低", - "visTypeTimeseries.aggLookup.overallStdDeviationLabel": "全体標準偏差", - "visTypeTimeseries.aggLookup.overallSumLabel": "全体合計", - "visTypeTimeseries.aggLookup.overallSumOfSqLabel": "全体平方和", - "visTypeTimeseries.aggLookup.overallVarianceLabel": "全体の相異", - "visTypeTimeseries.aggLookup.percentileLabel": "パーセンタイル", - "visTypeTimeseries.aggLookup.percentileRankLabel": "パーセンタイルランク", - "visTypeTimeseries.aggLookup.positiveOnlyLabel": "プラスのみ", - "visTypeTimeseries.aggLookup.serialDifferenceLabel": "連続差", - "visTypeTimeseries.aggLookup.seriesAggLabel": "数列集約", - "visTypeTimeseries.aggLookup.staticValueLabel": "不動値", - "visTypeTimeseries.aggLookup.sumLabel": "合計", - "visTypeTimeseries.aggLookup.sumOfSqLabel": "平方和", - "visTypeTimeseries.aggLookup.topHitLabel": "トップヒット", - "visTypeTimeseries.aggLookup.valueCountLabel": "値カウント", - "visTypeTimeseries.aggLookup.varianceLabel": "相異", - "visTypeTimeseries.aggRow.addMetricButtonTooltip": "メトリックを追加", - "visTypeTimeseries.aggRow.deleteMetricButtonTooltip": "メトリックを削除", - "visTypeTimeseries.aggSelect.aggGroups.metricAggLabel": "メトリック集約", - "visTypeTimeseries.aggSelect.aggGroups.parentPipelineAggLabel": "親パイプライン集約", - "visTypeTimeseries.aggSelect.aggGroups.siblingPipelineAggLabel": "シブリングパイプライン集約", - "visTypeTimeseries.aggSelect.aggGroups.specialAggLabel": "特殊集約", - "visTypeTimeseries.aggSelect.metricsAggs.averageLabel": "平均", - "visTypeTimeseries.aggSelect.metricsAggs.cardinalityLabel": "基数", - "visTypeTimeseries.aggSelect.metricsAggs.countLabel": "カウント", - "visTypeTimeseries.aggSelect.metricsAggs.filterRatioLabel": "フィルターレート", - "visTypeTimeseries.aggSelect.metricsAggs.maxLabel": "最高", - "visTypeTimeseries.aggSelect.metricsAggs.minLabel": "最低", - "visTypeTimeseries.aggSelect.metricsAggs.percentileLabel": "パーセンタイル", - "visTypeTimeseries.aggSelect.metricsAggs.percentileRankLabel": "パーセンタイルランク", - "visTypeTimeseries.aggSelect.metricsAggs.staticValueLabel": "不動値", - "visTypeTimeseries.aggSelect.metricsAggs.stdDeviationLabel": "標準偏差", - "visTypeTimeseries.aggSelect.metricsAggs.sumLabel": "合計", - "visTypeTimeseries.aggSelect.metricsAggs.sumOfSquaresLabel": "平方和", - "visTypeTimeseries.aggSelect.metricsAggs.topHitLabel": "トップヒット", - "visTypeTimeseries.aggSelect.metricsAggs.valueCountLabel": "値カウント", - "visTypeTimeseries.aggSelect.metricsAggs.varianceLabel": "相異", - "visTypeTimeseries.aggSelect.pipelineAggs.bucketScriptLabel": "バケットスクリプト", - "visTypeTimeseries.aggSelect.pipelineAggs.cumulativeSumLabel": "累積合計", - "visTypeTimeseries.aggSelect.pipelineAggs.derivativeLabel": "派生", - "visTypeTimeseries.aggSelect.pipelineAggs.movingAverageLabel": "移動平均", - "visTypeTimeseries.aggSelect.pipelineAggs.positiveOnlyLabel": "プラスのみ", - "visTypeTimeseries.aggSelect.pipelineAggs.serialDifferenceLabel": "連続差", - "visTypeTimeseries.aggSelect.selectAggPlaceholder": "集約を選択", - "visTypeTimeseries.aggSelect.siblingAggs.overallAverageLabel": "全体平均", - "visTypeTimeseries.aggSelect.siblingAggs.overallMaxLabel": "全体最高", - "visTypeTimeseries.aggSelect.siblingAggs.overallMinLabel": "全体最低", - "visTypeTimeseries.aggSelect.siblingAggs.overallStdDeviationLabel": "全体標準偏差", - "visTypeTimeseries.aggSelect.siblingAggs.overallSumLabel": "全体合計", - "visTypeTimeseries.aggSelect.siblingAggs.overallSumOfSquaresLabel": "全体平方和", - "visTypeTimeseries.aggSelect.siblingAggs.overallVarianceLabel": "全体の相異", - "visTypeTimeseries.aggSelect.specialAggs.mathLabel": "数学処理", - "visTypeTimeseries.aggSelect.specialAggs.seriesAggLabel": "数列集約", - "visTypeTimeseries.annotationsEditor.addDataSourceButtonLabel": "データソースを追加", - "visTypeTimeseries.annotationsEditor.dataSourcesLabel": "データソース", - "visTypeTimeseries.annotationsEditor.fieldsLabel": "フィールド (必須 - コンマ区切りのパス)", - "visTypeTimeseries.annotationsEditor.howToCreateAnnotationDataSourceDescription": "下のボタンをクリックして注釈データソースを作成します。", - "visTypeTimeseries.annotationsEditor.iconLabel": "アイコン (必須)", - "visTypeTimeseries.annotationsEditor.ignoreGlobalFiltersLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.annotationsEditor.ignorePanelFiltersLabel": "パネルフィルターを無視しますか？", - "visTypeTimeseries.annotationsEditor.indexPatternLabel": "インデックスパターン (必須)", - "visTypeTimeseries.annotationsEditor.queryStringLabel": "クエリ文字列", - "visTypeTimeseries.annotationsEditor.rowTemplateHelpText": "例: {rowTemplateExample}", - "visTypeTimeseries.annotationsEditor.rowTemplateLabel": "行テンプレート (必須)", - "visTypeTimeseries.annotationsEditor.timeFieldLabel": "時間フィールド (必須)", - "visTypeTimeseries.axisLabelOptions.axisLabel": "{unitValue} {unitString} ごと", - "visTypeTimeseries.calculateLabel.bucketScriptsLabel": "バケットスクリプト", - "visTypeTimeseries.calculateLabel.countLabel": "カウント", - "visTypeTimeseries.calculateLabel.filterRatioLabel": "フィルターレート", - "visTypeTimeseries.calculateLabel.lookupMetricTypeOfMetricFieldRankLabel": "{metricField} 中 {lookupMetricType}", - "visTypeTimeseries.calculateLabel.lookupMetricTypeOfTargetLabel": "{targetLabel} 中 {lookupMetricType}", - "visTypeTimeseries.calculateLabel.lookupMetricTypeOfTargetWithAdditionalLabel": "{targetLabel} ({additionalLabel}) 中 {lookupMetricType}", - "visTypeTimeseries.calculateLabel.mathLabel": "数学処理", - "visTypeTimeseries.calculateLabel.seriesAggLabel": "数列集約 ({metricFunction})", - "visTypeTimeseries.calculateLabel.staticValueLabel": "{metricValue} の不動値", - "visTypeTimeseries.calculateLabel.unknownLabel": "不明", - "visTypeTimeseries.calculation.aggregationLabel": "集約", - "visTypeTimeseries.calculation.painlessScriptDescription": "変数は {params} オブジェクトのキー、すなわち {paramsName} です。バケット間隔 (ミリ秒単位) にアクセスするには {paramsInterval} を使用します。", - "visTypeTimeseries.calculation.painlessScriptLabel": "Painless スクリプト", - "visTypeTimeseries.calculation.variablesLabel": "変数", - "visTypeTimeseries.colorPicker.clearIconLabel": "クリア", - "visTypeTimeseries.colorPicker.notAccessibleAriaLabel": "カラーピッカー、アクセス不可", - "visTypeTimeseries.colorPicker.notAccessibleWithValueAriaLabel": "カラーピッカー ({value})、アクセス不可", - "visTypeTimeseries.colorRules.adjustChartSizeAriaLabel": "上下の矢印を押してチャートサイズを調整します", - "visTypeTimeseries.colorRules.defaultPrimaryNameLabel": "背景", - "visTypeTimeseries.colorRules.defaultSecondaryNameLabel": "テキスト", - "visTypeTimeseries.colorRules.greaterThanLabel": "> greater than", - "visTypeTimeseries.colorRules.greaterThanOrEqualLabel": ">= greater than or equal", - "visTypeTimeseries.colorRules.ifMetricIsLabel": "メトリックが", - "visTypeTimeseries.colorRules.lessThanLabel": "< less than", - "visTypeTimeseries.colorRules.lessThanOrEqualLabel": "<= less than or equal", - "visTypeTimeseries.colorRules.setPrimaryColorLabel": "{primaryName} を", - "visTypeTimeseries.colorRules.setSecondaryColorLabel": "、{secondaryName} を", - "visTypeTimeseries.colorRules.valueAriaLabel": "値", - "visTypeTimeseries.cumulativeSum.aggregationLabel": "集約", - "visTypeTimeseries.cumulativeSum.metricLabel": "メトリック", - "visTypeTimeseries.dataFormatPicker.bytesLabel": "バイト", - "visTypeTimeseries.dataFormatPicker.customLabel": "カスタム", - "visTypeTimeseries.dataFormatPicker.decimalPlacesLabel": "小数部分の桁数", - "visTypeTimeseries.dataFormatPicker.durationLabel": "期間", - "visTypeTimeseries.dataFormatPicker.formatStringHelpText": "{numeralJsLink} をご覧ください", - "visTypeTimeseries.dataFormatPicker.formatStringLabel": "フォーマット文字列", - "visTypeTimeseries.dataFormatPicker.fromLabel": "開始値:", - "visTypeTimeseries.dataFormatPicker.numberLabel": "数字", - "visTypeTimeseries.dataFormatPicker.percentLabel": "パーセント", - "visTypeTimeseries.dataFormatPicker.toLabel": "To", - "visTypeTimeseries.defaultDataFormatterLabel": "データフォーマッター", - "visTypeTimeseries.derivative.aggregationLabel": "集約", - "visTypeTimeseries.derivative.metricLabel": "メトリック", - "visTypeTimeseries.derivative.unitsLabel": "単位 (1s、1m など)", - "visTypeTimeseries.durationOptions.daysLabel": "日", - "visTypeTimeseries.durationOptions.hoursLabel": "時間", - "visTypeTimeseries.durationOptions.humanize": "人間に読解可能", - "visTypeTimeseries.durationOptions.microsecondsLabel": "マイクロ秒", - "visTypeTimeseries.durationOptions.millisecondsLabel": "ミリ秒", - "visTypeTimeseries.durationOptions.minutesLabel": "分", - "visTypeTimeseries.durationOptions.monthsLabel": "か月", - "visTypeTimeseries.durationOptions.nanosecondsLabel": "ナノ秒", - "visTypeTimeseries.durationOptions.picosecondsLabel": "ピコ秒", - "visTypeTimeseries.durationOptions.secondsLabel": "秒", - "visTypeTimeseries.durationOptions.weeksLabel": "週間", - "visTypeTimeseries.durationOptions.yearsLabel": "年", - "visTypeTimeseries.error.requestForPanelFailedErrorMessage": "このパネルのリクエストに失敗しました", - "visTypeTimeseries.fetchFields.loadIndexPatternFieldsErrorMessage": "index_pattern フィールドを読み込めません", - "visTypeTimeseries.fieldSelect.selectFieldPlaceholder": "フィールドを選択してください...", - "visTypeTimeseries.filterRatio.aggregationLabel": "集約", - "visTypeTimeseries.filterRatio.denominatorLabel": "分母", - "visTypeTimeseries.filterRatio.fieldLabel": "フィールド", - "visTypeTimeseries.filterRatio.metricAggregationLabel": "メトリック集約", - "visTypeTimeseries.filterRatio.numeratorLabel": "分子", - "visTypeTimeseries.function.help": "TSVB ビジュアライゼーション", - "visTypeTimeseries.gauge.dataTab.dataButtonLabel": "データ", - "visTypeTimeseries.gauge.dataTab.metricsButtonLabel": "メトリック", - "visTypeTimeseries.gauge.editor.addSeriesTooltip": "数列を追加", - "visTypeTimeseries.gauge.editor.cloneSeriesTooltip": "数列のクローンを作成", - "visTypeTimeseries.gauge.editor.deleteSeriesTooltip": "数列を削除", - "visTypeTimeseries.gauge.editor.labelPlaceholder": "ラベル", - "visTypeTimeseries.gauge.editor.toggleEditorAriaLabel": "数列エディターを切り替える", - "visTypeTimeseries.gauge.optionsTab.backgroundColorLabel": "背景色:", - "visTypeTimeseries.gauge.optionsTab.colorRulesLabel": "カラールール", - "visTypeTimeseries.gauge.optionsTab.dataLabel": "データ", - "visTypeTimeseries.gauge.optionsTab.gaugeLineWidthLabel": "ゲージ線の幅", - "visTypeTimeseries.gauge.optionsTab.gaugeMaxLabel": "ゲージ最大値 (自動は未入力)", - "visTypeTimeseries.gauge.optionsTab.gaugeStyleLabel": "ゲージスタイル", - "visTypeTimeseries.gauge.optionsTab.ignoreGlobalFilterLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.gauge.optionsTab.innerColorLabel": "内側の色:", - "visTypeTimeseries.gauge.optionsTab.innerLineWidthLabel": "内側の線の幅", - "visTypeTimeseries.gauge.optionsTab.optionsButtonLabel": "オプション", - "visTypeTimeseries.gauge.optionsTab.panelFilterLabel": "パネルフィルター", - "visTypeTimeseries.gauge.optionsTab.panelOptionsButtonLabel": "パネルオプション", - "visTypeTimeseries.gauge.optionsTab.styleLabel": "スタイル", - "visTypeTimeseries.gauge.styleOptions.circleLabel": "円", - "visTypeTimeseries.gauge.styleOptions.halfCircleLabel": "半円", - "visTypeTimeseries.getInterval.daysLabel": "日", - "visTypeTimeseries.getInterval.hoursLabel": "時間", - "visTypeTimeseries.getInterval.minutesLabel": "分", - "visTypeTimeseries.getInterval.monthsLabel": "か月", - "visTypeTimeseries.getInterval.secondsLabel": "秒", - "visTypeTimeseries.getInterval.weeksLabel": "週間", - "visTypeTimeseries.getInterval.yearsLabel": "年", - "visTypeTimeseries.iconSelect.asteriskLabel": "アスタリスク", - "visTypeTimeseries.iconSelect.bellLabel": "ベル", - "visTypeTimeseries.iconSelect.boltLabel": "ボルト", - "visTypeTimeseries.iconSelect.bombLabel": "ボム", - "visTypeTimeseries.iconSelect.bugLabel": "バグ", - "visTypeTimeseries.iconSelect.commentLabel": "コメント", - "visTypeTimeseries.iconSelect.exclamationCircleLabel": "マル感嘆符", - "visTypeTimeseries.iconSelect.exclamationTriangleLabel": "注意三角マーク", - "visTypeTimeseries.iconSelect.fireLabel": "炎", - "visTypeTimeseries.iconSelect.flagLabel": "旗", - "visTypeTimeseries.iconSelect.heartLabel": "ハート", - "visTypeTimeseries.iconSelect.mapMarkerLabel": "マップマーカー", - "visTypeTimeseries.iconSelect.mapPinLabel": "マップピン", - "visTypeTimeseries.iconSelect.starLabel": "星", - "visTypeTimeseries.iconSelect.tagLabel": "タグ", - "visTypeTimeseries.indexPattern.dropLastBucketLabel": "最後のバケットをドロップしますか？", - "visTypeTimeseries.indexPattern.intervalHelpText": "例: auto、1m、1d、7d、1y、>=1m", - "visTypeTimeseries.indexPattern.intervalLabel": "間隔", - "visTypeTimeseries.indexPattern.searchByDefaultIndex": "デフォルトのインデックスパターンが使用されています。すべてのインデックスにクエリを実行するには * を使用します", - "visTypeTimeseries.indexPattern.timeFieldLabel": "時間フィールド", - "visTypeTimeseries.indexPattern.timeRange.entireTimeRange": "時間範囲全体", - "visTypeTimeseries.indexPattern.timeRange.hint": "この設定は、一致するドキュメントに使用される期間をコントロールします。\n 「時間範囲全体」は、タイムピッカーで選択されたすべてのドキュメントと照会します。\n 「最終値」は、期間の終了時から指定期間のドキュメントのみと照会します。", - "visTypeTimeseries.indexPattern.timeRange.label": "データ期間モード", - "visTypeTimeseries.indexPattern.timeRange.lastValue": "最終値", - "visTypeTimeseries.indexPattern.timeRange.selectTimeRange": "選択してください", - "visTypeTimeseries.indexPatternLabel": "インデックスパターン", - "visTypeTimeseries.kbnVisTypes.metricsDescription": "ビジュアルパイプラインインターフェースを使用して時系列のチャートを作成します。", - "visTypeTimeseries.kbnVisTypes.metricsTitle": "TSVB", - "visTypeTimeseries.markdown.alignOptions.bottomLabel": "一番下", - "visTypeTimeseries.markdown.alignOptions.middleLabel": "真ん中", - "visTypeTimeseries.markdown.alignOptions.topLabel": "一番上", - "visTypeTimeseries.markdown.dataTab.dataButtonLabel": "データ", - "visTypeTimeseries.markdown.dataTab.metricsButtonLabel": "メトリック", - "visTypeTimeseries.markdown.editor.addSeriesTooltip": "数列を追加", - "visTypeTimeseries.markdown.editor.cloneSeriesTooltip": "数列のクローンを作成", - "visTypeTimeseries.markdown.editor.deleteSeriesTooltip": "数列を削除", - "visTypeTimeseries.markdown.editor.labelPlaceholder": "ラベル", - "visTypeTimeseries.markdown.editor.toggleEditorAriaLabel": "数列エディターを切り替える", - "visTypeTimeseries.markdown.editor.variableNamePlaceholder": "変数名", - "visTypeTimeseries.markdown.optionsTab.backgroundColorLabel": "背景色:", - "visTypeTimeseries.markdown.optionsTab.customCSSLabel": "カスタム CSS (Less をサポート)", - "visTypeTimeseries.markdown.optionsTab.dataLabel": "データ", - "visTypeTimeseries.markdown.optionsTab.ignoreGlobalFilterLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.markdown.optionsTab.openLinksInNewTab": "新規タブでリンクを開きますか？", - "visTypeTimeseries.markdown.optionsTab.optionsButtonLabel": "オプション", - "visTypeTimeseries.markdown.optionsTab.panelFilterLabel": "パネルフィルター", - "visTypeTimeseries.markdown.optionsTab.panelOptionsButtonLabel": "パネルオプション", - "visTypeTimeseries.markdown.optionsTab.showScrollbarsLabel": "スクロールバーを表示しますか？", - "visTypeTimeseries.markdown.optionsTab.styleLabel": "スタイル", - "visTypeTimeseries.markdown.optionsTab.verticalAlignmentLabel": "縦の配列:", - "visTypeTimeseries.markdownEditor.howToAccessEntireTreeDescription": "{all} という特殊な変数もあり、ツリー全体へのアクセスに使用できます。これは group by からデータのリストを作成する際に便利です:", - "visTypeTimeseries.markdownEditor.howToUseVariablesInMarkdownDescription": "次の変数は Markdown で Handlebar (mustache) 構文を使用して使用できます。利用可能な表現は {handlebarLink} をご覧ください。", - "visTypeTimeseries.markdownEditor.howUseVariablesInMarkdownDescription.documentationLinkText": "ドキュメンテーションはここをクリックしてください", - "visTypeTimeseries.markdownEditor.nameLabel": "名前", - "visTypeTimeseries.markdownEditor.noVariablesAvailableDescription": "選択されたデータメトリックに利用可能な変数はありません。", - "visTypeTimeseries.markdownEditor.valueLabel": "値", - "visTypeTimeseries.math.aggregationLabel": "集約", - "visTypeTimeseries.math.expressionDescription": "このフィールドは基本的な数学表現 ({link} を参照) を使用します。つまり、変数は {params} オブジェクトのキーです。{paramsName} すべてのデータにアクセスするには、値の配列には {paramsValues} を使い、タイムスタンプの配列には {paramsTimestamps} を使います。{paramsTimestamp} は現在のバケットのタイムスタンプに使用でき、{paramsIndex} は現在のバケットのインデックスに使用でき、{paramsInterval} はミリ秒単位での間隔に使用できます。", - "visTypeTimeseries.math.expressionDescription.tinyMathLinkText": "TinyMath", - "visTypeTimeseries.math.expressionLabel": "表現", - "visTypeTimeseries.math.variablesLabel": "変数", - "visTypeTimeseries.metric.dataTab.dataButtonLabel": "データ", - "visTypeTimeseries.metric.dataTab.metricsButtonLabel": "メトリック", - "visTypeTimeseries.metric.editor.addSeriesTooltip": "数列を追加", - "visTypeTimeseries.metric.editor.cloneSeriesTooltip": "数列のクローンを作成", - "visTypeTimeseries.metric.editor.deleteSeriesTooltip": "数列を削除", - "visTypeTimeseries.metric.editor.labelPlaceholder": "ラベル", - "visTypeTimeseries.metric.editor.toggleEditorAriaLabel": "数列エディターを切り替える", - "visTypeTimeseries.metric.optionsTab.colorRulesLabel": "カラールール", - "visTypeTimeseries.metric.optionsTab.dataLabel": "データ", - "visTypeTimeseries.metric.optionsTab.ignoreGlobalFilterLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.metric.optionsTab.optionsButtonLabel": "オプション", - "visTypeTimeseries.metric.optionsTab.panelFilterLabel": "パネルフィルター", - "visTypeTimeseries.metric.optionsTab.panelOptionsButtonLabel": "パネルオプション", - "visTypeTimeseries.metricMissingErrorMessage": "メトリックに {field} がありません", - "visTypeTimeseries.metricSelect.selectMetricPlaceholder": "メトリックを選択してください…", - "visTypeTimeseries.missingPanelConfigDescription": "「{modelType}」にパネル構成が欠けています", - "visTypeTimeseries.movingAverage.aggregationLabel": "集約", - "visTypeTimeseries.movingAverage.alpha": "アルファ", - "visTypeTimeseries.movingAverage.beta": "ベータ", - "visTypeTimeseries.movingAverage.gamma": "ガンマ", - "visTypeTimeseries.movingAverage.metricLabel": "メトリック", - "visTypeTimeseries.movingAverage.model.selectPlaceholder": "選択してください", - "visTypeTimeseries.movingAverage.modelLabel": "モデル", - "visTypeTimeseries.movingAverage.modelOptions.exponentiallyWeightedLabel": "指数加重", - "visTypeTimeseries.movingAverage.modelOptions.holtLinearLabel": "Holt-Linear", - "visTypeTimeseries.movingAverage.modelOptions.holtWintersLabel": "Holt-Winters", - "visTypeTimeseries.movingAverage.modelOptions.linearLabel": "直線", - "visTypeTimeseries.movingAverage.modelOptions.simpleLabel": "シンプル", - "visTypeTimeseries.movingAverage.multiplicative": "マルチキャプティブ", - "visTypeTimeseries.movingAverage.multiplicative.selectPlaceholder": "選択してください", - "visTypeTimeseries.movingAverage.multiplicativeOptions.false": "False", - "visTypeTimeseries.movingAverage.multiplicativeOptions.true": "True", - "visTypeTimeseries.movingAverage.period": "期間", - "visTypeTimeseries.movingAverage.windowSizeHint": "ウィンドウは、必ず、期間のサイズの 2 倍以上でなければなりません", - "visTypeTimeseries.movingAverage.windowSizeLabel": "ウィンドウサイズ", - "visTypeTimeseries.multivalueRow.valueLabel": "値:", - "visTypeTimeseries.noButtonLabel": "いいえ", - "visTypeTimeseries.noDataDescription": "選択されたメトリックに表示するデータがありません", - "visTypeTimeseries.percentile.aggregationLabel": "集約", - "visTypeTimeseries.percentile.fieldLabel": "フィールド", - "visTypeTimeseries.percentile.fillToLabel": "次の基準に合わせる:", - "visTypeTimeseries.percentile.modeLabel": "モード:", - "visTypeTimeseries.percentile.modeOptions.bandLabel": "帯", - "visTypeTimeseries.percentile.modeOptions.lineLabel": "折れ線", - "visTypeTimeseries.percentile.percentileAriaLabel": "パーセンタイル", - "visTypeTimeseries.percentile.shadeLabel": "シェイド (0 から 1)", - "visTypeTimeseries.percentileRank.aggregationLabel": "集約", - "visTypeTimeseries.percentileRank.fieldLabel": "フィールド", - "visTypeTimeseries.positiveOnly.aggregationLabel": "集約", - "visTypeTimeseries.positiveOnly.metricLabel": "メトリック", - "visTypeTimeseries.replaceVars.errors.markdownErrorDescription": "Markdown、既知の変数、ビルトイン Handlebars 表現のみが使用されていることを確認してください。", - "visTypeTimeseries.replaceVars.errors.markdownErrorTitle": "Markdown の処理中にエラーが発生", - "visTypeTimeseries.replaceVars.errors.unknownVarDescription": "{badVar} は不明な変数です", - "visTypeTimeseries.replaceVars.errors.unknownVarTitle": "Markdown の処理中にエラーが発生", - "visTypeTimeseries.serialDiff.aggregationLabel": "集約", - "visTypeTimeseries.serialDiff.lagLabel": "ラグ", - "visTypeTimeseries.serialDiff.metricLabel": "メトリック", - "visTypeTimeseries.series.missingAggregationKeyErrorMessage": "返答から集約キーが欠けています。このリクエストのパーミッションを確認してください。", - "visTypeTimeseries.series.shouldOneSeriesPerRequestErrorMessage": "1 つのリクエストに複数の数列を含めることはできません。", - "visTypeTimeseries.seriesAgg.aggregationLabel": "集約", - "visTypeTimeseries.seriesAgg.functionLabel": "関数", - "visTypeTimeseries.seriesAgg.functionOptions.avgLabel": "平均", - "visTypeTimeseries.seriesAgg.functionOptions.cumulativeSumLabel": "累積合計", - "visTypeTimeseries.seriesAgg.functionOptions.maxLabel": "最高", - "visTypeTimeseries.seriesAgg.functionOptions.minLabel": "最低", - "visTypeTimeseries.seriesAgg.functionOptions.overallAvgLabel": "全体平均", - "visTypeTimeseries.seriesAgg.functionOptions.overallMaxLabel": "全体最高", - "visTypeTimeseries.seriesAgg.functionOptions.overallMinLabel": "全体最低", - "visTypeTimeseries.seriesAgg.functionOptions.overallSumLabel": "全体合計", - "visTypeTimeseries.seriesAgg.functionOptions.sumLabel": "合計", - "visTypeTimeseries.seriesAgg.seriesAggIsNotCompatibleLabel": "数列集約は表の可視化に対応していません。", - "visTypeTimeseries.seriesConfig.filterLabel": "フィルター", - "visTypeTimeseries.seriesConfig.missingSeriesComponentDescription": "パネルタイプ {panelType} の数列コンポーネントが欠けています", - "visTypeTimeseries.seriesConfig.offsetSeriesTimeLabel": "数列の時間を (1m, 1h, 1w, 1d) でオフセット", - "visTypeTimeseries.seriesConfig.overrideIndexPatternLabel": "インデックスパターンを上書きしますか？", - "visTypeTimeseries.seriesConfig.templateHelpText": "例: {templateExample}", - "visTypeTimeseries.seriesConfig.templateLabel": "テンプレート", - "visTypeTimeseries.sort.dragToSortAriaLabel": "ドラッグして並べ替えます", - "visTypeTimeseries.sort.dragToSortTooltip": "ドラッグして並べ替えます", - "visTypeTimeseries.splits.everything.groupByLabel": "グループ分けの条件", - "visTypeTimeseries.splits.filter.groupByLabel": "グループ分けの条件", - "visTypeTimeseries.splits.filter.queryStringLabel": "クエリ文字列", - "visTypeTimeseries.splits.filterItems.labelAriaLabel": "ラベル", - "visTypeTimeseries.splits.filterItems.labelPlaceholder": "ラベル", - "visTypeTimeseries.splits.filters.groupByLabel": "グループ分けの条件", - "visTypeTimeseries.splits.groupBySelect.modeOptions.everythingLabel": "すべて", - "visTypeTimeseries.splits.groupBySelect.modeOptions.filterLabel": "フィルター", - "visTypeTimeseries.splits.groupBySelect.modeOptions.filtersLabel": "フィルター", - "visTypeTimeseries.splits.groupBySelect.modeOptions.termsLabel": "用語", - "visTypeTimeseries.splits.terms.byLabel": "グループ基準", - "visTypeTimeseries.splits.terms.defaultCountLabel": "ドキュメントカウント (デフォルト)", - "visTypeTimeseries.splits.terms.directionLabel": "方向", - "visTypeTimeseries.splits.terms.dirOptions.ascendingLabel": "昇順", - "visTypeTimeseries.splits.terms.dirOptions.descendingLabel": "降順", - "visTypeTimeseries.splits.terms.excludeLabel": "除外", - "visTypeTimeseries.splits.terms.groupByLabel": "グループ分けの条件", - "visTypeTimeseries.splits.terms.includeLabel": "含める", - "visTypeTimeseries.splits.terms.orderByLabel": "並び順", - "visTypeTimeseries.splits.terms.sizePlaceholder": "サイズ", - "visTypeTimeseries.splits.terms.termsLabel": "用語", - "visTypeTimeseries.splits.terms.topLabel": "一番上", - "visTypeTimeseries.static.aggregationLabel": "集約", - "visTypeTimeseries.static.staticValuesLabel": "不動値", - "visTypeTimeseries.stdAgg.aggregationLabel": "集約", - "visTypeTimeseries.stdAgg.fieldLabel": "フィールド", - "visTypeTimeseries.stdDeviation.aggregationLabel": "集約", - "visTypeTimeseries.stdDeviation.fieldLabel": "フィールド", - "visTypeTimeseries.stdDeviation.modeLabel": "モード", - "visTypeTimeseries.stdDeviation.modeOptions.boundsBandLabel": "境界バンド", - "visTypeTimeseries.stdDeviation.modeOptions.lowerBoundLabel": "下の境界", - "visTypeTimeseries.stdDeviation.modeOptions.rawLabel": "生", - "visTypeTimeseries.stdDeviation.modeOptions.upperBoundLabel": "上の境界", - "visTypeTimeseries.stdDeviation.sigmaLabel": "シグマ", - "visTypeTimeseries.stdSibling.aggregationLabel": "集約", - "visTypeTimeseries.stdSibling.metricLabel": "メトリック", - "visTypeTimeseries.stdSibling.modeLabel": "モード", - "visTypeTimeseries.stdSibling.modeOptions.boundsBandLabel": "境界バンド", - "visTypeTimeseries.stdSibling.modeOptions.lowerBoundLabel": "下の境界", - "visTypeTimeseries.stdSibling.modeOptions.rawLabel": "生", - "visTypeTimeseries.stdSibling.modeOptions.upperBoundLabel": "上の境界", - "visTypeTimeseries.stdSibling.sigmaLabel": "シグマ", - "visTypeTimeseries.table.addSeriesTooltip": "数列を追加", - "visTypeTimeseries.table.aggregateFunctionLabel": "集約関数", - "visTypeTimeseries.table.avgLabel": "平均", - "visTypeTimeseries.table.cloneSeriesTooltip": "数列のクローンを作成", - "visTypeTimeseries.table.colorRulesLabel": "カラールール", - "visTypeTimeseries.table.columnNotSortableTooltip": "この列は並べ替えできません", - "visTypeTimeseries.table.cumulativeSumLabel": "累積合計", - "visTypeTimeseries.table.dataTab.columnLabel": "列ラベル", - "visTypeTimeseries.table.dataTab.columnsButtonLabel": "フィールド", - "visTypeTimeseries.table.dataTab.defineFieldDescription": "表の可視化は、用語集約でグループ分けの基準となるフィールドを定義する必要があります。", - "visTypeTimeseries.table.dataTab.groupByFieldLabel": "フィールドでグループ分け", - "visTypeTimeseries.table.dataTab.rowsLabel": "行", - "visTypeTimeseries.table.deleteSeriesTooltip": "数列を削除", - "visTypeTimeseries.table.fieldLabel": "フィールド", - "visTypeTimeseries.table.filterLabel": "フィルター", - "visTypeTimeseries.table.labelAriaLabel": "ラベル", - "visTypeTimeseries.table.labelPlaceholder": "ラベル", - "visTypeTimeseries.table.maxLabel": "最高", - "visTypeTimeseries.table.minLabel": "最低", - "visTypeTimeseries.table.noResultsAvailableMessage": "結果がありません。", - "visTypeTimeseries.table.noResultsAvailableWithDescriptionMessage": "結果がありません。このビジュアライゼーションは、フィールドでグループを選択する必要があります。", - "visTypeTimeseries.table.optionsTab.dataLabel": "データ", - "visTypeTimeseries.table.optionsTab.ignoreGlobalFilterLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.table.optionsTab.itemUrlHelpText": "これは mustache テンプレートをサポートしています。{key} が用語に設定されています。", - "visTypeTimeseries.table.optionsTab.itemUrlLabel": "アイテム URL", - "visTypeTimeseries.table.optionsTab.panelFilterLabel": "パネルフィルター", - "visTypeTimeseries.table.optionsTab.panelOptionsButtonLabel": "パネルオプション", - "visTypeTimeseries.table.overallAvgLabel": "全体平均", - "visTypeTimeseries.table.overallMaxLabel": "全体最高", - "visTypeTimeseries.table.overallMinLabel": "全体最低", - "visTypeTimeseries.table.overallSumLabel": "全体合計", - "visTypeTimeseries.table.showTrendArrowsLabel": "傾向矢印を表示しますか？", - "visTypeTimeseries.table.sumLabel": "合計", - "visTypeTimeseries.table.tab.metricsLabel": "メトリック", - "visTypeTimeseries.table.tab.optionsLabel": "オプション", - "visTypeTimeseries.table.templateHelpText": "例: {templateExample}", - "visTypeTimeseries.table.templateLabel": "テンプレート", - "visTypeTimeseries.table.toggleSeriesEditorAriaLabel": "数列エディターを切り替える", - "visTypeTimeseries.timeSeries.addSeriesTooltip": "数列を追加", - "visTypeTimeseries.timeseries.annotationsTab.annotationsButtonLabel": "注釈", - "visTypeTimeseries.timeSeries.axisMaxLabel": "軸最大値", - "visTypeTimeseries.timeSeries.axisMinLabel": "軸最小値", - "visTypeTimeseries.timeSeries.axisPositionLabel": "軸の配置", - "visTypeTimeseries.timeSeries.barLabel": "バー", - "visTypeTimeseries.timeSeries.chartBar.chartTypeLabel": "チャートタイプ", - "visTypeTimeseries.timeSeries.chartBar.fillLabel": "塗りつぶし (0 から 1)", - "visTypeTimeseries.timeSeries.chartBar.lineWidthLabel": "線の幅", - "visTypeTimeseries.timeSeries.chartBar.stackedLabel": "スタック", - "visTypeTimeseries.timeSeries.chartLine.chartTypeLabel": "チャートタイプ", - "visTypeTimeseries.timeSeries.chartLine.fillLabel": "塗りつぶし (0 から 1)", - "visTypeTimeseries.timeSeries.chartLine.lineWidthLabel": "線の幅", - "visTypeTimeseries.timeSeries.chartLine.pointSizeLabel": "点のサイズ", - "visTypeTimeseries.timeSeries.chartLine.stackedLabel": "スタック", - "visTypeTimeseries.timeSeries.chartLine.stepsLabel": "ステップ", - "visTypeTimeseries.timeSeries.cloneSeriesTooltip": "数列のクローンを作成", - "visTypeTimeseries.timeseries.dataTab.dataButtonLabel": "データ", - "visTypeTimeseries.timeSeries.deleteSeriesTooltip": "数列を削除", - "visTypeTimeseries.timeSeries.filterLabel": "フィルター", - "visTypeTimeseries.timeSeries.gradientLabel": "グラデーション", - "visTypeTimeseries.timeSeries.hideInLegendLabel": "凡例で非表示", - "visTypeTimeseries.timeSeries.labelPlaceholder": "ラベル", - "visTypeTimeseries.timeSeries.leftLabel": "左", - "visTypeTimeseries.timeseries.legendPositionOptions.bottomLabel": "一番下", - "visTypeTimeseries.timeseries.legendPositionOptions.leftLabel": "左", - "visTypeTimeseries.timeseries.legendPositionOptions.rightLabel": "右", - "visTypeTimeseries.timeSeries.lineLabel": "折れ線", - "visTypeTimeseries.timeSeries.noneLabel": "なし", - "visTypeTimeseries.timeSeries.offsetSeriesTimeLabel": "数列の時間を (1m, 1h, 1w, 1d) でオフセット", - "visTypeTimeseries.timeseries.optionsTab.axisMaxLabel": "軸最大値", - "visTypeTimeseries.timeseries.optionsTab.axisMinLabel": "軸最小値", - "visTypeTimeseries.timeseries.optionsTab.axisPositionLabel": "軸の配置", - "visTypeTimeseries.timeseries.optionsTab.axisScaleLabel": "軸のスケール", - "visTypeTimeseries.timeseries.optionsTab.backgroundColorLabel": "背景色:", - "visTypeTimeseries.timeseries.optionsTab.dataLabel": "データ", - "visTypeTimeseries.timeseries.optionsTab.displayGridLabel": "グリッドを表示", - "visTypeTimeseries.timeseries.optionsTab.ignoreGlobalFilterLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.timeseries.optionsTab.legendPositionLabel": "凡例の配置", - "visTypeTimeseries.timeseries.optionsTab.panelFilterLabel": "パネルフィルター", - "visTypeTimeseries.timeseries.optionsTab.panelOptionsButtonLabel": "パネルオプション", - "visTypeTimeseries.timeseries.optionsTab.showLegendLabel": "凡例を表示しますか？", - "visTypeTimeseries.timeseries.optionsTab.styleLabel": "スタイル", - "visTypeTimeseries.timeSeries.overrideIndexPatternLabel": "インデックスパターンを上書きしますか？", - "visTypeTimeseries.timeSeries.percentLabel": "パーセント", - "visTypeTimeseries.timeseries.positionOptions.leftLabel": "左", - "visTypeTimeseries.timeseries.positionOptions.rightLabel": "右", - "visTypeTimeseries.timeSeries.rainbowLabel": "虹", - "visTypeTimeseries.timeSeries.rightLabel": "右", - "visTypeTimeseries.timeseries.scaleOptions.logLabel": "ログ", - "visTypeTimeseries.timeseries.scaleOptions.normalLabel": "標準", - "visTypeTimeseries.timeSeries.separateAxisLabel": "軸を分けますか？", - "visTypeTimeseries.timeSeries.splitColorThemeLabel": "カラーテーマを分割", - "visTypeTimeseries.timeSeries.stackedLabel": "スタック", - "visTypeTimeseries.timeSeries.stackedWithinSeriesLabel": "数列内でスタック", - "visTypeTimeseries.timeSeries.tab.metricsLabel": "メトリック", - "visTypeTimeseries.timeSeries.tab.optionsLabel": "オプション", - "visTypeTimeseries.timeSeries.templateHelpText": "例: {templateExample}", - "visTypeTimeseries.timeSeries.templateLabel": "テンプレート", - "visTypeTimeseries.timeSeries.toggleSeriesEditorAriaLabel": "数列エディターを切り替える", - "visTypeTimeseries.topHit.aggregateWith.selectPlaceholder": "選択してください…", - "visTypeTimeseries.topHit.aggregateWithLabel": "アグリゲーション:", - "visTypeTimeseries.topHit.aggregationLabel": "集約", - "visTypeTimeseries.topHit.aggWithOptions.averageLabel": "平均", - "visTypeTimeseries.topHit.aggWithOptions.concatenate": "連結", - "visTypeTimeseries.topHit.aggWithOptions.maxLabel": "最高", - "visTypeTimeseries.topHit.aggWithOptions.minLabel": "最低", - "visTypeTimeseries.topHit.aggWithOptions.sumLabel": "合計", - "visTypeTimeseries.topHit.fieldLabel": "フィールド", - "visTypeTimeseries.topHit.order.selectPlaceholder": "選択してください…", - "visTypeTimeseries.topHit.orderByLabel": "並び順", - "visTypeTimeseries.topHit.orderLabel": "順序", - "visTypeTimeseries.topHit.orderOptions.ascLabel": "昇順", - "visTypeTimeseries.topHit.orderOptions.descLabel": "降順", - "visTypeTimeseries.topHit.sizeLabel": "サイズ", - "visTypeTimeseries.topN.addSeriesTooltip": "数列を追加", - "visTypeTimeseries.topN.cloneSeriesTooltip": "数列のクローンを作成", - "visTypeTimeseries.topN.dataTab.dataButtonLabel": "データ", - "visTypeTimeseries.topN.deleteSeriesTooltip": "数列を削除", - "visTypeTimeseries.topN.labelPlaceholder": "ラベル", - "visTypeTimeseries.topN.optionsTab.backgroundColorLabel": "背景色:", - "visTypeTimeseries.topN.optionsTab.colorRulesLabel": "カラールール", - "visTypeTimeseries.topN.optionsTab.dataLabel": "データ", - "visTypeTimeseries.topN.optionsTab.ignoreGlobalFilterLabel": "グローバルフィルターを無視しますか？", - "visTypeTimeseries.topN.optionsTab.itemUrlDescription": "これは mustache テンプレートをサポートしています。{key} が用語に設定されています。", - "visTypeTimeseries.topN.optionsTab.itemUrlLabel": "アイテム URL", - "visTypeTimeseries.topN.optionsTab.panelFilterLabel": "パネルフィルター", - "visTypeTimeseries.topN.optionsTab.panelOptionsButtonLabel": "パネルオプション", - "visTypeTimeseries.topN.optionsTab.styleLabel": "スタイル", - "visTypeTimeseries.topN.tab.metricsLabel": "メトリック", - "visTypeTimeseries.topN.tab.optionsLabel": "オプション", - "visTypeTimeseries.topN.toggleSeriesEditorAriaLabel": "数列エディターを切り替える", - "visTypeTimeseries.unsupportedAgg.aggIsNotSupportedDescription": "{modelType} 集約はサポートされなくなりました。", - "visTypeTimeseries.unsupportedAgg.aggIsTemporaryUnsupportedDescription": "{modelType} 集約は現在サポートされていません。", - "visTypeTimeseries.unsupportedSplit.splitIsUnsupportedDescription": "{modelType} による分割はサポートされていません。", - "visTypeTimeseries.validateInterval.notifier.maxBucketsExceededErrorMessage": "バケットの最高数を超えました。{buckets} が {maxBuckets} を超えています。パネルオプションでより広い間隔を試してみてください。", - "visTypeTimeseries.vars.variableNameAriaLabel": "変数名", - "visTypeTimeseries.vars.variableNamePlaceholder": "変数名", - "visTypeTimeseries.visEditorVisualization.applyChangesLabel": "変更を適用", - "visTypeTimeseries.visEditorVisualization.autoApplyLabel": "自動適用", - "visTypeTimeseries.visEditorVisualization.changesHaveNotBeenAppliedMessage": "ビジュアライゼーションへの変更が適用されました。", - "visTypeTimeseries.visEditorVisualization.changesSuccessfullyAppliedMessage": "最新の変更が適用されました。", - "visTypeTimeseries.visEditorVisualization.changesWillBeAutomaticallyAppliedMessage": "変更が自動的に適用されます。", - "visTypeTimeseries.visEditorVisualization.panelInterval": "間隔:{panelInterval}", - "visTypeTimeseries.visPicker.gaugeLabel": "ゲージ", - "visTypeTimeseries.visPicker.metricLabel": "メトリック", - "visTypeTimeseries.visPicker.tableLabel": "表", - "visTypeTimeseries.visPicker.timeSeriesLabel": "時系列", - "visTypeTimeseries.visPicker.topNLabel": "トップ N", - "visTypeTimeseries.yesButtonLabel": "はい", - "visTypeVega.editor.formatError": "仕様のフォーマット中にエラーが発生", - "visTypeVega.editor.reformatAsHJSONButtonLabel": "HJSON に変換", - "visTypeVega.editor.reformatAsJSONButtonLabel": "JSON に変換しコメントを削除", - "visTypeVega.editor.vegaDocumentationLinkText": "Vega ドキュメント", - "visTypeVega.editor.vegaEditorOptionsButtonAriaLabel": "Vega エディターオプション", - "visTypeVega.editor.vegaHelpButtonAriaLabel": "Vega ヘルプ", - "visTypeVega.editor.vegaHelpLinkText": "Kibana Vega ヘルプ", - "visTypeVega.editor.vegaLiteDocumentationLinkText": "Vega-Lite ドキュメンテーション", - "visTypeVega.emsFileParser.emsFileNameDoesNotExistErrorMessage": "{emsfile} {emsfileName} が存在しません", - "visTypeVega.emsFileParser.missingNameOfFileErrorMessage": "{dataUrlParamValue} の {dataUrlParam} には {nameParam} パラメーター (ファイル名) が必要です", - "visTypeVega.esQueryParser.autointervalValueTypeErrorMessage": "{autointerval} は文字 {trueValue} または数字である必要があります", - "visTypeVega.esQueryParser.dataUrlMustNotHaveLegacyAndBodyQueryValuesAtTheSameTimeErrorMessage": "{dataUrlParam} はレガシー {legacyContext} と {bodyQueryConfigName} の値を同時に含めることができません。", - "visTypeVega.esQueryParser.dataUrlMustNotHaveLegacyContextTogetherWithContextOrTimefieldErrorMessage": "{dataUrlParam} は {legacyContext} と同時に {context} または {timefield} を含めることができません", - "visTypeVega.esQueryParser.legacyContextCanBeTrueErrorMessage": "レガシー {legacyContext} は {trueValue} (時間範囲ピッカーを無視)、または時間フィールドの名前のどちらかです。例: {timestampParam}", - "visTypeVega.esQueryParser.legacyUrlShouldChangeToWarningMessage": "レガシー {urlParam}: {legacyUrl} を {result} に変更する必要があります", - "visTypeVega.esQueryParser.shiftMustValueTypeErrorMessage": "{shiftParam} は数値でなければなりません", - "visTypeVega.esQueryParser.timefilterValueErrorMessage": "{timefilter} のプロパティは {trueValue}、{minValue}、または {maxValue} に設定する必要があります", - "visTypeVega.esQueryParser.unknownUnitValueErrorMessage": "不明な {unitParamName} 値。[{unitParamValues}] の内の 1 つでなければなりません", - "visTypeVega.esQueryParser.urlBodyValueTypeErrorMessage": "{configName} はオブジェクトでなければなりません", - "visTypeVega.esQueryParser.urlContextAndUrlTimefieldMustNotBeUsedErrorMessage": "{urlContext} と {timefield} は {queryParam} が設定されている場合使用できません", - "visTypeVega.function.help": "Vega ビジュアライゼーション", - "visTypeVega.mapView.mapStyleNotFoundWarningMessage": "{mapStyleParam} が見つかりませんでした", - "visTypeVega.mapView.minZoomAndMaxZoomHaveBeenSwappedWarningMessage": "{minZoomPropertyName} と {maxZoomPropertyName} が交換されました", - "visTypeVega.mapView.resettingPropertyToMaxValueWarningMessage": "{name} を {max} にリセットしています", - "visTypeVega.mapView.resettingPropertyToMinValueWarningMessage": "{name} を {min} にリセットしています", - "visTypeVega.type.vegaDescription": "Vega と Vega-Lite を使用してカスタムビジュアライゼーションを作成します。", - "visTypeVega.urlParser.dataUrlRequiresUrlParameterInFormErrorMessage": "{dataUrlParam} には「{formLink}」の形で {urlParam} パラメーターが必要です", - "visTypeVega.urlParser.urlShouldHaveQuerySubObjectWarningMessage": "{urlObject} を使用するには {subObjectName} サブオブジェクトが必要です", - "visTypeVega.vegaParser.baseView.externalUrlsAreNotEnabledErrorMessage": "外部 URL が無効です。{enableExternalUrls} を {kibanaConfigFileName} に追加します", - "visTypeVega.vegaParser.baseView.functionIsNotDefinedForGraphErrorMessage": "このグラフには {funcName} が定義されていません", - "visTypeVega.vegaParser.baseView.timeValuesTypeErrorMessage": "時間フィルターの設定エラー: 両方の時間の値は相対的または絶対的な日付である必要があります。 {start}、{end}", - "visTypeVega.vegaParser.centerOnMarkConfigValueTypeErrorMessage": "{configName} は {trueValue}、{falseValue}、または数字でなければなりません", - "visTypeVega.vegaParser.dataExceedsSomeParamsUseTimesLimitErrorMessage": "データには {urlParam}、{valuesParam}、 {sourceParam} の内複数を含めることができません", - "visTypeVega.vegaParser.hostConfigIsDeprecatedWarningMessage": "{deprecatedConfigName} は廃止されました。代わりに {newConfigName} を使用してください。", - "visTypeVega.vegaParser.hostConfigValueTypeErrorMessage": "{configName} が含まれている場合、オブジェクトでなければなりません", - "visTypeVega.vegaParser.inputSpecDoesNotSpecifySchemaWarningMessage": "インプット仕様で {schemaParam} が指定されていないため、デフォルトで {defaultSchema} になります", - "visTypeVega.vegaParser.invalidVegaSpecErrorMessage": "無効な Vega 仕様", - "visTypeVega.vegaParser.kibanaConfigValueTypeErrorMessage": "{configName} が含まれている場合、オブジェクトでなければなりません", - "visTypeVega.vegaParser.mapStyleValueTypeWarningMessage": "{mapStyleConfigName} は {mapStyleConfigFirstAllowedValue} か {mapStyleConfigSecondAllowedValue} のどちらかです", - "visTypeVega.vegaParser.maxBoundsValueTypeWarningMessage": "{maxBoundsConfigName} は 4 つの数字の配列でなければなりません", - "visTypeVega.vegaParser.notSupportedUrlTypeErrorMessage": "{urlObject} はサポートされていません", - "visTypeVega.vegaParser.notValidLibraryVersionForInputSpecWarningMessage": "インプット仕様に {schemaLibrary} {schemaVersion} が使用されていますが、現在のバージョンの {schemaLibrary} は {libraryVersion} です。’", - "visTypeVega.vegaParser.paddingConfigValueTypeErrorMessage": "{configName} は数字でなければなりません", - "visTypeVega.vegaParser.someKibanaConfigurationIsNoValidWarningMessage": "{configName} は有効ではありません", - "visTypeVega.vegaParser.someKibanaParamValueTypeWarningMessage": "{configName} はブール値でなければなりません", - "visTypeVega.vegaParser.unexpectedValueForPositionConfigurationErrorMessage": "{configurationName} 構成に予期せぬ値が使用されています", - "visTypeVega.vegaParser.unrecognizedControlsLocationValueErrorMessage": "認識されない {controlsLocationParam} 値[{locToDirMap}] のいずれかである必要があります", - "visTypeVega.vegaParser.unrecognizedDirValueErrorMessage": "認識されない {dirParam} 値[{expectedValues}] のいずれかである必要があります", - "visTypeVega.vegaParser.VLCompilerShouldHaveGeneratedSingleProtectionObjectErrorMessage": "内部エラー:Vega-Lite コンパイラーがシングルプロジェクションオブジェクトを生成したはずです", - "visTypeVega.vegaParser.widthAndHeightParamsAreIgnoredWithAutosizeFitWarningMessage": "{widthParam} と {heightParam} パラメーターは {autosizeParam} で無視されます", - "visTypeVega.visualization.indexNotFoundErrorMessage": "インデックス {index} が見つかりません", - "visTypeVega.visualization.renderErrorTitle": "Vega エラー", - "visTypeVega.visualization.unableToFindDefaultIndexErrorMessage": "デフォルトのインデックスが見つかりません", - "visTypeVega.visualization.unableToRenderWithoutDataWarningMessage": "データなしにはレンダリングできません", - "visTypeVislib.area.areaDescription": "折れ線グラフの下の数量を強調します。", - "visTypeVislib.area.areaTitle": "エリア", - "visTypeVislib.area.countText": "カウント", - "visTypeVislib.area.groupTitle": "系列を分割", - "visTypeVislib.area.metricsTitle": "Y 軸", - "visTypeVislib.area.radiusTitle": "点のサイズ", - "visTypeVislib.area.segmentTitle": "X 軸", - "visTypeVislib.area.splitTitle": "チャートを分割", - "visTypeVislib.area.tabs.metricsAxesTitle": "メトリックと軸", - "visTypeVislib.area.tabs.panelSettingsTitle": "パネル設定", - "visTypeVislib.axisModes.normalText": "標準", - "visTypeVislib.axisModes.percentageText": "割合 (%)", - "visTypeVislib.axisModes.silhouetteText": "シルエット", - "visTypeVislib.axisModes.wiggleText": "振動", - "visTypeVislib.categoryAxis.rotate.angledText": "傾斜", - "visTypeVislib.categoryAxis.rotate.horizontalText": "横", - "visTypeVislib.categoryAxis.rotate.verticalText": "縦", - "visTypeVislib.chartModes.normalText": "標準", - "visTypeVislib.chartModes.stackedText": "スタック", - "visTypeVislib.chartTypes.areaText": "エリア", - "visTypeVislib.chartTypes.barText": "バー", - "visTypeVislib.chartTypes.lineText": "折れ線", - "visTypeVislib.controls.colorRanges.errorText": "各範囲は前の範囲よりも大きくなければなりません。", - "visTypeVislib.controls.colorSchema.colorSchemaLabel": "配色", - "visTypeVislib.controls.colorSchema.howToChangeColorsDescription": "それぞれの色は凡例で変更できます。", - "visTypeVislib.controls.colorSchema.resetColorsButtonLabel": "色をリセット", - "visTypeVislib.controls.colorSchema.reverseColorSchemaLabel": "図表を反転", - "visTypeVislib.controls.gaugeOptions.alignmentLabel": "アラインメント", - "visTypeVislib.controls.gaugeOptions.autoExtendRangeLabel": "範囲を自動拡張", - "visTypeVislib.controls.gaugeOptions.displayWarningsLabel": "警告を表示", - "visTypeVislib.controls.gaugeOptions.extendRangeTooltip": "範囲をデータの最高値に広げます。", - "visTypeVislib.controls.gaugeOptions.gaugeTypeLabel": "ゲージタイプ", - "visTypeVislib.controls.gaugeOptions.labelsTitle": "ラベル", - "visTypeVislib.controls.gaugeOptions.percentageModeLabel": "百分率モード", - "visTypeVislib.controls.gaugeOptions.rangesTitle": "範囲", - "visTypeVislib.controls.gaugeOptions.showLabelsLabel": "ラベルを表示", - "visTypeVislib.controls.gaugeOptions.showLegendLabel": "凡例を表示", - "visTypeVislib.controls.gaugeOptions.showOutline": "アウトラインを表示", - "visTypeVislib.controls.gaugeOptions.showScaleLabel": "縮尺を表示", - "visTypeVislib.controls.gaugeOptions.styleTitle": "スタイル", - "visTypeVislib.controls.gaugeOptions.subTextLabel": "サブラベル", - "visTypeVislib.controls.gaugeOptions.switchWarningsTooltip": "警告のオン/オフを切り替えます。オンにすると、すべてのラベルを表示できない際に警告が表示されます。", - "visTypeVislib.controls.heatmapOptions.colorLabel": "色", - "visTypeVislib.controls.heatmapOptions.colorScaleLabel": "カラースケール", - "visTypeVislib.controls.heatmapOptions.colorsNumberLabel": "色の数", - "visTypeVislib.controls.heatmapOptions.labelsTitle": "ラベル", - "visTypeVislib.controls.heatmapOptions.overwriteAutomaticColorLabel": "自動からーを上書きする", - "visTypeVislib.controls.heatmapOptions.percentageModeLabel": "百分率モード", - "visTypeVislib.controls.heatmapOptions.rotateLabel": "回転", - "visTypeVislib.controls.heatmapOptions.scaleToDataBoundsLabel": "データバウンドに合わせる", - "visTypeVislib.controls.heatmapOptions.showLabelsTitle": "ラベルを表示", - "visTypeVislib.controls.heatmapOptions.useCustomRangesLabel": "カスタム範囲を使用", - "visTypeVislib.controls.pointSeries.categoryAxis.alignLabel": "配置", - "visTypeVislib.controls.pointSeries.categoryAxis.filterLabelsLabel": "フィルターラベル", - "visTypeVislib.controls.pointSeries.categoryAxis.labelsTitle": "ラベル", - "visTypeVislib.controls.pointSeries.categoryAxis.positionLabel": "位置", - "visTypeVislib.controls.pointSeries.categoryAxis.showLabel": "軸線とラベルを表示", - "visTypeVislib.controls.pointSeries.categoryAxis.showLabelsLabel": "ラベルを表示", - "visTypeVislib.controls.pointSeries.categoryAxis.xAxisTitle": "X 軸", - "visTypeVislib.controls.pointSeries.gridAxis.dontShowLabel": "非表示", - "visTypeVislib.controls.pointSeries.gridAxis.gridText": "グリッド", - "visTypeVislib.controls.pointSeries.gridAxis.xAxisLinesLabel": "X 軸線を表示", - "visTypeVislib.controls.pointSeries.gridAxis.yAxisLinesDisabledTooltip": "ヒストグラムに X 軸線は表示できません。", - "visTypeVislib.controls.pointSeries.gridAxis.yAxisLinesLabel": "Y 軸線を表示", - "visTypeVislib.controls.pointSeries.series.chartTypeLabel": "チャートタイプ", - "visTypeVislib.controls.pointSeries.series.lineModeLabel": "線のモード", - "visTypeVislib.controls.pointSeries.series.lineWidthLabel": "線の幅", - "visTypeVislib.controls.pointSeries.series.metricsTitle": "メトリック", - "visTypeVislib.controls.pointSeries.series.modeLabel": "モード", - "visTypeVislib.controls.pointSeries.series.newAxisLabel": "新規軸…", - "visTypeVislib.controls.pointSeries.series.showDotsLabel": "点を表示", - "visTypeVislib.controls.pointSeries.series.showLineLabel": "線を表示", - "visTypeVislib.controls.pointSeries.series.valueAxisLabel": "値軸", - "visTypeVislib.controls.pointSeries.seriesAccordionAriaLabel": "{agg} オプションを切り替える", - "visTypeVislib.controls.pointSeries.valueAxes.addButtonTooltip": "Y 軸を追加します", - "visTypeVislib.controls.pointSeries.valueAxes.customExtentsLabel": "カスタム範囲", - "visTypeVislib.controls.pointSeries.valueAxes.maxLabel": "最高", - "visTypeVislib.controls.pointSeries.valueAxes.minErrorMessage": "最低値は最高値よりも低く設定する必要があります", - "visTypeVislib.controls.pointSeries.valueAxes.minLabel": "最低", - "visTypeVislib.controls.pointSeries.valueAxes.minNeededScaleText": "ログスケールが選択されている場合、最低値は 0 よりも大きいものである必要があります", - "visTypeVislib.controls.pointSeries.valueAxes.modeLabel": "モード", - "visTypeVislib.controls.pointSeries.valueAxes.positionLabel": "位置", - "visTypeVislib.controls.pointSeries.valueAxes.removeButtonTooltip": "Y 軸を削除します", - "visTypeVislib.controls.pointSeries.valueAxes.scaleToDataBounds.boundsMargin": "境界マージン", - "visTypeVislib.controls.pointSeries.valueAxes.scaleToDataBounds.minNeededBoundsMargin": "境界マージンは 0 以上でなければなりません", - "visTypeVislib.controls.pointSeries.valueAxes.scaleToDataBoundsLabel": "データバウンドに合わせる", - "visTypeVislib.controls.pointSeries.valueAxes.scaleTypeLabel": "スケールタイプ", - "visTypeVislib.controls.pointSeries.valueAxes.setAxisExtentsLabel": "軸範囲を設定", - "visTypeVislib.controls.pointSeries.valueAxes.showLabel": "軸線とラベルを表示", - "visTypeVislib.controls.pointSeries.valueAxes.titleLabel": "タイトル", - "visTypeVislib.controls.pointSeries.valueAxes.toggleCustomExtendsAriaLabel": "カスタム範囲を切り替える", - "visTypeVislib.controls.pointSeries.valueAxes.toggleOptionsAriaLabel": "{axisName} オプションを切り替える", - "visTypeVislib.controls.pointSeries.valueAxes.yAxisTitle": "Y 軸", - "visTypeVislib.controls.rangeErrorMessage": "値は {min} と {max} の間でなければなりません", - "visTypeVislib.controls.truncateLabel": "切り捨て", - "visTypeVislib.controls.vislibBasicOptions.legendPositionLabel": "凡例位置", - "visTypeVislib.controls.vislibBasicOptions.showTooltipLabel": "ツールヒントを表示", - "visTypeVislib.editors.heatmap.basicSettingsTitle": "基本設定", - "visTypeVislib.editors.heatmap.heatmapSettingsTitle": "ヒートマップ設定", - "visTypeVislib.editors.heatmap.highlightLabel": "ハイライト範囲", - "visTypeVislib.editors.heatmap.highlightLabelTooltip": "チャートのカーソルを当てた部分と凡例の対応するラベルをハイライトします。", - "visTypeVislib.editors.pie.donutLabel": "ドーナッツ", - "visTypeVislib.editors.pie.labelsSettingsTitle": "ラベル設定", - "visTypeVislib.editors.pie.pieSettingsTitle": "パイ設定", - "visTypeVislib.editors.pie.showLabelsLabel": "ラベルを表示", - "visTypeVislib.editors.pie.showTopLevelOnlyLabel": "トップレベルのみ表示", - "visTypeVislib.editors.pie.showValuesLabel": "値を表示", - "visTypeVislib.editors.pointSeries.currentTimeMarkerLabel": "現在時刻マーカー", - "visTypeVislib.editors.pointSeries.orderBucketsBySumLabel": "バケットを合計で並べ替え", - "visTypeVislib.editors.pointSeries.settingsTitle": "設定", - "visTypeVislib.editors.pointSeries.showLabels": "チャートに値を表示", - "visTypeVislib.editors.pointSeries.thresholdLine.colorLabel": "線の色", - "visTypeVislib.editors.pointSeries.thresholdLine.showLabel": "しきい線を表示", - "visTypeVislib.editors.pointSeries.thresholdLine.styleLabel": "ラインスタイル", - "visTypeVislib.editors.pointSeries.thresholdLine.valueLabel": "しきい値", - "visTypeVislib.editors.pointSeries.thresholdLine.widthLabel": "線の幅", - "visTypeVislib.editors.pointSeries.thresholdLineSettingsTitle": "しきい線", - "visTypeVislib.functions.pie.help": "パイビジュアライゼーション", - "visTypeVislib.functions.vislib.help": "Vislib ビジュアライゼーション", - "visTypeVislib.gauge.alignmentAutomaticTitle": "自動", - "visTypeVislib.gauge.alignmentHorizontalTitle": "横", - "visTypeVislib.gauge.alignmentVerticalTitle": "縦", - "visTypeVislib.gauge.gaugeDescription": "ゲージはメトリックのステータスを示します。メトリックの値とリファレンスしきい値との関連性を示すのに使用します。", - "visTypeVislib.gauge.gaugeTitle": "ゲージ", - "visTypeVislib.gauge.gaugeTypes.arcText": "弧形", - "visTypeVislib.gauge.gaugeTypes.circleText": "円", - "visTypeVislib.gauge.groupTitle": "グループを分割", - "visTypeVislib.gauge.metricTitle": "メトリック", - "visTypeVislib.goal.goalDescription": "ゴールチャートは、最終目標にどれだけ近いかを示します。", - "visTypeVislib.goal.goalTitle": "ゴール", - "visTypeVislib.goal.groupTitle": "グループを分割", - "visTypeVislib.goal.metricTitle": "メトリック", - "visTypeVislib.heatmap.groupTitle": "Y 軸", - "visTypeVislib.heatmap.heatmapDescription": "マトリックス内のセルに影をつける。", - "visTypeVislib.heatmap.heatmapTitle": "ヒートマップ", - "visTypeVislib.heatmap.metricTitle": "値", - "visTypeVislib.heatmap.segmentTitle": "X 軸", - "visTypeVislib.heatmap.splitTitle": "チャートを分割", - "visTypeVislib.histogram.groupTitle": "系列を分割", - "visTypeVislib.histogram.histogramDescription": "連続変数を各軸に割り当てる。", - "visTypeVislib.histogram.histogramTitle": "縦棒", - "visTypeVislib.histogram.metricTitle": "Y 軸", - "visTypeVislib.histogram.radiusTitle": "点のサイズ", - "visTypeVislib.histogram.segmentTitle": "X 軸", - "visTypeVislib.histogram.splitTitle": "チャートを分割", - "visTypeVislib.horizontalBar.groupTitle": "系列を分割", - "visTypeVislib.horizontalBar.horizontalBarDescription": "連続変数を各軸に割り当てる。", - "visTypeVislib.horizontalBar.horizontalBarTitle": "横棒", - "visTypeVislib.horizontalBar.metricTitle": "Y 軸", - "visTypeVislib.horizontalBar.radiusTitle": "点のサイズ", - "visTypeVislib.horizontalBar.segmentTitle": "X 軸", - "visTypeVislib.horizontalBar.splitTitle": "チャートを分割", - "visTypeVislib.interpolationModes.smoothedText": "スムーズ", - "visTypeVislib.interpolationModes.steppedText": "ステップ", - "visTypeVislib.interpolationModes.straightText": "直線", - "visTypeVislib.legendPositions.bottomText": "一番下", - "visTypeVislib.legendPositions.leftText": "左", - "visTypeVislib.legendPositions.rightText": "右", - "visTypeVislib.legendPositions.topText": "トップ", - "visTypeVislib.line.groupTitle": "系列を分割", - "visTypeVislib.line.lineDescription": "トレンドを強調します。", - "visTypeVislib.line.lineTitle": "折れ線", - "visTypeVislib.line.metricTitle": "Y 軸", - "visTypeVislib.line.radiusTitle": "点のサイズ", - "visTypeVislib.line.segmentTitle": "X 軸", - "visTypeVislib.line.splitTitle": "チャートを分割", - "visTypeVislib.pie.metricTitle": "サイズのスライス", - "visTypeVislib.pie.pieDescription": "全体に対する内訳を表現する。", - "visTypeVislib.pie.pieTitle": "パイ", - "visTypeVislib.pie.segmentTitle": "スライスの分割", - "visTypeVislib.pie.splitTitle": "チャートを分割", - "visTypeVislib.scaleTypes.linearText": "線形", - "visTypeVislib.scaleTypes.logText": "ログ", - "visTypeVislib.scaleTypes.squareRootText": "平方根", - "visTypeVislib.thresholdLine.style.dashedText": "鎖線", - "visTypeVislib.thresholdLine.style.dotdashedText": "点線", - "visTypeVislib.thresholdLine.style.fullText": "完全", - "visTypeVislib.vislib.heatmap.maxBucketsText": "定義された数列が多すぎます ({nr})。構成されている最大値は {max} です。", - "visTypeVislib.vislib.legend.filterForValueButtonAriaLabel": "値 {legendDataLabel} でフィルタリング", - "visTypeVislib.vislib.legend.filterOptionsLegend": "{legendDataLabel}、フィルターオプション", - "visTypeVislib.vislib.legend.filterOutValueButtonAriaLabel": "値 {legendDataLabel} を除外", - "visTypeVislib.vislib.legend.loadingLabel": "読み込み中…", - "visTypeVislib.vislib.legend.setColorScreenReaderDescription": "値 {legendDataLabel} の色を設定", - "visTypeVislib.vislib.legend.toggleLegendButtonAriaLabel": "凡例を切り替える", - "visTypeVislib.vislib.legend.toggleLegendButtonTitle": "凡例を切り替える", - "visTypeVislib.vislib.legend.toggleOptionsButtonAriaLabel": "{legendDataLabel}、トグルオプション", - "visTypeVislib.vislib.tooltip.fieldLabel": "フィールド", - "visTypeVislib.vislib.tooltip.valueLabel": "値", - "visualizations.disabledLabVisualizationMessage": "ラボビジュアライゼーションを表示するには、高度な設定でラボモードをオンにしてください。", - "visualizations.disabledLabVisualizationTitle": "{title} はラボビジュアライゼーションです。", - "visualizations.displayName": "ビジュアライゼーション", - "visualizations.function.range.from.help": "範囲の開始", - "visualizations.function.range.help": "範囲オブジェクトを生成します", - "visualizations.function.range.to.help": "範囲の終了", - "visualizations.function.visDimension.accessor.help": "使用するデータセット内の列 (列インデックスまたは列名)", - "visualizations.function.visDimension.error.accessor": "入力された列名は無効です。", - "visualizations.function.visDimension.format.help": "フォーマット", - "visualizations.function.visDimension.formatParams.help": "フォーマットパラメーター", - "visualizations.function.visDimension.help": "visConfig ディメンションオブジェクトを生成します", - "visualizations.functions.visualization.help": "シンプルなビジュアライゼーションです", - "visualizations.newVisWizard.betaDescription": "このビジュアライゼーションはベータ段階で、変更される可能性があります。デザインとコードはオフィシャル GA 機能よりも完成度が低く、現状のまま保証なしで提供されています。ベータ機能にはオフィシャル GA 機能の SLA が適用されません", - "visualizations.newVisWizard.betaTitle": "ベータ", - "visualizations.newVisWizard.chooseSourceTitle": "ソースの選択", - "visualizations.newVisWizard.experimentalDescription": "このビジュアライゼーションは実験的なものです。デザインと導入は安定したビジュアライゼーションよりも完成度が低く、変更される可能性があります。", - "visualizations.newVisWizard.experimentalTitle": "実験的", - "visualizations.newVisWizard.experimentalTooltip": "このビジュアライゼーションは今後のリリースで変更または削除される可能性があり、SLA のサポート対象になりません。", - "visualizations.newVisWizard.filterVisTypeAriaLabel": "ビジュアライゼーションのタイプでフィルタリング", - "visualizations.newVisWizard.helpText": "タイプを選択してビジュアライゼーションの作成を始めましょう。", - "visualizations.newVisWizard.helpTextAriaLabel": "タイプを選択してビジュアライゼーションの作成を始めましょう。ESC を押してこのモーダルを閉じます。Tab キーを押して次に進みます。", - "visualizations.newVisWizard.newVisTypeTitle": "新規 {visTypeName}", - "visualizations.newVisWizard.resultsFound": "{resultCount} 個の{resultCount, plural, one {タイプ} other {タイプ} } が見つかりました", - "visualizations.newVisWizard.searchSelection.notFoundLabel": "一致インデックスまたは保存した検索が見つかりません。", - "visualizations.newVisWizard.searchSelection.savedObjectType.indexPattern": "インデックスパターン", - "visualizations.newVisWizard.searchSelection.savedObjectType.search": "保存検索", - "visualizations.newVisWizard.selectVisType": "ビジュアライゼーションのタイプを選択してください", - "visualizations.newVisWizard.title": "新規ビジュアライゼーション", - "visualizations.newVisWizard.visTypeAliasDescription": "Visualize 外で Kibana アプリケーションを開きます。", - "visualizations.newVisWizard.visTypeAliasTitle": "Kibana アプリケーション", - "visualizations.savedObjectName": "ビジュアライゼーション", - "xpack.actions.actionTypeRegistry.get.missingActionTypeErrorMessage": "アクションタイプ \"{id}\" は登録されていません。", - "xpack.actions.actionTypeRegistry.register.duplicateActionTypeErrorMessage": "アクションタイプ \"{id}\" は既に登録されています。", - "xpack.actions.appName": "アクション", - "xpack.actions.builtin.email.errorSendingErrorMessage": "エラー送信メールアドレス", - "xpack.actions.builtin.emailTitle": "メール", - "xpack.actions.builtin.esIndex.errorIndexingErrorMessage": "エラーインデックス作成ドキュメント", - "xpack.actions.builtin.esIndexTitle": "インデックス", - "xpack.actions.builtin.pagerduty.pagerdutyConfigurationError": "pagerduty アクションの設定エラー: {message}", - "xpack.actions.builtin.pagerduty.postingErrorMessage": "pagerduty イベントの投稿エラー", - "xpack.actions.builtin.pagerduty.postingRetryErrorMessage": "pagerduty イベントの投稿エラー: http status {status}、後ほど再試行", - "xpack.actions.builtin.pagerduty.postingUnexpectedErrorMessage": "pagerduty イベントの投稿エラー: 予期せぬステータス {status}", - "xpack.actions.builtin.pagerdutyTitle": "PagerDuty", - "xpack.actions.builtin.serverLog.errorLoggingErrorMessage": "メッセージのロギングエラー", - "xpack.actions.builtin.serverLogTitle": "サーバーログ", - "xpack.actions.builtin.servicenow.emptyMapping": "[casesConfiguration.mapping]: 空以外の値が必要ですが空でした", - "xpack.actions.builtin.servicenow.informationAdded": "({date} に {user} が追加)", - "xpack.actions.builtin.servicenow.informationCreated": "({date} に {user} が作成)", - "xpack.actions.builtin.servicenow.informationDefault": "({date} に {user} が作成)", - "xpack.actions.builtin.servicenow.informationUpdated": "({date} に {user} が更新)", - "xpack.actions.builtin.servicenow.postingErrorMessage": "servicenow イベントの送信エラー", - "xpack.actions.builtin.servicenow.postingRetryErrorMessage": "servicenow イベントの送信エラー: http status {status}、後で再試行", - "xpack.actions.builtin.servicenow.postingUnexpectedErrorMessage": "servicenow イベントの送信エラー: 予期しないステータス {status}", - "xpack.actions.builtin.servicenow.servicenowApiNullError": "ServiceNow [apiUrl] が必要です", - "xpack.actions.builtin.servicenow.servicenowApiWhitelistError": "servicenow アクションの構成エラー: {message}", - "xpack.actions.builtin.servicenowTitle": "ServiceNow", - "xpack.actions.builtin.slack.errorPostingErrorMessage": "slack メッセージの投稿エラー", - "xpack.actions.builtin.slack.errorPostingRetryDateErrorMessage": "slack メッセージの投稿エラー、 {retryString} に再試行", - "xpack.actions.builtin.slack.errorPostingRetryLaterErrorMessage": "slack メッセージの投稿エラー、後ほど再試行", - "xpack.actions.builtin.slack.slackConfigurationError": "slack アクションの設定エラー: {message}", - "xpack.actions.builtin.slack.slackConfigurationErrorNoHostname": "slack アクションの構成エラー: Web フック URL からホスト名をパースできません", - "xpack.actions.builtin.slack.unexpectedHttpResponseErrorMessage": "slack からの予期せぬ http 応答: {httpStatus} {httpStatusText}", - "xpack.actions.builtin.slack.unexpectedNullResponseErrorMessage": "Slack から予期せぬ null 応答", - "xpack.actions.builtin.slackTitle": "Slack", - "xpack.actions.builtin.webhook.invalidResponseErrorMessage": "Webフックの呼び出しエラー、無効な応答", - "xpack.actions.builtin.webhook.invalidResponseRetryDateErrorMessage": "Webフックの呼び出しエラー、{retryString} に再試行", - "xpack.actions.builtin.webhook.invalidResponseRetryLaterErrorMessage": "Webフックの呼び出しエラー、後ほど再試行", - "xpack.actions.builtin.webhook.invalidUsernamePassword": "ユーザーとパスワードの両方を指定する必要があります", - "xpack.actions.builtin.webhook.unreachableErrorMessage": "webhookの呼び出しエラー、予期せぬエラー", - "xpack.actions.builtin.webhook.webhookConfigurationError": "Web フックアクションの構成中にエラーが発生: {message}", - "xpack.actions.builtin.webhookTitle": "Web フック", - "xpack.actions.disabledActionTypeError": "アクションタイプ \"{actionType}\" は、Kibana 構成 xpack.actions.enabledActionTypes では有効化されません", - "xpack.actions.serverSideErrors.expirerdLicenseErrorMessage": "{licenseType} ライセンスの期限が切れたのでアクションタイプ {actionTypeId} は無効です。", - "xpack.actions.serverSideErrors.invalidLicenseErrorMessage": "{licenseType} ライセンスでサポートされないのでアクションタイプ {actionTypeId} は無効です。ライセンスをアップグレードしてください。", - "xpack.actions.serverSideErrors.unavailableLicenseErrorMessage": "現時点でライセンス情報を入手できないため、アクションタイプ {actionTypeId} は無効です。", - "xpack.actions.serverSideErrors.unavailableLicenseInformationErrorMessage": "グラフを利用できません。現在ライセンス情報が利用できません。", - "xpack.actions.urlWhitelistConfigurationError": "target {field} \"{value}\" は Kibana 構成 xpack.actions.whitelistedHosts にはホワイトリスト化されていません。", - "xpack.advancedUiActions.components.actionWizard.changeButton": "変更", - "xpack.advancedUiActions.customizePanelTimeRange.modal.addToPanelButtonTitle": "パネルに追加", - "xpack.advancedUiActions.customizePanelTimeRange.modal.cancelButtonTitle": "キャンセル", - "xpack.advancedUiActions.customizePanelTimeRange.modal.optionsMenuForm.panelTitleFormRowLabel": "時間範囲", - "xpack.advancedUiActions.customizePanelTimeRange.modal.removeButtonTitle": "削除", - "xpack.advancedUiActions.customizePanelTimeRange.modal.updatePanelTimeRangeButtonTitle": "更新", - "xpack.advancedUiActions.customizeTimeRange.modal.headerTitle": "パネルの時間範囲のカスタマイズ", - "xpack.advancedUiActions.customizeTimeRangeMenuItem.displayName": "時間範囲のカスタマイズ", - "xpack.alerting.alertNavigationRegistry.get.missingNavigationError": "「{consumer}」内のアラートタイプ「{alertType}」のナビゲーションは登録されていません。", - "xpack.alerting.alertNavigationRegistry.register.duplicateDefaultError": "「{consumer}」内のデフォルトナビゲーションは既に登録されています。", - "xpack.alerting.alertNavigationRegistry.register.duplicateNavigationError": "「{consumer}」内のアラートタイプ「{alertType}」のナビゲーションは既に登録されています。", - "xpack.alerting.alertsClient.validateActions.invalidGroups": "無効なアクショングループ: {groups}", - "xpack.alerting.alertTypeRegistry.get.missingAlertTypeError": "アラートタイプ\"{id}\"は登録されていません。", - "xpack.alerting.alertTypeRegistry.register.duplicateAlertTypeError": "アラートタイプ\"{id}\"は既に登録されています。", - "xpack.alerting.api.error.disabledApiKeys": "アラートは API キーに依存しますがキーが無効になっているようです", - "xpack.alerting.appName": "アラート", - "xpack.alerting.loadAlertType.missingAlertTypeError": "アラートタイプ「{id}」は登録されていません。", - "xpack.alerting.serverSideErrors.unavailableLicenseInformationErrorMessage": "アラートを利用できません。現在ライセンス情報が利用できません。", - "xpack.alertingBuiltins.indexThreshold.actionGroupThresholdMetTitle": "しきい値一致", - "xpack.alertingBuiltins.indexThreshold.actionVariableContextDateLabel": "アラートがしきい値を超えた日付。", - "xpack.alertingBuiltins.indexThreshold.actionVariableContextGroupLabel": "しきい値を超えたグループ。", - "xpack.alertingBuiltins.indexThreshold.actionVariableContextMessageLabel": "アラートの事前構成メッセージ。", - "xpack.alertingBuiltins.indexThreshold.actionVariableContextTitleLabel": "アラートの事前構成タイトル。", - "xpack.alertingBuiltins.indexThreshold.actionVariableContextValueLabel": "しきい値を超えた値。", - "xpack.alertingBuiltins.indexThreshold.aggTypeRequiredErrorMessage": "[aggType] が「{aggType}」のときには [aggField] に値が必要です", - "xpack.alertingBuiltins.indexThreshold.alertTypeContextMessageDescription": "アラート {name} グループ {group} 値 {value} が {date} に {window} にわたってしきい値 {function} を超えました", - "xpack.alertingBuiltins.indexThreshold.alertTypeContextSubjectTitle": "アラート {name} グループ {group} がしきい値を超えました", - "xpack.alertingBuiltins.indexThreshold.alertTypeTitle": "インデックスしきい値", - "xpack.alertingBuiltins.indexThreshold.dateStartGTdateEndErrorMessage": "[dateStart] が [dateEnd] よりも大です", - "xpack.alertingBuiltins.indexThreshold.formattedFieldErrorMessage": "{fieldName} の無効な {formatName} 形式:「{fieldValue}」", - "xpack.alertingBuiltins.indexThreshold.intervalRequiredErrorMessage": "[interval]: [dateStart] が [dateEnd] と等しくない場合に指定する必要があります", - "xpack.alertingBuiltins.indexThreshold.invalidAggTypeErrorMessage": "無効な aggType:「{aggType}」", - "xpack.alertingBuiltins.indexThreshold.invalidComparatorErrorMessage": "無効な thresholdComparator が指定されました: {comparator}", - "xpack.alertingBuiltins.indexThreshold.invalidDateErrorMessage": "無効な日付 {date}", - "xpack.alertingBuiltins.indexThreshold.invalidDurationErrorMessage": "無効な期間:「{duration}」", - "xpack.alertingBuiltins.indexThreshold.invalidGroupByErrorMessage": "無効な groupBy:「{groupBy}」", - "xpack.alertingBuiltins.indexThreshold.invalidTermSizeMaximumErrorMessage": "[termSize]: {maxGroups} 以下でなければなりません。", - "xpack.alertingBuiltins.indexThreshold.invalidThreshold2ErrorMessage": "[threshold]: 「{thresholdComparator}」比較子の場合には 2 つの要素が必要です", - "xpack.alertingBuiltins.indexThreshold.invalidTimeWindowUnitsErrorMessage": "無効な timeWindowUnit:「{timeWindowUnit}」", - "xpack.alertingBuiltins.indexThreshold.maxIntervalsErrorMessage": "間隔 {intervals} の計算値が {maxIntervals} よりも大です", - "xpack.alertingBuiltins.indexThreshold.termFieldRequiredErrorMessage": "[termField]: [groupBy] がトップのときには termField が必要です", - "xpack.alertingBuiltins.indexThreshold.termSizeRequiredErrorMessage": "[termSize]: [groupBy] がトップのときには termSize が必要です", - "xpack.apm.agentConfig.allOptionLabel": "すべて", - "xpack.apm.agentConfig.apiRequestSize.description": "チャンクエンコーディング (HTTP ストリーミング) を経由して APM Server インテーク API に送信されるリクエスト本文の最大合計圧縮サイズ。\nわずかなオーバーシュートの可能性があることに注意してください。\n\n使用できるバイト単位は、「b」、「kb」、「mb」です。「1kb」は「1024b」と等価です。", - "xpack.apm.agentConfig.apiRequestSize.label": "API リクエストサイズ", - "xpack.apm.agentConfig.apiRequestTime.description": "APM Server への HTTP リクエストを開いておく最大時間。\n\n注:この値は、APM Server の「read_timeout」設定よりも低くする必要があります。", - "xpack.apm.agentConfig.apiRequestTime.label": "API リクエスト時間", - "xpack.apm.agentConfig.bytes.errorText": "整数と単位を指定してください", - "xpack.apm.agentConfig.captureBody.description": "HTTP リクエストのトランザクションの場合、エージェントはオプションとしてリクエスト本文 (POST 変数など) をキャプチャすることができます。デフォルトは「off」です。", - "xpack.apm.agentConfig.captureBody.label": "本文をキャプチャ", - "xpack.apm.agentConfig.captureHeaders.description": "「true」に設定すると、エージェントは Cookie を含むリクエストヘッダーとレスポンスヘッダーをキャプチャします。\n\n注:これを「false」に設定すると、ネットワーク帯域幅、ディスク容量、およびオブジェクト割り当てが減少します。", - "xpack.apm.agentConfig.captureHeaders.label": "ヘッダーのキャプチャ", - "xpack.apm.agentConfig.chooseService.editButton": "編集", - "xpack.apm.agentConfig.chooseService.service.environment.label": "環境", - "xpack.apm.agentConfig.chooseService.service.name.label": "サービス名", - "xpack.apm.agentConfig.chooseService.title": "サービスを選択", - "xpack.apm.agentConfig.circuitBreakerEnabled.description": "Circuit Breaker を有効にすべきかどうかを指定するブール値。\n有効にすると、エージェントは定期的にストレス監視をポーリングして、システム/プロセス/JVM のストレス状態を検出します。\n監視のいずれかがストレスの兆候を検出した場合、<> 構成オプションの設定が「false」であるかのようにエージェントは非アクティブになり、リソース消費を最小限に抑えられます。 \n\n非アクティブな場合、エージェントはストレス状態が緩和されたかどうかを検出するために同じ監視のポーリングを継続します。 \nすべての監視でシステム/プロセス/JVM にストレスがないことが認められると、エージェントは再開して完全に機能します。", - "xpack.apm.agentConfig.circuitBreakerEnabled.label": "Cirtcuit Breaker が有効", - "xpack.apm.agentConfig.configTable.appliedTooltipMessage": "1 つ以上のエージェントにより適用されました", - "xpack.apm.agentConfig.configTable.configTable.failurePromptText": "エージェントの構成一覧を取得できませんでした。ユーザーに十分なパーミッションがない可能性があります。", - "xpack.apm.agentConfig.configTable.createConfigButtonLabel": "構成の作成", - "xpack.apm.agentConfig.configTable.emptyPromptText": "変更しましょう。Kibana からエージェント構成を直接的に微調整できます。再展開する必要はありません。まず、最初の構成を作成します。", - "xpack.apm.agentConfig.configTable.emptyPromptTitle": "構成が見つかりません。", - "xpack.apm.agentConfig.configTable.environmentColumnLabel": "サービス環境", - "xpack.apm.agentConfig.configTable.lastUpdatedColumnLabel": "最終更新", - "xpack.apm.agentConfig.configTable.notAppliedTooltipMessage": "まだエージェントにより適用されていません", - "xpack.apm.agentConfig.configTable.serviceNameColumnLabel": "サービス名", - "xpack.apm.agentConfig.configurationsPanelTitle": "構成", - "xpack.apm.agentConfig.createConfigButtonLabel": "構成の作成", - "xpack.apm.agentConfig.createConfigTitle": "構成の作成", - "xpack.apm.agentConfig.deleteModal.cancel": "キャンセル", - "xpack.apm.agentConfig.deleteModal.confirm": "削除", - "xpack.apm.agentConfig.deleteModal.text": "サービス「{serviceName}」と環境「{environment}」の構成を削除しようとしています。", - "xpack.apm.agentConfig.deleteModal.title": "構成を削除", - "xpack.apm.agentConfig.deleteSection.deleteConfigFailedText": "「{serviceName}」の構成を削除中に問題が発生しました。エラー: 「{errorMessage}」", - "xpack.apm.agentConfig.deleteSection.deleteConfigFailedTitle": "構成を削除できませんでした", - "xpack.apm.agentConfig.deleteSection.deleteConfigSucceededText": "「{serviceName}」の構成が正常に削除されました。エージェントに反映されるまでに少し時間がかかります。", - "xpack.apm.agentConfig.deleteSection.deleteConfigSucceededTitle": "構成が削除されました", - "xpack.apm.agentConfig.editConfigTitle": "構成の編集", - "xpack.apm.agentConfig.enableLogCorrelation.description": "エージェントが SLF4J のhttps://www.slf4j.org/api/org/slf4j/MDC.html[MDC] と融合してトレースログ相関を有効にすべきかどうかを指定するブール値。\n「true」に設定した場合、エージェントは現在アクティブなスパンとトランザクションの「trace.id」と「transaction.id」を MDC に設定します。\n詳細は <> をご覧ください。\n\n注:実行時にこの設定を有効にできますが、再起動しないと無効にはできません。", - "xpack.apm.agentConfig.enableLogCorrelation.label": "ログ相関を有効にする", - "xpack.apm.agentConfig.float.errorText": "0.000 から 1 までの数字でなければなりません", - "xpack.apm.agentConfig.integer.errorText": "整数でなければなりません", - "xpack.apm.agentConfig.logLevel.description": "エージェントのログ記録レベルを設定します", - "xpack.apm.agentConfig.logLevel.label": "ログレベル", - "xpack.apm.agentConfig.newConfig.description": "これで Kibana でエージェント構成を直接的に微調整できます。\n しかも、変更は APM エージェントに自動的に伝達されるので、再デプロイする必要はありません。", - "xpack.apm.agentConfig.profilingInferredSpansEnabled.description": "「true」に設定すると、エージェントは、別名統計プロファイラーと呼ばれるサンプリングプロファイラーである https://github.com/jvm-profiling-tools/async-profiler[async-profiler] に基づいてメソッド実行用のスパンを作成します。サンプリングプロファイラーのしくみの性質上、推定スパンの期間は厳密ではなく見込みのみです。<<config-profiling-inferred-spans-sampling-interval, `profiling_inferred_spans_sampling_interval`>> で精度とオーバーヘッドのトレードオフを微調整できます。\n推定スパンは、プロファイルセッションの終了後に作成されます。つまり、通常のスパンと推定スパンの間には UI に表示されるタイミングに遅延があります。注:この機能は Windows で使用できません。", - "xpack.apm.agentConfig.profilingInferredSpansEnabled.label": "プロファイル推定スパンが有効です", - "xpack.apm.agentConfig.profilingInferredSpansExcludedClasses.description": "プロファイラー推定スパンを作成する必要がないクラスを除外します。\n\nこのオプションは、0 文字以上に一致するワイルドカード「*」をサポートします。\n例: 「/foo/*/bar/*/baz*」、「*foo*」\nデフォルトでは、照合時に大文字と小文字の区別はありません。\n要素の前に「(?-i)」を付けると、照合時に大文字と小文字が区別されます。", - "xpack.apm.agentConfig.profilingInferredSpansExcludedClasses.label": "プロファイル推定スパンでクラスを除外しました", - "xpack.apm.agentConfig.profilingInferredSpansIncludedClasses.description": "設定した場合、エージェントは、このリストに一致するメソッドの推定スパンのみを作成します。\n値を設定すると、パフォーマンスがわずかに向上することがあり、関心あるクラスのスパンのみを作成することによって煩雑になるのを防止できます。\n例:「org.example.myapp.*」\n\nこのオプションは、0 文字以上に一致するワイルドカード「*」をサポートします。\n例: 「/foo/*/bar/*/baz*」、「*foo*」\nデフォルトでは、照合時に大文字と小文字の区別はありません。\n要素の前に「(?-i)」を付けると、照合時に大文字と小文字が区別されます。", - "xpack.apm.agentConfig.profilingInferredSpansIncludedClasses.label": "プロファイル推定スパンでクラスを包含しました", - "xpack.apm.agentConfig.profilingInferredSpansMinDuration.description": "推定スパンの最小期間。\n最小期間もサンプリング間隔によって暗黙的に設定されることに注意してください。\nただし、サンプリング間隔を大きくすると、推定スパンの期間の精度も低下します。", - "xpack.apm.agentConfig.profilingInferredSpansMinDuration.label": "プロファイル推定スパン最小期間", - "xpack.apm.agentConfig.profilingInferredSpansSamplingInterval.description": "プロファイルセッション内でスタックトレースを収集する頻度。\n低い値に設定するほど継続時間の精度が上がります。\nその代わり、オーバーヘッドが増し、潜在的に無関係なオペレーションのスパンが増えるという犠牲が伴います。\nプロファイル推定スパンの最小期間は、この設定値と同じです。", - "xpack.apm.agentConfig.profilingInferredSpansSamplingInterval.label": "プロファイル推定サンプリング間隔", - "xpack.apm.agentConfig.saveConfig.failed.text": "「{serviceName}」の構成を保存中に問題が発生しました。エラー: 「{errorMessage}」", - "xpack.apm.agentConfig.saveConfig.failed.title": "構成を保存できませんでした", - "xpack.apm.agentConfig.saveConfig.succeeded.text": "「{serviceName}」の構成を保存しました。エージェントに反映されるまでに少し時間がかかります。", - "xpack.apm.agentConfig.saveConfig.succeeded.title": "構成が保存されました", - "xpack.apm.agentConfig.saveConfigurationButtonLabel": "次のステップ", - "xpack.apm.agentConfig.serverTimeout.description": "APM Server へのリクエストにかかる時間が設定したタイムアウトよりも長い場合、リクエストは中止され、イベント (例外またはトランザクション) は破棄されます。\n\n0 に設定するとタイムアウトが無効になります。\n\n警告:タイムアウトが無効か高い値に設定されている場合、APM Server がタイムアウトになると、アプリでメモリの問題が発生する可能性があります。", - "xpack.apm.agentConfig.serverTimeout.label": "サーバータイムアウト", - "xpack.apm.agentConfig.servicePage.alreadyConfiguredOption": "既に構成済み", - "xpack.apm.agentConfig.servicePage.cancelButton": "キャンセル", - "xpack.apm.agentConfig.servicePage.environment.description": "構成ごとに 1 つの環境のみがサポートされます。", - "xpack.apm.agentConfig.servicePage.environment.fieldLabel": "サービス環境", - "xpack.apm.agentConfig.servicePage.environment.title": "環境", - "xpack.apm.agentConfig.servicePage.service.description": "構成するサービスを選択してください。", - "xpack.apm.agentConfig.servicePage.service.fieldLabel": "サービス名", - "xpack.apm.agentConfig.servicePage.service.title": "サービス", - "xpack.apm.agentConfig.servicePage.title": "サービスを選択", - "xpack.apm.agentConfig.settings.title": "構成オプション", - "xpack.apm.agentConfig.settingsPage.discardChangesButton": "変更を破棄", - "xpack.apm.agentConfig.settingsPage.notFound.message": "リクエストされた構成が存在しません", - "xpack.apm.agentConfig.settingsPage.notFound.title": "申し訳ございません、エラーが発生しました", - "xpack.apm.agentConfig.settingsPage.saveButton": "構成を保存", - "xpack.apm.agentConfig.spanFramesMinDuration.description": "デフォルト設定では、APM エージェントは記録されたすべてのスパンでスタックトレースを収集します。\nこれはコード内でスパンの原因になる厳密な場所を見つけるうえで非常に役立ちますが、このスタックトレースを収集するとオーバーヘッドが生じます。\nこのオプションを負の値 (「-1ms」など) に設定すると、すべてのスパンのスタックトレースが収集されます。正の値 (たとえば、「5 ms」) に設定すると、スタックトレース収集を、指定値 (たとえば、5ミリ秒) 以上の期間にわたるスパンに制限されます。\n\nスパンのスタックトレース収集を完全に無効にするには、値を「0ms」に設定します。", - "xpack.apm.agentConfig.spanFramesMinDuration.label": "スパンフレーム最小期間", - "xpack.apm.agentConfig.stackTraceLimit.description": "0 に設定するとスタックトレース収集が無効になります。収集するフレームの最大数として正の整数値が使用されます。 -1 に設定すると、すべてのフレームが収集されます。", - "xpack.apm.agentConfig.stackTraceLimit.label": "スタックトレース制限", - "xpack.apm.agentConfig.stressMonitorCpuDurationThreshold.description": "システムに現在ストレスがかかっているか、それとも以前に検出したストレスが緩和されたかを判断するために必要な最小時間。 \n\nこの時期のすべての測定は、関連しきい値と比較してストレス状態の変化を検出できるように一貫性が必要です。 \n「1m」以上にする必要があります。", - "xpack.apm.agentConfig.stressMonitorCpuDurationThreshold.label": "ストレス監視 CPU 期間しきい値", - "xpack.apm.agentConfig.stressMonitorGcReliefThreshold.description": "ヒープにストレスがかからない時期を特定するために GC 監視で使用するしきい値。\n「stress_monitor_gc_stress_threshold」を超えた場合、エージェントはそれをヒープストレス状態と見なします。\nストレス状態が収まったことを確認するには、すべてのヒーププールで占有メモリの割合がこのしきい値よりも低いことを確認します。 \nGC 監視は、直近の GC の後で測定したメモリ消費のみに依存します。", - "xpack.apm.agentConfig.stressMonitorGcReliefThreshold.label": "ストレス監視システム GC 緩和しきい値", - "xpack.apm.agentConfig.stressMonitorGcStressThreshold.description": "ヒープストレスを特定するために GC 監視で使用するしきい値。\nすべてのヒーププールに同じしきい値が使用され、いずれかの使用率がその値を超える場合、エージェントはそれをヒープストレスと見なします。\nGC 監視は、直近の GC の後で測定したメモリ消費のみに依存します。", - "xpack.apm.agentConfig.stressMonitorGcStressThreshold.label": "ストレス監視システム GC ストレスしきい値", - "xpack.apm.agentConfig.stressMonitorSystemCpuReliefThreshold.description": "システムに CPU ストレスがかかっていないことを判断するためにシステム CPU 監視で使用するしきい値。 \n監視機能で CPU ストレスを検出した場合に CPU ストレスが緩和されたと判断するには、測定されたシステム CPU が「stress_monitor_cpu_duration_threshold」と同じ長さ以上の期間にわたってこのしきい値を下回る必要があります。", - "xpack.apm.agentConfig.stressMonitorSystemCpuReliefThreshold.label": "ストレス監視システム CPU 緩和しきい値", - "xpack.apm.agentConfig.stressMonitorSystemCpuStressThreshold.description": "システム CPU 監視でシステム CPU ストレスの検出に使用するしきい値。\nシステム CPU が少なくとも「stress_monitor_cpu_duration_threshold」と同じ長さ以上の期間にわたってこのしきい値を超えると、監視機能はこれをストレス状態と見なします。", - "xpack.apm.agentConfig.stressMonitorSystemCpuStressThreshold.label": "ストレス監視システム CPU ストレスしきい値", - "xpack.apm.agentConfig.transactionMaxSpans.description": "トランザクションごとに記録される範囲を制限します。デフォルトは 500 です。", - "xpack.apm.agentConfig.transactionMaxSpans.errorText": "0 と 32000 の間でなければなりません", - "xpack.apm.agentConfig.transactionMaxSpans.label": "トランザクションの最大範囲", - "xpack.apm.agentConfig.transactionSampleRate.description": "デフォルトでは、エージェントはすべてのトランザクション (例えば、サービスへのリクエストなど) をサンプリングします。オーバーヘッドやストレージ要件を減らすには、サンプルレートの値を 0.0〜1.0 に設定します。全体的な時間とサンプリングされないトランザクションの結果は記録されますが、コンテキスト情報、ラベル、スパンは記録されません。", - "xpack.apm.agentConfig.transactionSampleRate.label": "トランザクションのサンプルレート", - "xpack.apm.agentConfig.unsavedSetting.tooltip": "未保存", - "xpack.apm.agentMetrics.java.gcRate": "GC レート", - "xpack.apm.agentMetrics.java.gcRateChartTitle": "1 分ごとのごみ収集レート", - "xpack.apm.agentMetrics.java.gcTime": "GC 時間", - "xpack.apm.agentMetrics.java.gcTimeChartTitle": "1 分ごとのごみ収集の時間", - "xpack.apm.agentMetrics.java.heapMemoryChartTitle": "ヒープ領域", - "xpack.apm.agentMetrics.java.heapMemorySeriesCommitted": "平均実行割当", - "xpack.apm.agentMetrics.java.heapMemorySeriesMax": "平均制限", - "xpack.apm.agentMetrics.java.heapMemorySeriesUsed": "平均使用", - "xpack.apm.agentMetrics.java.nonHeapMemoryChartTitle": "ヒープ領域以外", - "xpack.apm.agentMetrics.java.nonHeapMemorySeriesCommitted": "平均実行割当", - "xpack.apm.agentMetrics.java.nonHeapMemorySeriesUsed": "平均使用", - "xpack.apm.agentMetrics.java.threadCount": "平均カウント", - "xpack.apm.agentMetrics.java.threadCountChartTitle": "スレッド数", - "xpack.apm.agentMetrics.java.threadCountMax": "最高カウント", - "xpack.apm.alertTypes.errorRate": "エラー率", - "xpack.apm.alertTypes.transactionDuration": "トランザクション期間", - "xpack.apm.apmDescription": "アプリケーション内から自動的に詳細なパフォーマンスメトリックやエラーを集めます。", - "xpack.apm.apmForESDescription": "Elastic Stack 用の APM", - "xpack.apm.applyFilter": "{title} フィルターを適用", - "xpack.apm.applyOptions": "オプションを適用", - "xpack.apm.breadcrumb.errorsTitle": "エラー", - "xpack.apm.breadcrumb.listSettingsTitle": "設定", - "xpack.apm.breadcrumb.metricsTitle": "メトリック", - "xpack.apm.breadcrumb.nodesTitle": "JVM", - "xpack.apm.breadcrumb.serviceMapTitle": "サービスマップ", - "xpack.apm.breadcrumb.servicesTitle": "サービス", - "xpack.apm.breadcrumb.settings.agentConfigurationTitle": "エージェントの編集", - "xpack.apm.breadcrumb.settings.createAgentConfigurationTitle": "エージェント構成の作成", - "xpack.apm.breadcrumb.settings.customizeUI": "UI をカスタマイズ", - "xpack.apm.breadcrumb.settings.editAgentConfigurationTitle": "エージェント構成の編集", - "xpack.apm.breadcrumb.settings.indicesTitle": "インデックス", - "xpack.apm.breadcrumb.tracesTitle": "トレース", - "xpack.apm.breadcrumb.transactionsTitle": "トランザクション", - "xpack.apm.chart.cpuSeries.processAverageLabel": "プロセス平均", - "xpack.apm.chart.cpuSeries.processMaxLabel": "プロセス最大", - "xpack.apm.chart.cpuSeries.systemAverageLabel": "システム平均", - "xpack.apm.chart.cpuSeries.systemMaxLabel": "システム最大", - "xpack.apm.chart.memorySeries.systemAverageLabel": "平均", - "xpack.apm.chart.memorySeries.systemMaxLabel": "最高", - "xpack.apm.clearFilters": "フィルターを消去", - "xpack.apm.customLink.buttom.create": "カスタムリンクを作成", - "xpack.apm.customLink.buttom.create.title": "作成", - "xpack.apm.customLink.buttom.manage": "カスタムリンクを管理", - "xpack.apm.customLink.empty": "カスタムリンクが見つかりません。独自のカスタムリンク、つまり特定のダッシュボードまたは外部リンクへのリンクをセットアップします。", - "xpack.apm.datePicker.last15MinutesLabel": "過去 15 分間", - "xpack.apm.datePicker.last1HourLabel": "過去 1 時間", - "xpack.apm.datePicker.last1YearLabel": "過去 1 年間", - "xpack.apm.datePicker.last24HoursLabel": "過去 24 時間", - "xpack.apm.datePicker.last30DaysLabel": "過去 30 日間", - "xpack.apm.datePicker.last30MinutesLabel": "過去 30 分間", - "xpack.apm.datePicker.last7DaysLabel": "過去 7 日間", - "xpack.apm.datePicker.last90DaysLabel": "過去 90 日間", - "xpack.apm.emptyMessage.noDataFoundDescription": "別の時間範囲を試すか検索フィルターをリセットしてください。", - "xpack.apm.emptyMessage.noDataFoundLabel": "データが見つかりません。", - "xpack.apm.error.prompt.body": "詳細はブラウザの開発者コンソールをご確認ください。", - "xpack.apm.error.prompt.title": "申し訳ございませんが、エラーが発生しました :(", - "xpack.apm.errorGroupDetails.culpritLabel": "原因", - "xpack.apm.errorGroupDetails.errorGroupTitle": "エラーグループ {errorGroupId}", - "xpack.apm.errorGroupDetails.errorOccurrenceTitle": "エラーのオカレンス", - "xpack.apm.errorGroupDetails.exceptionMessageLabel": "例外メッセージ", - "xpack.apm.errorGroupDetails.logMessageLabel": "ログメッセージ", - "xpack.apm.errorGroupDetails.noErrorsLabel": "エラーが見つかりませんでした", - "xpack.apm.errorGroupDetails.occurrencesChartLabel": "オカレンス", - "xpack.apm.errorGroupDetails.occurrencesLongLabel": "{occCount} 件", - "xpack.apm.errorGroupDetails.occurrencesShortLabel": "{occCount} 件", - "xpack.apm.errorGroupDetails.relatedTransactionSample": "関連トランザクションサンプル", - "xpack.apm.errorGroupDetails.unhandledLabel": "未対応", - "xpack.apm.errorGroupDetails.viewOccurrencesInDiscoverButtonLabel": "ディスカバリで {occurrencesCount} 件の{occurrencesCount, plural, one {ドキュメント} other {ドキュメント}}を表示。", - "xpack.apm.errorRateAlert.name": "エラー率しきい値", - "xpack.apm.errorRateAlert.thresholdMet": "しきい値一致", - "xpack.apm.errorRateAlertTrigger.errors": "エラー", - "xpack.apm.errorRateAlertTrigger.isAbove": "の下限は", - "xpack.apm.errorsTable.errorMessageAndCulpritColumnLabel": "エラーメッセージと原因", - "xpack.apm.errorsTable.groupIdColumnLabel": "グループ ID", - "xpack.apm.errorsTable.latestOccurrenceColumnLabel": "最近のオカレンス", - "xpack.apm.errorsTable.noErrorsLabel": "エラーが見つかりませんでした", - "xpack.apm.errorsTable.occurrencesColumnLabel": "オカレンス", - "xpack.apm.errorsTable.unhandledLabel": "未対応", - "xpack.apm.featureRegistry.apmFeatureName": "APM", - "xpack.apm.feedbackMenu.appName": "APM", - "xpack.apm.fetcher.error.status": "エラー", - "xpack.apm.fetcher.error.title": "リソースの取得中にエラーが発生しました", - "xpack.apm.fetcher.error.url": "URL", - "xpack.apm.filter.environment.allLabel": "すべて", - "xpack.apm.filter.environment.label": "環境", - "xpack.apm.filter.environment.notDefinedLabel": "未定義", - "xpack.apm.filter.environment.selectEnvironmentLabel": "環境を選択", - "xpack.apm.formatters.hoursTimeUnitLabel": "h", - "xpack.apm.formatters.microsTimeUnitLabel": "マイクロ秒", - "xpack.apm.formatters.millisTimeUnitLabel": "ミリ秒", - "xpack.apm.formatters.minutesTimeUnitLabel": "最低", - "xpack.apm.formatters.requestsPerMinLabel": "1分あたりリクエスト数", - "xpack.apm.formatters.secondsTimeUnitLabel": "秒", - "xpack.apm.formatters.transactionsPerMinLabel": "1分あたりトランザクション数", - "xpack.apm.header.badge.readOnly.text": "読み込み専用", - "xpack.apm.header.badge.readOnly.tooltip": "を保存できませんでした", - "xpack.apm.helpMenu.upgradeAssistantLink": "アップグレードアシスタント", - "xpack.apm.home.serviceMapTabLabel": "サービスマップ", - "xpack.apm.home.servicesTabLabel": "サービス", - "xpack.apm.home.tracesTabLabel": "トレース", - "xpack.apm.invalidLicense.licenseManagementLink": "ライセンスを更新", - "xpack.apm.invalidLicense.message": "現在ご使用のライセンスが期限切れか有効でなくなったため、APM UI を利用できません。", - "xpack.apm.invalidLicense.title": "無効なライセンス", - "xpack.apm.jvmsTable.cpuColumnLabel": "CPU 平均", - "xpack.apm.jvmsTable.explainServiceNodeNameMissing": "これらのメトリックが所属する JVM を特定できませんでした。7.5 よりも古い APM Server を実行していることが原因である可能性が高いです。この問題は APM Server 7.5 以降にアップグレードすることで解決されます。", - "xpack.apm.jvmsTable.heapMemoryColumnLabel": "ヒープ領域の平均", - "xpack.apm.jvmsTable.nameColumnLabel": "名前", - "xpack.apm.jvmsTable.nameExplanation": "JVM 名はデフォルトでコンピューター ID (該当する場合) またはホスト名ですが、エージェントの「'service_node_name」で手動で構成することもできます。", - "xpack.apm.jvmsTable.noJvmsLabel": "JVM が見つかりませんでした", - "xpack.apm.jvmsTable.nonHeapMemoryColumnLabel": "非ヒープ領域の平均", - "xpack.apm.jvmsTable.threadCountColumnLabel": "最大スレッド数", - "xpack.apm.kueryBar.disabledPlaceholder": "サービスマップの検索は利用できません", - "xpack.apm.kueryBar.placeholder": "検索 {event, select,\n トランザクション {transactions}\n メトリック: {metric}\n エラー {errors}\n その他 {transactions, errors and metrics}\n } (E.g. {queryExample})", - "xpack.apm.license.betaBadge": "ベータ", - "xpack.apm.license.betaTooltipMessage": "現在、この機能はベータです。不具合を見つけた場合やご意見がある場合、サポートに問い合わせるか、またはディスカッションフォーラムにご報告ください。", - "xpack.apm.license.button": "トライアルを開始", - "xpack.apm.license.title": "無料の 30 日トライアルを開始", - "xpack.apm.loadingServiceMap": "サービスマップを読み込み中...多少時間がかかる場合があります。", - "xpack.apm.localFilters.titles.agentName": "エージェント名", - "xpack.apm.localFilters.titles.containerId": "コンテナー ID", - "xpack.apm.localFilters.titles.host": "ホスト", - "xpack.apm.localFilters.titles.podName": "Kubernetes ポッド", - "xpack.apm.localFilters.titles.serviceVersion": "サービスバージョン", - "xpack.apm.localFilters.titles.transactionResult": "トランザクション結果", - "xpack.apm.localFilters.titles.transactionType": "トランザクションタイプ", - "xpack.apm.localFiltersTitle": "各種フィルター", - "xpack.apm.metadataTable.section.agentLabel": "エージェント", - "xpack.apm.metadataTable.section.clientLabel": "クライアント", - "xpack.apm.metadataTable.section.containerLabel": "コンテナー", - "xpack.apm.metadataTable.section.customLabel": "カスタム", - "xpack.apm.metadataTable.section.errorLabel": "エラー", - "xpack.apm.metadataTable.section.hostLabel": "ホスト", - "xpack.apm.metadataTable.section.httpLabel": "HTTP", - "xpack.apm.metadataTable.section.labelsLabel": "ラベル", - "xpack.apm.metadataTable.section.messageLabel": "メッセージ", - "xpack.apm.metadataTable.section.pageLabel": "ページ", - "xpack.apm.metadataTable.section.processLabel": "プロセス", - "xpack.apm.metadataTable.section.serviceLabel": "サービス", - "xpack.apm.metadataTable.section.spanLabel": "スパン", - "xpack.apm.metadataTable.section.traceLabel": "トレース", - "xpack.apm.metadataTable.section.transactionLabel": "トランザクション", - "xpack.apm.metadataTable.section.urlLabel": "URL", - "xpack.apm.metadataTable.section.userAgentLabel": "ユーザーエージェント", - "xpack.apm.metadataTable.section.userLabel": "ユーザー", - "xpack.apm.metrics.durationByCountryMap.avgPageLoadByCountryLabel": "国ごとの平均ページ読み込み時間の分布", - "xpack.apm.metrics.durationByCountryMap.RegionMapChart.ToolTip.avgPageLoadDuration": "平均ページ読み込み時間:", - "xpack.apm.metrics.durationByCountryMap.RegionMapChart.ToolTip.countPageLoads": "{docCount} ページの読み込み", - "xpack.apm.metrics.pageLoadCharts.avgPageLoadByBrowser": "ブラウザごとの平均ページ読み込み時間の分布", - "xpack.apm.metrics.plot.noDataLabel": "この時間範囲のデータがありません。", - "xpack.apm.metrics.transactionChart.machineLearningLabel": "機械学習:", - "xpack.apm.metrics.transactionChart.machineLearningTooltip": "平均期間の周りのストリームには予測バウンドが表示されます。異常スコアが >= 75 の場合、注釈が表示されます。", - "xpack.apm.metrics.transactionChart.pageLoadTimesLabel": "ページ読み込み時間", - "xpack.apm.metrics.transactionChart.requestsPerMinuteLabel": "1 分あたりのリクエスト", - "xpack.apm.metrics.transactionChart.routeChangeTimesLabel": "ルート変更時間", - "xpack.apm.metrics.transactionChart.transactionDurationLabel": "トランザクション時間", - "xpack.apm.metrics.transactionChart.transactionsPerMinuteLabel": "1 分あたりのトランザクション数", - "xpack.apm.notAvailableLabel": "N/A", - "xpack.apm.percentOfParent": "({parentType, select, transaction { 件中 {value} 件のトランザクション} トレース {trace} })", - "xpack.apm.permission.apm": "APM", - "xpack.apm.permission.description": "このユーザーには、すべての APM インデックスへのアクセス権がありません。APM アプリを使用できますが、一部のデータが欠けることがあります。以下のインデックスへのアクセス権が必要です。", - "xpack.apm.permission.dismissWarning": "閉じる", - "xpack.apm.permission.learnMore": "APM パーミッションの詳細を表示", - "xpack.apm.permission.title": "APM へのアクセス権がありません", - "xpack.apm.propertiesTable.agentFeature.noDataAvailableLabel": "利用可能なデータがありません", - "xpack.apm.propertiesTable.agentFeature.noResultFound": "\"{value}\"に対する結果が見つかりませんでした。", - "xpack.apm.propertiesTable.tabs.exceptionStacktraceLabel": "例外のスタックトレース", - "xpack.apm.propertiesTable.tabs.logStacktraceLabel": "スタックトレース", - "xpack.apm.propertiesTable.tabs.metadataLabel": "メタデータ", - "xpack.apm.propertiesTable.tabs.timelineLabel": "タイムライン", - "xpack.apm.searchInput.filter": "フィルター...", - "xpack.apm.selectPlaceholder": "オプションを選択:", - "xpack.apm.serviceDetails.alertsMenu.alerts": "アラート", - "xpack.apm.serviceDetails.alertsMenu.createThresholdAlert": "しきい値アラートを作成", - "xpack.apm.serviceDetails.alertsMenu.errorRate": "エラー率", - "xpack.apm.serviceDetails.alertsMenu.transactionDuration": "トランザクション期間", - "xpack.apm.serviceDetails.alertsMenu.viewActiveAlerts": "アクティブアラートを表示", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.callout.jobExistsDescription": "現在 {serviceName} ({transactionType}) の実行中のジョブがあります。", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.callout.jobExistsDescription.viewJobLinkText": "既存のジョブを表示", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.callout.jobExistsTitle": "ジョブが既に存在します", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.createMLJobDescription": "ここでは、{serviceName} 数列内の APM トランザクションの期間の異常スコアを計算する機械学習ジョブを作成できます。有効にすると、{transactionDurationGraphText} が予測バウンドを表示し、異常スコアが >=75 の場合グラフに注釈が追加されます。", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.createMLJobDescription.transactionDurationGraphText": "トランザクション時間のグラフ", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.createNewJobButtonLabel": "ジョブを作成", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.enableAnomalyDetectionTitle": "異常検知を有効にする", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.jobCreatedNotificationText": "現在 {serviceName} ({transactionType}) の分析を実行中です。応答時間グラフに結果が追加されるまで少し時間がかかる場合があります。", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.jobCreatedNotificationText.viewJobLinkText": "ジョブを表示", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.jobCreatedNotificationTitle": "ジョブが作成されました", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.jobCreationFailedNotificationText": "現在のライセンスでは機械学習ジョブの作成が許可されていないか、ジョブが既に存在する可能性があります。", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.jobCreationFailedNotificationTitle": "ジョブの作成に失敗", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.manageMLJobDescription": "ジョブはそれぞれのサービス + トランザクションタイプの組み合わせに対して作成できます。ジョブの作成後、{mlJobsPageLink} で管理と詳細の確認ができます。", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.manageMLJobDescription.mlJobsPageLinkText": "機械学習ジョブの管理ページ", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.manageMLJobDescription.noteText": "注:ジョブが結果の計算を開始するまでに少し時間がかかる場合があります。", - "xpack.apm.serviceDetails.enableAnomalyDetectionPanel.selectTransactionTypeLabel": "このジョブのトランザクションタイプを選択してください", - "xpack.apm.serviceDetails.enableErrorReportsPanel.actionsDescription": "レポートはメールで送信するか Slack チャンネルに投稿できます。各レポートにはオカランス別のトップ 10 のエラーが含まれます。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.actionsTitle": "アクション", - "xpack.apm.serviceDetails.enableErrorReportsPanel.conditionTitle": "コンディション", - "xpack.apm.serviceDetails.enableErrorReportsPanel.createWatchButtonLabel": "ウォッチを作成", - "xpack.apm.serviceDetails.enableErrorReportsPanel.dailyReportHelpText": "デイリーレポートは {dailyTimeFormatted} / {dailyTime12HourFormatted} に送信されます。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.dailyReportRadioButtonLabel": "デイリーレポート", - "xpack.apm.serviceDetails.enableErrorReportsPanel.emailSubjectText": "{serviceName} にしきい値を超えたエラーグループがあります", - "xpack.apm.serviceDetails.enableErrorReportsPanel.emailTemplateText": "{serviceName} サービスに {timeRange}{br}{br}{errorGroupsBuckets}{br}{errorLogMessage}{br}{errorCulprit}N/A{slashErrorCulprit}{br}{docCountParam} オカレンス {br}{slashErrorGroupsBucket} 内で {threshold} 件のオカレンスを超えるエラーグループがあります", - "xpack.apm.serviceDetails.enableErrorReportsPanel.enableErrorReportsTitle": "エラーレポートを有効にする", - "xpack.apm.serviceDetails.enableErrorReportsPanel.formDescription": "このフォームは、このサービスでのエラーのオカレンスを通知するウォッチの作成をアシストします。Watcher の書斎は、{documentationLink} をご覧ください。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.formDescription.documentationLinkText": "ドキュメンテーション", - "xpack.apm.serviceDetails.enableErrorReportsPanel.intervalHelpText": "レポートの間隔。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.intervalRadioButtonLabel": "間隔", - "xpack.apm.serviceDetails.enableErrorReportsPanel.intervalUnit.hrsLabel": "時間", - "xpack.apm.serviceDetails.enableErrorReportsPanel.intervalUnit.minsLabel": "分", - "xpack.apm.serviceDetails.enableErrorReportsPanel.occurrencesThresholdHelpText": "エラーグループがレポートに含まれるしきい値です。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.occurrencesThresholdLabel": "エラーグループごとのオカレンスのしきい値", - "xpack.apm.serviceDetails.enableErrorReportsPanel.recipientsHelpText": "メールを構成していない場合は、{documentationLink} をご覧ください。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.recipientsHelpText.documentationLinkText": "ドキュメンテーション", - "xpack.apm.serviceDetails.enableErrorReportsPanel.recipientsLabel": "受信者 (コンマ区切り)", - "xpack.apm.serviceDetails.enableErrorReportsPanel.sendEmailLabel": "メールを送信", - "xpack.apm.serviceDetails.enableErrorReportsPanel.sendSlackNotificationLabel": "Slack 通知を送信", - "xpack.apm.serviceDetails.enableErrorReportsPanel.slackTemplateText": "{serviceName} サービスに {timeRange} 以内に {threshold} 件のオカレンスを超えるエラーグループがあります。\n{errorGroupsBuckets}\n{errorLogMessage}\n{errorCulprit}N/A{slashErrorCulprit}\n{docCountParam} 件のオカレンス\n{slashErrorGroupsBucket}", - "xpack.apm.serviceDetails.enableErrorReportsPanel.slackWebhookURLHelpText": "Slack webhook の取得方法は、{documentationLink} をご覧ください。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.slackWebhookURLHelpText.documentationLinkText": "ドキュメンテーション", - "xpack.apm.serviceDetails.enableErrorReportsPanel.slackWebhookURLLabel": "Slack Webhook URL", - "xpack.apm.serviceDetails.enableErrorReportsPanel.triggerScheduleDescription": "しきい値を超えた際のレポートの間隔を選択してください。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.triggerScheduleTitle": "トリガースケジュール", - "xpack.apm.serviceDetails.enableErrorReportsPanel.triggerText": "この値はトリガーセクションで変更する必要があります。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.watchCreatedNotificationText": "ウォッチの準備が完了し、{serviceName} のエラーレポートが送信されます。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.watchCreatedNotificationText.viewWatchLinkText": "ウォッチを表示", - "xpack.apm.serviceDetails.enableErrorReportsPanel.watchCreatedNotificationTitle": "新規ウォッチが作成されました！", - "xpack.apm.serviceDetails.enableErrorReportsPanel.watchCreationFailedNotificationText": "ユーザーにウォッチ作成のパーミッションがあることを確認してください。", - "xpack.apm.serviceDetails.enableErrorReportsPanel.watchCreationFailedNotificationTitle": "ウォッチの作成に失敗", - "xpack.apm.serviceDetails.errorsTabLabel": "エラー", - "xpack.apm.serviceDetails.integrationsMenu.enableMLAnomalyDetectionButtonLabel": "ML 異常検知を有効にする", - "xpack.apm.serviceDetails.integrationsMenu.enableMLAnomalyDetectionButtonTooltip": "このサービスの機械学習ジョブをセットアップします", - "xpack.apm.serviceDetails.integrationsMenu.enableWatcherErrorReportsButtonLabel": "ウォッチエラーレポートを有効にする", - "xpack.apm.serviceDetails.integrationsMenu.integrationsButtonLabel": "統合", - "xpack.apm.serviceDetails.integrationsMenu.viewWatchesButtonLabel": "既存のウォッチを表示", - "xpack.apm.serviceDetails.metrics.cpuUsageChartTitle": "CPU 使用状況", - "xpack.apm.serviceDetails.metrics.errorOccurrencesChartTitle": "エラーのオカレンス", - "xpack.apm.serviceDetails.metrics.memoryUsageChartTitle": "システムメモリー使用状況", - "xpack.apm.serviceDetails.metricsTabLabel": "メトリック", - "xpack.apm.serviceDetails.nodesTabLabel": "JVM", - "xpack.apm.serviceDetails.transactionsTabLabel": "トランザクション", - "xpack.apm.serviceMap.avgCpuUsagePopoverMetric": "CPU使用状況 （平均）", - "xpack.apm.serviceMap.avgErrorsPerMinutePopoverMetric": "1分あたりのエラー（平均）", - "xpack.apm.serviceMap.avgMemoryUsagePopoverMetric": "メモリー使用状況（平均）", - "xpack.apm.serviceMap.avgReqPerMinutePopoverMetric": "1分あたりのリクエスト（平均）", - "xpack.apm.serviceMap.avgTransDurationPopoverMetric": "トランザクションの長さ（平均）", - "xpack.apm.serviceMap.betaBadge": "ベータ", - "xpack.apm.serviceMap.betaTooltipMessage": "現在、この機能はベータです。不具合を見つけた場合やご意見がある場合、サポートに問い合わせるか、またはディスカッションフォーラムにご報告ください。", - "xpack.apm.serviceMap.center": "中央", - "xpack.apm.serviceMap.emptyBanner.docsLink": "詳細はドキュメントをご覧ください", - "xpack.apm.serviceMap.emptyBanner.message": "接続されているサービスや外部リクエストを検出できる場合、システムはそれらをマップします。最新版の APM エージェントが動作していることを確認してください。", - "xpack.apm.serviceMap.emptyBanner.title": "単一のサービスしかないようです。", - "xpack.apm.serviceMap.focusMapButtonText": "焦点マップ", - "xpack.apm.serviceMap.invalidLicenseMessage": "サービスマップを利用するには、Elastic Platinum ライセンスが必要です。これにより、APM データとともにアプリケーションスタック全てを可視化することができるようになります。", - "xpack.apm.serviceMap.numInstancesMetric": "{numInstances}インスタンス", - "xpack.apm.serviceMap.serviceDetailsButtonText": "サービス詳細", - "xpack.apm.serviceMap.subtypePopoverMetric": "サブタイプ", - "xpack.apm.serviceMap.typePopoverMetric": "タイプ", - "xpack.apm.serviceMap.viewFullMap": "サービスの全体マップを表示", - "xpack.apm.serviceMap.zoomIn": "ズームイン", - "xpack.apm.serviceMap.zoomOut": "ズームアウト", - "xpack.apm.serviceNodeMetrics.containerId": "コンテナー ID", - "xpack.apm.serviceNodeMetrics.host": "ホスト", - "xpack.apm.serviceNodeMetrics.serviceName": "サービス名", - "xpack.apm.serviceNodeMetrics.unidentifiedServiceNodesWarningDocumentationLink": "APM Server のドキュメンテーション", - "xpack.apm.serviceNodeMetrics.unidentifiedServiceNodesWarningText": "これらのメトリックが所属する JVM を特定できませんでした。7.5 よりも古い APM Server を実行していることが原因である可能性が高いです。この問題は APM Server 7.5 以降にアップグレードすることで解決されます。アップグレードに関する詳細は、{link} をご覧ください。代わりに Kibana クエリバーを使ってホスト名、コンテナー ID、またはその他フィールドでフィルタリングすることもできます。", - "xpack.apm.serviceNodeMetrics.unidentifiedServiceNodesWarningTitle": "JVM を特定できませんでした", - "xpack.apm.serviceNodeNameMissing": "(空)", - "xpack.apm.serviceOverview.toastText": "現在 Elastic Stack 7.0+ を実行中で、以前のバージョン 6.x からの互換性のないデータを検知しました。このデータを APM で表示するには、移行が必要です。詳細: ", - "xpack.apm.serviceOverview.toastTitle": "選択された時間範囲内にレガシーデータが検知されました。", - "xpack.apm.serviceOverview.upgradeAssistantLink": "アップグレードアシスタント", - "xpack.apm.servicesTable.7xOldDataMessage": "また、移行が必要な古いデータがある可能性もあります。", - "xpack.apm.servicesTable.7xUpgradeServerMessage": "pre-7.x バージョンからのアップグレードですか？次のアップグレードも完了していることを確認してください:\n APM サーバーインスタンスを 7.0 以降に。", - "xpack.apm.servicesTable.agentColumnLabel": "エージェント", - "xpack.apm.servicesTable.avgResponseTimeColumnLabel": "平均応答時間", - "xpack.apm.servicesTable.environmentColumnLabel": "環境", - "xpack.apm.servicesTable.environmentCount": "{environmentCount, plural, one {1 個の環境} other {# 個の環境}}", - "xpack.apm.servicesTable.errorsPerMinuteColumnLabel": "1 分あたりのエラー", - "xpack.apm.servicesTable.errorsPerMinuteUnitLabel": "エラー", - "xpack.apm.servicesTable.nameColumnLabel": "名前", - "xpack.apm.servicesTable.noServicesLabel": "APM サービスがインストールされていないようです。追加しましょう！", - "xpack.apm.servicesTable.notFoundLabel": "サービスが見つかりません", - "xpack.apm.servicesTable.transactionsPerMinuteColumnLabel": "1 分あたりのトランザクション", - "xpack.apm.servicesTable.transactionsPerMinuteUnitLabel": "1分あたりトランザクション数", - "xpack.apm.servicesTable.UpgradeAssistantLink": "Kibana アップグレードアシスタントで詳細をご覧ください", - "xpack.apm.serviceVersion": "サービスバージョン", - "xpack.apm.settings.agentConfig": "エージェントの編集", - "xpack.apm.settings.apmIndices.applyButton": "変更を適用", - "xpack.apm.settings.apmIndices.applyChanges.failed.text": "インデックスの適用時に何か問題が発生しました。エラー: {errorMessage}", - "xpack.apm.settings.apmIndices.applyChanges.failed.title": "インデックスが適用できませんでした。", - "xpack.apm.settings.apmIndices.applyChanges.succeeded.text": "インデックスの変更の適用に成功しました。これらの変更は、APM UIでただちに反映されます。", - "xpack.apm.settings.apmIndices.applyChanges.succeeded.title": "適用されるインデックス", - "xpack.apm.settings.apmIndices.cancelButton": "キャンセル", - "xpack.apm.settings.apmIndices.description": "APM UI は、APM インデックスをクエリするためにインデックスパターンを使用しています。APM サーバーがイベントを書き込むインデックス名をカスタマイズした場合、APM UI が機能するにはこれらパターンをアップデートする必要がある場合があります。ここの設定は、 kibana.yml で設定されたものよりも優先します。", - "xpack.apm.settings.apmIndices.errorIndicesLabel": "エラーインデックス", - "xpack.apm.settings.apmIndices.helpText": "上書き {configurationName}: {defaultValue}", - "xpack.apm.settings.apmIndices.metricsIndicesLabel": "メトリックインデックス", - "xpack.apm.settings.apmIndices.onboardingIndicesLabel": "オンボーディングインデックス", - "xpack.apm.settings.apmIndices.sourcemapIndicesLabel": "ソースマップインデックス", - "xpack.apm.settings.apmIndices.spanIndicesLabel": "スパンインデックス", - "xpack.apm.settings.apmIndices.title": "インデックス", - "xpack.apm.settings.apmIndices.transactionIndicesLabel": "トランザクションインデックス", - "xpack.apm.settings.customizeUI": "UI をカスタマイズ", - "xpack.apm.settings.customizeUI.customLink": "カスタムリンク", - "xpack.apm.settings.customizeUI.customLink.create.failed": "リンクを保存できませんでした！", - "xpack.apm.settings.customizeUI.customLink.create.failed.message": "リンクを保存するときに問題が発生しました。エラー: 「{errorMessage}」", - "xpack.apm.settings.customizeUI.customLink.create.successed": "リンクを保存しました。", - "xpack.apm.settings.customizeUI.customLink.createCustomLink": "カスタムリンクを作成", - "xpack.apm.settings.customizeUI.customLink.default.label": "Elastic.co", - "xpack.apm.settings.customizeUI.customLink.default.url": "https://www.elastic.co", - "xpack.apm.settings.customizeUI.customLink.delete": "削除", - "xpack.apm.settings.customizeUI.customLink.delete.failed": "カスタムリンクを削除できませんでした", - "xpack.apm.settings.customizeUI.customLink.delete.successed": "カスタムリンクを削除しました。", - "xpack.apm.settings.customizeUI.customLink.emptyPromptText": "変更しましょう。サービスごとのトランザクションの詳細でアクションコンテキストメニューにカスタムリンクを追加できます。自社のサポートポータルへの役立つリンクを作成するか、新しい不具合レポートを発行します。詳細はドキュメントをご覧ください", - "xpack.apm.settings.customizeUI.customLink.emptyPromptTitle": "リンクが見つかりません。", - "xpack.apm.settings.customizeUI.customLink.flyout.action.title": "リンク", - "xpack.apm.settings.customizeUI.customLink.flyout.close": "閉じる", - "xpack.apm.settings.customizeUI.customLink.flyout.filters.addAnotherFilter": "別のフィルターを追加", - "xpack.apm.settings.customizeUI.customLink.flyOut.filters.defaultOption": "フィールドを選択してください...", - "xpack.apm.settings.customizeUI.customLink.flyOut.filters.defaultOption.value": "値", - "xpack.apm.settings.customizeUI.customLink.flyout.filters.prepend": "フィールド", - "xpack.apm.settings.customizeUI.customLink.flyout.filters.subtitle": "フィルターオプションを使用すると、特定のサービスについてのみ表示されるようにスコープを設定できます。", - "xpack.apm.settings.customizeUI.customLink.flyout.filters.title": "フィルター", - "xpack.apm.settings.customizeUI.customLink.flyout.label": "リンクは APM アプリ全体にわたるトランザクション詳細のコンテキストで利用できるようになります。作成できるリンクの数は無制限です。トランザクションメタデータのいずれかを使用することで、動的変数を参照して URL を入力できます。さらなる詳細および例がドキュメンテーションに記載されています。", - "xpack.apm.settings.customizeUI.customLink.flyout.label.doc": "", - "xpack.apm.settings.customizeUI.customLink.flyout.link.label": "ラベル", - "xpack.apm.settings.customizeUI.customLink.flyout.link.label.helpText": "これはアクションコンテキストメニューに表示されるラベルです。できるだけ短くしてください。", - "xpack.apm.settings.customizeUI.customLink.flyout.link.label.placeholder": "例: サポートチケット", - "xpack.apm.settings.customizeUI.customLink.flyout.link.url": "URL", - "xpack.apm.settings.customizeUI.customLink.flyout.link.url.doc": "詳細はドキュメントをご覧ください。", - "xpack.apm.settings.customizeUI.customLink.flyout.link.url.helpText": "URL にフィールド名変数 (例:{sample}) を追加すると値を適用できます。", - "xpack.apm.settings.customizeUI.customLink.flyout.link.url.placeholder": "例: https://www.elastic.co/", - "xpack.apm.settings.customizeUI.customLink.flyout.required": "必須", - "xpack.apm.settings.customizeUI.customLink.flyout.save": "保存", - "xpack.apm.settings.customizeUI.customLink.flyout.title": "リンクを作成", - "xpack.apm.settings.customizeUI.customLink.info": "これらのリンクは、トランザクションの詳細に関する「アクション」コンテキストメニューに表示されます。", - "xpack.apm.settings.customizeUI.customLink.license.text": "カスタムリンクを作成するには、Elastic Gold 以上のライセンスが必要です。適切なライセンスがあれば、カスタムリンクを作成してサービスを分析する際にワークフローを改良できます。", - "xpack.apm.settings.customizeUI.customLink.linkPreview.descrition": "上記のフィルターに基づき、サンプルトランザクションドキュメントの値でリンクをテストしてください。", - "xpack.apm.settings.customizeUI.customLink.preview.contextVariable.invalid": "無効な変数が定義されているため、サンプルトランザクションドキュメントが見つかりませんでした。", - "xpack.apm.settings.customizeUI.customLink.preview.contextVariable.noMatch": "{variables} に一致する値がサンプルトランザクションドキュメント内にありませんでした。", - "xpack.apm.settings.customizeUI.customLink.preview.transaction.notFound": "定義されたフィルターに基づき、一致するトランザクションドキュメントが見つかりませんでした。", - "xpack.apm.settings.customizeUI.customLink.searchInput.filter": "名前と URL でリンクをフィルタリング...", - "xpack.apm.settings.customizeUI.customLink.table.editButtonDescription": "このカスタムリンクを編集", - "xpack.apm.settings.customizeUI.customLink.table.editButtonLabel": "編集", - "xpack.apm.settings.customizeUI.customLink.table.lastUpdated": "最終更新", - "xpack.apm.settings.customizeUI.customLink.table.name": "名前", - "xpack.apm.settings.customizeUI.customLink.table.noResultFound": "\"{value}\"に対する結果が見つかりませんでした。", - "xpack.apm.settings.customizeUI.customLink.table.url": "URL", - "xpack.apm.settings.indices": "インデックス", - "xpack.apm.settings.pageTitle": "設定", - "xpack.apm.settings.returnToOverviewLinkLabel": "概要に戻る", - "xpack.apm.settingsLinkLabel": "設定", - "xpack.apm.setupInstructionsButtonLabel": "セットアップの手順", - "xpack.apm.stacktraceTab.causedByFramesToogleButtonLabel": "作成元", - "xpack.apm.stacktraceTab.libraryFramesToogleButtonLabel": "{count, plural, one {# library frame} other {# library frames}}", - "xpack.apm.stacktraceTab.localVariablesToogleButtonLabel": "ローカル変数", - "xpack.apm.stacktraceTab.noStacktraceAvailableLabel": "利用可能なスタックトレースがありません", - "xpack.apm.toggleHeight.showLessButtonLabel": "表示する行数を減らす", - "xpack.apm.toggleHeight.showMoreButtonLabel": "表示する行数を増やす", - "xpack.apm.tracesTable.avgResponseTimeColumnLabel": "平均応答時間", - "xpack.apm.tracesTable.impactColumnDescription": "ご利用のサービスで最も頻繁に使用されていて、最も遅いエンドポイントです。相対的平均時間に 1 分ごとのトランザクション数をかけて計算されます。", - "xpack.apm.tracesTable.impactColumnLabel": "インパクト", - "xpack.apm.tracesTable.nameColumnLabel": "名前", - "xpack.apm.tracesTable.notFoundLabel": "このクエリのトレースが見つかりません", - "xpack.apm.tracesTable.originatingServiceColumnLabel": "発生元サービス", - "xpack.apm.tracesTable.tracesPerMinuteColumnLabel": "1 分あたりのトレース", - "xpack.apm.tracesTable.tracesPerMinuteUnitLabel": "1分あたりトランザクション数", - "xpack.apm.transactionActionMenu.actionsButtonLabel": "アクション", - "xpack.apm.transactionActionMenu.container.subtitle": "このコンテナーのログとインデックスを表示し、さらに詳細を確認できます。", - "xpack.apm.transactionActionMenu.container.title": "コンテナーの詳細", - "xpack.apm.transactionActionMenu.customLink.popover.title": "カスタムリンク", - "xpack.apm.transactionActionMenu.customLink.section": "カスタムリンク", - "xpack.apm.transactionActionMenu.customLink.seeMore": "詳細を表示", - "xpack.apm.transactionActionMenu.customLink.subtitle": "リンクは新しいウィンドウで開きます。", - "xpack.apm.transactionActionMenu.host.subtitle": "ホストログとメトリックを表示し、さらに詳細を確認できます。", - "xpack.apm.transactionActionMenu.host.title": "ホストの詳細", - "xpack.apm.transactionActionMenu.pod.subtitle": "このポッドのログとメトリックを表示し、さらに詳細を確認できます。", - "xpack.apm.transactionActionMenu.pod.title": "ポッドの詳細", - "xpack.apm.transactionActionMenu.showContainerLogsLinkLabel": "コンテナーログ", - "xpack.apm.transactionActionMenu.showContainerMetricsLinkLabel": "コンテナーメトリック", - "xpack.apm.transactionActionMenu.showHostLogsLinkLabel": "ホストログ", - "xpack.apm.transactionActionMenu.showHostMetricsLinkLabel": "ホストメトリック", - "xpack.apm.transactionActionMenu.showPodLogsLinkLabel": "ポッドログ", - "xpack.apm.transactionActionMenu.showPodMetricsLinkLabel": "ポッドメトリック", - "xpack.apm.transactionActionMenu.showTraceLogsLinkLabel": "トレースログ", - "xpack.apm.transactionActionMenu.status.subtitle": "ステータスを表示し、さらに詳細を確認できます。", - "xpack.apm.transactionActionMenu.status.title": "ステータスの詳細", - "xpack.apm.transactionActionMenu.trace.subtitle": "トレースログを表示し、さらに詳細を確認できます。", - "xpack.apm.transactionActionMenu.trace.title": "トレースの詳細", - "xpack.apm.transactionActionMenu.viewInUptime": "ステータス", - "xpack.apm.transactionActionMenu.viewSampleDocumentLinkLabel": "サンプルドキュメントを表示", - "xpack.apm.transactionBreakdown.chartTitle": "スパンタイプ別時間", - "xpack.apm.transactionBreakdown.hideChart": "グラフを非表示", - "xpack.apm.transactionBreakdown.noData": "この時間範囲のデータがありません。", - "xpack.apm.transactionBreakdown.showChart": "グラフを表示", - "xpack.apm.transactionDetails.errorCount": "{errorCount, number} {errorCount, plural, one {件のエラー} other {件のエラー}}", - "xpack.apm.transactionDetails.errorsOverviewLinkTooltip": "{errorCount, plural, one {1 件の関連エラーを表示} other {# 件の関連エラーを表示}}", - "xpack.apm.transactionDetails.notFoundLabel": "トランザクションが見つかりませんでした。", - "xpack.apm.transactionDetails.noTraceParentButtonTooltip": "トレースの親が見つかりませんでした", - "xpack.apm.transactionDetails.percentOfTraceLabelExplanation": "{parentType, select, transaction {トランザクション} trace {トレース} }の割合が100%を超えています。これは、この{childType, select, span {スパン} transaction {トランザクション} }がルートトランザクションよりも時間がかかるためです。", - "xpack.apm.transactionDetails.requestMethodLabel": "リクエストメソッド", - "xpack.apm.transactionDetails.resultLabel": "結果", - "xpack.apm.transactionDetails.serviceLabel": "サービス", - "xpack.apm.transactionDetails.servicesTitle": "サービス", - "xpack.apm.transactionDetails.spanFlyout.databaseStatementTitle": "データベースステートメント", - "xpack.apm.transactionDetails.spanFlyout.nameLabel": "名前", - "xpack.apm.transactionDetails.spanFlyout.spanAction": "アクション", - "xpack.apm.transactionDetails.spanFlyout.spanDetailsTitle": "スパン詳細", - "xpack.apm.transactionDetails.spanFlyout.spanSubtype": "サブタイプ", - "xpack.apm.transactionDetails.spanFlyout.spanType": "タイプ", - "xpack.apm.transactionDetails.spanFlyout.spanType.navigationTimingLabel": "ナビゲーションタイミング", - "xpack.apm.transactionDetails.spanFlyout.stackTraceTabLabel": "スタックトレース", - "xpack.apm.transactionDetails.spanFlyout.viewSpanInDiscoverButtonLabel": "ディスカバリでスパンを表示", - "xpack.apm.transactionDetails.statusCode": "ステータスコード", - "xpack.apm.transactionDetails.syncBadgeAsync": "非同期", - "xpack.apm.transactionDetails.syncBadgeBlocking": "ブロック", - "xpack.apm.transactionDetails.traceNotFound": "選択されたトレースが見つかりません", - "xpack.apm.transactionDetails.traceSampleTitle": "トレースのサンプル", - "xpack.apm.transactionDetails.transactionLabel": "トランザクション", - "xpack.apm.transactionDetails.transactionsDurationDistributionChart.noSampleTooltip": "このバケットに利用可能なサンプルがありません", - "xpack.apm.transactionDetails.transactionsDurationDistributionChart.requestTypeUnitLongLabel": "{transCount, plural, =0 {# request} 1 {# 件のリクエスト} other {# 件のリクエスト}}", - "xpack.apm.transactionDetails.transactionsDurationDistributionChart.transactionTypeUnitLongLabel": "{transCount, plural, =0 {# transaction} 1 {# 件のトランザクション} other {# 件のトランザクション}}", - "xpack.apm.transactionDetails.transactionsDurationDistributionChart.unitShortLabel": "{transCount} {transType, select, request {件のリクエスト} other {件のトランザクション}}", - "xpack.apm.transactionDetails.transactionsDurationDistributionChartTitle": "トラザクション時間の分布", - "xpack.apm.transactionDetails.transactionsDurationDistributionChartTooltip.samplingDescription": "各バケットはサンプルトランザクションを示します。利用可能なサンプルがない場合、恐らくエージェントの構成で設定されたサンプリング制限が原因です。", - "xpack.apm.transactionDetails.transactionsDurationDistributionChartTooltip.samplingLabel": "サンプリング", - "xpack.apm.transactionDetails.transFlyout.callout.agentDroppedSpansMessage": "このトランザクションを報告した APM エージェントが、構成に基づき {dropped} 個以上のスパンをドロップしました。", - "xpack.apm.transactionDetails.transFlyout.callout.learnMoreAboutDroppedSpansLinkText": "ドロップされたスパンの詳細。", - "xpack.apm.transactionDetails.transFlyout.transactionDetailsTitle": "トランザクションの詳細", - "xpack.apm.transactionDetails.userAgentAndVersionLabel": "ユーザーエージェントとバージョン", - "xpack.apm.transactionDetails.viewFullTraceButtonLabel": "完全なトレースを表示", - "xpack.apm.transactionDetails.viewingFullTraceButtonTooltip": "現在完全なトレースが表示されています", - "xpack.apm.transactionDurationAlert.aggregationType.95th": "95 パーセンタイル", - "xpack.apm.transactionDurationAlert.aggregationType.99th": "99 パーセンタイル", - "xpack.apm.transactionDurationAlert.aggregationType.avg": "平均", - "xpack.apm.transactionDurationAlert.name": "トランザクション期間のしきい値", - "xpack.apm.transactionDurationAlert.thresholdMet": "しきい値一致", - "xpack.apm.transactionDurationAlertTrigger.isAbove": "の下限は", - "xpack.apm.transactionDurationAlertTrigger.ms": "ms", - "xpack.apm.transactionDurationAlertTrigger.type": "タイプ", - "xpack.apm.transactionDurationAlertTrigger.when": "タイミング", - "xpack.apm.transactionDurationLabel": "期間", - "xpack.apm.transactions.chart.95thPercentileLabel": "95 パーセンタイル", - "xpack.apm.transactions.chart.99thPercentileLabel": "99 パーセンタイル", - "xpack.apm.transactions.chart.anomalyBoundariesLabel": "異常境界", - "xpack.apm.transactions.chart.anomalyScoreLabel": "異常スコア", - "xpack.apm.transactions.chart.averageLabel": "平均", - "xpack.apm.transactionsTable.95thPercentileColumnLabel": "95 パーセンタイル", - "xpack.apm.transactionsTable.avgDurationColumnLabel": "平均期間", - "xpack.apm.transactionsTable.impactColumnDescription": "ご利用のサービスで最も頻繁に使用されていて、最も遅いエンドポイントです。相対的平均時間に 1 分ごとのトランザクション数をかけて計算されます。", - "xpack.apm.transactionsTable.impactColumnLabel": "インパクト", - "xpack.apm.transactionsTable.nameColumnLabel": "名前", - "xpack.apm.transactionsTable.notFoundLabel": "トランザクションが見つかりませんでした。", - "xpack.apm.transactionsTable.transactionsPerMinuteColumnLabel": "1 分あたりのトランザクション", - "xpack.apm.transactionsTable.transactionsPerMinuteUnitLabel": "1分あたりトランザクション数", - "xpack.apm.tutorial.apmAgents.statusCheck.btnLabel": "エージェントステータスを確認", - "xpack.apm.tutorial.apmAgents.statusCheck.errorMessage": "エージェントからまだデータを受け取っていません", - "xpack.apm.tutorial.apmAgents.statusCheck.successMessage": "1 つまたは複数のエージェントからデータを受け取りました", - "xpack.apm.tutorial.apmAgents.statusCheck.text": "アプリケーションが実行されていてエージェントがデータを送信していることを確認してください。", - "xpack.apm.tutorial.apmAgents.statusCheck.title": "エージェントステータス", - "xpack.apm.tutorial.apmAgents.title": "APM エージェント", - "xpack.apm.tutorial.apmServer.callOut.message": "ご使用の APM Server を 7.0 以上に更新してあることを確認してください。 Kibana の管理セクションにある移行アシスタントで 6.x データを移行することもできます。", - "xpack.apm.tutorial.apmServer.callOut.title": "重要:7.0 以上に更新中", - "xpack.apm.tutorial.apmServer.statusCheck.btnLabel": "APM Server ステータスを確認", - "xpack.apm.tutorial.apmServer.statusCheck.errorMessage": "APM Server が検出されました。7.0 以上に更新され、動作中であることを確認してください。", - "xpack.apm.tutorial.apmServer.statusCheck.successMessage": "APM Server が正しくセットアップされました", - "xpack.apm.tutorial.apmServer.statusCheck.text": "APM エージェントの導入を開始する前に、APM Server が動作していることを確認してください。", - "xpack.apm.tutorial.apmServer.statusCheck.title": "APM Server ステータス", - "xpack.apm.tutorial.apmServer.title": "APM Server", - "xpack.apm.tutorial.djangoClient.configure.commands.addAgentComment": "インストールされたアプリにエージェントを追加します", - "xpack.apm.tutorial.djangoClient.configure.commands.addTracingMiddlewareComment": "パフォーマンスメトリックを送信するには、追跡ミドルウェアを追加します。", - "xpack.apm.tutorial.djangoClient.configure.commands.allowedCharactersComment": "a-z、A-Z、0-9、-、_、スペース", - "xpack.apm.tutorial.djangoClient.configure.commands.setCustomApmServerUrlComment": "カスタム APM Server URL (デフォルト: {defaultApmServerUrl})", - "xpack.apm.tutorial.djangoClient.configure.commands.setRequiredServiceNameComment": "必要なサーバー名を設定します。使用できる文字:", - "xpack.apm.tutorial.djangoClient.configure.commands.useIfApmServerRequiresTokenComment": "APM Server にトークンが必要な場合に使います", - "xpack.apm.tutorial.djangoClient.configure.textPost": "高度な用途に関しては [ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.djangoClient.configure.textPre": "エージェントとは、アプリケーションプロセス内で実行されるライブラリです。APM サービスは「SERVICE_NAME」に基づいてプログラムで作成されます。", - "xpack.apm.tutorial.djangoClient.configure.title": "エージェントの構成", - "xpack.apm.tutorial.djangoClient.install.textPre": "Python 用の APM エージェントを依存関係としてインストールします。", - "xpack.apm.tutorial.djangoClient.install.title": "APM エージェントのインストール", - "xpack.apm.tutorial.dotNetClient.configureAgent.textPost": "エージェントに「IConfiguration」インスタンスが渡されていない場合、(例: 非 ASP.NET Core アプリケーションの場合)、エージェントを環境変数で構成することもできます。\n 高度な用途に関しては [ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.dotNetClient.configureAgent.title": "appsettings.json ファイルの例:", - "xpack.apm.tutorial.dotNetClient.configureApplication.textPost": "「IConfiguration」インスタンスを渡すのは任意であり、これにより、エージェントはこの「IConfiguration」インスタンス (例: 「appsettings.json」ファイル) から構成を読み込みます。", - "xpack.apm.tutorial.dotNetClient.configureApplication.textPre": "「Elastic.Apm.NetCoreAll」パッケージの ASP.NET Core の場合、「Startup.cs」ファイル内の「Configure」メソドの「UseElasticApm」メソドを呼び出します。", - "xpack.apm.tutorial.dotNetClient.configureApplication.title": "エージェントをアプリケーションに追加", - "xpack.apm.tutorial.dotNetClient.download.textPre": "[NuGet]({allNuGetPackagesLink}) から .NET アプリケーションにエージェントパッケージを追加してください。用途の異なる複数の NuGet パッケージがあります。\n\nEntity Framework Core の ASP.NET Core アプリケーションの場合は、[Elastic.Apm.NetCoreAll]({netCoreAllApmPackageLink}) パッケージをダウンロードしてください。このパッケージは、自動的にすべてのエージェントコンポーネントをアプリケーションに追加します。\n\n 依存性を最低限に抑えたい場合、ASP.NET Core の監視のみに [Elastic.Apm.AspNetCore]({aspNetCorePackageLink}) パッケージ、または Entity Framework Core の監視のみに [Elastic.Apm.EfCore]({efCorePackageLink}) パッケージを使用することができます。\n\n 手動インストルメンテーションのみにパブリック Agent API を使用する場合は、[Elastic.Apm]({elasticApmPackageLink}) パッケージを使用してください。", - "xpack.apm.tutorial.dotNetClient.download.title": "APM エージェントのダウンロード", - "xpack.apm.tutorial.downloadServer.title": "APM Server をダウンロードして展開します", - "xpack.apm.tutorial.downloadServerRpm": "32 ビットパッケージをお探しですか？[ダウンロードページ]({downloadPageLink}) をご覧ください。", - "xpack.apm.tutorial.downloadServerTitle": "32 ビットパッケージをお探しですか？[ダウンロードページ]({downloadPageLink}) をご覧ください。", - "xpack.apm.tutorial.editConfig.textPre": "Elastic Stack の X-Pack セキュアバージョンをご使用の場合、「apm-server.yml」構成ファイルで認証情報を指定する必要があります。", - "xpack.apm.tutorial.editConfig.title": "構成を編集する", - "xpack.apm.tutorial.elasticCloud.textPre": "APM Server を有効にするには、[the Elastic Cloud console](https://cloud.elastic.co/deployments?q={cloudId}) に移動し、展開設定で APM を有効にします。有効になったら、このページを更新してください。", - "xpack.apm.tutorial.elasticCloudInstructions.title": "APM エージェント", - "xpack.apm.tutorial.flaskClient.configure.commands.allowedCharactersComment": "a-z、A-Z、0-9、-、_、スペース", - "xpack.apm.tutorial.flaskClient.configure.commands.configureElasticApmComment": "またはアプリケーションの設定で ELASTIC_APM を使用するよう構成します。", - "xpack.apm.tutorial.flaskClient.configure.commands.initializeUsingEnvironmentVariablesComment": "環境変数を使用して初期化します", - "xpack.apm.tutorial.flaskClient.configure.commands.setCustomApmServerUrlComment": "カスタム APM Server URL (デフォルト: {defaultApmServerUrl})", - "xpack.apm.tutorial.flaskClient.configure.commands.setRequiredServiceNameComment": "必要なサーバー名を設定します。使用できる文字:", - "xpack.apm.tutorial.flaskClient.configure.commands.useIfApmServerRequiresTokenComment": "APM Server にトークンが必要な場合に使います", - "xpack.apm.tutorial.flaskClient.configure.textPost": "高度な用途に関しては [ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.flaskClient.configure.textPre": "エージェントとは、アプリケーションプロセス内で実行されるライブラリです。APM サービスは「SERVICE_NAME」に基づいてプログラムで作成されます。", - "xpack.apm.tutorial.flaskClient.configure.title": "エージェントの構成", - "xpack.apm.tutorial.flaskClient.install.textPre": "Python 用の APM エージェントを依存関係としてインストールします。", - "xpack.apm.tutorial.flaskClient.install.title": "APM エージェントのインストール", - "xpack.apm.tutorial.goClient.configure.commands.initializeUsingEnvironmentVariablesComment": "環境変数を使用して初期化します:", - "xpack.apm.tutorial.goClient.configure.commands.setCustomApmServerUrlComment": "カスタム APM Server URL (デフォルト: {defaultApmServerUrl})", - "xpack.apm.tutorial.goClient.configure.commands.setServiceNameComment": "サービス名を設定します。使用できる文字は # a-z、A-Z、0-9、-、_、スペースです。", - "xpack.apm.tutorial.goClient.configure.commands.usedExecutableNameComment": "ELASTIC_APM_SERVICE_NAME が指定されていない場合、実行可能な名前が使用されます。", - "xpack.apm.tutorial.goClient.configure.commands.useIfApmRequiresTokenComment": "APM Server にトークンが必要な場合に使います", - "xpack.apm.tutorial.goClient.configure.textPost": "高度な構成に関しては [ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.goClient.configure.textPre": "エージェントとは、アプリケーションプロセス内で実行されるライブラリです。APM サービスは実行ファイル名または「ELASTIC_APM_SERVICE_NAME」環境変数に基づいてプログラムで作成されます。", - "xpack.apm.tutorial.goClient.configure.title": "エージェントの構成", - "xpack.apm.tutorial.goClient.install.textPre": "Go の APM エージェントパッケージをインストールします。", - "xpack.apm.tutorial.goClient.install.title": "APM エージェントのインストール", - "xpack.apm.tutorial.goClient.instrument.textPost": "Go のソースコードのインストルメンテーションの詳細ガイドは、[ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.goClient.instrument.textPre": "提供されたインストルメンテーションモジュールの 1 つ、またはトレーサー API を直接使用して、Go アプリケーションにインストルメンテーションを設定します。", - "xpack.apm.tutorial.goClient.instrument.title": "アプリケーションのインストルメンテーション", - "xpack.apm.tutorial.introduction": "アプリケーション内から詳細なパフォーマンスメトリックやエラーを収集します。", - "xpack.apm.tutorial.javaClient.download.textPre": "[Maven Central]({mavenCentralLink}) からエージェントをダウンロードします。アプリケーションにエージェントを依存関係として「追加しない」でください。", - "xpack.apm.tutorial.javaClient.download.title": "APM エージェントのダウンロード", - "xpack.apm.tutorial.javaClient.startApplication.textPost": "構成オプションと高度な用途に関しては、[ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.javaClient.startApplication.textPre": "「-javaagent」フラグを追加してエージェントをシステムプロパティで構成します。\n\n * 必要なサービス名を設定します (使用可能な文字は a-z、A-Z、0-9、-、_、スペースです)\n * カスタム APM Server URL (デフォルト: {customApmServerUrl})\n * アプリケーションのベースパッケージを設定します", - "xpack.apm.tutorial.javaClient.startApplication.title": "javaagent フラグでアプリケーションを起動", - "xpack.apm.tutorial.jsClient.enableRealUserMonitoring.textPre": "デフォルトでは、APM Server を実行すると RUM サポートは無効になります。RUM サポートを有効にする手順については、[ドキュメンテーション]({documentationLink}) をご覧ください。", - "xpack.apm.tutorial.jsClient.enableRealUserMonitoring.title": "APM Server のリアルユーザー監視エージェントを有効にする", - "xpack.apm.tutorial.jsClient.installDependency.commands.setCustomApmServerUrlComment": "カスタム APM Server URL (デフォルト: {defaultApmServerUrl})", - "xpack.apm.tutorial.jsClient.installDependency.commands.setRequiredServiceNameComment": "必要なサービス名を設定します (使用可能な文字は a-z、A-Z、0-9、-、_、スペースです)", - "xpack.apm.tutorial.jsClient.installDependency.commands.setServiceVersionComment": "サービスバージョンを設定します (ソースマップ機能に必要)", - "xpack.apm.tutorial.jsClient.installDependency.textPost": "React や Angular などのフレームワーク統合には、カスタム依存関係があります。詳細は [統合ドキュメント]({docLink}) をご覧ください。", - "xpack.apm.tutorial.jsClient.installDependency.textPre": "「npm install @elastic/apm-rum --save」でエージェントをアプリケーションへの依存関係としてインストールできます。\n\nその後で以下のようにアプリケーションでエージェントを初期化して構成できます。", - "xpack.apm.tutorial.jsClient.installDependency.title": "エージェントを依存関係としてセットアップ", - "xpack.apm.tutorial.jsClient.scriptTags.textPre": "または、スクリプトタグを使用してエージェントのセットアップと構成ができます。` を追加