From d40269c748bbfc793c08c0a74dd1b404a689f96c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez?= Date: Fri, 24 Jan 2020 11:16:11 +0100 Subject: [PATCH 01/77] Fix the scale of the search markers (#55731) The search markers where placed on the minimap using a different scale than the density chart and time ruler. That made the log stream jump to unexpected time positions when the user clicked on a search marker. This also fixes an problem where the search markers didn't move alongside the rest of the minimap when the user dragged and dropped it. --- .../logging/log_minimap/log_minimap.tsx | 19 +++++++++---------- .../logging/log_minimap/search_markers.tsx | 2 +- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/x-pack/legacy/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx b/x-pack/legacy/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx index ad47d17fe3db9..75d8c5a47d32d 100644 --- a/x-pack/legacy/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx +++ b/x-pack/legacy/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx @@ -215,6 +215,15 @@ export class LogMinimap extends React.Component + + {highlightedInterval ? ( ) : null} - - - { .range([0, height]); return ( - + {buckets.map(bucket => ( Date: Fri, 24 Jan 2020 11:22:31 +0100 Subject: [PATCH 02/77] [ML] Singel Metric Viewer: Fix full refresh check. (#55726) Fixes the check whether to do a full refresh of the page or not. lastRefresh was mistakenly part of the check. This fixes keeping the flyout open for rules editing. --- .../application/timeseriesexplorer/timeseriesexplorer.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js index 02cb2e3f4e25a..44b9fbc71f71a 100644 --- a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js +++ b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js @@ -965,16 +965,15 @@ export class TimeSeriesExplorer extends React.Component { !isEqual(previousProps.lastRefresh, this.props.lastRefresh) || !isEqual(previousProps.selectedDetectorIndex, this.props.selectedDetectorIndex) || !isEqual(previousProps.selectedEntities, this.props.selectedEntities) || - !isEqual(previousProps.selectedForecastId, this.props.selectedForecastId) || + previousProps.selectedForecastId !== this.props.selectedForecastId || previousProps.selectedJobId !== this.props.selectedJobId ) { const fullRefresh = previousProps === undefined || !isEqual(previousProps.bounds, this.props.bounds) || - !isEqual(previousProps.lastRefresh, this.props.lastRefresh) || !isEqual(previousProps.selectedDetectorIndex, this.props.selectedDetectorIndex) || !isEqual(previousProps.selectedEntities, this.props.selectedEntities) || - !isEqual(previousProps.selectedForecastId, this.props.selectedForecastId) || + previousProps.selectedForecastId !== this.props.selectedForecastId || previousProps.selectedJobId !== this.props.selectedJobId; this.loadSingleMetricData(fullRefresh); } From fee22e8d94177202b84bb1225133de36f0903049 Mon Sep 17 00:00:00 2001 From: Walter Rafelsberger Date: Fri, 24 Jan 2020 11:25:55 +0100 Subject: [PATCH 03/77] [ML] Anomaly Explorer: Fix view by selection when filter is active. (#55717) Fixes the view-by selection when a KQL filter gets active and restores previous behavior: - If the filter includes AND view-by switches to Job ID. - Otherwise the view-by selection switches to the first available option present in the KQL filter - Additionally, the view-by dropdown options get filtered down to the options present in the KQL filter --- .../explorer_reducer/set_influencer_filter_settings.ts | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/x-pack/legacy/plugins/ml/public/application/explorer/reducers/explorer_reducer/set_influencer_filter_settings.ts b/x-pack/legacy/plugins/ml/public/application/explorer/reducers/explorer_reducer/set_influencer_filter_settings.ts index 8d083a396582a..0d84179c572d2 100644 --- a/x-pack/legacy/plugins/ml/public/application/explorer/reducers/explorer_reducer/set_influencer_filter_settings.ts +++ b/x-pack/legacy/plugins/ml/public/application/explorer/reducers/explorer_reducer/set_influencer_filter_settings.ts @@ -23,17 +23,20 @@ export function setInfluencerFilterSettings( const { selectedCells, viewBySwimlaneOptions } = state; let selectedViewByFieldName = state.viewBySwimlaneFieldName; + const filteredViewBySwimlaneOptions = viewBySwimlaneOptions.filter(d => + filteredFields.includes(d) + ); // if it's an AND filter set view by swimlane to job ID as the others will have no results - if (isAndOperator && selectedCells === null) { + if (isAndOperator && selectedCells === undefined) { selectedViewByFieldName = VIEW_BY_JOB_LABEL; } else { // Set View by dropdown to first relevant fieldName based on incoming filter if there's no cell selection already // or if selected cell is from overall swimlane as this won't include an additional influencer filter for (let i = 0; i < filteredFields.length; i++) { if ( - viewBySwimlaneOptions.includes(filteredFields[i]) && - (selectedCells === null || (selectedCells && selectedCells.type === 'overall')) + filteredViewBySwimlaneOptions.includes(filteredFields[i]) && + (selectedCells === undefined || (selectedCells && selectedCells.type === 'overall')) ) { selectedViewByFieldName = filteredFields[i]; break; @@ -53,5 +56,6 @@ export function setInfluencerFilterSettings( selectedViewByFieldName === VIEW_BY_JOB_LABEL || filteredFields.includes(selectedViewByFieldName) === false, viewBySwimlaneFieldName: selectedViewByFieldName, + viewBySwimlaneOptions: filteredViewBySwimlaneOptions, }; } From 43a7aa7fc0769cf109cf2282f9a214dd758da749 Mon Sep 17 00:00:00 2001 From: Jean-Louis Leysens Date: Fri, 24 Jan 2020 12:26:25 +0100 Subject: [PATCH 04/77] [Console] Remove z-index from editor panes and move it to the resizer (#55813) * Remove z-index from editor panes and move it to the resizer * Update comment --- .../console/public/np_ready/application/styles/_app.scss | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/legacy/core_plugins/console/public/np_ready/application/styles/_app.scss b/src/legacy/core_plugins/console/public/np_ready/application/styles/_app.scss index b89a43f7455a5..3b6297f9cdbff 100644 --- a/src/legacy/core_plugins/console/public/np_ready/application/styles/_app.scss +++ b/src/legacy/core_plugins/console/public/np_ready/application/styles/_app.scss @@ -27,9 +27,6 @@ // Required on IE11 to render ace editor correctly after first input. position: relative; - // Give the aria selection border priority when the divider is selected - z-index: 0; - &__spinner { width: 100%; } @@ -38,8 +35,6 @@ .conApp__output { display: flex; flex: 1 1 1px; - // Give the aria selection border priority when the divider is selected - z-index: -1; } .conApp__textAreaLabelHack, @@ -76,6 +71,8 @@ .conApp__resizer { @include kbnResizer; + // Give the aria selection border priority when the divider is selected on IE11 and Chrome + z-index: $euiZLevel1; } // SASSTODO: This component seems to not be used anymore? From 6984cf1711371d86b1ad8d7abcafc751a105743c Mon Sep 17 00:00:00 2001 From: Jean-Louis Leysens Date: Fri, 24 Jan 2020 13:10:59 +0100 Subject: [PATCH 05/77] Move SplitPanel to kibana_react (#55529) * split_panel component -> kibana_react * Update useEffect for console warning * `console` -> `kibana-react` i18n namespace * Update when warning about children is emitted in split panel component Co-authored-by: Elastic Machine --- .../np_ready/application/components/index.ts | 1 - .../application/containers/editor/editor.tsx | 2 +- .../vis/editors/default/default_editor.tsx | 5 +---- src/plugins/kibana_react/public/index.ts | 1 + .../__snapshots__/split_panel.test.tsx.snap | 0 .../public}/split_panel/components/resizer.tsx | 2 +- .../public}/split_panel/containers/panel.tsx | 0 .../split_panel/containers/panel_container.tsx | 17 +++++++++++++++-- .../public}/split_panel/context.tsx | 0 .../kibana_react/public}/split_panel/index.ts | 0 .../public}/split_panel/registry.ts | 4 ---- .../public}/split_panel/split_panel.test.tsx | 0 12 files changed, 19 insertions(+), 13 deletions(-) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/__snapshots__/split_panel.test.tsx.snap (100%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/components/resizer.tsx (94%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/containers/panel.tsx (100%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/containers/panel_container.tsx (89%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/context.tsx (100%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/index.ts (100%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/registry.ts (92%) rename src/{legacy/core_plugins/console/public/np_ready/application/components => plugins/kibana_react/public}/split_panel/split_panel.test.tsx (100%) diff --git a/src/legacy/core_plugins/console/public/np_ready/application/components/index.ts b/src/legacy/core_plugins/console/public/np_ready/application/components/index.ts index 4669e210e7c2d..eccde899a2640 100644 --- a/src/legacy/core_plugins/console/public/np_ready/application/components/index.ts +++ b/src/legacy/core_plugins/console/public/np_ready/application/components/index.ts @@ -17,7 +17,6 @@ * under the License. */ -export * from './split_panel'; export { SomethingWentWrongCallout } from './something_went_wrong_callout'; export { TopNavMenuItem, TopNavMenu } from './top_nav_menu'; export { ConsoleMenu } from './console_menu'; diff --git a/src/legacy/core_plugins/console/public/np_ready/application/containers/editor/editor.tsx b/src/legacy/core_plugins/console/public/np_ready/application/containers/editor/editor.tsx index 7be1382760eb9..b42d791e5acd8 100644 --- a/src/legacy/core_plugins/console/public/np_ready/application/containers/editor/editor.tsx +++ b/src/legacy/core_plugins/console/public/np_ready/application/containers/editor/editor.tsx @@ -21,7 +21,7 @@ import React, { useCallback } from 'react'; import { debounce } from 'lodash'; import { EditorContentSpinner } from '../../components'; -import { Panel, PanelsContainer } from '../../components/split_panel'; +import { Panel, PanelsContainer } from '../../../../../../../../plugins/kibana_react/public'; import { Editor as EditorUI, EditorOutput } from './legacy/console_editor'; import { StorageKeys } from '../../../services'; import { useEditorReadContext, useServicesContext } from '../../contexts'; diff --git a/src/legacy/ui/public/vis/editors/default/default_editor.tsx b/src/legacy/ui/public/vis/editors/default/default_editor.tsx index 3e99bb83d224f..efe5a79cd027e 100644 --- a/src/legacy/ui/public/vis/editors/default/default_editor.tsx +++ b/src/legacy/ui/public/vis/editors/default/default_editor.tsx @@ -23,10 +23,7 @@ import { start as embeddables } from '../../../../../core_plugins/embeddable_api import { EditorRenderProps } from '../../../../../core_plugins/kibana/public/visualize/np_ready/types'; import { VisualizeEmbeddable } from '../../../../../core_plugins/visualizations/public/embeddable'; import { VisualizeEmbeddableFactory } from '../../../../../core_plugins/visualizations/public/embeddable/visualize_embeddable_factory'; -import { - PanelsContainer, - Panel, -} from '../../../../../core_plugins/console/public/np_ready/application/components/split_panel'; +import { PanelsContainer, Panel } from '../../../../../../plugins/kibana_react/public'; import './vis_type_agg_filter'; import { DefaultEditorSideBar } from './components/sidebar'; diff --git a/src/plugins/kibana_react/public/index.ts b/src/plugins/kibana_react/public/index.ts index cfe89f16e99dd..81f2e694e8e5b 100644 --- a/src/plugins/kibana_react/public/index.ts +++ b/src/plugins/kibana_react/public/index.ts @@ -25,5 +25,6 @@ export * from './overlays'; export * from './ui_settings'; export * from './field_icon'; export * from './table_list_view'; +export * from './split_panel'; export { useUrlTracker } from './use_url_tracker'; export { toMountPoint } from './util'; diff --git a/src/legacy/core_plugins/console/public/np_ready/application/components/split_panel/__snapshots__/split_panel.test.tsx.snap b/src/plugins/kibana_react/public/split_panel/__snapshots__/split_panel.test.tsx.snap similarity index 100% rename from src/legacy/core_plugins/console/public/np_ready/application/components/split_panel/__snapshots__/split_panel.test.tsx.snap rename to src/plugins/kibana_react/public/split_panel/__snapshots__/split_panel.test.tsx.snap diff --git a/src/legacy/core_plugins/console/public/np_ready/application/components/split_panel/components/resizer.tsx b/src/plugins/kibana_react/public/split_panel/components/resizer.tsx similarity index 94% rename from src/legacy/core_plugins/console/public/np_ready/application/components/split_panel/components/resizer.tsx rename to src/plugins/kibana_react/public/split_panel/components/resizer.tsx index 67fe92b7eb03a..306db4c7d9a63 100644 --- a/src/legacy/core_plugins/console/public/np_ready/application/components/split_panel/components/resizer.tsx +++ b/src/plugins/kibana_react/public/split_panel/components/resizer.tsx @@ -35,7 +35,7 @@ export function Resizer(props: Props) { - - - - -`; - exports[`Storyshots components/Export/WorkpadExport enabled 1`] = `
( -
- -
- )); diff --git a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/__examples__/workpad_export.examples.tsx b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/__examples__/workpad_export.examples.tsx index 7e401194f44f1..92e7cca40ee3a 100644 --- a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/__examples__/workpad_export.examples.tsx +++ b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/__examples__/workpad_export.examples.tsx @@ -8,26 +8,13 @@ import { action } from '@storybook/addon-actions'; import React from 'react'; import { WorkpadExport } from '../workpad_export'; -storiesOf('components/Export/WorkpadExport', module) - .add('enabled', () => ( - { - action(`getExportUrl('${type}')`); - return type; - }} - /> - )) - .add('disabled', () => ( - { - action(`getExportUrl('${type}')`); - return type; - }} - /> - )); +storiesOf('components/Export/WorkpadExport', module).add('enabled', () => ( + { + action(`getExportUrl('${type}')`); + return type; + }} + /> +)); diff --git a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/disabled_panel.tsx b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/disabled_panel.tsx deleted file mode 100644 index 85d1174f50bbd..0000000000000 --- a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/disabled_panel.tsx +++ /dev/null @@ -1,50 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License; - * you may not use this file except in compliance with the Elastic License. - */ - -import React from 'react'; -import { FormattedMessage } from '@kbn/i18n/react'; -import { EuiText, EuiSpacer, EuiCodeBlock, EuiCode } from '@elastic/eui'; -import { Clipboard } from '../../clipboard'; - -const REPORTING_CONFIG = `xpack.reporting: - enabled: true - capture.browser.type: chromium`; - -interface Props { - /** Handler to invoke when the Kibana configuration is copied. */ - onCopy: () => void; -} - -/** - * A panel to display within the Export menu when reporting is disabled. - */ -export const DisabledPanel = ({ onCopy }: Props) => ( -
- -

- kibana.yml, - }} - /> -

-
- - - - {REPORTING_CONFIG} - - -
-); diff --git a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/index.ts b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/index.ts index 2b2a582fb4526..39611dd6c2994 100644 --- a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/index.ts +++ b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/index.ts @@ -10,8 +10,6 @@ import { jobCompletionNotifications } from '../../../../../reporting/public/lib/ // @ts-ignore Untyped local import { getWorkpad, getPages } from '../../../state/selectors/workpad'; // @ts-ignore Untyped local -import { getReportingBrowserType } from '../../../state/selectors/app'; -// @ts-ignore Untyped local import { notify } from '../../../lib/notify'; import { getWindow } from '../../../lib/get_window'; // @ts-ignore Untyped local @@ -34,7 +32,6 @@ const { WorkpadHeaderWorkpadExport: strings } = ComponentStrings; const mapStateToProps = (state: State) => ({ workpad: getWorkpad(state), pageCount: getPages(state).length, - enabled: getReportingBrowserType(state) === 'chromium', }); const getAbsoluteUrl = (path: string) => { @@ -51,15 +48,13 @@ const getAbsoluteUrl = (path: string) => { interface Props { workpad: CanvasWorkpad; pageCount: number; - enabled: boolean; } export const WorkpadExport = compose( connect(mapStateToProps), withKibana, withProps( - ({ workpad, pageCount, enabled, kibana }: Props & WithKibanaProps): ComponentProps => ({ - enabled, + ({ workpad, pageCount, kibana }: Props & WithKibanaProps): ComponentProps => ({ getExportUrl: type => { if (type === 'pdf') { const pdfUrl = getPdfUrl(workpad, { pageCount }, kibana.services.http.basePath.prepend); diff --git a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/workpad_export.tsx b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/workpad_export.tsx index 0558652fb6029..522be043ec457 100644 --- a/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/workpad_export.tsx +++ b/x-pack/legacy/plugins/canvas/public/components/workpad_header/workpad_export/workpad_export.tsx @@ -9,7 +9,6 @@ import PropTypes from 'prop-types'; import { EuiButtonIcon, EuiContextMenu, EuiIcon } from '@elastic/eui'; // @ts-ignore Untyped local import { Popover } from '../../popover'; -import { DisabledPanel } from './disabled_panel'; import { PDFPanel } from './pdf_panel'; import { ShareWebsiteFlyout } from './flyout'; @@ -29,8 +28,6 @@ export type OnCloseFn = (type: CloseTypes) => void; export type GetExportUrlFn = (type: ExportUrlTypes) => string; export interface Props { - /** True if exporting is enabled, false otherwise. */ - enabled: boolean; /** Handler to invoke when an export URL is copied to the clipboard. */ onCopy: OnCopyFn; /** Handler to invoke when an end product is exported. */ @@ -42,12 +39,7 @@ export interface Props { /** * The Menu for Exporting a Workpad from Canvas. */ -export const WorkpadExport: FunctionComponent = ({ - enabled, - onCopy, - onExport, - getExportUrl, -}) => { +export const WorkpadExport: FunctionComponent = ({ onCopy, onExport, getExportUrl }) => { const [showFlyout, setShowFlyout] = useState(false); const onClose = () => { @@ -106,16 +98,7 @@ export const WorkpadExport: FunctionComponent = ({ panel: { id: 1, title: strings.getShareDownloadPDFTitle(), - content: enabled ? ( - getPDFPanel(closePopover) - ) : ( - { - onCopy('reportingConfig'); - closePopover(); - }} - /> - ), + content: getPDFPanel(closePopover), }, }, { @@ -160,7 +143,6 @@ export const WorkpadExport: FunctionComponent = ({ }; WorkpadExport.propTypes = { - enabled: PropTypes.bool.isRequired, onCopy: PropTypes.func.isRequired, onExport: PropTypes.func.isRequired, getExportUrl: PropTypes.func.isRequired, diff --git a/x-pack/legacy/plugins/canvas/public/legacy.ts b/x-pack/legacy/plugins/canvas/public/legacy.ts index 61e12893b3e02..254fba0f23ad2 100644 --- a/x-pack/legacy/plugins/canvas/public/legacy.ts +++ b/x-pack/legacy/plugins/canvas/public/legacy.ts @@ -9,8 +9,6 @@ import { CanvasStartDeps } from './plugin'; // eslint-disable-line import/order // @ts-ignore Untyped Kibana Lib import chrome, { loadingCount } from 'ui/chrome'; // eslint-disable-line import/order -// @ts-ignore Untyped Module -import { uiModules } from 'ui/modules'; // eslint-disable-line import/order import { absoluteToParsedUrl } from 'ui/url/absolute_to_parsed_url'; // eslint-disable-line import/order import { Storage } from '../../../../../src/plugins/kibana_utils/public'; // eslint-disable-line import/order // @ts-ignore Untyped Kibana Lib @@ -25,6 +23,7 @@ const shimCoreStart = { ...npStart.core, }; const shimSetupPlugins = {}; + const shimStartPlugins: CanvasStartDeps = { ...npStart.plugins, __LEGACY: { @@ -33,12 +32,9 @@ const shimStartPlugins: CanvasStartDeps = { // ToDo: Copy directly into canvas formatMsg, QueryString, - // ToDo: Remove in favor of core.application.register - setRootController: chrome.setRootController, storage: Storage, // ToDo: Won't be a part of New Platform. Will need to handle internally trackSubUrlForApp: chrome.trackSubUrlForApp, - uiModules, }, }; diff --git a/x-pack/legacy/plugins/canvas/public/plugin.tsx b/x-pack/legacy/plugins/canvas/public/plugin.tsx index 155eef99632a0..7928d46067908 100644 --- a/x-pack/legacy/plugins/canvas/public/plugin.tsx +++ b/x-pack/legacy/plugins/canvas/public/plugin.tsx @@ -7,15 +7,15 @@ import React from 'react'; import ReactDOM from 'react-dom'; import { Chrome } from 'ui/chrome'; -import { IModule } from 'angular'; import { i18n } from '@kbn/i18n'; import { Storage } from '../../../../../src/plugins/kibana_utils/public'; import { CoreSetup, CoreStart, Plugin } from '../../../../../src/core/public'; // @ts-ignore: Untyped Local -import { initStateManagement, initLocationProvider } from './angular/config'; -import { CanvasRootControllerFactory } from './angular/controllers'; -// @ts-ignore: Untypled Local -import { initStore } from './angular/services'; +import { CapabilitiesStrings } from '../i18n'; +const { ReadOnlyBadge: strings } = CapabilitiesStrings; + +import { createStore } from './store'; + // @ts-ignore: untyped local component import { HelpMenu } from './components/help_menu/help_menu'; // @ts-ignore: untyped local @@ -40,12 +40,8 @@ export interface CanvasStartDeps { absoluteToParsedUrl: (url: string, basePath: string) => any; formatMsg: any; QueryString: any; - setRootController: Chrome['setRootController']; storage: typeof Storage; trackSubUrlForApp: Chrome['trackSubUrlForApp']; - uiModules: { - get: (module: string) => IModule; - }; }; } @@ -67,6 +63,22 @@ export class CanvasPlugin // Things like registering functions to the interpreter that need // to be available everywhere, not just in Canvas + core.application.register({ + id: 'canvas', + title: 'Canvas App', + async mount(context, params) { + // Load application bundle + const { renderApp } = await import('./application'); + + // Setup our store + const canvasStore = await createStore(core, plugins); + + // Get start services + const [coreStart, depsStart] = await core.getStartServices(); + + return renderApp(coreStart, depsStart, params, canvasStore); + }, + }); return {}; } @@ -74,14 +86,19 @@ export class CanvasPlugin loadExpressionTypes(); loadTransitions(); - initStateManagement(core, plugins); - initLocationProvider(core, plugins); - initStore(core, plugins); initClipboard(plugins.__LEGACY.storage); initLoadingIndicator(core.http.addLoadingCountSource); - const CanvasRootController = CanvasRootControllerFactory(core, plugins); - plugins.__LEGACY.setRootController('canvas', CanvasRootController); + core.chrome.setBadge( + core.application.capabilities.canvas && core.application.capabilities.canvas.save + ? undefined + : { + text: strings.getText(), + tooltip: strings.getTooltip(), + iconType: 'glasses', + } + ); + core.chrome.setHelpExtension({ appName: i18n.translate('xpack.canvas.helpMenu.appName', { defaultMessage: 'Canvas', diff --git a/x-pack/legacy/plugins/canvas/public/state/selectors/app.ts b/x-pack/legacy/plugins/canvas/public/state/selectors/app.ts index 255d45cf558fc..d68702a30d645 100644 --- a/x-pack/legacy/plugins/canvas/public/state/selectors/app.ts +++ b/x-pack/legacy/plugins/canvas/public/state/selectors/app.ts @@ -32,10 +32,6 @@ export function getBasePath(state: State): State['app']['basePath'] { return state.app.basePath; } -export function getReportingBrowserType(state: State): State['app']['reportingBrowserType'] { - return state.app.reportingBrowserType; -} - // return true only when the required parameters are in the state export function isAppReady(state: State): boolean { const appReady = getAppReady(state); diff --git a/x-pack/legacy/plugins/canvas/public/store.ts b/x-pack/legacy/plugins/canvas/public/store.ts new file mode 100644 index 0000000000000..0a378979f6ad9 --- /dev/null +++ b/x-pack/legacy/plugins/canvas/public/store.ts @@ -0,0 +1,31 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +// @ts-ignore Untyped local +import { createStore as createReduxStore } from './state/store'; +// @ts-ignore Untyped local +import { getInitialState } from './state/initial_state'; + +import { CoreSetup } from '../../../../../src/core/public'; +import { CanvasSetupDeps } from './plugin'; + +export async function createStore(core: CoreSetup, plugins: CanvasSetupDeps) { + const initialState = getInitialState(); + + const basePath = core.http.basePath.get(); + + // Retrieve server functions + const serverFunctionsResponse = await core.http.get(`/api/interpreter/fns`); + const serverFunctions = Object.values(serverFunctionsResponse); + + initialState.app = { + basePath, + serverFunctions, + ready: false, + }; + + return createReduxStore(initialState); +} diff --git a/x-pack/legacy/plugins/canvas/server/plugin.ts b/x-pack/legacy/plugins/canvas/server/plugin.ts index 07f4b7d9ac6db..ac3edbabce930 100644 --- a/x-pack/legacy/plugins/canvas/server/plugin.ts +++ b/x-pack/legacy/plugins/canvas/server/plugin.ts @@ -13,25 +13,11 @@ export class Plugin { public setup(core: CoreSetup, plugins: PluginsSetup) { routes(core); - const { serverFunctions } = plugins.interpreter.register({ serverFunctions: functions }); + plugins.interpreter.register({ serverFunctions: functions }); core.injectUiAppVars('canvas', async () => { - const config = core.getServerConfig(); - const basePath = config.get('server.basePath'); - const reportingBrowserType = (() => { - const configKey = 'xpack.reporting.capture.browser.type'; - if (!config.has(configKey)) { - return null; - } - return config.get(configKey); - })(); - return { ...plugins.kibana.injectedUiAppVars, - kbnIndex: config.get('kibana.index'), - serverFunctions: serverFunctions.toArray(), - basePath, - reportingBrowserType, }; }); diff --git a/x-pack/legacy/plugins/canvas/types/state.ts b/x-pack/legacy/plugins/canvas/types/state.ts index 3aca3003f9dc5..171c5515fbb2a 100644 --- a/x-pack/legacy/plugins/canvas/types/state.ts +++ b/x-pack/legacy/plugins/canvas/types/state.ts @@ -32,9 +32,7 @@ export interface AppState { } interface StoreAppState { - kbnVersion: string; basePath: string; - reportingBrowserType: string; // TODO: These server functions are actually missing the fn because they are serialized from the server serverFunctions: CanvasFunction[]; ready: boolean; diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index b4c85f369519d..9b17de0d91334 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -5271,7 +5271,6 @@ "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelCopyAriaLabel": "この {URL} を使用してスクリプトから、または Watcher で {PDF} を生成することもできます。{URL} をクリップボードにコピーするにはエンターキーを押してください。", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelCopyButtonLabel": "{POST} {URL} をコピー", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelCopyDescription": "{POST} {URL} をコピーして {KIBANA} 外または ウォッチャー から生成することもできます。", - "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelDisabledDescription": "PDF へのエクスポートは無効になっています。Chromium ブラウザを使用するにはレポートの構成が必要です。これを {fileName} ファイルに追加します。", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelGenerateButtonLabel": "{PDF} を生成", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelGenerateDescription": "ワークパッドのサイズによって、{PDF} の生成には数分かかる場合があります。", "xpack.canvas.workpadHeaderWorkpadExport.shareDownloadJSONTitle": "{JSON} をダウンロード", diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 583f181e148c6..932e1e79f949c 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -5270,7 +5270,6 @@ "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelCopyAriaLabel": "或者,也可以从脚本或使用 {URL} 通过 Watcher 生成 {PDF}。按 Enter 键可将 {URL} 复制到剪贴板。", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelCopyButtonLabel": "复制 {POST} {URL}", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelCopyDescription": "或者,复制此 {POST} {URL} 以从 {KIBANA} 外部或从 Watcher 调用生成。", - "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelDisabledDescription": "导出到 PDF 已禁用。必须配置报告,才能使用 Chromium 浏览器。将其添加到您的 {fileName} 文件中。", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelGenerateButtonLabel": "生成 {PDF}", "xpack.canvas.workpadHeaderWorkpadExport.pdfPanelGenerateDescription": "{PDF} 可能会花费 1 或 2 分钟生成,取决于 Workpad 的大小。", "xpack.canvas.workpadHeaderWorkpadExport.shareDownloadJSONTitle": "下载为 {JSON}", From 551e4dc472642dc584206c90075fc47882c323a8 Mon Sep 17 00:00:00 2001 From: Nathan L Smith Date: Mon, 27 Jan 2020 15:31:09 -0600 Subject: [PATCH 65/77] Add animation to service map layout (#56042) We had previously deleted the animation because the method we were using for adding nodes to the map would wipe the whole map out before redrawing it and make for very awkward animation. The way it works now is the Cytoscape component calls `add` on the cytoscape instance when new elements are added, so the animation looks ok. Fixes #54796. Co-authored-by: Elastic Machine --- .../apm/public/components/app/ServiceMap/cytoscapeOptions.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts index 1a6247388a655..a243021ddc5fd 100644 --- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts +++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts @@ -10,7 +10,10 @@ import { defaultIcon, iconForNode } from './icons'; const layout = { name: 'dagre', nodeDimensionsIncludeLabels: true, - rankDir: 'LR' + rankDir: 'LR', + animate: true, + animationEasing: theme.euiAnimSlightBounce, + animationDuration: parseInt(theme.euiAnimSpeedNormal, 10) }; function isService(el: cytoscape.NodeSingular) { From 99f224097c709b2bd2f4136de0f0b3a4728f26f7 Mon Sep 17 00:00:00 2001 From: Brian Seeders Date: Mon, 27 Jan 2020 17:10:34 -0500 Subject: [PATCH 66/77] Remove matrix build support (#54202) --- .ci/Jenkinsfile_coverage | 4 +- .ci/es-snapshots/Jenkinsfile_verify_es | 4 +- .ci/jobs.yml | 2 + .ci/run.sh | 50 ----------- Jenkinsfile | 4 +- test/scripts/jenkins_accessibility.sh | 19 +---- test/scripts/jenkins_ci_group.sh | 17 +--- test/scripts/jenkins_firefox_smoke.sh | 18 +--- test/scripts/jenkins_test_setup.sh | 10 +-- test/scripts/jenkins_test_setup_oss.sh | 11 +++ test/scripts/jenkins_test_setup_xpack.sh | 13 +++ test/scripts/jenkins_unit.sh | 4 +- test/scripts/jenkins_visual_regression.sh | 16 +--- test/scripts/jenkins_xpack.sh | 14 ++- test/scripts/jenkins_xpack_accessibility.sh | 28 +----- test/scripts/jenkins_xpack_ci_group.sh | 45 +--------- test/scripts/jenkins_xpack_firefox_smoke.sh | 19 +---- .../jenkins_xpack_visual_regression.sh | 19 +---- vars/kibanaPipeline.groovy | 85 +++++++++---------- 19 files changed, 94 insertions(+), 288 deletions(-) delete mode 100755 .ci/run.sh create mode 100644 test/scripts/jenkins_test_setup_oss.sh create mode 100644 test/scripts/jenkins_test_setup_xpack.sh diff --git a/.ci/Jenkinsfile_coverage b/.ci/Jenkinsfile_coverage index d9ec1861c9979..01c18b10d0804 100644 --- a/.ci/Jenkinsfile_coverage +++ b/.ci/Jenkinsfile_coverage @@ -16,14 +16,14 @@ stage("Kibana Pipeline") { // This stage is just here to help the BlueOcean UI a withEnv([ 'NODE_ENV=test' // Needed for jest tests only ]) { - kibanaPipeline.legacyJobRunner('kibana-intake')() + kibanaPipeline.intakeWorker('kibana-intake', './test/scripts/jenkins_unit.sh')() } }, 'x-pack-intake-agent': { withEnv([ 'NODE_ENV=test' // Needed for jest tests only ]) { - kibanaPipeline.legacyJobRunner('x-pack-intake')() + kibanaPipeline.intakeWorker('x-pack-intake', './test/scripts/jenkins_xpack.sh')() } }, 'kibana-oss-agent': kibanaPipeline.withWorkers('kibana-oss-tests', { kibanaPipeline.buildOss() }, [ diff --git a/.ci/es-snapshots/Jenkinsfile_verify_es b/.ci/es-snapshots/Jenkinsfile_verify_es index 3d5ec75fa0e72..30d52a56547bd 100644 --- a/.ci/es-snapshots/Jenkinsfile_verify_es +++ b/.ci/es-snapshots/Jenkinsfile_verify_es @@ -26,8 +26,8 @@ timeout(time: 120, unit: 'MINUTES') { withEnv(["ES_SNAPSHOT_MANIFEST=${SNAPSHOT_MANIFEST}"]) { parallel([ // TODO we just need to run integration tests from intake? - 'kibana-intake-agent': kibanaPipeline.legacyJobRunner('kibana-intake'), - 'x-pack-intake-agent': kibanaPipeline.legacyJobRunner('x-pack-intake'), + 'kibana-intake-agent': kibanaPipeline.intakeWorker('kibana-intake', './test/scripts/jenkins_unit.sh'), + 'x-pack-intake-agent': kibanaPipeline.intakeWorker('x-pack-intake', './test/scripts/jenkins_xpack.sh'), 'kibana-oss-agent': kibanaPipeline.withWorkers('kibana-oss-tests', { kibanaPipeline.buildOss() }, [ 'oss-ciGroup1': kibanaPipeline.getOssCiGroupWorker(1), 'oss-ciGroup2': kibanaPipeline.getOssCiGroupWorker(2), diff --git a/.ci/jobs.yml b/.ci/jobs.yml index a2d8100f78efd..3add92aadd256 100644 --- a/.ci/jobs.yml +++ b/.ci/jobs.yml @@ -1,3 +1,5 @@ +# This file is needed by functionalTests:ensureAllTestsInCiGroup for the list of ciGroups. That must be changed before this file can be removed + JOB: - kibana-intake - x-pack-intake diff --git a/.ci/run.sh b/.ci/run.sh deleted file mode 100755 index 9f77438be62d0..0000000000000 --- a/.ci/run.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/usr/bin/env bash - -set -e - -# move to Kibana root -cd "$(dirname "$0")/.." - -source src/dev/ci_setup/load_env_keys.sh -source src/dev/ci_setup/extract_bootstrap_cache.sh -source src/dev/ci_setup/setup.sh -source src/dev/ci_setup/checkout_sibling_es.sh - -case "$JOB" in -kibana-intake) - ./test/scripts/jenkins_unit.sh - ;; -kibana-ciGroup*) - export CI_GROUP="${JOB##kibana-ciGroup}" - ./test/scripts/jenkins_ci_group.sh - ;; -kibana-visualRegression*) - ./test/scripts/jenkins_visual_regression.sh - ;; -kibana-accessibility*) - ./test/scripts/jenkins_accessibility.sh - ;; -kibana-firefoxSmoke*) - ./test/scripts/jenkins_firefox_smoke.sh - ;; -x-pack-intake) - ./test/scripts/jenkins_xpack.sh - ;; -x-pack-ciGroup*) - export CI_GROUP="${JOB##x-pack-ciGroup}" - ./test/scripts/jenkins_xpack_ci_group.sh - ;; -x-pack-visualRegression*) - ./test/scripts/jenkins_xpack_visual_regression.sh - ;; -x-pack-accessibility*) - ./test/scripts/jenkins_xpack_accessibility.sh - ;; -x-pack-firefoxSmoke*) - ./test/scripts/jenkins_xpack_firefox_smoke.sh - ;; -*) - echo "JOB '$JOB' is not implemented." - exit 1 - ;; -esac diff --git a/Jenkinsfile b/Jenkinsfile index 4695004cd010a..4e6f3141a12e7 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -11,8 +11,8 @@ stage("Kibana Pipeline") { // This stage is just here to help the BlueOcean UI a catchError { retryable.enable() parallel([ - 'kibana-intake-agent': kibanaPipeline.legacyJobRunner('kibana-intake'), - 'x-pack-intake-agent': kibanaPipeline.legacyJobRunner('x-pack-intake'), + 'kibana-intake-agent': kibanaPipeline.intakeWorker('kibana-intake', './test/scripts/jenkins_unit.sh'), + 'x-pack-intake-agent': kibanaPipeline.intakeWorker('x-pack-intake', './test/scripts/jenkins_xpack.sh'), 'kibana-oss-agent': kibanaPipeline.withWorkers('kibana-oss-tests', { kibanaPipeline.buildOss() }, [ 'oss-firefoxSmoke': kibanaPipeline.getPostBuildWorker('firefoxSmoke', { retryable('kibana-firefoxSmoke') { diff --git a/test/scripts/jenkins_accessibility.sh b/test/scripts/jenkins_accessibility.sh index 0b3d8dc3f85c2..c122d71b58edb 100755 --- a/test/scripts/jenkins_accessibility.sh +++ b/test/scripts/jenkins_accessibility.sh @@ -1,23 +1,6 @@ #!/usr/bin/env bash -set -e - -if [[ -n "$IS_PIPELINE_JOB" ]] ; then - source src/dev/ci_setup/setup_env.sh -fi - -export TEST_BROWSER_HEADLESS=1 - -if [[ -z "$IS_PIPELINE_JOB" ]] ; then - yarn run grunt functionalTests:ensureAllTestsInCiGroup; - node scripts/build --debug --oss; -else - installDir="$(realpath $PARENT_DIR/kibana/build/oss/kibana-*-SNAPSHOT-linux-x86_64)" - destDir=${installDir}-${CI_WORKER_NUMBER} - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" -fi +source test/scripts/jenkins_test_setup_oss.sh checks-reporter-with-killswitch "Kibana accessibility tests" \ node scripts/functional_tests \ diff --git a/test/scripts/jenkins_ci_group.sh b/test/scripts/jenkins_ci_group.sh index fccdb29ff512b..bef6b518b1999 100755 --- a/test/scripts/jenkins_ci_group.sh +++ b/test/scripts/jenkins_ci_group.sh @@ -1,19 +1,8 @@ #!/usr/bin/env bash -source test/scripts/jenkins_test_setup.sh - -if [[ -z "$CODE_COVERAGE" ]] ; then - if [[ -z "$IS_PIPELINE_JOB" ]] ; then - yarn run grunt functionalTests:ensureAllTestsInCiGroup; - node scripts/build --debug --oss; - else - installDir="$(realpath $PARENT_DIR/kibana/build/oss/kibana-*-SNAPSHOT-linux-x86_64)" - destDir=${installDir}-${CI_WORKER_NUMBER} - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" - fi +source test/scripts/jenkins_test_setup_oss.sh +if [[ -z "$CODE_COVERAGE" ]]; then checks-reporter-with-killswitch "Functional tests / Group ${CI_GROUP}" yarn run grunt "run:functionalTests_ciGroup${CI_GROUP}"; if [ "$CI_GROUP" == "1" ]; then @@ -24,8 +13,6 @@ if [[ -z "$CODE_COVERAGE" ]] ; then fi else echo " -> Running Functional tests with code coverage" - export NODE_OPTIONS=--max_old_space_size=8192 - yarn run grunt "run:functionalTests_ciGroup${CI_GROUP}"; fi diff --git a/test/scripts/jenkins_firefox_smoke.sh b/test/scripts/jenkins_firefox_smoke.sh index 9a31f5f43d224..0129d4f1bce9f 100755 --- a/test/scripts/jenkins_firefox_smoke.sh +++ b/test/scripts/jenkins_firefox_smoke.sh @@ -1,22 +1,6 @@ #!/usr/bin/env bash -source test/scripts/jenkins_test_setup.sh - -if [[ -z "$IS_PIPELINE_JOB" ]] ; then - node scripts/build --debug --oss; - linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-oss-*-linux-x86_64.tar.gz')" - installDir="$PARENT_DIR/install/kibana" - mkdir -p "$installDir" - tar -xzf "$linuxBuild" -C "$installDir" --strip=1 -else - installDir="$(realpath $PARENT_DIR/kibana/build/oss/kibana-*-SNAPSHOT-linux-x86_64)" - destDir=${installDir}-${CI_WORKER_NUMBER} - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" -fi - -export TEST_BROWSER_HEADLESS=1 +source test/scripts/jenkins_test_setup_oss.sh checks-reporter-with-killswitch "Firefox smoke test" \ node scripts/functional_tests \ diff --git a/test/scripts/jenkins_test_setup.sh b/test/scripts/jenkins_test_setup.sh index e2dd0bc276bb6..49ee8a6b526ca 100644 --- a/test/scripts/jenkins_test_setup.sh +++ b/test/scripts/jenkins_test_setup.sh @@ -1,11 +1,9 @@ +#!/usr/bin/env bash + set -e function post_work() { set +e - if [[ -z "$IS_PIPELINE_JOB" ]] ; then - node "$KIBANA_DIR/scripts/report_failed_tests" - fi - if [[ -z "$REMOVE_KIBANA_INSTALL_DIR" && -z "$KIBANA_INSTALL_DIR" && -d "$KIBANA_INSTALL_DIR" ]]; then rm -rf "$REMOVE_KIBANA_INSTALL_DIR" fi @@ -15,6 +13,4 @@ trap 'post_work' EXIT export TEST_BROWSER_HEADLESS=1 -if [[ -n "$IS_PIPELINE_JOB" ]] ; then - source src/dev/ci_setup/setup_env.sh -fi +source src/dev/ci_setup/setup_env.sh diff --git a/test/scripts/jenkins_test_setup_oss.sh b/test/scripts/jenkins_test_setup_oss.sh new file mode 100644 index 0000000000000..9e68272053221 --- /dev/null +++ b/test/scripts/jenkins_test_setup_oss.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash + +source test/scripts/jenkins_test_setup.sh + +if [[ -z "$CODE_COVERAGE" ]] ; then + installDir="$(realpath $PARENT_DIR/kibana/build/oss/kibana-*-SNAPSHOT-linux-x86_64)" + destDir=${installDir}-${CI_WORKER_NUMBER} + cp -R "$installDir" "$destDir" + + export KIBANA_INSTALL_DIR="$destDir" +fi diff --git a/test/scripts/jenkins_test_setup_xpack.sh b/test/scripts/jenkins_test_setup_xpack.sh new file mode 100644 index 0000000000000..76fc7cfe6c876 --- /dev/null +++ b/test/scripts/jenkins_test_setup_xpack.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash + +source test/scripts/jenkins_test_setup.sh + +if [[ -z "$CODE_COVERAGE" ]]; then + installDir="$PARENT_DIR/install/kibana" + destDir="${installDir}-${CI_WORKER_NUMBER}" + cp -R "$installDir" "$destDir" + + export KIBANA_INSTALL_DIR="$destDir" + + cd "$XPACK_DIR" +fi diff --git a/test/scripts/jenkins_unit.sh b/test/scripts/jenkins_unit.sh index a8b5e8e4fdf97..fe67594ad8ac2 100755 --- a/test/scripts/jenkins_unit.sh +++ b/test/scripts/jenkins_unit.sh @@ -1,8 +1,6 @@ #!/usr/bin/env bash -set -e - -export TEST_BROWSER_HEADLESS=1 +source test/scripts/jenkins_test_setup.sh if [[ -z "$CODE_COVERAGE" ]] ; then "$(FORCE_COLOR=0 yarn bin)/grunt" jenkins:unit --dev; diff --git a/test/scripts/jenkins_visual_regression.sh b/test/scripts/jenkins_visual_regression.sh index 9ca1c0f08d2c9..dda966dea98d0 100755 --- a/test/scripts/jenkins_visual_regression.sh +++ b/test/scripts/jenkins_visual_regression.sh @@ -1,22 +1,8 @@ #!/usr/bin/env bash -source test/scripts/jenkins_test_setup.sh +source test/scripts/jenkins_test_setup_xpack.sh source "$KIBANA_DIR/src/dev/ci_setup/setup_percy.sh" -if [[ -z "$IS_PIPELINE_JOB" ]] ; then - node scripts/build --debug --oss; - linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-oss-*-linux-x86_64.tar.gz')" - installDir="$PARENT_DIR/install/kibana" - mkdir -p "$installDir" - tar -xzf "$linuxBuild" -C "$installDir" --strip=1 -else - installDir="$(realpath $PARENT_DIR/kibana/build/oss/kibana-*-SNAPSHOT-linux-x86_64)" - destDir=${installDir}-${CI_WORKER_NUMBER} - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" -fi - checks-reporter-with-killswitch "Kibana visual regression tests" \ yarn run percy exec -t 500 \ node scripts/functional_tests \ diff --git a/test/scripts/jenkins_xpack.sh b/test/scripts/jenkins_xpack.sh index e0055085d9b37..e076bd43e1c6e 100755 --- a/test/scripts/jenkins_xpack.sh +++ b/test/scripts/jenkins_xpack.sh @@ -1,8 +1,6 @@ #!/usr/bin/env bash -set -e - -export TEST_BROWSER_HEADLESS=1 +source test/scripts/jenkins_test_setup.sh if [[ -z "$CODE_COVERAGE" ]] ; then echo " -> Running mocha tests" @@ -10,26 +8,26 @@ if [[ -z "$CODE_COVERAGE" ]] ; then checks-reporter-with-killswitch "X-Pack Karma Tests" yarn test:browser echo "" echo "" - + echo " -> Running jest tests" cd "$XPACK_DIR" checks-reporter-with-killswitch "X-Pack Jest" node scripts/jest --ci --verbose echo "" echo "" - + echo " -> Running SIEM cyclic dependency test" cd "$XPACK_DIR" checks-reporter-with-killswitch "X-Pack SIEM cyclic dependency test" node legacy/plugins/siem/scripts/check_circular_deps echo "" echo "" - + # FAILING: https://github.com/elastic/kibana/issues/44250 # echo " -> Running jest contracts tests" # cd "$XPACK_DIR" # SLAPSHOT_ONLINE=true CONTRACT_ONLINE=true node scripts/jest_contract.js --ci --verbose # echo "" # echo "" - + # echo " -> Running jest integration tests" # cd "$XPACK_DIR" # node scripts/jest_integration --ci --verbose @@ -48,4 +46,4 @@ else ../target/kibana-coverage/jest/xpack-coverage-final.json echo "" echo "" -fi \ No newline at end of file +fi diff --git a/test/scripts/jenkins_xpack_accessibility.sh b/test/scripts/jenkins_xpack_accessibility.sh index af813c3c40f84..a3c03dd780886 100755 --- a/test/scripts/jenkins_xpack_accessibility.sh +++ b/test/scripts/jenkins_xpack_accessibility.sh @@ -1,32 +1,6 @@ #!/usr/bin/env bash -set -e - -if [[ -n "$IS_PIPELINE_JOB" ]] ; then - source src/dev/ci_setup/setup_env.sh -fi - -if [[ -z "$IS_PIPELINE_JOB" ]] ; then - echo " -> building and extracting default Kibana distributable for use in functional tests" - node scripts/build --debug --no-oss - - linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-*-linux-x86_64.tar.gz')" - installDir="$PARENT_DIR/install/kibana" - - mkdir -p "$installDir" - tar -xzf "$linuxBuild" -C "$installDir" --strip=1 - - export KIBANA_INSTALL_DIR="$installDir" -else - installDir="$PARENT_DIR/install/kibana" - destDir="${installDir}-${CI_WORKER_NUMBER}" - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" -fi - -export TEST_BROWSER_HEADLESS=1 -cd "$XPACK_DIR" +source test/scripts/jenkins_test_setup_xpack.sh checks-reporter-with-killswitch "X-Pack accessibility tests" \ node scripts/functional_tests \ diff --git a/test/scripts/jenkins_xpack_ci_group.sh b/test/scripts/jenkins_xpack_ci_group.sh index 58c407a848ae3..b599dc73005ec 100755 --- a/test/scripts/jenkins_xpack_ci_group.sh +++ b/test/scripts/jenkins_xpack_ci_group.sh @@ -1,47 +1,9 @@ #!/usr/bin/env bash -source test/scripts/jenkins_test_setup.sh - -if [[ -z "$CODE_COVERAGE" ]] ; then - if [[ -z "$IS_PIPELINE_JOB" ]] ; then - echo " -> Ensuring all functional tests are in a ciGroup" - cd "$XPACK_DIR" - node scripts/functional_tests --assert-none-excluded \ - --include-tag ciGroup1 \ - --include-tag ciGroup2 \ - --include-tag ciGroup3 \ - --include-tag ciGroup4 \ - --include-tag ciGroup5 \ - --include-tag ciGroup6 \ - --include-tag ciGroup7 \ - --include-tag ciGroup8 \ - --include-tag ciGroup9 \ - --include-tag ciGroup10 - fi - - cd "$KIBANA_DIR" - - if [[ -z "$IS_PIPELINE_JOB" ]] ; then - echo " -> building and extracting default Kibana distributable for use in functional tests" - node scripts/build --debug --no-oss - - linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-*-linux-x86_64.tar.gz')" - installDir="$PARENT_DIR/install/kibana" - - mkdir -p "$installDir" - tar -xzf "$linuxBuild" -C "$installDir" --strip=1 - - export KIBANA_INSTALL_DIR="$installDir" - else - installDir="$PARENT_DIR/install/kibana" - destDir="${installDir}-${CI_WORKER_NUMBER}" - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" - fi +source test/scripts/jenkins_test_setup_xpack.sh +if [[ -z "$CODE_COVERAGE" ]]; then echo " -> Running functional and api tests" - cd "$XPACK_DIR" checks-reporter-with-killswitch "X-Pack Chrome Functional tests / Group ${CI_GROUP}" \ node scripts/functional_tests \ @@ -53,9 +15,6 @@ if [[ -z "$CODE_COVERAGE" ]] ; then echo "" else echo " -> Running X-Pack functional tests with code coverage" - cd "$XPACK_DIR" - export NODE_OPTIONS=--max_old_space_size=8192 - node scripts/functional_tests --debug --include-tag "ciGroup$CI_GROUP" fi diff --git a/test/scripts/jenkins_xpack_firefox_smoke.sh b/test/scripts/jenkins_xpack_firefox_smoke.sh index 43220459bcb97..5fe8b41cc0010 100755 --- a/test/scripts/jenkins_xpack_firefox_smoke.sh +++ b/test/scripts/jenkins_xpack_firefox_smoke.sh @@ -1,23 +1,6 @@ #!/usr/bin/env bash -source test/scripts/jenkins_test_setup.sh - -if [[ -z "$IS_PIPELINE_JOB" ]] ; then - node scripts/build --debug --no-oss; - linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-*-linux-x86_64.tar.gz')" - installDir="$PARENT_DIR/install/kibana" - mkdir -p "$installDir" - tar -xzf "$linuxBuild" -C "$installDir" --strip=1 - export KIBANA_INSTALL_DIR="$installDir" -else - installDir="$PARENT_DIR/install/kibana" - destDir="${installDir}-${CI_WORKER_NUMBER}" - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" -fi - -cd "$XPACK_DIR" +source test/scripts/jenkins_test_setup_xpack.sh checks-reporter-with-killswitch "X-Pack firefox smoke test" \ node scripts/functional_tests \ diff --git a/test/scripts/jenkins_xpack_visual_regression.sh b/test/scripts/jenkins_xpack_visual_regression.sh index 5699f9e5ee7c1..6e3d4dd7c249b 100755 --- a/test/scripts/jenkins_xpack_visual_regression.sh +++ b/test/scripts/jenkins_xpack_visual_regression.sh @@ -1,25 +1,8 @@ #!/usr/bin/env bash -source test/scripts/jenkins_test_setup.sh +source test/scripts/jenkins_test_setup_xpack.sh source "$KIBANA_DIR/src/dev/ci_setup/setup_percy.sh" -if [[ -z "$IS_PIPELINE_JOB" ]] ; then - node scripts/build --debug --no-oss; - linuxBuild="$(find "$KIBANA_DIR/target" -name 'kibana-*-linux-x86_64.tar.gz')" - installDir="$PARENT_DIR/install/kibana" - mkdir -p "$installDir" - tar -xzf "$linuxBuild" -C "$installDir" --strip=1 - export KIBANA_INSTALL_DIR="$installDir" -else - installDir="$PARENT_DIR/install/kibana" - destDir="${installDir}-${CI_WORKER_NUMBER}" - cp -R "$installDir" "$destDir" - - export KIBANA_INSTALL_DIR="$destDir" -fi - -cd "$XPACK_DIR" - checks-reporter-with-killswitch "X-Pack visual regression tests" \ yarn run percy exec -t 500 \ node scripts/functional_tests \ diff --git a/vars/kibanaPipeline.groovy b/vars/kibanaPipeline.groovy index 346bcf77b96b1..dd66586e912d6 100644 --- a/vars/kibanaPipeline.groovy +++ b/vars/kibanaPipeline.groovy @@ -2,7 +2,7 @@ def withWorkers(machineName, preWorkerClosure = {}, workerClosures = [:]) { return { jobRunner('tests-xl', true) { withGcsArtifactUpload(machineName, { - try { + withPostBuildReporting { doSetup() preWorkerClosure() @@ -26,24 +26,53 @@ def withWorkers(machineName, preWorkerClosure = {}, workerClosures = [:]) { } parallel(workers) - } finally { - catchError { - runErrorReporter() - } - - catchError { - runbld.junit() - } - - catchError { - publishJunit() - } } }) } } } +def withWorker(machineName, label, Closure closure) { + return { + jobRunner(label, false) { + withGcsArtifactUpload(machineName) { + withPostBuildReporting { + doSetup() + closure() + } + } + } + } +} + +def intakeWorker(jobName, String script) { + return withWorker(jobName, 'linux && immutable') { + withEnv([ + "JOB=${jobName}", + ]) { + runbld(script, "Execute ${jobName}") + } + } +} + +def withPostBuildReporting(Closure closure) { + try { + closure() + } finally { + catchError { + runErrorReporter() + } + + catchError { + runbld.junit() + } + + catchError { + publishJunit() + } + } +} + def getPostBuildWorker(name, closure) { return { workerNumber -> def kibanaPort = "61${workerNumber}1" @@ -90,34 +119,6 @@ def getXpackCiGroupWorker(ciGroup) { }) } -def legacyJobRunner(name) { - return { - parallel([ - "${name}": { - withEnv([ - "JOB=${name}", - ]) { - jobRunner('linux && immutable', false) { - withGcsArtifactUpload(name, { - try { - runbld('.ci/run.sh', "Execute ${name}", true) - } finally { - catchError { - runErrorReporter() - } - - catchError { - publishJunit() - } - } - }) - } - } - } - ]) - } -} - def jobRunner(label, useRamDisk, closure) { node(label) { agentInfo.print() @@ -168,8 +169,6 @@ def jobRunner(label, useRamDisk, closure) { } } -// TODO what should happen if GCS, Junit, or email publishing fails? Unstable build? Failed build? - def uploadGcsArtifact(uploadPrefix, pattern) { googleStorageUpload( credentialsId: 'kibana-ci-gcs-plugin', From d66489df375013377f7fe30060f474fc35c88e8d Mon Sep 17 00:00:00 2001 From: Spencer Date: Mon, 27 Jan 2020 16:27:36 -0700 Subject: [PATCH 67/77] make test less flaky by retrying if list is re-rendered (#55949) Co-authored-by: Elastic Machine --- .../services/dashboard/add_panel.js | 23 +++++++++++++------ 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/test/functional/services/dashboard/add_panel.js b/test/functional/services/dashboard/add_panel.js index e390fd918eaee..91e7c15c4f1d9 100644 --- a/test/functional/services/dashboard/add_panel.js +++ b/test/functional/services/dashboard/add_panel.js @@ -54,14 +54,23 @@ export function DashboardAddPanelProvider({ getService, getPageObjects }) { async addEveryEmbeddableOnCurrentPage() { log.debug('addEveryEmbeddableOnCurrentPage'); const itemList = await testSubjects.find('savedObjectFinderItemList'); - const embeddableRows = await itemList.findAllByCssSelector('li'); const embeddableList = []; - for (let i = 0; i < embeddableRows.length; i++) { - embeddableList.push(await embeddableRows[i].getVisibleText()); - await embeddableRows[i].click(); - await PageObjects.common.closeToast(); - } - log.debug(`Added ${embeddableRows.length} embeddables`); + await retry.try(async () => { + const embeddableRows = await itemList.findAllByCssSelector('li'); + for (let i = 0; i < embeddableRows.length; i++) { + const name = await embeddableRows[i].getVisibleText(); + + if (embeddableList.includes(name)) { + // already added this one + continue; + } + + await embeddableRows[i].click(); + await PageObjects.common.closeToast(); + embeddableList.push(name); + } + }); + log.debug(`Added ${embeddableList.length} embeddables`); return embeddableList; } From 80087a399fdf80743662eb47166061a7fcb38a1a Mon Sep 17 00:00:00 2001 From: Garrett Spong Date: Mon, 27 Jan 2020 16:44:58 -0700 Subject: [PATCH 68/77] [SIEM] [Detection Engine] Fixes histogram intervals (#55969) ## Summary This PR wraps up the remaining `Detection Engine` meta tickets: https://github.com/elastic/kibana/issues/55585, https://github.com/elastic/kibana/issues/54935, and https://github.com/elastic/siem-team/issues/498 - [x] Histogram bar interval (bar counts and widths) consistency (https://github.com/elastic/kibana/issues/55585) - [x] Make the bar intervals a consistent 32 bars across the board * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms. - [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (https://github.com/elastic/siem-team/issues/498) - [ ] ~Import query from saved timeline~ * For 7.7 tracking ticket here: https://github.com/elastic/kibana/issues/56079 - [x] `Investigate detections using this timeline template` - [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts" - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs - [x] Updated DE permission/index error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions) - [x] Removed `frequency` in favor of `count` for remaining histograms ##### Inconsistent Histogram intervals ![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png) ##### Consistent Histogram Intervals ![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png) cc @MichaelMarcialis @cwurm @MikePaquette ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. - [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~ - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) - [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~ - [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~ - [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~ ### For maintainers - [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~ - [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~ --- .../public/components/alerts_viewer/index.tsx | 10 +++++- .../components/alerts_viewer/translations.ts | 10 +++--- .../timeline/search_super_select/index.tsx | 34 ++++++++++++------- .../signals_histogram_panel/helpers.tsx | 9 +++-- .../signals_histogram_panel/translations.ts | 2 +- .../detection_engine_no_signal_index.tsx | 29 ++++++++-------- .../detection_engine_user_unauthenticated.tsx | 28 ++++++++------- .../rules/components/pick_timeline/index.tsx | 1 + .../siem/public/pages/hosts/translations.ts | 2 +- .../siem/public/pages/network/translations.ts | 2 +- .../public/pages/overview/translations.ts | 2 +- .../siem/server/lib/alerts/query.dsl.ts | 19 +++++------ .../query.anomalies_over_time.dsl.ts | 19 +++++------ .../query.authentications_over_time.dsl.ts | 19 +++++------ .../lib/events/query.events_over_time.dsl.ts | 19 +++++------ .../lib/network/query_dns_histogram.dsl.ts | 6 ++-- .../calculate_timeseries_interval.ts | 11 ++---- 17 files changed, 118 insertions(+), 104 deletions(-) diff --git a/x-pack/legacy/plugins/siem/public/components/alerts_viewer/index.tsx b/x-pack/legacy/plugins/siem/public/components/alerts_viewer/index.tsx index 0b99a8b059df7..2d10928da570a 100644 --- a/x-pack/legacy/plugins/siem/public/components/alerts_viewer/index.tsx +++ b/x-pack/legacy/plugins/siem/public/components/alerts_viewer/index.tsx @@ -6,6 +6,7 @@ import { noop } from 'lodash/fp'; import React, { useEffect, useCallback } from 'react'; import { EuiSpacer } from '@elastic/eui'; +import numeral from '@elastic/numeral'; import { AlertsComponentsQueryProps } from './types'; import { AlertsTable } from './alerts_table'; @@ -13,6 +14,8 @@ import * as i18n from './translations'; import { MatrixHistogramOption } from '../matrix_histogram/types'; import { MatrixHistogramContainer } from '../../containers/matrix_histogram'; import { MatrixHistogramGqlQuery } from '../../containers/matrix_histogram/index.gql_query'; +import { useUiSetting$ } from '../../lib/kibana'; +import { DEFAULT_NUMBER_FORMAT } from '../../../common/constants'; const ID = 'alertsOverTimeQuery'; export const alertsStackByOptions: MatrixHistogramOption[] = [ { @@ -37,6 +40,8 @@ export const AlertsView = ({ type, updateDateRange = noop, }: AlertsComponentsQueryProps) => { + const [defaultNumberFormat] = useUiSetting$(DEFAULT_NUMBER_FORMAT); + useEffect(() => { return () => { if (deleteQuery) { @@ -46,7 +51,10 @@ export const AlertsView = ({ }, []); const getSubtitle = useCallback( - (totalCount: number) => `${i18n.SHOWING}: ${totalCount} ${i18n.UNIT(totalCount)}`, + (totalCount: number) => + `${i18n.SHOWING}: ${numeral(totalCount).format(defaultNumberFormat)} ${i18n.UNIT( + totalCount + )}`, [] ); diff --git a/x-pack/legacy/plugins/siem/public/components/alerts_viewer/translations.ts b/x-pack/legacy/plugins/siem/public/components/alerts_viewer/translations.ts index 408c406a854be..b0bc38bd3ebdc 100644 --- a/x-pack/legacy/plugins/siem/public/components/alerts_viewer/translations.ts +++ b/x-pack/legacy/plugins/siem/public/components/alerts_viewer/translations.ts @@ -7,19 +7,19 @@ import { i18n } from '@kbn/i18n'; export const ALERTS_DOCUMENT_TYPE = i18n.translate('xpack.siem.alertsView.alertsDocumentType', { - defaultMessage: 'Alerts', + defaultMessage: 'External alerts', }); export const TOTAL_COUNT_OF_ALERTS = i18n.translate('xpack.siem.alertsView.totalCountOfAlerts', { - defaultMessage: 'alerts match the search criteria', + defaultMessage: 'external alerts match the search criteria', }); export const ALERTS_TABLE_TITLE = i18n.translate('xpack.siem.alertsView.alertsTableTitle', { - defaultMessage: 'Alerts', + defaultMessage: 'External alerts', }); export const ALERTS_GRAPH_TITLE = i18n.translate('xpack.siem.alertsView.alertsGraphTitle', { - defaultMessage: 'Alert detection frequency', + defaultMessage: 'External alerts count', }); export const ALERTS_STACK_BY_MODULE = i18n.translate( @@ -36,7 +36,7 @@ export const SHOWING = i18n.translate('xpack.siem.alertsView.showing', { export const UNIT = (totalCount: number) => i18n.translate('xpack.siem.alertsView.unit', { values: { totalCount }, - defaultMessage: `{totalCount, plural, =1 {alert} other {alerts}}`, + defaultMessage: `external {totalCount, plural, =1 {alert} other {alerts}}`, }); export const ERROR_FETCHING_ALERTS_DATA = i18n.translate( diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/search_super_select/index.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/search_super_select/index.tsx index 009ab141e958e..b8280aedd12fa 100644 --- a/x-pack/legacy/plugins/siem/public/components/timeline/search_super_select/index.tsx +++ b/x-pack/legacy/plugins/siem/public/components/timeline/search_super_select/index.tsx @@ -73,6 +73,7 @@ const MyEuiFlexGroup = styled(EuiFlexGroup)` interface SearchTimelineSuperSelectProps { isDisabled: boolean; + hideUntitled?: boolean; timelineId: string | null; timelineTitle: string | null; onTimelineChange: (timelineTitle: string, timelineId: string | null) => void; @@ -101,6 +102,7 @@ const POPOVER_HEIGHT = 260; const TIMELINE_ITEM_HEIGHT = 50; const SearchTimelineSuperSelectComponent: React.FC = ({ isDisabled, + hideUntitled = false, timelineId, timelineTitle, onTimelineChange, @@ -287,7 +289,11 @@ const SearchTimelineSuperSelectComponent: React.FC !hideUntitled || t.title !== '').length, + totalCount + ), } as unknown) as ListProps, }} renderOption={renderTimelineOption} @@ -308,18 +314,20 @@ const SearchTimelineSuperSelectComponent: React.FC - ({ - description: t.description, - favorite: t.favorite, - label: t.title, - id: t.savedObjectId, - key: `${t.title}-${index}`, - title: t.title, - checked: t.savedObjectId === timelineId ? 'on' : undefined, - } as Option) - ), + ...timelines + .filter(t => !hideUntitled || t.title !== '') + .map( + (t, index) => + ({ + description: t.description, + favorite: t.favorite, + label: t.title, + id: t.savedObjectId, + key: `${t.title}-${index}`, + title: t.title, + checked: t.savedObjectId === timelineId ? 'on' : undefined, + } as Option) + ), ]} > {(list, search) => ( diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx index 71a19d4595f6a..551850fa610db 100644 --- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx +++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx @@ -47,9 +47,14 @@ export const getSignalsHistogramQuery = ( }, aggs: { signals: { - auto_date_histogram: { + date_histogram: { field: '@timestamp', - buckets: 36, + fixed_interval: `${Math.floor((to - from) / 32)}ms`, + min_doc_count: 0, + extended_bounds: { + min: from, + max: to, + }, }, }, }, diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/translations.ts index 8c88fa4a5dae6..4cecf7376ca41 100644 --- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/translations.ts +++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/translations.ts @@ -86,7 +86,7 @@ export const STACK_BY_USERS = i18n.translate( export const HISTOGRAM_HEADER = i18n.translate( 'xpack.siem.detectionEngine.signals.histogram.headerTitle', { - defaultMessage: 'Signal count', + defaultMessage: 'Signals count', } ); diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_no_signal_index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_no_signal_index.tsx index 1be6317a91607..f1478ab5858c9 100644 --- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_no_signal_index.tsx +++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_no_signal_index.tsx @@ -5,23 +5,24 @@ */ import React from 'react'; -import chrome from 'ui/chrome'; import { EmptyPage } from '../../components/empty_page'; import * as i18n from './translations'; +import { useKibana } from '../../lib/kibana'; -const basePath = chrome.getBasePath(); - -export const DetectionEngineNoIndex = React.memo(() => ( - -)); +export const DetectionEngineNoIndex = React.memo(() => { + const docLinks = useKibana().services.docLinks; + return ( + + ); +}); DetectionEngineNoIndex.displayName = 'DetectionEngineNoIndex'; diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_user_unauthenticated.tsx index 33b63aa3bf0fe..b5c805f92135a 100644 --- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_user_unauthenticated.tsx +++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_user_unauthenticated.tsx @@ -5,23 +5,25 @@ */ import React from 'react'; -import chrome from 'ui/chrome'; import { EmptyPage } from '../../components/empty_page'; import * as i18n from './translations'; +import { useKibana } from '../../lib/kibana'; -const basePath = chrome.getBasePath(); +export const DetectionEngineUserUnauthenticated = React.memo(() => { + const docLinks = useKibana().services.docLinks; -export const DetectionEngineUserUnauthenticated = React.memo(() => ( - -)); + return ( + + ); +}); DetectionEngineUserUnauthenticated.displayName = 'DetectionEngineUserUnauthenticated'; diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/pick_timeline/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/pick_timeline/index.tsx index 873e0c2184c61..f467d0ebede41 100644 --- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/pick_timeline/index.tsx +++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/pick_timeline/index.tsx @@ -65,6 +65,7 @@ export const PickTimeline = ({ > diff --git a/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts b/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts index 662fc721111ed..656abd3dc0570 100644 --- a/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts +++ b/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts @@ -13,7 +13,7 @@ export const ALERTS_COUNT_BY = (groupByField: string) => }); export const ALERTS_GRAPH_TITLE = i18n.translate('xpack.siem.overview.alertsGraphTitle', { - defaultMessage: 'Alert detection frequency', + defaultMessage: 'External alerts count', }); export const EVENTS_COUNT_BY = (groupByField: string) => diff --git a/x-pack/legacy/plugins/siem/server/lib/alerts/query.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/alerts/query.dsl.ts index 08015c3508b86..eb82327197543 100644 --- a/x-pack/legacy/plugins/siem/server/lib/alerts/query.dsl.ts +++ b/x-pack/legacy/plugins/siem/server/lib/alerts/query.dsl.ts @@ -4,7 +4,7 @@ * you may not use this file except in compliance with the Elastic License. */ -import { createQueryFilterClauses, calculateTimeseriesInterval } from '../../utils/build_query'; +import { createQueryFilterClauses, calculateTimeSeriesInterval } from '../../utils/build_query'; import { buildTimelineQuery } from '../events/query.dsl'; import { RequestOptions, MatrixHistogramRequestOptions } from '../framework'; @@ -68,18 +68,17 @@ export const buildAlertsHistogramQuery = ({ ]; const getHistogramAggregation = () => { - const interval = calculateTimeseriesInterval(from, to); + const interval = calculateTimeSeriesInterval(from, to); const histogramTimestampField = '@timestamp'; const dateHistogram = { date_histogram: { field: histogramTimestampField, - fixed_interval: `${interval}s`, - }, - }; - const autoDateHistogram = { - auto_date_histogram: { - field: histogramTimestampField, - buckets: 36, + fixed_interval: interval, + min_doc_count: 0, + extended_bounds: { + min: from, + max: to, + }, }, }; return { @@ -93,7 +92,7 @@ export const buildAlertsHistogramQuery = ({ size: 10, }, aggs: { - alerts: interval ? dateHistogram : autoDateHistogram, + alerts: dateHistogram, }, }, }; diff --git a/x-pack/legacy/plugins/siem/server/lib/anomalies/query.anomalies_over_time.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/anomalies/query.anomalies_over_time.dsl.ts index b0892a68f0a2e..38e8387f43ffd 100644 --- a/x-pack/legacy/plugins/siem/server/lib/anomalies/query.anomalies_over_time.dsl.ts +++ b/x-pack/legacy/plugins/siem/server/lib/anomalies/query.anomalies_over_time.dsl.ts @@ -4,7 +4,7 @@ * you may not use this file except in compliance with the Elastic License. */ -import { createQueryFilterClauses, calculateTimeseriesInterval } from '../../utils/build_query'; +import { createQueryFilterClauses, calculateTimeSeriesInterval } from '../../utils/build_query'; import { MatrixHistogramRequestOptions } from '../framework'; export const buildAnomaliesOverTimeQuery = ({ @@ -26,18 +26,17 @@ export const buildAnomaliesOverTimeQuery = ({ ]; const getHistogramAggregation = () => { - const interval = calculateTimeseriesInterval(from, to); + const interval = calculateTimeSeriesInterval(from, to); const histogramTimestampField = 'timestamp'; const dateHistogram = { date_histogram: { field: histogramTimestampField, - fixed_interval: `${interval}s`, - }, - }; - const autoDateHistogram = { - auto_date_histogram: { - field: histogramTimestampField, - buckets: 36, + fixed_interval: interval, + min_doc_count: 0, + extended_bounds: { + min: from, + max: to, + }, }, }; return { @@ -50,7 +49,7 @@ export const buildAnomaliesOverTimeQuery = ({ size: 10, }, aggs: { - anomalies: interval ? dateHistogram : autoDateHistogram, + anomalies: dateHistogram, }, }, }; diff --git a/x-pack/legacy/plugins/siem/server/lib/authentications/query.authentications_over_time.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/authentications/query.authentications_over_time.dsl.ts index 77b35fef77dca..ccf0d235abdd3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/authentications/query.authentications_over_time.dsl.ts +++ b/x-pack/legacy/plugins/siem/server/lib/authentications/query.authentications_over_time.dsl.ts @@ -3,7 +3,7 @@ * or more contributor license agreements. Licensed under the Elastic License; * you may not use this file except in compliance with the Elastic License. */ -import { createQueryFilterClauses, calculateTimeseriesInterval } from '../../utils/build_query'; +import { createQueryFilterClauses, calculateTimeSeriesInterval } from '../../utils/build_query'; import { MatrixHistogramRequestOptions } from '../framework'; export const buildAuthenticationsOverTimeQuery = ({ @@ -28,18 +28,17 @@ export const buildAuthenticationsOverTimeQuery = ({ ]; const getHistogramAggregation = () => { - const interval = calculateTimeseriesInterval(from, to); + const interval = calculateTimeSeriesInterval(from, to); const histogramTimestampField = '@timestamp'; const dateHistogram = { date_histogram: { field: histogramTimestampField, - fixed_interval: `${interval}s`, - }, - }; - const autoDateHistogram = { - auto_date_histogram: { - field: histogramTimestampField, - buckets: 36, + fixed_interval: interval, + min_doc_count: 0, + extended_bounds: { + min: from, + max: to, + }, }, }; return { @@ -53,7 +52,7 @@ export const buildAuthenticationsOverTimeQuery = ({ size: 2, }, aggs: { - events: interval ? dateHistogram : autoDateHistogram, + events: dateHistogram, }, }, }; diff --git a/x-pack/legacy/plugins/siem/server/lib/events/query.events_over_time.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/events/query.events_over_time.dsl.ts index 4b1837497669f..3a4281b980cc4 100644 --- a/x-pack/legacy/plugins/siem/server/lib/events/query.events_over_time.dsl.ts +++ b/x-pack/legacy/plugins/siem/server/lib/events/query.events_over_time.dsl.ts @@ -3,7 +3,7 @@ * or more contributor license agreements. Licensed under the Elastic License; * you may not use this file except in compliance with the Elastic License. */ -import { createQueryFilterClauses, calculateTimeseriesInterval } from '../../utils/build_query'; +import { createQueryFilterClauses, calculateTimeSeriesInterval } from '../../utils/build_query'; import { MatrixHistogramRequestOptions } from '../framework'; export const buildEventsOverTimeQuery = ({ @@ -28,18 +28,17 @@ export const buildEventsOverTimeQuery = ({ ]; const getHistogramAggregation = () => { - const interval = calculateTimeseriesInterval(from, to); + const interval = calculateTimeSeriesInterval(from, to); const histogramTimestampField = '@timestamp'; const dateHistogram = { date_histogram: { field: histogramTimestampField, - fixed_interval: `${interval}s`, - }, - }; - const autoDateHistogram = { - auto_date_histogram: { - field: histogramTimestampField, - buckets: 36, + fixed_interval: interval, + min_doc_count: 0, + extended_bounds: { + min: from, + max: to, + }, }, }; return { @@ -53,7 +52,7 @@ export const buildEventsOverTimeQuery = ({ size: 10, }, aggs: { - events: interval ? dateHistogram : autoDateHistogram, + events: dateHistogram, }, }, }; diff --git a/x-pack/legacy/plugins/siem/server/lib/network/query_dns_histogram.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/network/query_dns_histogram.dsl.ts index 67457ab4840ac..1ce324e0ffff8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/network/query_dns_histogram.dsl.ts +++ b/x-pack/legacy/plugins/siem/server/lib/network/query_dns_histogram.dsl.ts @@ -4,7 +4,7 @@ * you may not use this file except in compliance with the Elastic License. */ -import { createQueryFilterClauses, calculateTimeseriesInterval } from '../../utils/build_query'; +import { createQueryFilterClauses, calculateTimeSeriesInterval } from '../../utils/build_query'; import { MatrixHistogramRequestOptions } from '../framework'; export const buildDnsHistogramQuery = ({ @@ -29,12 +29,12 @@ export const buildDnsHistogramQuery = ({ ]; const getHistogramAggregation = () => { - const interval = calculateTimeseriesInterval(from, to); + const interval = calculateTimeSeriesInterval(from, to); const histogramTimestampField = '@timestamp'; const dateHistogram = { date_histogram: { field: histogramTimestampField, - fixed_interval: `${interval}s`, + fixed_interval: interval, }, }; diff --git a/x-pack/legacy/plugins/siem/server/utils/build_query/calculate_timeseries_interval.ts b/x-pack/legacy/plugins/siem/server/utils/build_query/calculate_timeseries_interval.ts index 752c686b243ac..5b667f461fc60 100644 --- a/x-pack/legacy/plugins/siem/server/utils/build_query/calculate_timeseries_interval.ts +++ b/x-pack/legacy/plugins/siem/server/utils/build_query/calculate_timeseries_interval.ts @@ -89,13 +89,6 @@ export const calculateAuto = { }), }; -export const calculateTimeseriesInterval = ( - lowerBoundInMsSinceEpoch: number, - upperBoundInMsSinceEpoch: number -) => { - const duration = moment.duration(upperBoundInMsSinceEpoch - lowerBoundInMsSinceEpoch, 'ms'); - - const matchedInterval = calculateAuto.near(50, duration); - - return matchedInterval ? Math.max(matchedInterval.asSeconds(), 1) : null; +export const calculateTimeSeriesInterval = (from: number, to: number) => { + return `${Math.floor((to - from) / 32)}ms`; }; From 1ec7ee79b61811180a8c4e0351c599f4a27d445c Mon Sep 17 00:00:00 2001 From: Phillip Burch Date: Mon, 27 Jan 2020 19:10:34 -0600 Subject: [PATCH 69/77] Create a new menu for observability links (#54847) * Create a new menu for observability links. Use it on inentory page. * Change the order of props for clarity * Fix default message * Composition over configuration * Show ids and ips. PR feedback. * Don't wrap subtitle. Use fields in inventory model for name * Tooltip was becoming hacky. Keep it simple and wrap the id. * Create observability plugin. Add action menu to it. * Fix path * Satisfy linter and fix test * Please the linter * Update translastions * Update test for disabled links * Update more tests Co-authored-by: Elastic Machine --- .../common/inventory_models/aws_ec2/index.ts | 3 + .../common/inventory_models/aws_rds/index.ts | 3 + .../common/inventory_models/aws_s3/index.ts | 3 + .../common/inventory_models/aws_sqs/index.ts | 3 + .../inventory_models/container/index.ts | 3 + .../common/inventory_models/host/index.ts | 3 + .../common/inventory_models/pod/index.ts | 3 + .../infra/common/inventory_models/types.ts | 1 + .../components/waffle/node_context_menu.tsx | 153 ++++++++++++------ x-pack/plugins/observability/kibana.json | 6 + .../public/components/action_menu.tsx | 57 +++++++ x-pack/plugins/observability/public/index.ts | 16 ++ x-pack/plugins/observability/public/plugin.ts | 15 ++ .../translations/translations/ja-JP.json | 4 +- .../translations/translations/zh-CN.json | 4 +- .../infrastructure_security.ts | 12 +- .../feature_controls/infrastructure_spaces.ts | 6 +- 17 files changed, 237 insertions(+), 58 deletions(-) create mode 100644 x-pack/plugins/observability/kibana.json create mode 100644 x-pack/plugins/observability/public/components/action_menu.tsx create mode 100644 x-pack/plugins/observability/public/index.ts create mode 100644 x-pack/plugins/observability/public/plugin.ts diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/aws_ec2/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/aws_ec2/index.ts index ccfd8cd9851eb..5f667beebd83b 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/aws_ec2/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/aws_ec2/index.ts @@ -13,6 +13,9 @@ export const awsEC2: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModels.awsEC2.displayName', { defaultMessage: 'EC2 Instances', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModels.awsEC2.singularDisplayName', { + defaultMessage: 'EC2 Instance', + }), requiredModule: 'aws', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/aws_rds/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/aws_rds/index.ts index f1182a942ff06..02cef192b59ef 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/aws_rds/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/aws_rds/index.ts @@ -13,6 +13,9 @@ export const awsRDS: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModels.awsRDS.displayName', { defaultMessage: 'RDS Databases', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModels.awsRDS.singularDisplayName', { + defaultMessage: 'RDS Database', + }), requiredModule: 'aws', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/aws_s3/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/aws_s3/index.ts index 3bdf319f49c5f..a786283a100a9 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/aws_s3/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/aws_s3/index.ts @@ -13,6 +13,9 @@ export const awsS3: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModels.awsS3.displayName', { defaultMessage: 'S3 Buckets', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModels.awsS3.singularDisplayName', { + defaultMessage: 'S3 Bucket', + }), requiredModule: 'aws', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/aws_sqs/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/aws_sqs/index.ts index 1733e995a824f..21379ebb1e604 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/aws_sqs/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/aws_sqs/index.ts @@ -13,6 +13,9 @@ export const awsSQS: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModels.awsSQS.displayName', { defaultMessage: 'SQS Queues', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModels.awsSQS.singularDisplayName', { + defaultMessage: 'SQS Queue', + }), requiredModule: 'aws', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/container/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/container/index.ts index 29b3cfe3af180..c142f600d1d56 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/container/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/container/index.ts @@ -13,6 +13,9 @@ export const container: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModel.container.displayName', { defaultMessage: 'Docker Containers', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModel.container.singularDisplayName', { + defaultMessage: 'Docker Container', + }), requiredModule: 'docker', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/host/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/host/index.ts index 364ef0b4c2c91..538af4f5119b4 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/host/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/host/index.ts @@ -17,6 +17,9 @@ export const host: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModel.host.displayName', { defaultMessage: 'Hosts', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModels.host.singularDisplayName', { + defaultMessage: 'Host', + }), requiredModule: 'system', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/pod/index.ts b/x-pack/legacy/plugins/infra/common/inventory_models/pod/index.ts index f76a0304e26c0..961e0248c79da 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/pod/index.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/pod/index.ts @@ -14,6 +14,9 @@ export const pod: InventoryModel = { displayName: i18n.translate('xpack.infra.inventoryModel.pod.displayName', { defaultMessage: 'Kubernetes Pods', }), + singularDisplayName: i18n.translate('xpack.infra.inventoryModels.pod.singularDisplayName', { + defaultMessage: 'Kubernetes Pod', + }), requiredModule: 'kubernetes', crosslinkSupport: { details: true, diff --git a/x-pack/legacy/plugins/infra/common/inventory_models/types.ts b/x-pack/legacy/plugins/infra/common/inventory_models/types.ts index cc2396547edc4..2f61b16fb3df8 100644 --- a/x-pack/legacy/plugins/infra/common/inventory_models/types.ts +++ b/x-pack/legacy/plugins/infra/common/inventory_models/types.ts @@ -320,6 +320,7 @@ export interface InventoryMetrics { export interface InventoryModel { id: string; displayName: string; + singularDisplayName: string; requiredModule: string; fields: { id: string; diff --git a/x-pack/legacy/plugins/infra/public/components/waffle/node_context_menu.tsx b/x-pack/legacy/plugins/infra/public/components/waffle/node_context_menu.tsx index 5a90efcc51a57..86a22c358b4d5 100644 --- a/x-pack/legacy/plugins/infra/public/components/waffle/node_context_menu.tsx +++ b/x-pack/legacy/plugins/infra/public/components/waffle/node_context_menu.tsx @@ -4,21 +4,26 @@ * you may not use this file except in compliance with the Elastic License. */ -import { - EuiContextMenu, - EuiContextMenuPanelDescriptor, - EuiPopover, - EuiPopoverProps, -} from '@elastic/eui'; +import { EuiPopoverProps, EuiCode } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; +import { FormattedMessage } from '@kbn/i18n/react'; -import React from 'react'; +import React, { useMemo } from 'react'; import { InfraWaffleMapNode, InfraWaffleMapOptions } from '../../lib/lib'; import { getNodeDetailUrl, getNodeLogsUrl } from '../../pages/link_to'; import { createUptimeLink } from './lib/create_uptime_link'; -import { findInventoryModel } from '../../../common/inventory_models'; +import { findInventoryModel, findInventoryFields } from '../../../common/inventory_models'; import { useKibana } from '../../../../../../../src/plugins/kibana_react/public'; import { InventoryItemType } from '../../../common/inventory_models/types'; +import { + Section, + SectionLinkProps, + ActionMenu, + SectionTitle, + SectionSubtitle, + SectionLinks, + SectionLink, +} from '../../../../../../plugins/observability/public'; interface Props { options: InfraWaffleMapOptions; @@ -43,15 +48,42 @@ export const NodeContextMenu = ({ }: Props) => { const uiCapabilities = useKibana().services.application?.capabilities; const inventoryModel = findInventoryModel(nodeType); + const nodeDetailFrom = currentTime - inventoryModel.metrics.defaultTimeRangeInSeconds * 1000; // Due to the changing nature of the fields between APM and this UI, // We need to have some exceptions until 7.0 & ECS is finalized. Reference // #26620 for the details for these fields. // TODO: This is tech debt, remove it after 7.0 & ECS migration. const apmField = nodeType === 'host' ? 'host.hostname' : inventoryModel.fields.id; - const nodeLogsMenuItem = { - name: i18n.translate('xpack.infra.nodeContextMenu.viewLogsName', { - defaultMessage: 'View logs', + const showDetail = inventoryModel.crosslinkSupport.details; + const showLogsLink = + inventoryModel.crosslinkSupport.logs && node.id && uiCapabilities?.logs?.show; + const showAPMTraceLink = + inventoryModel.crosslinkSupport.apm && uiCapabilities?.apm && uiCapabilities?.apm.show; + const showUptimeLink = + inventoryModel.crosslinkSupport.uptime && (['pod', 'container'].includes(nodeType) || node.ip); + + const inventoryId = useMemo(() => { + if (nodeType === 'host') { + if (node.ip) { + return { label: host.ip, value: node.ip }; + } + } else { + if (options.fields) { + const { id } = findInventoryFields(nodeType, options.fields); + return { + label: {id}, + value: node.id, + }; + } + } + return { label: '', value: '' }; + }, [nodeType, node.ip, node.id, options.fields]); + + const nodeLogsMenuItem: SectionLinkProps = { + label: i18n.translate('xpack.infra.nodeContextMenu.viewLogsName', { + defaultMessage: '{inventoryName} logs', + values: { inventoryName: inventoryModel.singularDisplayName }, }), href: getNodeLogsUrl({ nodeType, @@ -59,12 +91,13 @@ export const NodeContextMenu = ({ time: currentTime, }), 'data-test-subj': 'viewLogsContextMenuItem', + isDisabled: !showLogsLink, }; - const nodeDetailFrom = currentTime - inventoryModel.metrics.defaultTimeRangeInSeconds * 1000; - const nodeDetailMenuItem = { - name: i18n.translate('xpack.infra.nodeContextMenu.viewMetricsName', { - defaultMessage: 'View metrics', + const nodeDetailMenuItem: SectionLinkProps = { + label: i18n.translate('xpack.infra.nodeContextMenu.viewMetricsName', { + defaultMessage: '{inventoryName} metrics', + values: { inventoryName: inventoryModel.singularDisplayName }, }), href: getNodeDetailUrl({ nodeType, @@ -72,54 +105,82 @@ export const NodeContextMenu = ({ from: nodeDetailFrom, to: currentTime, }), + isDisabled: !showDetail, }; - const apmTracesMenuItem = { - name: i18n.translate('xpack.infra.nodeContextMenu.viewAPMTraces', { - defaultMessage: 'View APM traces', + const apmTracesMenuItem: SectionLinkProps = { + label: i18n.translate('xpack.infra.nodeContextMenu.viewAPMTraces', { + defaultMessage: '{inventoryName} APM traces', + values: { inventoryName: inventoryModel.singularDisplayName }, }), href: `../app/apm#/traces?_g=()&kuery=${apmField}:"${node.id}"`, 'data-test-subj': 'viewApmTracesContextMenuItem', + isDisabled: !showAPMTraceLink, }; - const uptimeMenuItem = { - name: i18n.translate('xpack.infra.nodeContextMenu.viewUptimeLink', { - defaultMessage: 'View in Uptime', + const uptimeMenuItem: SectionLinkProps = { + label: i18n.translate('xpack.infra.nodeContextMenu.viewUptimeLink', { + defaultMessage: '{inventoryName} in Uptime', + values: { inventoryName: inventoryModel.singularDisplayName }, }), href: createUptimeLink(options, nodeType, node), + isDisabled: !showUptimeLink, }; - const showDetail = inventoryModel.crosslinkSupport.details; - const showLogsLink = - inventoryModel.crosslinkSupport.logs && node.id && uiCapabilities?.logs?.show; - const showAPMTraceLink = - inventoryModel.crosslinkSupport.apm && uiCapabilities?.apm && uiCapabilities?.apm.show; - const showUptimeLink = - inventoryModel.crosslinkSupport.uptime && (['pod', 'container'].includes(nodeType) || node.ip); - - const items = [ - ...(showLogsLink ? [nodeLogsMenuItem] : []), - ...(showDetail ? [nodeDetailMenuItem] : []), - ...(showAPMTraceLink ? [apmTracesMenuItem] : []), - ...(showUptimeLink ? [uptimeMenuItem] : []), - ]; - const panels: EuiContextMenuPanelDescriptor[] = [{ id: 0, title: '', items }]; - - // If there is nothing to show then we need to return the child as is - if (items.length === 0) { - return <>{children}; - } - return ( - - - +
+
+ + + + {inventoryId.label && ( + +
+ +
+
+ )} + + + + + + +
+
+ ); }; diff --git a/x-pack/plugins/observability/kibana.json b/x-pack/plugins/observability/kibana.json new file mode 100644 index 0000000000000..57063ea729ed6 --- /dev/null +++ b/x-pack/plugins/observability/kibana.json @@ -0,0 +1,6 @@ +{ + "id": "observability", + "version": "8.0.0", + "kibanaVersion": "kibana", + "ui": true +} diff --git a/x-pack/plugins/observability/public/components/action_menu.tsx b/x-pack/plugins/observability/public/components/action_menu.tsx new file mode 100644 index 0000000000000..6e964dde3aecf --- /dev/null +++ b/x-pack/plugins/observability/public/components/action_menu.tsx @@ -0,0 +1,57 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +import { + EuiPopover, + EuiText, + EuiListGroup, + EuiSpacer, + EuiHorizontalRule, + EuiListGroupItem, + EuiPopoverProps, +} from '@elastic/eui'; + +import React, { HTMLAttributes } from 'react'; +import { EuiListGroupItemProps } from '@elastic/eui/src/components/list_group/list_group_item'; + +type Props = EuiPopoverProps & HTMLAttributes; + +export const SectionTitle: React.FC<{}> = props => ( + <> + +
{props.children}
+
+ + +); + +export const SectionSubtitle: React.FC<{}> = props => ( + <> + + {props.children} + + + +); + +export const SectionLinks: React.FC<{}> = props => ( + + {props.children} + +); + +export const SectionSpacer: React.FC<{}> = () => ; + +export const Section: React.FC<{}> = props => <>{props.children}; + +export type SectionLinkProps = EuiListGroupItemProps; +export const SectionLink: React.FC = props => ( + +); + +export const ActionMenuDivider: React.FC<{}> = props => ; + +export const ActionMenu: React.FC = props => ; diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts new file mode 100644 index 0000000000000..c822edc3f4de8 --- /dev/null +++ b/x-pack/plugins/observability/public/index.ts @@ -0,0 +1,16 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +import { PluginInitializerContext, PluginInitializer } from 'kibana/public'; +import { Plugin, ClientSetup, ClientStart } from './plugin'; + +export const plugin: PluginInitializer = ( + context: PluginInitializerContext +) => { + return new Plugin(context); +}; + +export * from './components/action_menu'; diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts new file mode 100644 index 0000000000000..a7eb1c50a0392 --- /dev/null +++ b/x-pack/plugins/observability/public/plugin.ts @@ -0,0 +1,15 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ +import { Plugin as PluginClass, PluginInitializerContext } from 'kibana/public'; + +export type ClientSetup = void; +export type ClientStart = void; + +export class Plugin implements PluginClass { + constructor(context: PluginInitializerContext) {} + start() {} + setup() {} +} diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index 9b17de0d91334..ce6126e79a82b 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -6636,8 +6636,6 @@ "xpack.infra.metricsExplorer.openInTSVB": "ビジュアライザーで開く", "xpack.infra.metricsExplorer.viewNodeDetail": "{name} のメトリックを表示", "xpack.infra.node.ariaLabel": "{nodeName}、クリックしてメニューを開きます", - "xpack.infra.nodeContextMenu.viewLogsName": "ログを表示", - "xpack.infra.nodeContextMenu.viewMetricsName": "メトリックを表示", "xpack.infra.nodeDetails.labels.availabilityZone": "アベイラビリティゾーン", "xpack.infra.nodeDetails.labels.cloudProvider": "クラウドプロバイダー", "xpack.infra.nodeDetails.labels.containerized": "コンテナー化", @@ -13203,4 +13201,4 @@ "xpack.watcher.watchEdit.thresholdWatchExpression.aggType.fieldIsRequiredValidationMessage": "フィールドを選択してください。", "xpack.watcher.watcherDescription": "アラートの作成、管理、監視によりデータへの変更を検知します。" } -} +} \ No newline at end of file diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 932e1e79f949c..a5b2bafaded88 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -6635,8 +6635,6 @@ "xpack.infra.metricsExplorer.openInTSVB": "在 Visualize 中打开", "xpack.infra.metricsExplorer.viewNodeDetail": "查看 {name} 的指标", "xpack.infra.node.ariaLabel": "{nodeName},单击打开菜单", - "xpack.infra.nodeContextMenu.viewLogsName": "查看日志", - "xpack.infra.nodeContextMenu.viewMetricsName": "查看指标", "xpack.infra.nodeDetails.labels.availabilityZone": "可用区", "xpack.infra.nodeDetails.labels.cloudProvider": "云服务提供商", "xpack.infra.nodeDetails.labels.containerized": "容器化", @@ -13202,4 +13200,4 @@ "xpack.watcher.watchEdit.thresholdWatchExpression.aggType.fieldIsRequiredValidationMessage": "此字段必填。", "xpack.watcher.watcherDescription": "通过创建、管理和监测警报来检测数据中的更改。" } -} +} \ No newline at end of file diff --git a/x-pack/test/functional/apps/infra/feature_controls/infrastructure_security.ts b/x-pack/test/functional/apps/infra/feature_controls/infrastructure_security.ts index b7c5667a57506..ac7bd66d3466f 100644 --- a/x-pack/test/functional/apps/infra/feature_controls/infrastructure_security.ts +++ b/x-pack/test/functional/apps/infra/feature_controls/infrastructure_security.ts @@ -104,12 +104,14 @@ export default function({ getPageObjects, getService }: FtrProviderContext) { it(`does not show link to view logs`, async () => { await retry.waitFor('context menu', () => testSubjects.exists('~nodeContextMenu')); - await testSubjects.missingOrFail('~viewLogsContextMenuItem'); + const link = await testSubjects.find('~viewLogsContextMenuItem'); + expect(await link.isEnabled()).to.be(false); }); it(`does not show link to view apm traces`, async () => { await retry.waitFor('context menu', () => testSubjects.exists('~nodeContextMenu')); - await testSubjects.missingOrFail('~viewApmTracesContextMenuItem'); + const link = await testSubjects.find('~viewApmTracesContextMenuItem'); + expect(await link.isEnabled()).to.be(false); }); }); @@ -217,12 +219,14 @@ export default function({ getPageObjects, getService }: FtrProviderContext) { it(`does not show link to view logs`, async () => { await retry.waitFor('context menu', () => testSubjects.exists('~nodeContextMenu')); - await testSubjects.missingOrFail('~viewLogsContextMenuItem'); + const link = await testSubjects.find('~viewLogsContextMenuItem'); + expect(await link.isEnabled()).to.be(false); }); it(`does not show link to view apm traces`, async () => { await retry.waitFor('context menu', () => testSubjects.exists('~nodeContextMenu')); - await testSubjects.missingOrFail('~viewApmTracesContextMenuItem'); + const link = await testSubjects.find('~viewApmTracesContextMenuItem'); + expect(await link.isEnabled()).to.be(false); }); }); diff --git a/x-pack/test/functional/apps/infra/feature_controls/infrastructure_spaces.ts b/x-pack/test/functional/apps/infra/feature_controls/infrastructure_spaces.ts index 90458ef53dfc2..1d7ef9bea81e6 100644 --- a/x-pack/test/functional/apps/infra/feature_controls/infrastructure_spaces.ts +++ b/x-pack/test/functional/apps/infra/feature_controls/infrastructure_spaces.ts @@ -191,7 +191,8 @@ export default function({ getPageObjects, getService }: FtrProviderContext) { it(`doesn't show link to view logs`, async () => { await retry.waitFor('context menu', () => testSubjects.exists('~nodeContextMenu')); - await testSubjects.missingOrFail('~viewLogsContextMenuItem'); + const link = await testSubjects.find('~viewLogsContextMenuItem'); + expect(await link.isEnabled()).to.be(false); }); it(`shows link to view apm traces`, async () => { @@ -239,7 +240,8 @@ export default function({ getPageObjects, getService }: FtrProviderContext) { it(`doesn't show link to view apm traces`, async () => { await retry.waitFor('context menu', () => testSubjects.exists('~nodeContextMenu')); - await testSubjects.missingOrFail('~viewApmTracesContextMenuItem'); + const link = await testSubjects.find('~viewApmTracesContextMenuItem'); + expect(await link.isEnabled()).to.be(false); }); }); }); From 1488aa9eaf99dc19a9af53e9fccea8084a153abf Mon Sep 17 00:00:00 2001 From: Nathan Reese Date: Mon, 27 Jan 2020 20:13:21 -0500 Subject: [PATCH 70/77] [Maps] fix join metric field selection bugs (#56044) * lint fixes * move aggregation check to MEtricEditor * fix functional test, handle case where fields are not loaded --- .../maps/public/components/metric_editor.js | 42 ++++++++++++++----- 1 file changed, 32 insertions(+), 10 deletions(-) diff --git a/x-pack/legacy/plugins/maps/public/components/metric_editor.js b/x-pack/legacy/plugins/maps/public/components/metric_editor.js index f6f5b23f14596..e60c2ac0dd7ab 100644 --- a/x-pack/legacy/plugins/maps/public/components/metric_editor.js +++ b/x-pack/legacy/plugins/maps/public/components/metric_editor.js @@ -14,12 +14,41 @@ import { MetricSelect, METRIC_AGGREGATION_VALUES } from './metric_select'; import { SingleFieldSelect } from './single_field_select'; import { METRIC_TYPE } from '../../common/constants'; +function filterFieldsForAgg(fields, aggType) { + if (!fields) { + return []; + } + + if (aggType === METRIC_TYPE.UNIQUE_COUNT) { + return fields.filter(field => { + return field.aggregatable; + }); + } + + return fields.filter(field => { + return field.aggregatable && field.type === 'number'; + }); +} + export function MetricEditor({ fields, metricsFilter, metric, onChange, removeButton }) { const onAggChange = metricAggregationType => { - onChange({ + const newMetricProps = { ...metric, type: metricAggregationType, - }); + }; + + // unset field when new agg type does not support currently selected field. + if (metric.field && metricAggregationType !== METRIC_TYPE.COUNT) { + const fieldsForNewAggType = filterFieldsForAgg(fields, metricAggregationType); + const found = fieldsForNewAggType.find(field => { + return field.name === metric.field; + }); + if (!found) { + newMetricProps.field = undefined; + } + } + + onChange(newMetricProps); }; const onFieldChange = fieldName => { onChange({ @@ -36,12 +65,6 @@ export function MetricEditor({ fields, metricsFilter, metric, onChange, removeBu let fieldSelect; if (metric.type && metric.type !== METRIC_TYPE.COUNT) { - const filterField = - metric.type !== METRIC_TYPE.UNIQUE_COUNT - ? field => { - return field.type === 'number'; - } - : undefined; fieldSelect = ( From ba151fea0bfb1d187f9d1cdd7eb9077dc39b2e80 Mon Sep 17 00:00:00 2001 From: Brian Seeders Date: Mon, 27 Jan 2020 20:45:24 -0500 Subject: [PATCH 71/77] Fix Github PR comment formatting (#56078) --- vars/githubPr.groovy | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/vars/githubPr.groovy b/vars/githubPr.groovy index 4c19511bb8953..91a4a76894d94 100644 --- a/vars/githubPr.groovy +++ b/vars/githubPr.groovy @@ -106,23 +106,28 @@ def getTestFailuresMessage() { } def messages = [] + messages << "---\n\n### [Test Failures](${env.BUILD_URL}testReport)" - failures.take(5).each { failure -> + failures.take(3).each { failure -> messages << """ ---- - -### [Test Failures](${env.BUILD_URL}testReport)
${failure.fullDisplayName} [Link to Jenkins](${failure.url}) +""" -``` -${failure.stdOut} -``` -
+ if (failure.stdOut) { + messages << "\n#### Standard Out\n```\n${failure.stdOut}\n```" + } ---- - """ + if (failure.stdErr) { + messages << "\n#### Standard Error\n```\n${failure.stdErr}\n```" + } + + if (failure.stacktrace) { + messages << "\n#### Stack Trace\n```\n${failure.stacktrace}\n```" + } + + messages << "\n\n---" } if (failures.size() > 3) { From e792292923b3567c73226c4eb40d1043f9d67d49 Mon Sep 17 00:00:00 2001 From: Brian Seeders Date: Mon, 27 Jan 2020 21:44:58 -0500 Subject: [PATCH 72/77] Fix failing snapshot artifact tests when using env var (#56063) --- packages/kbn-es/src/artifact.test.js | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/packages/kbn-es/src/artifact.test.js b/packages/kbn-es/src/artifact.test.js index 985b65c747563..453eb1a9a7689 100644 --- a/packages/kbn-es/src/artifact.test.js +++ b/packages/kbn-es/src/artifact.test.js @@ -52,21 +52,22 @@ const createArchive = (params = {}) => { const mockFetch = mock => fetch.mockReturnValue(Promise.resolve(new Response(JSON.stringify(mock)))); -let previousSnapshotManifestValue = null; +const previousEnvVars = {}; +const ENV_VARS_TO_RESET = ['ES_SNAPSHOT_MANIFEST', 'KBN_ES_SNAPSHOT_USE_UNVERIFIED']; beforeAll(() => { - if ('ES_SNAPSHOT_MANIFEST' in process.env) { - previousSnapshotManifestValue = process.env.ES_SNAPSHOT_MANIFEST; - delete process.env.ES_SNAPSHOT_MANIFEST; - } + ENV_VARS_TO_RESET.forEach(key => { + if (key in process.env) { + previousEnvVars[key] = process.env[key]; + delete process.env[key]; + } + }); }); afterAll(() => { - if (previousSnapshotManifestValue !== null) { - process.env.ES_SNAPSHOT_MANIFEST = previousSnapshotManifestValue; - } else { - delete process.env.ES_SNAPSHOT_MANIFEST; - } + Object.keys(previousEnvVars).forEach(key => { + process.env[key] = previousEnvVars[key]; + }); }); beforeEach(() => { From 4f659859793f29087d2bfbebb91534dd96042ddf Mon Sep 17 00:00:00 2001 From: Frank Hassanabad Date: Mon, 27 Jan 2020 20:26:01 -0700 Subject: [PATCH 73/77] [SIEM][Detection Engine] critical blocker, updates the pre-packaged rules, removes dead ones, adds license file (#56090) ## Summary * Adds updated pre-packaged rules with more meta-data (from randomuserid) * Deletes older rules not shipping (from randomuserid) * Adds license file for rules (from randomuserid) ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. ~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11]~~(https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) ~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~ ~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~ ~~- [ ] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~~ ~~- [ ] This was checked for [keyboard-only and screenreader accessibility]~~(https://developer.mozilla.org/enUS/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~ ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process) - [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process) --- .../403_response_to_a_post.json | 20 +- .../405_response_method_not_allowed.json | 20 +- .../500_response_on_admin_page.json | 20 -- .../rules/prepackaged_rules/NOTICE.txt | 20 ++ ..._security_adversary_behavior_detected.json | 19 ++ ...dpoint_security_cred_dumping_detected.json | 19 ++ ...point_security_cred_dumping_prevented.json | 19 ++ ...t_security_cred_manipulation_detected.json | 19 ++ ..._security_cred_manipulation_prevented.json | 18 ++ ...ic_endpoint_security_exploit_detected.json | 19 ++ ...c_endpoint_security_exploit_prevented.json | 19 ++ ...ic_endpoint_security_malware_detected.json | 19 ++ ...c_endpoint_security_malware_prevented.json | 19 ++ ...nt_security_permission_theft_detected.json | 19 ++ ...t_security_permission_theft_prevented.json | 19 ++ ...t_security_process_injection_detected.json | 19 ++ ..._security_process_injection_prevented.json | 19 ++ ...endpoint_security_ransomware_detected.json | 19 ++ ...ndpoint_security_ransomware_prevented.json | 19 ++ ...den_file_attribute_with_via_attribexe.json | 17 +- .../eql_adobe_hijack_persistence.json | 13 +- .../eql_audio_capture_via_powershell.json | 13 +- .../eql_audio_capture_via_soundrecorder.json | 13 +- .../eql_bypass_uac_event_viewer.json | 15 +- .../eql_bypass_uac_via_cmstp.json | 17 +- .../eql_bypass_uac_via_sdclt.json | 17 +- .../eql_clearing_windows_event_logs.json | 13 +- ...delete_volume_usn_journal_with_fsutil.json | 17 +- ...deleting_backup_catalogs_with_wbadmin.json | 17 +- .../eql_direct_outbound_smb_connection.json | 13 +- ...ble_windows_firewall_rules_with_netsh.json | 17 +- .../eql_dll_search_order_hijack.json | 13 +- ...coding_or_decoding_files_via_certutil.json | 13 +- .../eql_local_scheduled_task_commands.json | 16 +- .../eql_local_service_commands.json | 13 +- ...ql_modification_of_boot_configuration.json | 15 +- ...ql_msbuild_making_network_connections.json | 13 +- .../eql_mshta_making_network_connections.json | 21 +- .../eql_msxsl_making_network_connections.json | 17 +- .../eql_psexec_lateral_movement_command.json | 52 +++- ...ql_suspicious_ms_office_child_process.json | 13 +- ...l_suspicious_ms_outlook_child_process.json | 15 +- ...l_suspicious_pdf_reader_child_process.json | 15 +- .../eql_system_shells_via_services.json | 13 +- ...usual_network_connection_via_rundll32.json | 15 +- .../eql_unusual_parentchild_relationship.json | 15 +- ...ql_unusual_process_network_connection.json | 13 +- .../eql_user_account_creation.json | 13 +- ...eql_user_added_to_administrator_group.json | 13 +- ...ume_shadow_copy_deletion_via_vssadmin.json | 15 +- ..._volume_shadow_copy_deletion_via_wmic.json | 17 +- ...l_windows_script_executing_powershell.json | 15 +- .../eql_wmic_command_lateral_movement.json | 18 +- .../rules/prepackaged_rules/index.ts | 278 +++++++----------- .../linux_hping_activity.json | 18 +- .../linux_iodine_activity.json | 20 +- .../linux_kernel_module_activity.json | 12 +- .../linux_ldso_process_activity.json | 16 +- .../linux_lzop_activity.json | 20 -- .../linux_mknod_activity.json | 20 +- .../linux_netcat_network_connection.json | 16 +- ...k_anomalous_process_using_https_ports.json | 20 -- .../linux_nmap_activity.json | 20 +- .../linux_nping_activity.json | 18 +- ...nux_process_started_in_temp_directory.json | 14 +- .../linux_ptrace_activity.json | 20 -- .../linux_rawshark_activity.json | 20 -- .../linux_shell_activity_by_web_server.json | 17 +- .../linux_socat_activity.json | 14 +- .../linux_ssh_forwarding.json | 19 +- .../linux_strace_activity.json | 20 +- .../linux_tcpdump_activity.json | 14 +- .../prepackaged_rules/linux_web_download.json | 20 -- .../linux_whoami_commmand.json | 16 +- .../network_dns_directly_to_the_internet.json | 15 +- ...fer_protocol_activity_to_the_internet.json | 17 +- ...hat_protocol_activity_to_the_internet.json | 17 +- .../network_nat_traversal_port_activity.json | 11 +- .../network_port_26_activity.json | 11 +- .../network_port_8000_activity.json | 20 -- ...rk_port_8000_activity_to_the_internet.json | 11 +- ..._to_point_tunneling_protocol_activity.json | 28 +- ...k_proxy_port_activity_to_the_internet.json | 13 +- ...te_desktop_protocol_from_the_internet.json | 49 ++- ...mote_desktop_protocol_to_the_internet.json | 19 +- ...mote_procedure_call_from_the_internet.json | 12 +- ...remote_procedure_call_to_the_internet.json | 14 +- ...file_sharing_activity_to_the_internet.json | 16 +- .../network_smtp_to_the_internet.json | 15 +- ..._server_port_activity_to_the_internet.json | 30 +- ...rk_ssh_secure_shell_from_the_internet.json | 54 ++-- ...work_ssh_secure_shell_to_the_internet.json | 13 +- .../network_telnet_port_activity.json | 44 ++- .../network_tor_activity_to_the_internet.json | 30 +- ...l_network_computing_from_the_internet.json | 37 ++- ...ual_network_computing_to_the_internet.json | 21 +- .../prepackaged_rules/null_user_agent.json | 24 +- .../prepackaged_rules/sqlmap_user_agent.json | 20 +- ...rvice_bits_connecting_to_the_internet.json | 49 ++- .../windows_burp_ce_activity.json | 20 -- ...s_certutil_connecting_to_the_internet.json | 34 ++- ...and_prompt_connecting_to_the_internet.json | 52 +++- ...nd_shell_started_by_internet_explorer.json | 34 ++- ...s_command_shell_started_by_powershell.json | 49 ++- ...dows_command_shell_started_by_svchost.json | 34 ++- .../windows_credential_dumping_commands.json | 20 -- ...dows_credential_dumping_via_imageload.json | 20 -- ..._credential_dumping_via_registry_save.json | 20 -- ...ows_data_compression_using_powershell.json | 20 -- ...fense_evasion_decoding_using_certutil.json | 20 -- ...asion_or_persistence_via_hidden_files.json | 20 -- ...ws_defense_evasion_via_filter_manager.json | 35 ++- ...e_evasion_via_windows_event_log_tools.json | 20 -- ...dows_execution_via_compiled_html_file.json | 52 +++- ...dows_execution_via_connection_manager.json | 35 ++- ...on_via_microsoft_html_application_hta.json | 20 -- ...dows_execution_via_net_com_assemblies.json | 38 ++- .../windows_execution_via_regsvr32.json | 49 ++- ...ution_via_trusted_developer_utilities.json | 53 +++- ...le_program_connecting_to_the_internet.json | 49 ++- ...dows_image_load_from_a_temp_directory.json | 47 --- .../windows_indirect_command_execution.json | 20 -- .../windows_iodine_activity.json | 20 -- ...agement_instrumentation_wmi_execution.json | 20 -- ...cation_hta_connecting_to_the_internet.json | 20 -- .../windows_mimikatz_activity.json | 20 -- ...isc_lolbin_connecting_to_the_internet.json | 49 ++- ...ommand_activity_by_the_system_account.json | 34 ++- .../windows_net_user_command_activity.json | 20 -- .../windows_netcat_activity.json | 20 -- .../windows_netcat_network_activity.json | 20 -- ...ous_windows_process_using_https_ports.json | 20 -- .../windows_nmap_activity.json | 20 -- .../windows_nmap_scan_activity.json | 20 -- ...dows_payload_obfuscation_via_certutil.json | 20 -- ...stence_or_priv_escalation_via_hooking.json | 20 -- ..._persistence_via_application_shimming.json | 50 +++- .../windows_persistence_via_bits_jobs.json | 20 -- ..._via_modification_of_existing_service.json | 20 -- ...s_persistence_via_netshell_helper_dll.json | 20 -- ...powershell_connecting_to_the_internet.json | 20 -- ...escalation_via_accessibility_features.json | 50 +++- ...rocess_discovery_via_tasklist_command.json | 38 ++- .../windows_process_execution_via_wmi.json | 37 ++- ...ed_by_acrobat_reader_possible_payload.json | 20 -- ...by_ms_office_program_possible_payload.json | 20 -- ...s_process_started_by_the_java_runtime.json | 20 -- .../windows_psexec_activity.json | 20 -- ...er_program_connecting_to_the_internet.json | 52 +++- .../windows_registry_query_local.json | 20 -- .../windows_registry_query_network.json | 20 -- .../windows_remote_management_execution.json | 20 -- .../windows_scheduled_task_activity.json | 20 -- ...nterpreter_connecting_to_the_internet.json | 20 -- ...windows_signed_binary_proxy_execution.json | 52 +++- ...igned_binary_proxy_execution_download.json | 52 +++- ...uspicious_process_started_by_a_script.json | 52 +++- .../windows_whoami_command_activity.json | 37 ++- .../windows_windump_activity.json | 20 -- .../windows_wireshark_activity.json | 20 -- 160 files changed, 2055 insertions(+), 1880 deletions(-) delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/500_response_on_admin_page.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/NOTICE.txt create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_lzop_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_network_anomalous_process_using_https_ports.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ptrace_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_rawshark_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_web_download.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_burp_ce_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_commands.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_imageload.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_registry_save.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_data_compression_using_powershell.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_decoding_using_certutil.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_or_persistence_via_hidden_files.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_windows_event_log_tools.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_microsoft_html_application_hta.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_image_load_from_a_temp_directory.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_indirect_command_execution.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_iodine_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_management_instrumentation_wmi_execution.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_microsoft_html_application_hta_connecting_to_the_internet.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_mimikatz_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_user_command_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_network_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_network_anomalous_windows_process_using_https_ports.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_scan_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_payload_obfuscation_via_certutil.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_or_priv_escalation_via_hooking.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_bits_jobs.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_modification_of_existing_service.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_netshell_helper_dll.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_powershell_connecting_to_the_internet.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_acrobat_reader_possible_payload.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_ms_office_program_possible_payload.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_the_java_runtime.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_psexec_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_local.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_network.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_remote_management_execution.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_scheduled_task_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_script_interpreter_connecting_to_the_internet.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_windump_activity.json delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_wireshark_activity.json diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json index da0613e1f6fa7..c685d96cdf57b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json @@ -4,22 +4,22 @@ "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, or the user is unauthorized, or the request is unusual, these may be suspicious or malicious activity." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "apm-*-transaction*" ], "language": "kuery", "max_signals": 33, "name": "Web Application Suspicious Activity: POST Request Declined", "query": "http.response.status_code:403 and http.request.method:post", - "references": ["https://en.wikipedia.org/wiki/HTTP_403"], - "risk_score": 50, + "references": [ + "https://en.wikipedia.org/wiki/HTTP_403" + ], + "risk_score": 47, "rule_id": "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e", - "severity": "low", - "tags": ["Elastic", "apm"], + "severity": "medium", + "tags": [ + "Elastic", + "APM" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json index b0edfb25e9392..64264452d468b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json @@ -4,22 +4,22 @@ "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, or the user is unauthorized, or the request is unusual, these may be suspicious or malicious activity." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "apm-*-transaction*" ], "language": "kuery", "max_signals": 33, "name": "Web Application Suspicious Activity: Unauthorized Method", "query": "http.response.status_code:405", - "references": ["https://en.wikipedia.org/wiki/HTTP_405"], - "risk_score": 50, + "references": [ + "https://en.wikipedia.org/wiki/HTTP_405" + ], + "risk_score": 47, "rule_id": "75ee75d8-c180-481c-ba88-ee50129a6aef", - "severity": "low", - "tags": ["Elastic", "apm"], + "severity": "medium", + "tags": [ + "Elastic", + "APM" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/500_response_on_admin_page.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/500_response_on_admin_page.json deleted file mode 100644 index 3b4bcbe670921..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/500_response_on_admin_page.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "500 Response on Admin page", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "500 Response on Admin page", - "query": "url.path:\"/admin/\" and http.response.status_code:500", - "risk_score": 50, - "rule_id": "054f669c-b065-492e-acd9-15e44fc42380", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/NOTICE.txt b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/NOTICE.txt new file mode 100644 index 0000000000000..cd5f1cc6f886c --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/NOTICE.txt @@ -0,0 +1,20 @@ +This product bundles rules based on https://github.com/BlueTeamLabs/sentinel-attack +which is available under a "MIT" license. The files based on this license are: + +- windows_defense_evasion_via_filter_manager.json +- windows_process_discovery_via_tasklist_command.json +- windows_priv_escalation_via_accessibility_features.json +- windows_persistence_via_application_shimming.json +- windows_execution_via_trusted_developer_utilities.json +- windows_execution_via_net_com_assemblies.json +- windows_execution_via_connection_manager.json + +MIT License + +Copyright (c) 2019 Edoardo Gerosa, Olaf Hartong + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json new file mode 100644 index 0000000000000..56d142fdf3ef8 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Adversary behavior detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Adversary Behavior - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:rules_engine_event", + "risk_score": 47, + "rule_id": "77a3c3df-8ec4-4da4-b758-878f551dee69", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json new file mode 100644 index 0000000000000..6805696ce6bc9 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Credential dumping detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Cred Dumping - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:cred_theft_event and endgame.metadata.type:detection", + "risk_score": 73, + "rule_id": "571afc56-5ed9-465d-a2a9-045f099f6e7e", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json new file mode 100644 index 0000000000000..68c0f5cad8252 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Credential dumping prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Cred Dumping - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:cred_theft_event and endgame.metadata.type:prevention", + "risk_score": 47, + "rule_id": "db8c33a8-03cd-4988-9e2c-d0a4863adb13", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json new file mode 100644 index 0000000000000..0d0d9c71a2ec1 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Credential manipulation detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Cred Manipulation - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:token_manipulation_event and endgame.metadata.type:detection", + "risk_score": 73, + "rule_id": "c0be5f31-e180-48ed-aa08-96b36899d48f", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json new file mode 100644 index 0000000000000..df49c80e3097b --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json @@ -0,0 +1,18 @@ +{ + "description": "Elastic Endpoint Security Alert - Credential manipulation prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Cred Manipulation - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:token_manipulation_event and endgame.metadata.type:prevention", + "risk_score": 47, + "rule_id": "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa", + "severity": "medium", + "tags": [ + "Elastic" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json new file mode 100644 index 0000000000000..9c3896a70b3a0 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Exploit detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Exploit - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:exploit_event and endgame.metadata.type:detection", + "risk_score": 73, + "rule_id": "2003cdc8-8d83-4aa5-b132-1f9a8eb48514", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json new file mode 100644 index 0000000000000..4632ae6a1487b --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Exploit prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Exploit - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:exploit_event and endgame.metadata.type:prevention", + "risk_score": 47, + "rule_id": "2863ffeb-bf77-44dd-b7a5-93ef94b72036", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json new file mode 100644 index 0000000000000..68831392942d4 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Malware detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Malware - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:file_classification_event and endgame.metadata.type:detection", + "risk_score": 99, + "rule_id": "0a97b20f-4144-49ea-be32-b540ecc445de", + "severity": "critical", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json new file mode 100644 index 0000000000000..56b41df2a3349 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Malware prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Malware - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:file_classification_event and endgame.metadata.type:prevention", + "risk_score": 73, + "rule_id": "3b382770-efbb-44f4-beed-f5e0a051b895", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json new file mode 100644 index 0000000000000..268dc9cf89121 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Permission theft detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Permission Theft - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:detection", + "risk_score": 73, + "rule_id": "c3167e1b-f73c-41be-b60b-87f4df707fe3", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json new file mode 100644 index 0000000000000..6deda3d0453b2 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Permission theft prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Permission Theft - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:prevention", + "risk_score": 47, + "rule_id": "453f659e-0429-40b1-bfdb-b6957286e04b", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json new file mode 100644 index 0000000000000..25a03e611fe3e --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Process injection detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Process Injection - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:kernel_shellcode_event and endgame.metadata.type:detection", + "risk_score": 73, + "rule_id": "80c52164-c82a-402c-9964-852533d58be1", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json new file mode 100644 index 0000000000000..6c549d70a9d41 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Process injection prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Process Injection - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:kernel_shellcode_event and endgame.metadata.type:prevention", + "risk_score": 47, + "rule_id": "990838aa-a953-4f3e-b3cb-6ddf7584de9e", + "severity": "medium", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json new file mode 100644 index 0000000000000..4a118cf8ab861 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Ransomware detected.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Ransomware - Detected - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:ransomware_event and endgame.metadata.type:detection", + "risk_score": 99, + "rule_id": "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd", + "severity": "critical", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json new file mode 100644 index 0000000000000..8b48e8f4c1758 --- /dev/null +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json @@ -0,0 +1,19 @@ +{ + "description": "Elastic Endpoint Security Alert - Ransomware prevented.", + "index": [ + "endgame-*" + ], + "language": "kuery", + "max_signals": 33, + "name": "Ransomware - Prevented - Elastic Endpoint", + "query": "event.kind:alert and event.module:endgame and event.action:ransomware_event and endgame.metadata.type:prevention", + "risk_score": 73, + "rule_id": "e3c5d5cb-41d5-4206-805c-f30561eae3ac", + "severity": "high", + "tags": [ + "Elastic", + "Endpoint" + ], + "type": "query", + "version": 1 +} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json index 6843f622bee8f..374691f670b74 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json @@ -1,20 +1,19 @@ { "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Adding the Hidden File Attribute with via attrib.exe", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"attrib.exe\" and process.args:\"+h\"", - "risk_score": 25, + "max_signals": 33, + "name": "Adding Hidden File Attribute via Attrib", + "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"attrib.exe\" and process.args:\"+h\"", + "risk_score": 21, "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json index fcc105f2447e8..47f171dd7be0e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json @@ -1,20 +1,19 @@ { "description": "Detects writing executable files that will be automatically launched by Adobe on launch.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Adobe Hijack Persistence", "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexeec.exe", - "risk_score": 25, + "risk_score": 21, "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json index feaa8451754a5..7ec960eea6302 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json @@ -1,20 +1,19 @@ { "description": "An adversary can leverage a computer's peripheral devices or applications to capture audio recordings for the purpose of listening into sensitive conversations to gather information.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Audio Capture via PowerShell", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"powershell.exe\" and process.args:\"WindowsAudioDevice-Powershell-Cmdlet\"", - "risk_score": 25, + "risk_score": 21, "rule_id": "b27b9f47-0a20-4807-8377-7f899b4fbada", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json index 0365616e86faf..87bdfc4980124 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json @@ -1,20 +1,19 @@ { "description": "An adversary can leverage a computer's peripheral devices or applications to capture audio recordings for the purpose of listening into sensitive conversations to gather information.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Audio Capture via SoundRecorder", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"SoundRecorder.exe\" and process.args:\"/FILE\"", - "risk_score": 25, + "risk_score": 21, "rule_id": "f8e06892-ed10-4452-892e-2c5a38d552f1", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json index e3d57d2b05503..2fa63fa51f7c1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json @@ -1,20 +1,19 @@ { - "description": "Identifies User Account Control (UAC) bypass via eventvwr. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Bypass UAC via Event Viewer", "query": "process.parent.name:eventvwr.exe and event.action:\"Process Create (rule: ProcessCreate)\" and not process.executable:(\"C:\\Windows\\System32\\mmc.exe\" or \"C:\\Windows\\SysWOW64\\mmc.exe\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "59547add-a400-4baa-aa0c-66c72efdb77f", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json index 0d9346a7e1f88..fdc716dcb3ebe 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json @@ -1,20 +1,19 @@ { - "description": "Identifies User Account Control (UAC) bypass via cmstp. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "description": "Identifies User Account Control (UAC) bypass via cmstp.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Bypass UAC via CMSTP", + "max_signals": 33, + "name": "Bypass UAC via Cmstp", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:\"cmstp.exe\" and process.parent.args:(\"/s\" and \"/au\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "2f7403da-1a4c-46bb-8ecc-c1a596e10cd0", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json index 3e99f1be6bf2e..484a01e0211ab 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json @@ -1,20 +1,19 @@ { - "description": "Identifies User Account Control (UAC) bypass via cmstp. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "description": "Identifies User Account Control (UAC) bypass via sdclt.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Bypass UAC via SDCLT", + "max_signals": 33, + "name": "Bypass UAC via Sdclt", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"sdclt.exe\" and process.args:\"/kickoffelev\" and not process.executable:(\"C:\\Windows\\System32\\sdclt.exe\" or \"C:\\Windows\\System32\\control.exe\" or \"C:\\Windows\\SysWOW64\\sdclt.exe\" or \"C:\\Windows\\SysWOW64\\control.exe\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "f68d83a1-24cb-4b8d-825b-e8af400b9670", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json index 9d8d3bab1ace7..e9729ff102619 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json @@ -1,20 +1,19 @@ { "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt evade detection or destroy forensic evidence on a system.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Clearing Windows Event Logs", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and (process.name:\"wevtutil.exe\" and process.args:\"cl\") or (process.name:\"powershell.exe\" and process.args:\"Clear-EventLog\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json index e69de058960d4..479bb4a2a6d7c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json @@ -1,20 +1,19 @@ { - "description": "Identifies use of the fsutil command to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", + "description": "Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Delete Volume USN Journal with fsutil", + "max_signals": 33, + "name": "Delete Volume USN Journal with Fsutil", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"fsutil.exe\" and process.args:(\"usn\" and \"deletejournal\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json index cbf51ffb7c20b..204925e4b677b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json @@ -1,20 +1,19 @@ { - "description": "Identifies use of the wbadmin command to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", + "description": "Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Deleting Backup Catalogs with wbadmin", + "max_signals": 33, + "name": "Deleting Backup Catalogs with Wbadmin", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"wbadmin.exe\" and process.args:(\"delete\" and \"catalog\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json index 5e8321c6777aa..b6398a9985e7e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json @@ -1,20 +1,19 @@ { "description": "Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Direct Outbound SMB Connection", "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and destination.port:445 and not process.pid:4 and not destination.ip:(\"127.0.0.1\" or \"::1\")", - "risk_score": 50, + "risk_score": 47, "rule_id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json index c9510913a151f..32b43cc24e91b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json @@ -1,20 +1,19 @@ { - "description": "Identifies use of the netsh command to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", + "description": "Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Disable Windows Firewall Rules with Netsh", + "max_signals": 33, + "name": "Disable Windows Firewall Rules via Netsh", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"netsh.exe\" and process.args:(\"firewall\" and \"set\" and \"disable\") or process.args:(\"advfirewall\" and \"state\" and \"off\")", - "risk_score": 50, + "risk_score": 47, "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json index 214ddfaf0feec..5740453b6ae6d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json @@ -1,20 +1,19 @@ { "description": "Detects writing DLL files to known locations associated with Windows files vulnerable to DLL search order hijacking.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "DLL Search Order Hijack", "query": " event.action:\"File created (rule: FileCreate)\" and not winlog.user.identifier:(\"S-1-5-18\" or \"S-1-5-19\" or \"S-1-5-20\") and file.path:(\"C\\Windows\\ehome\\cryptbase.dll\" or \"C\\Windows\\System32\\Sysprep\\cryptbase.dll\" or \"C\\Windows\\System32\\Sysprep\\cryptsp.dll\" or \"C\\Windows\\System32\\Sysprep\\rpcrtremote.dll\" or \"C\\Windows\\System32\\Sysprep\\uxtheme.dll\" or \"C\\Windows\\System32\\Sysprep\\dwmapi.dll\" or \"C\\Windows\\System32\\Sysprep\\shcore.dll\" or \"C\\Windows\\System32\\Sysprep\\oleacc.dll\" or \"C\\Windows\\System32\\ntwdblib.dll\") ", - "risk_score": 50, + "risk_score": 47, "rule_id": "73fbc44c-c3cd-48a8-a473-f4eb2065c716", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json index e531a2d05a97e..37e1c26885a15 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json @@ -1,20 +1,19 @@ { "description": "Identifies the use of certutil.exe to encode or decode data. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to encode or decode base64 data for stealthier command and control or exfiltration.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Encoding or Decoding Files via CertUtil", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"certutil.exe\" and process.args:(\"-encode\" or \"/encode\" or \"-decode\" or \"/decode\")", - "risk_score": 50, + "risk_score": 47, "rule_id": "fd70c98a-c410-42dc-a2e3-761c71848acf", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json index 426d32b9b1e48..dc4991f86a0f5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json @@ -1,20 +1,22 @@ { "description": "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Local Scheduled Task Commands", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:schtasks.exe and process.args:(\"/create\" or \"-create\" or \"/S\" or \"-s\" or \"/run\" or \"-run\" or \"/change\" or \"-change\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json index 71f94ecf91788..eb6f2377376f2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json @@ -1,20 +1,19 @@ { "description": "Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Local Service Commands", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:sc.exe and process.args:(\"create\" or \"config\" or \"failure\" or \"start\")", - "risk_score": 25, + "risk_score": 21, "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json index 162dfe717df55..26bd65b897c63 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json @@ -1,20 +1,19 @@ { - "description": "Identifies use of the bcdedit command to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", + "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Modification of Boot Configuration", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"bcdedit.exe\" and process.args:\"set\" and process.args:( (\"bootstatuspolicy\" and \"ignoreallfailures\") or (\"recoveryenabled\" and \"no\") ) ", - "risk_score": 75, + "risk_score": 73, "rule_id": "b9ab2f7f-f719-4417-9599-e0252fffe2d8", "severity": "high", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json index 296f6f0862374..d40ffed523c6a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json @@ -1,20 +1,19 @@ { "description": "Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "MsBuild Making Network Connections", "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:msbuild.exe and not destination.ip:(\"127.0.0.1\" or \"::1\")", - "risk_score": 50, + "risk_score": 47, "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json index 18c9e286c99ef..7905d80c6e8c2 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json @@ -1,21 +1,22 @@ { - "description": "Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.", + "description": "Identifies mshta.exe making a network connection. This may indicate adversarial activity as mshta.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Mshta Making Network Connections", + "max_signals": 33, + "name": "Network Connection via Mshta", "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:\"mshta.exe\" and not process.name:\"mshta.exe\"", - "references": ["https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"], - "risk_score": 50, + "references": [ + "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html" + ], + "risk_score": 47, "rule_id": "a4ec1382-4557-452b-89ba-e413b22ed4b8", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json index b21b17cd89abf..16ef15589f48f 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json @@ -1,20 +1,19 @@ { - "description": "Identifies MsXsl.exe making outbound network connections. This may indicate adversarial activity as MsXsl is often leveraged by adversaries to execute malicious scripts and evade detection.", + "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "MsXsl Making Network Connections", + "max_signals": 33, + "name": "Network Connection via MsXsl", "query": "process.name:msxsl.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 47, "rule_id": "d7351b03-135d-43ba-8b36-cc9b07854525", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json index 3e04dd4be292b..fd210005118b8 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json @@ -1,20 +1,54 @@ { - "description": "Identifies use of the SysInternals tool PsExec to execute commands on a remote host. This is an indication of lateral movement and may detect adversaries.", + "description": "Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.", + "false_positives": [ + "PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "PsExec Lateral Movement Command", + "max_signals": 33, + "name": "PsExec Network Connection", "query": "process.name:psexec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" ", - "risk_score": 50, + "risk_score": 21, "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1035", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1035/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1035", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1035/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json index ac66af50ecd1d..a5d71e23a1215 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json @@ -1,20 +1,19 @@ { "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Suspicious MS Office Child Process", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"winword.exe\" or \"excel.exe\" or \"powerpnt.exe\" or \"eqnedt32.exe\" or \"fltldr.exe\" or \"mspub.exe\" or \"msaccess.exe\") and process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ", - "risk_score": 25, + "risk_score": 21, "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json index 928144f0ecf0c..86716d6608049 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json @@ -1,20 +1,19 @@ { "description": "Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Suspicious MS Outlook Child Process", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:\"outlook.exe\" and process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ", - "risk_score": 25, + "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:\"outlook.exe\" and process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ", + "risk_score": 21, "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json index 160da5b899042..b0fbccf1b67a7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json @@ -1,20 +1,19 @@ { "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "EQL - Suspicious PDF Reader Child Process", + "max_signals": 33, + "name": "Suspicious PDF Reader Child Process", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"acrord32.exe\" or \"rdrcef.exe\" or \"foxitphantomPDF.exe\" or \"foxitreader.exe\") and process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ", - "risk_score": 75, + "risk_score": 73, "rule_id": "afcac7b1-d092-43ff-a136-aa7accbda38f", "severity": "high", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json index 268e8110c508d..984b522596c1e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json @@ -1,20 +1,19 @@ { "description": "Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "System Shells via Services", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:\"services.exe\" and process.name:(\"cmd.exe\" or \"powershell.exe\")", - "risk_score": 50, + "risk_score": 47, "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json index 7332cc7710347..03b9bebb655c3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json @@ -1,20 +1,19 @@ { - "description": "Identifies unusual instances of Rundll32.exe making outbound network connections. This may indicate adversarial activity and may identify malicious DLLs.", + "description": "Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial activity and may identify malicious DLLs.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Unusual Network Connection via RunDLL32", "query": "process.name:rundll32.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 25, + "risk_score": 21, "rule_id": "52aaab7b-b51c-441a-89ce-4387b3aea886", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json index d13d23a9354f7..72eb17863e0d3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json @@ -1,20 +1,19 @@ { "description": "Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Unusual Parent-Child Relationship ", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and ( (process.name:\"smss.exe\" and not process.parent.name:(\"System\" or \"smss.exe\")) or (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\" or \"svchost.exe\")) or (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or (process.name:\"lsass.exe\" and not process.parent.name:\"wininit.exe\") or (process.name:\"LogonUI.exe\" and not process.parent.name:(\"winlogon.exe\" or \"wininit.exe\")) or (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or (process.name:\"svchost.exe\" and not process.parent.name:(\"services.exe\" or \"MsMpEng.exe\")) or (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\" or \"svchost.exe\")) or (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\" or \"svchost.exe\")) or (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\" or \"winlogon.exe\")) )", - "risk_score": 50, + "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and ( (process.name:\"smss.exe\" and not process.parent.name:(\"System\" or \"smss.exe\")) or (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\" or \"svchost.exe\")) or (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or (process.name:\"lsass.exe\" and not process.parent.name:\"wininit.exe\") or (process.name:\"LogonUI.exe\" and not process.parent.name:(\"winlogon.exe\" or \"wininit.exe\")) or (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or (process.name:\"svchost.exe\" and not process.parent.name:(\"services.exe\" or \"MsMpEng.exe\")) or (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\" or \"svchost.exe\")) or (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\" or \"svchost.exe\")) or (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\" or \"winlogon.exe\")) )", + "risk_score": 47, "rule_id": "35df0dd8-092d-4a83-88c1-5151a804f31b", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json index 138ecbb820513..8ca16198ff175 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json @@ -1,20 +1,19 @@ { "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Unusual Process Network Connection", "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:(bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or Microsoft.Workflow.Compiler.exe or odbcconf.exe or rcsi.exe or xwizard.exe)", - "risk_score": 25, + "risk_score": 21, "rule_id": "610949a1-312f-4e04-bb55-3a79b8c95267", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json index 9f3ecdb7a7f57..dee3d18bd5eda 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json @@ -1,20 +1,19 @@ { "description": "Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or domain.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "User Account Creation", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(\"net.exe\" or \"net1.exe\") and not process.parent.name:\"net.exe\" and process.args:(\"user\" and (\"/add\" or \"/ad\")) ", - "risk_score": 50, + "risk_score": 21, "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json index 1a0e0f8dcb2ad..4ed6a06b18d3b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json @@ -1,20 +1,19 @@ { "description": "Identifies attempts to add a user to an administrative group with the \"net.exe\" command. This is sometimes done by attackers to increase access of a compromised account or create new account.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "User Added to Administrator Group", "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(\"net.exe\" or \"net1.exe\") and not process.parent.name:\"net.exe\" and process.args:(\"group\" and \"admin\" and \"/add\") ", - "risk_score": 50, + "risk_score": 47, "rule_id": "4426de6f-6103-44aa-a77e-49d672836c27", "severity": "medium", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json index 794fec38b380e..cdeeb1563dfde 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json @@ -1,20 +1,19 @@ { "description": "Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Volume Shadow Copy Deletion via VssAdmin", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"vssadmin.exe\" and process.args:(\"delete\" and \"shadows\") ", - "risk_score": 75, + "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"vssadmin.exe\" and process.args:(\"delete\" and \"shadows\") ", + "risk_score": 73, "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", "severity": "high", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json index a3e94b08275be..9465cf84d73f4 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json @@ -1,20 +1,19 @@ { - "description": "Identifies use of wmic for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "description": "Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Volume Shadow Copy Deletion via WMIC", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"wmic.exe\" and process.args:(\"shadowcopy\" and \"delete\")", - "risk_score": 75, + "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"wmic.exe\" and process.args:(\"shadowcopy\" and \"delete\")", + "risk_score": 73, "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", "severity": "high", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json index 868d84ef9ebce..f3df1276de53d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json @@ -1,20 +1,19 @@ { - "description": "Identifies a PowerShell process launched by either CScript or WScript. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", + "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "Windows Script Executing PowerShell", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"", - "risk_score": 50, + "risk_score": 21, "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json index 5c2804507cbd2..a50d9e64f2e2b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json @@ -1,20 +1,22 @@ { "description": "Identifies use of wmic.exe to run commands on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", + "false_positives": [ + "The WMIC utility provides a command-line interface for WMI, which can be used for an array of administrative capabilities. It's important to baseline your environment to determine any abnormal use of this tool." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", + "max_signals": 33, "name": "WMIC Command Lateral Movement", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"wmic.exe\" and process.args:(\"/node\" or \"-node\") and process.args:(\"call\" or \"set\")", - "risk_score": 25, + "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"wmic.exe\" and process.args:(\"/node\" or \"-node\") and process.args:(\"call\" or \"set\")", + "risk_score": 21, "rule_id": "9616587f-6396-42d0-bd31-ef8dbd806210", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts index a70ff7d13f0ee..cd6d899133bff 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts @@ -9,147 +9,117 @@ import rule1 from './403_response_to_a_post.json'; import rule2 from './405_response_method_not_allowed.json'; -import rule3 from './500_response_on_admin_page.json'; -import rule4 from './eql_adding_the_hidden_file_attribute_with_via_attribexe.json'; -import rule5 from './eql_adobe_hijack_persistence.json'; -import rule6 from './eql_audio_capture_via_powershell.json'; -import rule7 from './eql_audio_capture_via_soundrecorder.json'; -import rule8 from './eql_bypass_uac_event_viewer.json'; -import rule9 from './eql_bypass_uac_via_cmstp.json'; -import rule10 from './eql_bypass_uac_via_sdclt.json'; -import rule11 from './eql_clearing_windows_event_logs.json'; -import rule12 from './eql_delete_volume_usn_journal_with_fsutil.json'; -import rule13 from './eql_deleting_backup_catalogs_with_wbadmin.json'; -import rule14 from './eql_direct_outbound_smb_connection.json'; -import rule15 from './eql_disable_windows_firewall_rules_with_netsh.json'; -import rule16 from './eql_dll_search_order_hijack.json'; -import rule17 from './eql_encoding_or_decoding_files_via_certutil.json'; -import rule18 from './eql_local_scheduled_task_commands.json'; -import rule19 from './eql_local_service_commands.json'; -import rule20 from './eql_modification_of_boot_configuration.json'; -import rule21 from './eql_msbuild_making_network_connections.json'; -import rule22 from './eql_mshta_making_network_connections.json'; -import rule23 from './eql_msxsl_making_network_connections.json'; -import rule24 from './eql_psexec_lateral_movement_command.json'; -import rule25 from './eql_suspicious_ms_office_child_process.json'; -import rule26 from './eql_suspicious_ms_outlook_child_process.json'; -import rule27 from './eql_suspicious_pdf_reader_child_process.json'; -import rule28 from './eql_system_shells_via_services.json'; -import rule29 from './eql_unusual_network_connection_via_rundll32.json'; -import rule30 from './eql_unusual_parentchild_relationship.json'; -import rule31 from './eql_unusual_process_network_connection.json'; -import rule32 from './eql_user_account_creation.json'; -import rule33 from './eql_user_added_to_administrator_group.json'; -import rule34 from './eql_volume_shadow_copy_deletion_via_vssadmin.json'; -import rule35 from './eql_volume_shadow_copy_deletion_via_wmic.json'; -import rule36 from './eql_windows_script_executing_powershell.json'; -import rule37 from './eql_wmic_command_lateral_movement.json'; -import rule38 from './linux_hping_activity.json'; -import rule39 from './linux_iodine_activity.json'; -import rule40 from './linux_kernel_module_activity.json'; -import rule41 from './linux_ldso_process_activity.json'; -import rule42 from './linux_lzop_activity.json'; -import rule43 from './linux_mknod_activity.json'; -import rule44 from './linux_netcat_network_connection.json'; -import rule45 from './linux_network_anomalous_process_using_https_ports.json'; -import rule46 from './linux_nmap_activity.json'; -import rule47 from './linux_nping_activity.json'; -import rule48 from './linux_process_started_in_temp_directory.json'; -import rule49 from './linux_ptrace_activity.json'; -import rule50 from './linux_rawshark_activity.json'; -import rule51 from './linux_shell_activity_by_web_server.json'; -import rule52 from './linux_socat_activity.json'; -import rule53 from './linux_ssh_forwarding.json'; -import rule54 from './linux_strace_activity.json'; -import rule55 from './linux_tcpdump_activity.json'; -import rule56 from './linux_web_download.json'; -import rule57 from './linux_whoami_commmand.json'; -import rule58 from './network_dns_directly_to_the_internet.json'; -import rule59 from './network_ftp_file_transfer_protocol_activity_to_the_internet.json'; -import rule60 from './network_irc_internet_relay_chat_protocol_activity_to_the_internet.json'; -import rule61 from './network_nat_traversal_port_activity.json'; -import rule62 from './network_port_26_activity.json'; -import rule63 from './network_port_8000_activity.json'; -import rule64 from './network_port_8000_activity_to_the_internet.json'; -import rule65 from './network_pptp_point_to_point_tunneling_protocol_activity.json'; -import rule66 from './network_proxy_port_activity_to_the_internet.json'; -import rule67 from './network_rdp_remote_desktop_protocol_from_the_internet.json'; -import rule68 from './network_rdp_remote_desktop_protocol_to_the_internet.json'; -import rule69 from './network_rpc_remote_procedure_call_from_the_internet.json'; -import rule70 from './network_rpc_remote_procedure_call_to_the_internet.json'; -import rule71 from './network_smb_windows_file_sharing_activity_to_the_internet.json'; -import rule72 from './network_smtp_to_the_internet.json'; -import rule73 from './network_sql_server_port_activity_to_the_internet.json'; -import rule74 from './network_ssh_secure_shell_from_the_internet.json'; -import rule75 from './network_ssh_secure_shell_to_the_internet.json'; -import rule76 from './network_telnet_port_activity.json'; -import rule77 from './network_tor_activity_to_the_internet.json'; -import rule78 from './network_vnc_virtual_network_computing_from_the_internet.json'; -import rule79 from './network_vnc_virtual_network_computing_to_the_internet.json'; -import rule80 from './null_user_agent.json'; -import rule81 from './sqlmap_user_agent.json'; -import rule82 from './windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json'; -import rule83 from './windows_burp_ce_activity.json'; -import rule84 from './windows_certutil_connecting_to_the_internet.json'; -import rule85 from './windows_command_prompt_connecting_to_the_internet.json'; -import rule86 from './windows_command_shell_started_by_internet_explorer.json'; -import rule87 from './windows_command_shell_started_by_powershell.json'; -import rule88 from './windows_command_shell_started_by_svchost.json'; -import rule89 from './windows_credential_dumping_commands.json'; -import rule90 from './windows_credential_dumping_via_imageload.json'; -import rule91 from './windows_credential_dumping_via_registry_save.json'; -import rule92 from './windows_data_compression_using_powershell.json'; -import rule93 from './windows_defense_evasion_decoding_using_certutil.json'; -import rule94 from './windows_defense_evasion_or_persistence_via_hidden_files.json'; -import rule95 from './windows_defense_evasion_via_filter_manager.json'; -import rule96 from './windows_defense_evasion_via_windows_event_log_tools.json'; +import rule3 from './elastic_endpoint_security_adversary_behavior_detected.json'; +import rule4 from './elastic_endpoint_security_cred_dumping_detected.json'; +import rule5 from './elastic_endpoint_security_cred_dumping_prevented.json'; +import rule6 from './elastic_endpoint_security_cred_manipulation_detected.json'; +import rule7 from './elastic_endpoint_security_cred_manipulation_prevented.json'; +import rule8 from './elastic_endpoint_security_exploit_detected.json'; +import rule9 from './elastic_endpoint_security_exploit_prevented.json'; +import rule10 from './elastic_endpoint_security_malware_detected.json'; +import rule11 from './elastic_endpoint_security_malware_prevented.json'; +import rule12 from './elastic_endpoint_security_permission_theft_detected.json'; +import rule13 from './elastic_endpoint_security_permission_theft_prevented.json'; +import rule14 from './elastic_endpoint_security_process_injection_detected.json'; +import rule15 from './elastic_endpoint_security_process_injection_prevented.json'; +import rule16 from './elastic_endpoint_security_ransomware_detected.json'; +import rule17 from './elastic_endpoint_security_ransomware_prevented.json'; +import rule18 from './eql_adding_the_hidden_file_attribute_with_via_attribexe.json'; +import rule19 from './eql_adobe_hijack_persistence.json'; +import rule20 from './eql_audio_capture_via_powershell.json'; +import rule21 from './eql_audio_capture_via_soundrecorder.json'; +import rule22 from './eql_bypass_uac_event_viewer.json'; +import rule23 from './eql_bypass_uac_via_cmstp.json'; +import rule24 from './eql_bypass_uac_via_sdclt.json'; +import rule25 from './eql_clearing_windows_event_logs.json'; +import rule26 from './eql_delete_volume_usn_journal_with_fsutil.json'; +import rule27 from './eql_deleting_backup_catalogs_with_wbadmin.json'; +import rule28 from './eql_direct_outbound_smb_connection.json'; +import rule29 from './eql_disable_windows_firewall_rules_with_netsh.json'; +import rule30 from './eql_dll_search_order_hijack.json'; +import rule31 from './eql_encoding_or_decoding_files_via_certutil.json'; +import rule32 from './eql_local_scheduled_task_commands.json'; +import rule33 from './eql_local_service_commands.json'; +import rule34 from './eql_modification_of_boot_configuration.json'; +import rule35 from './eql_msbuild_making_network_connections.json'; +import rule36 from './eql_mshta_making_network_connections.json'; +import rule37 from './eql_msxsl_making_network_connections.json'; +import rule38 from './eql_psexec_lateral_movement_command.json'; +import rule39 from './eql_suspicious_ms_office_child_process.json'; +import rule40 from './eql_suspicious_ms_outlook_child_process.json'; +import rule41 from './eql_suspicious_pdf_reader_child_process.json'; +import rule42 from './eql_system_shells_via_services.json'; +import rule43 from './eql_unusual_network_connection_via_rundll32.json'; +import rule44 from './eql_unusual_parentchild_relationship.json'; +import rule45 from './eql_unusual_process_network_connection.json'; +import rule46 from './eql_user_account_creation.json'; +import rule47 from './eql_user_added_to_administrator_group.json'; +import rule48 from './eql_volume_shadow_copy_deletion_via_vssadmin.json'; +import rule49 from './eql_volume_shadow_copy_deletion_via_wmic.json'; +import rule50 from './eql_windows_script_executing_powershell.json'; +import rule51 from './eql_wmic_command_lateral_movement.json'; +import rule52 from './linux_hping_activity.json'; +import rule53 from './linux_iodine_activity.json'; +import rule54 from './linux_kernel_module_activity.json'; +import rule55 from './linux_ldso_process_activity.json'; +import rule56 from './linux_mknod_activity.json'; +import rule57 from './linux_netcat_network_connection.json'; +import rule58 from './linux_nmap_activity.json'; +import rule59 from './linux_nping_activity.json'; +import rule60 from './linux_process_started_in_temp_directory.json'; +import rule61 from './linux_shell_activity_by_web_server.json'; +import rule62 from './linux_socat_activity.json'; +import rule63 from './linux_ssh_forwarding.json'; +import rule64 from './linux_strace_activity.json'; +import rule65 from './linux_tcpdump_activity.json'; +import rule66 from './linux_whoami_commmand.json'; +import rule67 from './network_dns_directly_to_the_internet.json'; +import rule68 from './network_ftp_file_transfer_protocol_activity_to_the_internet.json'; +import rule69 from './network_irc_internet_relay_chat_protocol_activity_to_the_internet.json'; +import rule70 from './network_nat_traversal_port_activity.json'; +import rule71 from './network_port_26_activity.json'; +import rule72 from './network_port_8000_activity_to_the_internet.json'; +import rule73 from './network_pptp_point_to_point_tunneling_protocol_activity.json'; +import rule74 from './network_proxy_port_activity_to_the_internet.json'; +import rule75 from './network_rdp_remote_desktop_protocol_from_the_internet.json'; +import rule76 from './network_rdp_remote_desktop_protocol_to_the_internet.json'; +import rule77 from './network_rpc_remote_procedure_call_from_the_internet.json'; +import rule78 from './network_rpc_remote_procedure_call_to_the_internet.json'; +import rule79 from './network_smb_windows_file_sharing_activity_to_the_internet.json'; +import rule80 from './network_smtp_to_the_internet.json'; +import rule81 from './network_sql_server_port_activity_to_the_internet.json'; +import rule82 from './network_ssh_secure_shell_from_the_internet.json'; +import rule83 from './network_ssh_secure_shell_to_the_internet.json'; +import rule84 from './network_telnet_port_activity.json'; +import rule85 from './network_tor_activity_to_the_internet.json'; +import rule86 from './network_vnc_virtual_network_computing_from_the_internet.json'; +import rule87 from './network_vnc_virtual_network_computing_to_the_internet.json'; +import rule88 from './null_user_agent.json'; +import rule89 from './sqlmap_user_agent.json'; +import rule90 from './windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json'; +import rule91 from './windows_certutil_connecting_to_the_internet.json'; +import rule92 from './windows_command_prompt_connecting_to_the_internet.json'; +import rule93 from './windows_command_shell_started_by_internet_explorer.json'; +import rule94 from './windows_command_shell_started_by_powershell.json'; +import rule95 from './windows_command_shell_started_by_svchost.json'; +import rule96 from './windows_defense_evasion_via_filter_manager.json'; import rule97 from './windows_execution_via_compiled_html_file.json'; import rule98 from './windows_execution_via_connection_manager.json'; -import rule99 from './windows_execution_via_microsoft_html_application_hta.json'; -import rule100 from './windows_execution_via_net_com_assemblies.json'; -import rule101 from './windows_execution_via_regsvr32.json'; -import rule102 from './windows_execution_via_trusted_developer_utilities.json'; -import rule103 from './windows_html_help_executable_program_connecting_to_the_internet.json'; -import rule104 from './windows_image_load_from_a_temp_directory.json'; -import rule105 from './windows_indirect_command_execution.json'; -import rule106 from './windows_iodine_activity.json'; -import rule107 from './windows_management_instrumentation_wmi_execution.json'; -import rule108 from './windows_microsoft_html_application_hta_connecting_to_the_internet.json'; -import rule109 from './windows_mimikatz_activity.json'; -import rule110 from './windows_misc_lolbin_connecting_to_the_internet.json'; -import rule111 from './windows_net_command_activity_by_the_system_account.json'; -import rule112 from './windows_net_user_command_activity.json'; -import rule113 from './windows_netcat_activity.json'; -import rule114 from './windows_netcat_network_activity.json'; -import rule115 from './windows_network_anomalous_windows_process_using_https_ports.json'; -import rule116 from './windows_nmap_activity.json'; -import rule117 from './windows_nmap_scan_activity.json'; -import rule118 from './windows_payload_obfuscation_via_certutil.json'; -import rule119 from './windows_persistence_or_priv_escalation_via_hooking.json'; -import rule120 from './windows_persistence_via_application_shimming.json'; -import rule121 from './windows_persistence_via_bits_jobs.json'; -import rule122 from './windows_persistence_via_modification_of_existing_service.json'; -import rule123 from './windows_persistence_via_netshell_helper_dll.json'; -import rule124 from './windows_powershell_connecting_to_the_internet.json'; -import rule125 from './windows_priv_escalation_via_accessibility_features.json'; -import rule126 from './windows_process_discovery_via_tasklist_command.json'; -import rule127 from './windows_process_execution_via_wmi.json'; -import rule128 from './windows_process_started_by_acrobat_reader_possible_payload.json'; -import rule129 from './windows_process_started_by_ms_office_program_possible_payload.json'; -import rule130 from './windows_process_started_by_the_java_runtime.json'; -import rule131 from './windows_psexec_activity.json'; -import rule132 from './windows_register_server_program_connecting_to_the_internet.json'; -import rule133 from './windows_registry_query_local.json'; -import rule134 from './windows_registry_query_network.json'; -import rule135 from './windows_remote_management_execution.json'; -import rule136 from './windows_scheduled_task_activity.json'; -import rule137 from './windows_script_interpreter_connecting_to_the_internet.json'; -import rule138 from './windows_signed_binary_proxy_execution.json'; -import rule139 from './windows_signed_binary_proxy_execution_download.json'; -import rule140 from './windows_suspicious_process_started_by_a_script.json'; -import rule141 from './windows_whoami_command_activity.json'; -import rule142 from './windows_windump_activity.json'; -import rule143 from './windows_wireshark_activity.json'; +import rule99 from './windows_execution_via_net_com_assemblies.json'; +import rule100 from './windows_execution_via_regsvr32.json'; +import rule101 from './windows_execution_via_trusted_developer_utilities.json'; +import rule102 from './windows_html_help_executable_program_connecting_to_the_internet.json'; +import rule103 from './windows_misc_lolbin_connecting_to_the_internet.json'; +import rule104 from './windows_net_command_activity_by_the_system_account.json'; +import rule105 from './windows_persistence_via_application_shimming.json'; +import rule106 from './windows_priv_escalation_via_accessibility_features.json'; +import rule107 from './windows_process_discovery_via_tasklist_command.json'; +import rule108 from './windows_process_execution_via_wmi.json'; +import rule109 from './windows_register_server_program_connecting_to_the_internet.json'; +import rule110 from './windows_signed_binary_proxy_execution.json'; +import rule111 from './windows_signed_binary_proxy_execution_download.json'; +import rule112 from './windows_suspicious_process_started_by_a_script.json'; +import rule113 from './windows_whoami_command_activity.json'; export const rawRules = [ rule1, rule2, @@ -264,34 +234,4 @@ export const rawRules = [ rule111, rule112, rule113, - rule114, - rule115, - rule116, - rule117, - rule118, - rule119, - rule120, - rule121, - rule122, - rule123, - rule124, - rule125, - rule126, - rule127, - rule128, - rule129, - rule130, - rule131, - rule132, - rule133, - rule134, - rule135, - rule136, - rule137, - rule138, - rule139, - rule140, - rule141, - rule142, - rule143, ]; diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json index d0a07ce2d0365..517e16fb3d284 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json @@ -4,22 +4,22 @@ "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Hping Process Activity", "query": "process.name: hping and event.action:executed", - "references": ["https://en.wikipedia.org/wiki/Hping"], - "risk_score": 75, + "references": [ + "https://en.wikipedia.org/wiki/Hping" + ], + "risk_score": 73, "rule_id": "90169566-2260-4824-b8e4-8615c3b4ed52", "severity": "high", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json index 1a116735e98f3..49f18ef9871a1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json @@ -1,25 +1,25 @@ { - "description": "Iodine is a tool for tunneling internet protocol version 4 (IPV4) trafic over the DNS protocol in order to circumvent firewalls, network security groups or network access lists while evading detection.", + "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol in order to circumvent firewalls, network security groups or network access lists while evading detection.", "false_positives": [ "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Potential DNS Tunneling via Iodine", "query": "process.name: (iodine or iodined) and event.action:executed", - "references": ["https://code.kryo.se/iodine/"], - "risk_score": 75, + "references": [ + "https://code.kryo.se/iodine/" + ], + "risk_score": 73, "rule_id": "041d4d41-9589-43e2-ba13-5680af75ebc2", "severity": "high", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json index 1529862571381..8c94694ca4d04 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json @@ -3,17 +3,23 @@ "false_positives": [ "Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon." ], - "index": ["auditbeat-*"], + "index": [ + "auditbeat-*" + ], + "language": "kuery", "max_signals": 33, "name": "Persistence via Kernel Module Modification", "query": "process.name: (insmod or kmod or modprobe or rmod) and event.action:executed", "references": [ "https://www.hackers-arise.com/single-post/2017/11/03/Linux-for-Hackers-Part-10-Loadable-Kernel-Modules-LKM" ], - "risk_score": 25, + "risk_score": 21, "rule_id": "81cc58f5-8062-49a2-ba84-5cc4b4d31c40", "severity": "low", - "tags": ["Elastic", "auditbeat"], + "tags": [ + "Elastic", + "Linux" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json index 187fc6379ef25..82a2a16080160 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json @@ -1,24 +1,22 @@ { - "description": "ld.so runs in a privlieged context and can be used to escape restrictive environments by spawning a shell in order to elevate privlieges or move laterally.", + "description": "The dynamic linker, ld.so, runs in a privileged context and can be used to escape restrictive environments by spawning a shell in order to elevate privileges or move laterally.", "false_positives": [ "ld.so is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or administrators. Use of ld.so by non-engineers or ordinary users is uncommon." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Ld.so Process Activity", "query": "process.name:ld.so and event.action:executed", - "risk_score": 25, + "risk_score": 21, "rule_id": "3f31a31c-f7cf-4268-a0df-ec1a98099e7f", "severity": "low", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_lzop_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_lzop_activity.json deleted file mode 100644 index 8061ff72e130b..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_lzop_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Linux lzop activity - possible @JulianRunnels", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Linux lzop activity", - "query": "process.name:lzop and event.action:executed", - "risk_score": 50, - "rule_id": "d7359214-54a4-4572-9e51-ebf79cda9b04", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json index 1fe4802c6cf79..8f4e1f40fad12 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json @@ -1,25 +1,25 @@ { - "description": "The Linux mknod program is sometimes used in the command paylod of remote command injection (RCI) and other exploits to export a command shell when the traditional version of netcat is not available to the payload.", + "description": "The Linux mknod program is sometimes used in the command payload of remote command injection (RCI) and other exploits to export a command shell when the traditional version of netcat is not available to the payload.", "false_positives": [ "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by web servers is more likely to be suspicious." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Mknod Process Activity", "query": "process.name: mknod and event.action:executed", - "references": ["https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem"], - "risk_score": 25, + "references": [ + "https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem" + ], + "risk_score": 21, "rule_id": "61c31c14-507f-4627-8c31-072556b89a9c", "severity": "low", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json index 6d57d0cbab375..b06a342d24977 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json @@ -1,15 +1,10 @@ { - "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltation. ", + "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration. ", "false_positives": [ "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools and frameworks." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, @@ -20,10 +15,13 @@ "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", "https://en.wikipedia.org/wiki/Netcat" ], - "risk_score": 50, + "risk_score": 47, "rule_id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f", "severity": "medium", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_network_anomalous_process_using_https_ports.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_network_anomalous_process_using_https_ports.json deleted file mode 100644 index f10c940f8bb93..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_network_anomalous_process_using_https_ports.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Linux Network - Anomalous Process Using HTTP/S Ports", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Linux Network - Anomalous Process Using HTTP/S Ports", - "query": "(destination.port:443 or destination.port:80) and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16 and not process.name:curl and not process.name:http and not process.name:https and not process.name:nginx and not process.name:packetbeat and not process.name:python2 and not process.name:snapd and not process.name:wget", - "risk_score": 50, - "rule_id": "be40c674-1799-4a00-934d-0b2d54495913", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json index b2284eea3f309..406cd8e026e7a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json @@ -1,25 +1,25 @@ { - "description": "Nmap ran on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks and identify listneing services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.", + "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks, identify listening services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.", "false_positives": [ "Security testing tools and frameworks may run nmap in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Nmap Process Activity", "query": "process.name: nmap", - "references": ["https://en.wikipedia.org/wiki/Nmap"], - "risk_score": 25, + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "risk_score": 21, "rule_id": "c87fca17-b3a9-4e83-b545-f30746c53920", "severity": "low", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json index 4d37f32fb3ca0..de53e05e70fa3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json @@ -4,22 +4,22 @@ "Some normal use of this command may originate from security engineers and network or server administrators but this is usually not routine or unannounced. Use of nping by non-engineers or ordinary users is uncommon." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Nping Process Activity", "query": "process.name: nping and event.action:executed", - "references": ["https://en.wikipedia.org/wiki/Nmap"], - "risk_score": 50, + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "risk_score": 47, "rule_id": "0d69150b-96f8-467c-a86d-a67a3378ce77", "severity": "medium", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json index d38cead306cd4..4ed021a4c864d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json @@ -4,21 +4,19 @@ "Build systems like Jenkins may start processes in the /tmp directory. These can be exempted by name or by username." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Unusual Process Execution - Temp", "query": "process.working_directory: /tmp and event.action:executed", - "risk_score": 50, + "risk_score": 47, "rule_id": "df959768-b0c9-4d45-988c-5606a2be8e5a", "severity": "medium", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ptrace_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ptrace_activity.json deleted file mode 100644 index 6f99312c04a00..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ptrace_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Linux: Ptrace Activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Linux: Ptrace Activity", - "query": "process.name: ptrace and event.action:executed", - "risk_score": 50, - "rule_id": "1bff9259-e160-4920-bf72-4c96b6dbb7af", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_rawshark_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_rawshark_activity.json deleted file mode 100644 index 148468e959899..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_rawshark_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Linux: Rawshark Activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Linux: Rawshark Activity", - "query": "process.name: rawshark and event.action:executed", - "risk_score": 50, - "rule_id": "30eb2b9d-b53b-4ba5-bfab-7119a8b84029", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json index 1711f45e770ed..c7d856cbe61f3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json @@ -3,16 +3,23 @@ "false_positives": [ "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." ], - "index": ["auditbeat-*"], + "index": [ + "auditbeat-*" + ], "language": "kuery", "max_signals": 33, "name": "Potential Shell via Web Server", "query": "process.name: bash and (user.name: apache or www) and event.action:executed", - "references": ["https://pentestlab.blog/tag/web-shell/"], - "risk_score": 50, + "references": [ + "https://pentestlab.blog/tag/web-shell/" + ], + "risk_score": 47, "rule_id": "231876e7-4d1f-4d63-a47c-47dd1acdc1cb", - "severity": "low", - "tags": ["Elastic", "linux"], + "severity": "medium", + "tags": [ + "Elastic", + "Linux" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json index 364a2bee65c23..481a99518d4ed 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json @@ -4,12 +4,7 @@ "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by web servers is more likely to be suspicious." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, @@ -18,10 +13,13 @@ "references": [ "https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat" ], - "risk_score": 50, + "risk_score": 47, "rule_id": "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126", "severity": "medium", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ssh_forwarding.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ssh_forwarding.json index 3447689f08d62..3b61814ab66fd 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ssh_forwarding.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ssh_forwarding.json @@ -4,22 +4,23 @@ "Some normal use of this command may originate from usage by engineers as an alternative or ad-hoc remote access solution. Use of this command by non-administrative users is uncommon." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Potential Lateral Movement via SSH Port Forwarding", "query": "process.name:ssh and process.args:\"-R\" and event.action:executed", - "references": ["https://www.ssh.com/ssh/tunneling", "https://www.ssh.com/ssh/tunneling/example"], - "risk_score": 50, + "references": [ + "https://www.ssh.com/ssh/tunneling", + "https://www.ssh.com/ssh/tunneling/example" + ], + "risk_score": 47, "rule_id": "45d256ab-e665-445b-8306-2f83a8db59f8", "severity": "medium", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json index b0c2b4ecd07c2..6f8bc112fd011 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json @@ -1,25 +1,25 @@ { - "description": "Strace runs in a privlieged context and can be used to escape restrictive environments by instantiating a shell in order to elevate privlieges or move laterally.", + "description": "Strace runs in a privileged context and can be used to escape restrictive environments by instantiating a shell in order to elevate privlieges or move laterally.", "false_positives": [ "Strace is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or SREs engaged in debugging or system call tracing." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Strace Process Activity", "query": "process.name: strace and event.action:executed", - "references": ["https://en.wikipedia.org/wiki/Strace"], - "risk_score": 25, + "references": [ + "https://en.wikipedia.org/wiki/Strace" + ], + "risk_score": 21, "rule_id": "d6450d4e-81c6-46a3-bd94-079886318ed5", "severity": "low", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json index 594aee0eca708..b6dc7f1689770 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json @@ -4,21 +4,19 @@ "Some normal use of this command may originate from server or network administrators engaged in network troubleshooting." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "auditbeat-*" ], "language": "kuery", "max_signals": 33, "name": "Network Sniffing via Tcpdump", "query": "process.name: tcpdump and event.action:executed", - "risk_score": 25, + "risk_score": 21, "rule_id": "7a137d76-ce3d-48e2-947d-2747796a78c0", "severity": "low", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_web_download.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_web_download.json deleted file mode 100644 index 311e2b5779602..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_web_download.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Linux: Web Download", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Linux: Web Download", - "query": "process.name: (curl or wget) and event.action:executed", - "risk_score": 50, - "rule_id": "e8ec93a6-49d2-4467-8c12-81c435fcc519", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json index a370a44d4eb46..91c6d2bcc9f95 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json @@ -1,14 +1,22 @@ { - "description": "The 'whoami' command was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privlieged access.", - "index": ["auditbeat-*"], + "description": "The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.", + "false_positives": [ + "Security testing tools and frameworks may run this command. Some normal use of this command may originate from automation tools and frameworks." + ], + "index": [ + "auditbeat-*" + ], "language": "kuery", "max_signals": 33, "name": "User Discovery via Whoami", "query": "process.name: whoami and event.action:executed", - "risk_score": 25, + "risk_score": 21, "rule_id": "120559c6-5e24-49f4-9e30-8ffe697df6b9", "severity": "low", - "tags": ["Elastic", "linux"], + "tags": [ + "Elastic", + "Linux" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json index 5c1d64e294159..3d1b07a267eca 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json @@ -1,26 +1,29 @@ { - "description": "This signal detects DNS network traffic logs that indicate an internal network\nclient reaching out to infrastructure on the Internet directly to answer name\nqueries. This activity could be a default or misconfiguration. This impacts\nyour organization's ability to provide enterprise monitoring and logging of DNS\nand opens your network to a variety of abuses or malicious communications.\n", + "description": "This signal detects internal network client sending DNS traffic directly to the Internet.\nThis is atypical behavior for a managed network and can be indicative of malware,\nexfiltration, command and control or simply misconfiguration. This also impacts your\norganization's ability to provide enterprise monitoring and logging of DNS and opens\nyour network to a variety of abuses or malicious communications.\n", "false_positives": [ - "You should apply a filter to this rule to exclude your enterprise nameservers that are expected to reach out to the Internet" + "DNS servers should be excluded from this rule as this is expected behavior for them. Endpoints usually query local DNS servers defined in their DHCP scopes but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it would tend to break intra-net name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations; in that case, such devices or networks can be excluded from this rule if this is expected behavior." ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*" ], + "language": "kuery", "name": "DNS Activity to the Internet", "query": "destination.port:53 and (\n network.direction: outbound or (\n source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip:( 169.254.169.254/32 or 127.0.0.53/32 or 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.251 or ff02\\:\\:fb or 255.255.255.255 )\n )\n)\n", "references": [ "https://www.us-cert.gov/ncas/alerts/TA15-240A", "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf" ], - "risk_score": 50, + "risk_score": 47, "rule_id": "6ea71ff0-9e95-475b-9506-2580d1ce6154", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json index 62064db7e1443..ef7b39412c808 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects events that may indicate the use of FTP network connections.\nThe File Transfer Protocol (FTP) has been around in its current form since the\n1980's. It can be an efficient and normal procedure on your network to send and\nreceive files. Because it is common and efficient, adversaries will also often\nuse this protocol to exfiltrate data from your network or download new tools.\nAdditionally, FTP is a plaintext protocol which may expose your username and\npassword, if intercepted.\n", + "description": "This signal detects events that may indicate the use of FTP network connections to the Internet.\nThe File Transfer Protocol (FTP) has been around in its current form since the\n1980's. It can be an efficient and normal procedure on your network to send and\nreceive files. Because it is common and efficient, adversaries will also often\nuse this protocol to ex-filtrate data from your network or download new tools.\nAdditionally, FTP is a plain-text protocol which may expose your user name and\npassword, if intercepted. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.\n", + "false_positives": [ + "FTP servers should be excluded from this rule as this is expected behavior for them. Some business work-flows may use FTP for data exchange. These work-flows often have expected characteristics such as users, sources and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP work-flow or business requirement is often suspicious. NEW NEW" + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "FTP (File Transfer Protocol) Activity to the Internet", "query": "network.transport: tcp and destination.port: (20 or 21) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 21, "rule_id": "87ec6396-9ac4-4706-bcf0-2ebb22002f43", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -36,11 +41,11 @@ "tactic": { "id": "TA0010", "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" + "reference": "https://attack.mitre.org/tactics/TA0010/" }, "technique": [ { - "id": "T1043", + "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": "https://attack.mitre.org/techniques/T1048/" } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json index 4590fdf39d143..2700eae977482 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects events that use common ports for IRC to the Internet. IRC\nis a common protocol that can be used chat and file transfer. This protocol\nalso makes a good candidate for remote control of malware and data transfer in\nand out of a network.\n", + "description": "This signal detects events that use common ports for IRC to the Internet. IRC (Internet Relay Chat)\nis a common protocol that can be used chat and file transfer. This protocol\nalso makes a good candidate for remote control of malware and data transfer in\nand out of a network.\n", + "false_positives": [ + "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATted web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some legacy applications may use these ports but this is very uncommon and usually appears only in local traffic using private IPs which this rule does not match." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "IRC (Internet Relay Chat) Protocol Activity to the Internet", "query": "network.transport: tcp and destination.port:(6667 or 6697) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 47, "rule_id": "c6474c34-4953-447a-903e-9fcb7b6661aa", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -40,7 +45,7 @@ }, "technique": [ { - "id": "T1043", + "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": "https://attack.mitre.org/techniques/T1048/" } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json index e74bed3463993..e87e296017a36 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json @@ -1,7 +1,9 @@ { "description": "This signal detects events that could be describing IPSEC NAT Traversal traffic.\nIPSEC is a VPN technology that allows one system to talk to another using\nencrypted tunnels. NAT Traversal enables these tunnels to communicate over\nthe Internet where one of the sides is behind a NAT router gateway. This may\nbe common on your network, but this technique is also used by threat actors\nto avoid detection.\n", + "false_positives": [ + "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions such as when a application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded if desired." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "IPSEC NAT Traversal Port Activity", "query": "network.transport: udp and destination.port: 4500", - "risk_score": 25, + "risk_score": 21, "rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json index e05e83ff0a1ee..59db16c7b7d3d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json @@ -1,7 +1,9 @@ { "description": "This signal detects events that may indicate use of SMTP on TCP port 26. This\nport is commonly used by several popular mail transfer agents to deconflict\nwith the default SMTP port 25. This port has also been used by a malware family\ncalled BadPatch for command and control of Windows systems.\n", + "false_positives": [ + "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior for them." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -15,10 +17,13 @@ "https://unit42.paloaltonetworks.com/unit42-badpatch/", "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/" ], - "risk_score": 25, + "risk_score": 21, "rule_id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity.json deleted file mode 100644 index 73a634a3a9f42..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Network - Port 8000 Activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Network - Port 8000 Activity", - "query": "destination.port:8000", - "risk_score": 50, - "rule_id": "9c5f8092-e3f7-4eda-b9d3-56eed28fb157", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json index e193ab83d89fd..2b3d08a7c80d9 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json @@ -1,7 +1,9 @@ { "description": "TCP Port 8000 is commonly used for development environments of web server\nsoftware. It generally should not be exposed directly to the Internet. If you are\nrunning software like this on the Internet, you should consider placing it behind\na reverse proxy.\n", + "false_positives": [ + "Because this port is in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "TCP Port 8000 Activity to the Internet", "query": "network.transport: tcp and destination.port: 8000 and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 21, "rule_id": "08d5d7e2-740f-44d8-aeda-e41f4263efaf", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json index 7b527dbc09a44..b008ca2c2bee6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json @@ -1,7 +1,9 @@ { "description": "This signal detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of connections to tunnel their traffic while avoiding detection.", + "false_positives": [ + "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions such as when an application server with replies to a client which has used this port by coincidence. This is uncommon but such servers can be excluded if desired." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,30 @@ "language": "kuery", "name": "PPTP (Point to Point Tunneling Protocol) Activity", "query": "network.transport: tcp and destination.port: 1723", - "risk_score": 25, + "risk_score": 21, "rule_id": "d2053495-8fe7-4168-b3df-dad844046be3", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json index 50f521ea91e2b..f7c6ffddcaf9e 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json @@ -1,7 +1,9 @@ { "description": "This signal detects events that may describe network events of proxy use to the\nInternet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically\nenvironments will use an internal IP address for a proxy server. It can also\nbe used to circumvent network controls and detection mechanisms.\n", + "false_positives": [ + "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "Proxy Port Activity to the Internet", "query": "network.transport: tcp and destination.port: (3128 or 8080 or 1080) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 47, "rule_id": "ad0e5e75-dd89-4875-8d0a-dfdc1828b5f3", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json index edd4aa456974d..76528da19a57c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of RDP traffic\nfrom the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of RDP traffic\nfrom the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", + "false_positives": [ + "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,23 +13,56 @@ "language": "kuery", "name": "RDP (Remote Desktop Protocol) from the Internet", "query": "network.transport: tcp and destination.port: 3389 and (\n network.direction: inbound or (\n not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n and destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 47, "rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", "tactic": { "id": "TA0011", - "name": "Initial Access", + "name": "Command and Control", "reference": "https://attack.mitre.org/tactics/TA0011/" }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1190", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, "technique": [ { "id": "T1190", "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1043/" + "reference": "https://attack.mitre.org/techniques/T1190/" } ] } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json index c9f3f95ad1e07..55b9716af9346 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of RDP traffic\nto the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of RDP traffic\nto the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", + "false_positives": [ + "RDP connections may be made directly to Internet destinations in order to access Windows cloud server instances but such connections are usually made only by engineers. In such cases, only RDP gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "RDP (Remote Desktop Protocol) to the Internet", "query": "network.transport: tcp and destination.port: 3389 and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 21, "rule_id": "e56993d2-759c-4120-984c-9ec9bb940fd5", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -25,7 +30,7 @@ }, "technique": [ { - "id": "T1190", + "id": "T1043", "name": "Exploit Public-Facing Application", "reference": "https://attack.mitre.org/techniques/T1043/" } @@ -36,11 +41,11 @@ "tactic": { "id": "TA0010", "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" + "reference": "https://attack.mitre.org/tactics/TA0010/" }, "technique": [ { - "id": "T1043", + "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": "https://attack.mitre.org/techniques/T1048/" } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json index 9f5a60f1743d7..ca6715ac48785 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json @@ -1,7 +1,6 @@ { - "description": "This signal detects network events that may indicate the use of RPC traffic\nfrom the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of RPC traffic\nfrom the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +10,13 @@ "language": "kuery", "name": "RPC (Remote Procedure Call) from the Internet", "query": "network.transport: tcp and destination.port: 135 and (\n network.direction: inbound or (\n not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 73, "rule_id": "143cb236-0956-4f42-a706-814bcaa0cf5a", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "high", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json index b860158ef93d3..91db97dabdd46 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json @@ -1,7 +1,6 @@ { - "description": "This signal detects network events that may indicate the use of RPC traffic\nto the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of RPC traffic\nto the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +10,13 @@ "language": "kuery", "name": "RPC (Remote Procedure Call) to the Internet", "query": "network.transport: tcp and destination.port: 135 and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 73, "rule_id": "32923416-763a-4531-bb35-f33b9232ecdb", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "high", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -27,7 +29,7 @@ { "id": "T1190", "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1043/" + "reference": "https://attack.mitre.org/techniques/T1190/" } ] } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json index fa1f1aba66e83..ee47dff73db40 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json @@ -1,7 +1,6 @@ { - "description": "This signal detects network events that may indicate the use of Windows\nfile sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly\nused within networks to share files, printers, and other system resources amongst\ntrusted systems. It should almost never be directly exposed to the Internet, as\nit is frequently targetted and exploited by threat actors as an initial access\nor backdoor vector or for data exfiltration.\n", + "description": "This signal detects network events that may indicate the use of Windows\nfile sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly\nused within networks to share files, printers, and other system resources amongst\ntrusted systems. It should almost never be directly exposed to the Internet, as\nit is frequently targeted and exploited by threat actors as an initial access\nor back-door vector or for data exfiltration.\n", "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +10,13 @@ "language": "kuery", "name": "SMB (Windows File Sharing) Activity to the Internet", "query": "network.transport: tcp and destination.port: (139 or 445) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 73, "rule_id": "c82b2bd8-d701-420c-ba43-f11a155b681a", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "high", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -27,7 +29,7 @@ { "id": "T1190", "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1043/" + "reference": "https://attack.mitre.org/techniques/T1190/" } ] }, @@ -36,7 +38,7 @@ "tactic": { "id": "TA0010", "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" + "reference": "https://attack.mitre.org/tactics/TA0010/" }, "technique": [ { diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json index 85c8b3f05166c..68daf71d9992a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json @@ -1,7 +1,9 @@ { "description": "This signal detects events that may describe SMTP traffic from internal\nhosts to a host across the Internet. In an enterprise network, there is typically\na dedicate host that is internal that could perform this function. It is also\nfrequently abused by threat actors for command and control or data exfiltration.\n", + "false_positives": [ + "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and / or personal devices may send email traffic to remote Internet destinations; in that case, such devices or networks can be excluded from this rule if this is expected behavior." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "SMTP to the Internet", "query": "network.transport: tcp and destination.port: (25 or 465 or 587) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 21, "rule_id": "67a9beba-830d-4035-bfe8-40b7e28f8ac4", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -36,11 +41,11 @@ "tactic": { "id": "TA0010", "name": "Exfiltration", - "reference": "https://attack.mitre.org/tactics/TA0011/" + "reference": "https://attack.mitre.org/tactics/TA0010/" }, "technique": [ { - "id": "T1043", + "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": "https://attack.mitre.org/techniques/T1048/" } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json index e0998029081d3..df779d47246a5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json @@ -1,7 +1,9 @@ { "description": "This signal detects events that may describe database traffic\n(MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases\nshould almost never be directly exposed to the Internet, as they are\nfrequently targeted by threat actors to gain initial access to network resources.\n", + "false_positives": [ + "Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and database instances are accessed directly across the Internet." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,30 @@ "language": "kuery", "name": "SQL Traffic to the Internet", "query": "network.transport: tcp and destination.port: (1433 or 1521 or 3336 or 5432) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 50, + "risk_score": 47, "rule_id": "139c7458-566a-410c-a5cd-f80238d6a5cd", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json index 2428909491584..6c278700450b1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", + "false_positives": [ + "Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,38 +13,56 @@ "language": "kuery", "name": "SSH (Secure Shell) from the Internet", "query": "network.transport: tcp and destination.port:22 and (\n network.direction: inbound or (\n not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 47, "rule_id": "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", "tactic": { - "id": "TA0001", - "name": "Initial Access", - "reference": "https://attack.mitre.org/tactics/TA0001/" + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" }, "technique": [ { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1190/" + "id": "T1043", + "name": "Commonly Used Port", + "reference": "https://attack.mitre.org/techniques/T1043/" } ] }, { "framework": "MITRE ATT&CK", "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" }, "technique": [ { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" } ] } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json index cf77f9363f525..63f2dbc8a34f1 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", + "false_positives": [ + "SSH connections may be made directly to Internet destinations in order to access Linux cloud server instances but such connections are usually made only by engineers. In such cases, only SSH gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "SSH (Secure Shell) to the Internet", "query": "network.transport: tcp and destination.port:22 and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 21, "rule_id": "6f1500bc-62d7-4eb9-8601-7485e87da2f4", "severity": "low", - "tags": ["Elastic", "network"], + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json index a9a364b1b14bd..0d28f0ea53d9a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of Telnet traffic.\nTelnet is commonly used by system administrators to remotely control older or embeded\nsystems using the command line shell. It should almost never be directly exposed to\nthe Internet, as it is frequently targetted and exploited by threat actors as an\ninitial access or backdoor vector. As a plaintext protocol, it may also expose\n", + "description": "This signal detects network events that may indicate the use of Telnet traffic.\nTelnet is commonly used by system administrators to remotely control older or embed ed\nsystems using the command line shell. It should almost never be directly exposed to\nthe Internet, as it is frequently targeted and exploited by threat actors as an\ninitial access or back-door vector. As a plain-text protocol, it may also expose\n", + "false_positives": [ + "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,38 +13,56 @@ "language": "kuery", "name": "Telnet Port Activity", "query": "network.transport: tcp and destination.port: 23", - "risk_score": 50, + "risk_score": 47, "rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", "tactic": { "id": "TA0011", - "name": "Initial Access", + "name": "Command and Control", "reference": "https://attack.mitre.org/tactics/TA0011/" }, "technique": [ { - "id": "T1190", - "name": "Exploit Public-Facing Application", + "id": "T1043", + "name": "Commonly Used Port", "reference": "https://attack.mitre.org/techniques/T1043/" } ] }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, { "framework": "MITRE ATT&CK", "tactic": { "id": "TA0011", - "name": "Command and Control", + "name": "Initial Access", "reference": "https://attack.mitre.org/tactics/TA0011/" }, "technique": [ { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" } ] } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json index 811a81c0e6754..80893e9404f02 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of Tor traffic\nto the Internet. Tor is a network protocol that sends traffic through a\nseries of encrypted tunnels used to conceal a user's location and usage.\nTor may be used by threat actors as an alternate communication pathway to\nconceal the actor's indentity and avoid detection.\n", + "description": "This signal detects network events that may indicate the use of Tor traffic\nto the Internet. Tor is a network protocol that sends traffic through a\nseries of encrypted tunnels used to conceal a user's location and usage.\nTor may be used by threat actors as an alternate communication pathway to\nconceal the actor's identity and avoid detection.\n", + "false_positives": [ + "Tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used one of these ports by coincidence. In this case, such servers can be excluded if desired." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "Tor Activity to the Internet", "query": "network.transport: tcp and destination.port: (9001 or 9030) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 47, "rule_id": "7d2c38d7-ede7-4bdf-b140-445906e6c540", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -30,6 +35,21 @@ "reference": "https://attack.mitre.org/techniques/T1043/" } ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1188", + "name": "Multi-hop Proxy", + "reference": "https://attack.mitre.org/techniques/T1188/" + } + ] } ], "type": "query", diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json index d46ee76ba72b2..e64138dd053fa 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of VNC traffic\nfrom the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of VNC traffic\nfrom the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", + "false_positives": [ + "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,38 +13,41 @@ "language": "kuery", "name": "VNC (Virtual Network Computing) from the Internet", "query": "network.transport: tcp and (destination.port >= 5800 and destination.port <= 5810) and (\n network.direction: inbound or (\n not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 73, "rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "high", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", "tactic": { - "id": "TA0001", - "name": "Initial Access", + "id": "TA0011", + "name": "Command and Control", "reference": "https://attack.mitre.org/tactics/TA0011/" }, "technique": [ { - "id": "T1190", - "name": "Exploit Public-Facing Application", - "reference": "https://attack.mitre.org/techniques/T1043/" + "id": "T1219", + "name": "Remote Access Tools", + "reference": "https://attack.mitre.org/techniques/T1219/" } ] }, { "framework": "MITRE ATT&CK", "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" }, "technique": [ { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" } ] } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json index d820cedc335ab..8c43419c3ead5 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json @@ -1,7 +1,9 @@ { - "description": "This signal detects network events that may indicate the use of VNC traffic\nfrom the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targetted and\nexploited by threat actors as an initial access or backdoor vector.\n", + "description": "This signal detects network events that may indicate the use of VNC traffic\nto the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n", + "false_positives": [ + "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], "index": [ - "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", @@ -11,10 +13,13 @@ "language": "kuery", "name": "VNC (Virtual Network Computing) to the Internet", "query": "network.transport: tcp and (destination.port >= 5800 and destination.port <= 5810) and (\n network.direction: outbound or (\n source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n )\n)\n", - "risk_score": 25, + "risk_score": 47, "rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf", - "severity": "low", - "tags": ["Elastic", "network"], + "severity": "medium", + "tags": [ + "Elastic", + "network" + ], "threat": [ { "framework": "MITRE ATT&CK", @@ -25,9 +30,9 @@ }, "technique": [ { - "id": "T1043", - "name": "Commonly Used Port", - "reference": "https://attack.mitre.org/techniques/T1043/" + "id": "T1219", + "name": "Remote Access Tools", + "reference": "https://attack.mitre.org/techniques/T1219/" } ] } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json index 9d787d3ab738f..87a3119ac780d 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json @@ -3,14 +3,6 @@ "false_positives": [ "Some normal applications and scripts may contain no user agent. Most legitmate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, or the user is unauthorized, or the request is unusual, these may be suspicious or malicious activity." ], - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], "filters": [ { "$state": { @@ -29,15 +21,23 @@ } } ], + "index": [ + "apm-*-transaction*" + ], "language": "kuery", "max_signals": 33, "name": "Web Application Suspicious Activity: No User Agent", "query": "url.path: *", - "references": ["https://en.wikipedia.org/wiki/User_agent"], - "risk_score": 50, + "references": [ + "https://en.wikipedia.org/wiki/User_agent" + ], + "risk_score": 47, "rule_id": "43303fd4-4839-4e48-b2b2-803ab060758d", - "severity": "low", - "tags": ["Elastic", "apm"], + "severity": "medium", + "tags": [ + "Elastic", + "APM" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json index c92b801995837..72d85dcbffc06 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json @@ -4,21 +4,21 @@ "This signal does not indicate that a SQL injection attack occured, only that the sqlmap tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity." ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" + "apm-*-transaction*" ], "language": "kuery", "name": "Web Application Suspicious Activity: sqlmap User Agent", "query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"", - "references": ["http://sqlmap.org/"], - "risk_score": 50, + "references": [ + "http://sqlmap.org/" + ], + "risk_score": 47, "rule_id": "d49cc73f-7a16-4def-89ce-9fc7127d7820", - "severity": "low", - "tags": ["Elastic", "apm"], + "severity": "medium", + "tags": [ + "Elastic", + "APM" + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json index 91abe1368b011..9b3784345b013 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json @@ -1,20 +1,51 @@ { - "description": "Windows: Background Intelligent Transfer Service (BITS) Connecting to the Internet", + "description": "Adversaries may abuse the Background Intelligent Transfer Service (BITS) to download, execute, or clean up after performing a malicious action.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows: Background Intelligent Transfer Service (BITS) Connecting to the Internet", + "max_signals": 33, + "name": "Background Intelligent Transfer Service (BITS) connecting to the Internet", "query": "process.name:bitsadmin.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 21, "rule_id": "7edadee3-98ae-472c-b1c4-8c0a2c4877cc", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1197", + "name": "BITS Jobs", + "reference": "https://attack.mitre.org/techniques/T1197/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1197", + "name": "BITS Jobs", + "reference": "https://attack.mitre.org/techniques/T1197/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_burp_ce_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_burp_ce_activity.json deleted file mode 100644 index f3e62405d6e18..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_burp_ce_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Burp CE activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Burp CE activity", - "query": "process.name:BurpSuiteCommunity.exe", - "risk_score": 50, - "rule_id": "0f09845b-2ec8-4770-8155-7df3d4e402cc", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json index 451a1ad4942de..0a960fc427d7b 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json @@ -1,20 +1,36 @@ { - "description": "Windows: Certutil Connecting to the Internet", + "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows: Certutil Connecting to the Internet", + "max_signals": 33, + "name": "Certutil Network Connection", "query": "process.name:certutil.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 21, "rule_id": "1a2cf526-6784-4c51-a2b9-f0adcc05d85c", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Remote File Copy", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json index 6a2a9213a94a9..87dbd4cd70777 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json @@ -1,20 +1,54 @@ { - "description": "Windows: Command Prompt Connecting to the Internet", + "description": "Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL.", + "false_positives": [ + "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows: Command Prompt Connecting to the Internet", + "max_signals": 33, + "name": "Command Prompt Network Connection", "query": "process.name:cmd.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 21, "rule_id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Remote File Copy", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json index 92edd71a665dd..a214ab4544b97 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json @@ -1,20 +1,36 @@ { - "description": "Command shell started by Internet Explorer", + "description": "Identifies a suspicious parent child process relationship with cmd.exe spawning form Internet Explorer.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Command shell started by Internet Explorer", + "max_signals": 33, + "name": "Internet Explorer spawning cmd.exe", "query": "process.parent.name:iexplore.exe and process.name:cmd.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "7a6e1e81-deae-4cf6-b807-9a768fff3c06", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json index 663b2485fab93..187cc9d344902 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json @@ -1,20 +1,51 @@ { - "description": "Command shell started by Powershell", + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Command shell started by Powershell", + "max_signals": 33, + "name": "PowerShell spawning cmd.exe", "query": "process.parent.name:powershell.exe and process.name:cmd.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "0f616aee-8161-4120-857e-742366f5eeb3", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1086", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1086/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json index 73ab27a131e3d..81114bf8b8766 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json @@ -1,20 +1,36 @@ { - "description": "Command shell started by Svchost", + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Command shell started by Svchost", + "max_signals": 33, + "name": "Svchost spawning cmd.exe", "query": "process.parent.name:svchost.exe and process.name:cmd.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command-Line Interface", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_commands.json deleted file mode 100644 index 9516b80412582..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_commands.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Credential Dumping Commands", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Credential Dumping Commands", - "query": "event.code: 1 and process.args:*Invoke-Mimikatz-DumpCreds* or process.args:*gsecdump* or process.args:*wce* or (process.args:*procdump* and process.args:*lsass*) or (process.args:*ntdsutil* and process.args:*ntds*ifm*create*)", - "risk_score": 50, - "rule_id": "66885745-ea38-432c-9edb-599b943948d4", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_imageload.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_imageload.json deleted file mode 100644 index 06a9de8f20720..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_imageload.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Credential Dumping via ImageLoad", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Credential Dumping via ImageLoad", - "query": "event.code:7 and not process.name:Sysmon.exe and not process.name:Sysmon64.exe and not process.name:svchost.exe and not process.name:logonui.exe and (file.path:*samlib.dll* or file.path:*WinSCard.dll* or file.path:*cryptdll.dll* or file.path:*hid.dll* or file.path:*vaultcli.dll*)", - "risk_score": 50, - "rule_id": "f872647c-d070-4b1c-afcc-055f081d9205", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_registry_save.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_registry_save.json deleted file mode 100644 index a19646d2f83cf..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_credential_dumping_via_registry_save.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Credential Dumping via Registry Save", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Credential Dumping via Registry Save", - "query": "event.code: 1 and process.name:reg.exe and process.args:*save* and (process.args:*sam* or process.args:*system*)", - "risk_score": 50, - "rule_id": "9f6fb56f-4bbd-404e-b955-49dfba7c0e68", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_data_compression_using_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_data_compression_using_powershell.json deleted file mode 100644 index 9be27cbec023f..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_data_compression_using_powershell.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Data Compression Using Powershell", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Data Compression Using Powershell", - "query": "event.code: 1 and process.name:powershell.exe and (process.args:*Recurse* and process.args:*Compress-Archive*)", - "risk_score": 50, - "rule_id": "bc913943-e1f9-4bf5-a593-caca7c2eb0c3", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_decoding_using_certutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_decoding_using_certutil.json deleted file mode 100644 index a4126a9b45ec9..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_decoding_using_certutil.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Defense Evasion - Decoding Using Certutil", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Defense Evasion - Decoding Using Certutil", - "query": "event.code:1 and process.name:attrib.exe and (process.args:*+h* or process.args:*+s*)", - "risk_score": 50, - "rule_id": "d9642bf2-87d0-45c2-8781-2bd2017cdbb8", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_or_persistence_via_hidden_files.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_or_persistence_via_hidden_files.json deleted file mode 100644 index edba96cbcc37b..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_or_persistence_via_hidden_files.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Defense Evasion or Persistence via Hidden Files", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Defense Evasion or Persistence via Hidden Files", - "query": "event.code:1 and process.name:attrib.exe and (process.args:\"+h\" or process.args:\"+s\")", - "risk_score": 50, - "rule_id": "340a0063-baba-447b-8396-26a5cc1eb684", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json index 56c2a3ecd7eaf..7c999c1fc1e03 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json @@ -1,20 +1,37 @@ { - "description": "Windows Defense evasion via Filter Manager", + "description": "The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Defense evasion via Filter Manager", + "max_signals": 33, + "name": "Potential Evasion via Filter Manager", "query": "event.code:1 and process.name:fltmc.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_windows_event_log_tools.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_windows_event_log_tools.json deleted file mode 100644 index 2f25c7282a87d..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_windows_event_log_tools.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Defense Evasion via Windows Event Log Tools", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Defense Evasion via Windows Event Log Tools", - "query": "event.code:1 and process.name:wevtutil.exe", - "risk_score": 50, - "rule_id": "07979a67-ab4d-460f-9ff3-bf1352de6762", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json index 079d33bf0f676..62c8942dda9c3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json @@ -1,20 +1,54 @@ { - "description": "Windows Execution via Compiled HTML File", + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "false_positives": [ + "The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Execution via Compiled HTML File", + "max_signals": 33, + "name": "Process Activity via Compiled HTML File", "query": "event.code:1 and process.name:hh.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json index 9c8a4f4b47dce..657487232fe81 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json @@ -1,20 +1,37 @@ { - "description": "Windows Execution via Connection Manager", + "description": "Various Windows utilities may be used to execute commands, possibly without invoking cmd.exe, including the Program Compatibility Assistant (pcalua.exe) or forfiles.exe.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Execution via Connection Manager", + "max_signals": 33, + "name": "Indirect Command Execution", "query": "event.code:1 and process.parent.name:pcalua.exe or (process.name:bash.exe or process.name:forfiles.exe or process.name:pcalua.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "f2728299-167a-489c-913c-2e0955ac3c40", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_microsoft_html_application_hta.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_microsoft_html_application_hta.json deleted file mode 100644 index d986ccbb865f8..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_microsoft_html_application_hta.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Execution via Microsoft HTML Application (HTA)", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Execution via Microsoft HTML Application (HTA)", - "query": "event.code:1 and (process.parent.args:*mshta* or process.args:*mshta*)", - "risk_score": 50, - "rule_id": "b007cc82-c522-48d1-b7a7-53f63c50c494", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json index 26e99cbb59e48..80d91fa515342 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json @@ -1,20 +1,40 @@ { - "description": "Windows Execution via .NET COM Assemblies", + "description": "Adversaries can use Regsvcs.exe and Regasm.exe to proxy execution of code through a trusted Windows utility.", + "false_positives": [ + "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Execution via .NET COM Assemblies", + "max_signals": 33, + "name": "Execution via Regsvcs/Regasm", "query": "event.code:1 and (process.name:regasm.exe or process.name:regsvcs.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "5c12412f-602c-4120-8c4f-69d723dbba04", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1121", + "name": "Regsvcs/Regasm", + "reference": "https://attack.mitre.org/techniques/T1121/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json index 06d4a075c4e6b..6b2c54d527963 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json @@ -1,20 +1,51 @@ { - "description": "Windows Execution via Regsvr32", + "description": "Identifies scrobj.dll loaded into unusual Microsoft processes. This may indicate a malicious scriptlet is being executed in the target process.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Execution via Regsvr32", + "max_signals": 33, + "name": "Suspicious Script Object Execution", "query": "event.code: 1 and scrobj.dll and (process.name:certutil.exe or process.name:regsvr32.exe or process.name:rundll32.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "b7333d08-be4b-4cb4-b81e-924ae37b3143", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1064", + "name": "Scripting", + "reference": "https://attack.mitre.org/techniques/T1064/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1064", + "name": "Scripting", + "reference": "https://attack.mitre.org/techniques/T1064/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json index bc3ebf38181a0..e722d311b86c7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json @@ -1,20 +1,55 @@ { - "description": "Windows Execution via Trusted Developer Utilities", + "description": "Identifies possibly suspicious activity using trusted Windows developer activity.", + "false_positives": [ + "These programs may be used by Windows developers but use by non-engineers is unusual." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Execution via Trusted Developer Utilities", + "max_signals": 33, + "name": "Trusted Developer Application Usage", "query": "event.code:1 and (process.name:MSBuild.exe or process.name:msxsl.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json index cec9fe4a4aebe..2b4d774281b84 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json @@ -1,20 +1,51 @@ { - "description": "Windows: HTML Help executable Program Connecting to the Internet", + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows: HTML Help executable Program Connecting to the Internet", + "max_signals": 33, + "name": "Network Connection via Compiled HTML File", "query": "process.name:hh.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 21, "rule_id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1223", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1223/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_image_load_from_a_temp_directory.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_image_load_from_a_temp_directory.json deleted file mode 100644 index 3e80b58377af6..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_image_load_from_a_temp_directory.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "description": "Windows image load from a temp directory", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.action", - "negate": false, - "params": { - "query": "Image loaded (rule: ImageLoad)" - }, - "type": "phrase", - "value": "Image loaded (rule: ImageLoad)" - }, - "query": { - "match": { - "event.action": { - "query": "Image loaded (rule: ImageLoad)", - "type": "phrase" - } - } - } - } - ], - "language": "kuery", - "name": "Windows image load from a temp directory", - "query": "file.path:Temp", - "risk_score": 50, - "rule_id": "f23e4cc7-6825-4a28-b27a-e67437a9a806", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_indirect_command_execution.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_indirect_command_execution.json deleted file mode 100644 index a7f22358a11d9..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_indirect_command_execution.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Indirect Command Execution", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Indirect Command Execution", - "query": "event.code:1 and process.parent.name:pcalua.exe or (process.name:bash.exe or process.name:forfiles.exe or process.name:pcalua.exe)", - "risk_score": 50, - "rule_id": "ff969842-c573-4e69-8e12-02fb303290f2", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_iodine_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_iodine_activity.json deleted file mode 100644 index 8aae9dc83a1cd..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_iodine_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Iodine activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Iodine activity", - "query": "event.code: 1 and process.name:iodine.exe or process.name:iodined.exe", - "risk_score": 50, - "rule_id": "fcbbf0b2-99c5-4c7f-8411-dc9ee392e43f", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_management_instrumentation_wmi_execution.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_management_instrumentation_wmi_execution.json deleted file mode 100644 index da525a8573264..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_management_instrumentation_wmi_execution.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Management Instrumentation (WMI) Execution", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Management Instrumentation (WMI) Execution", - "query": "event.code:1 and (process.parent.args:*wmiprvse.exe* or process.name:wmic.exe or process.args:*wmic* )", - "risk_score": 50, - "rule_id": "cec5eb81-6e01-40e5-a1bf-bf175cce4eb4", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_microsoft_html_application_hta_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_microsoft_html_application_hta_connecting_to_the_internet.json deleted file mode 100644 index 2f7a8dbee7c80..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_microsoft_html_application_hta_connecting_to_the_internet.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows: Microsoft HTML Application (HTA) Connecting to the Internet", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows: Microsoft HTML Application (HTA) Connecting to the Internet", - "query": "process.name:mshta.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, - "rule_id": "b084514b-e8ba-4bc4-bc2b-50fe145a4215", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_mimikatz_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_mimikatz_activity.json deleted file mode 100644 index 64641bb539cb9..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_mimikatz_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Mimikatz activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Mimikatz activity", - "query": "event.code: 1 and process.name:mimikatz.exe", - "risk_score": 50, - "rule_id": "5346463d-062f-419d-88ff-7a5e97875210", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json index bb08cd4023e6a..8a4cb75588bff 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json @@ -1,20 +1,51 @@ { - "description": "Windows: Misc LOLBin Connecting to the Internet", + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows: Misc LOLBin Connecting to the Internet", + "max_signals": 33, + "name": "Network Connection via Signed Binary", "query": "(process.name:expand.exe or process.name:extrac.exe or process.name:ieexec.exe or process.name:makecab.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 21, "rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json index fce37db4fae3d..5b3257daec8fb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json @@ -1,20 +1,36 @@ { - "description": "Windows net command activity by the SYSTEM account", + "description": "Identifies attempts to create new users via the SYSTEM account.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows net command activity by the SYSTEM account", + "max_signals": 33, + "name": "Net command via SYSTEM account", "query": "process.name: (net.exe or net1.exe) and user.name:SYSTEM", - "risk_score": 50, + "risk_score": 21, "rule_id": "c3f5dc81-a8b4-4144-95a7-d0a818d7355d", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_user_command_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_user_command_activity.json deleted file mode 100644 index 555bb4afb0c10..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_user_command_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows net user command activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows net user command activity", - "query": "process.name:net.exe and process.args:user and event.code:1", - "risk_score": 50, - "rule_id": "b039a69d-7fba-4c84-8029-57ac12548a15", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_activity.json deleted file mode 100644 index 288bc6dd2375b..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Netcat activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Netcat activity", - "query": "process.name:ncat.exe and event.code:1", - "risk_score": 50, - "rule_id": "e2437364-0c89-4e65-a34b-782cfbb7690b", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_network_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_network_activity.json deleted file mode 100644 index a533cd36ffdcf..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_netcat_network_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Netcat network activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Netcat network activity", - "query": "process.name:ncat.exe and event.action:\"Network connection detected (rule: NetworkConnect)\"", - "risk_score": 50, - "rule_id": "ebdc4b6f-7fdb-4c21-bbd6-59e1ed11024a", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_network_anomalous_windows_process_using_https_ports.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_network_anomalous_windows_process_using_https_ports.json deleted file mode 100644 index 173e5191d9e65..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_network_anomalous_windows_process_using_https_ports.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Network - Anomalous Windows Process Using HTTP/S Ports", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Network - Anomalous Windows Process Using HTTP/S Ports", - "query": "(destination.port:443 or destination.port:80) and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16 and not process.name:chrome.exe and not process.name:explorer.exe and not process.name:filebeat.exe and not process.name:firefox.exe and not process.name:iexplore.exe and not process.name:jusched.exe and not process.name:MpCmdRun.exe and not process.name:MpSigStub.exe and not process.name:msfeedssync.exe and not process.name:packetbeat.exe and not process.name:powershell.exe and not process.name:procexp64.exe and not process.name:svchost.exe and not process.name:taskhostw.exe and not process.name:winlogbeat.exe", - "risk_score": 50, - "rule_id": "b486fa9e-e6c7-44a1-b07d-7d5f07f21ce1", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_activity.json deleted file mode 100644 index dc231e5edce1e..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows nmap activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows nmap activity", - "query": "process.name:nmap.exe and event.code:1", - "risk_score": 50, - "rule_id": "5a4b2a98-31a6-4852-b224-d63aeb9e172d", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_scan_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_scan_activity.json deleted file mode 100644 index ccd49169e6497..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_nmap_scan_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows nmap scan activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows nmap scan activity", - "query": "process.name:nmap.exe and event.action:\"Network connection detected (rule: NetworkConnect)\"", - "risk_score": 50, - "rule_id": "54413985-a3da-4f45-b238-75afb65a1bae", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_payload_obfuscation_via_certutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_payload_obfuscation_via_certutil.json deleted file mode 100644 index f7a331ca01474..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_payload_obfuscation_via_certutil.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Payload Obfuscation via Certutil", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Payload Obfuscation via Certutil", - "query": "event.code:1 and process.name:certutil.exe and (process.args:*encode* or process.args:*ToBase64String*)", - "risk_score": 50, - "rule_id": "ce7c270c-c69b-47dd-8c21-60a35e92f372", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_or_priv_escalation_via_hooking.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_or_priv_escalation_via_hooking.json deleted file mode 100644 index 379cab0f07438..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_or_priv_escalation_via_hooking.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Persistence or Priv Escalation via Hooking", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Persistence or Priv Escalation via Hooking", - "query": "event.code:1 and process.name:mavinject.exe and processs.args:*INJECTRUNNING*", - "risk_score": 50, - "rule_id": "015f070d-cf70-437c-99d1-472e31d36b03", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json index ca5daf772a22e..2c10382cdbc7c 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json @@ -1,20 +1,52 @@ { - "description": "Windows Persistence via Application Shimming", + "description": "The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Persistence via Application Shimming", + "max_signals": 33, + "name": "Potential Application Shimming via Sdbinst", "query": "event.code:1 and process.name:sdbinst.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1138", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1138/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1138", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1138/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_bits_jobs.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_bits_jobs.json deleted file mode 100644 index 4c6515f33fad0..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_bits_jobs.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Persistence via BITS Jobs", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Persistence via BITS Jobs", - "query": "event.code:1 and (process.name:bitsadmin.exe or process.args:*Start-BitsTransfer*)", - "risk_score": 50, - "rule_id": "7904fb20-172c-43fb-83e4-bfe27e3c702c", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_modification_of_existing_service.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_modification_of_existing_service.json deleted file mode 100644 index 01b56a1ecd1e0..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_modification_of_existing_service.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Persistence via Modification of Existing Service", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Persistence via Modification of Existing Service", - "query": "event.code:1 and process.args:*sc*config*binpath* and (process.name:cmd.exe or process.name:powershell.exe or process.name:sc.exe)", - "risk_score": 50, - "rule_id": "3bb04809-84ab-4487-bd99-ccc58675bd40", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_netshell_helper_dll.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_netshell_helper_dll.json deleted file mode 100644 index 50b31aa7033eb..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_netshell_helper_dll.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Persistence via Netshell Helper DLL", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Persistence via Netshell Helper DLL", - "query": "event.code:1 and process.name:netsh.exe and process.args:*helper*", - "risk_score": 50, - "rule_id": "d7c2561d-2758-46ad-b5a9-247efb9eea21", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_powershell_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_powershell_connecting_to_the_internet.json deleted file mode 100644 index 5198f85b999ac..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_powershell_connecting_to_the_internet.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows: Powershell Connecting to the Internet", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows: Powershell Connecting to the Internet", - "query": "process.name:powershell.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:169.254.169.254/32 and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, - "rule_id": "a8cfa646-e4d8-48b5-884e-6204ba77fc8d", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json index f24460373f55d..23d05aaf526e3 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json @@ -1,20 +1,52 @@ { - "description": "Windows Priv Escalation via Accessibility Features", + "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.", "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Priv Escalation via Accessibility Features", + "max_signals": 33, + "name": "Potential Modification of Accessibility Binaries", "query": "event.code:1 and process.parent.name:winlogon.exe and (process.name:atbroker.exe or process.name:displayswitch.exe or process.name:magnify.exe or process.name:narrator.exe or process.name:osk.exe or process.name:sethc.exe or process.name:utilman.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1015", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1015/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1015", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1015/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json index fd2bfcf216bf3..5f5215ddff8c6 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json @@ -1,20 +1,40 @@ { - "description": "Windows Process Discovery via Tasklist Command", + "description": "Adversaries may attempt to get information about running processes on a system.", + "false_positives": [ + "Administrators may use the tasklist command to display a list of currently running processes. By itself, it does not indicate malicious activity. After obtaining a foothold, it's possible adversaries may use discovery commands like tasklist to get information about running processes." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Process Discovery via Tasklist Command", + "max_signals": 33, + "name": "Process Discovery via Tasklist", "query": "event.code:1 and process.name:tasklist.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "cc16f774-59f9-462d-8b98-d27ccd4519ec", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "D-SA", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json index 1e14de81b7cb2..6d6343330a7ff 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json @@ -1,20 +1,39 @@ { - "description": "Process Execution via WMI", + "description": "Identifies use of scrcons.exe, which is a Windows Management Instrumentation (WMI) Standard Event Consumer scripting application.", + "false_positives": [ + " Windows Management Instrumentation (WMI) processes can be used for an array of administrative capabilities. It's important to baseline your environment to determine any abnormal use of this tool." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Process Execution via WMI", + "max_signals": 33, + "name": "Execution via Scrcons", "query": "process.name:scrcons.exe", - "risk_score": 50, + "risk_score": 21, "rule_id": "7e6cd4b9-6346-4683-b3e6-6a3e66f3208f", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_acrobat_reader_possible_payload.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_acrobat_reader_possible_payload.json deleted file mode 100644 index 973a7df57f712..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_acrobat_reader_possible_payload.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Process started by Acrobat reader - possible payload", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process started by Acrobat reader - possible payload", - "query": "process.parent.name:AcroRd32.exe and event.code:1", - "risk_score": 50, - "rule_id": "b6422896-b6e3-45c3-9d9e-4eccb2a25270", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_ms_office_program_possible_payload.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_ms_office_program_possible_payload.json deleted file mode 100644 index cb7b234c21f8c..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_ms_office_program_possible_payload.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Process started by MS Office program - possible payload", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Process started by MS Office program - possible payload", - "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE and event.code:1", - "risk_score": 50, - "rule_id": "838dcec6-ce9a-4cdd-9ca8-f6512cf6d559", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_the_java_runtime.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_the_java_runtime.json deleted file mode 100644 index c684be0732064..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_started_by_the_java_runtime.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows process started by the Java runtime", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows process started by the Java runtime", - "query": "process.parent.name:javaw.exe and event.code:1", - "risk_score": 50, - "rule_id": "159168a1-b1d0-4e5c-ad72-c1e9ae2edec2", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_psexec_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_psexec_activity.json deleted file mode 100644 index e4c91b6f89cd4..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_psexec_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "PSexec activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "PSexec activity", - "query": "process.name:PsExec.exe or process.name:PsExec64.exe", - "risk_score": 50, - "rule_id": "3e61ab8b-0f39-4d2e-ab64-332f0d0b3ad7", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json index a106eda988e94..b35e016be15d7 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json @@ -1,20 +1,54 @@ { - "description": "Windows: Register Server Program Connecting to the Internet", + "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows: Register Server Program Connecting to the Internet", + "max_signals": 33, + "name": "Network Connection via Regsvr", "query": "(process.name:regsvr32.exe or process.name:regsvr64.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:169.254.169.254/32 and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, + "risk_score": 21, "rule_id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1117", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1117/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1117", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1117/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_local.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_local.json deleted file mode 100644 index 49642d271d4ea..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_local.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Registry Query, Local", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Registry Query, Local", - "query": "event.code: 1 and process.name:reg.exe and process.args:*query* and process.args:*reg*", - "risk_score": 50, - "rule_id": "b9074c74-6d23-4b07-927e-cc18b318a088", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_network.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_network.json deleted file mode 100644 index 884deb7645a67..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_registry_query_network.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Registry Query, Network", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Registry Query, Network", - "query": "event.code: 1 and process.name:reg.exe and process.args:*query* and process.args:*reg*", - "risk_score": 50, - "rule_id": "f5412e37-981e-4d37-a1b2-eddaf797445a", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_remote_management_execution.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_remote_management_execution.json deleted file mode 100644 index 08d96ad741502..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_remote_management_execution.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Remote Management Execution", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Remote Management Execution", - "query": "(process.name:wsmprovhost.exe or process.name:winrm.cmd) and (process.args:*Enable-PSRemoting -Force* or process.args:*Invoke-Command -computer_name* or process.args:*wmic*node*process call create*)", - "risk_score": 50, - "rule_id": "ced66221-3e07-40ee-8588-5f107e7d50d8", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_scheduled_task_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_scheduled_task_activity.json deleted file mode 100644 index 56f5b71ceb510..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_scheduled_task_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Scheduled Task Activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Scheduled Task Activity", - "query": "event.code:1 and (process.name:schtasks.exe or process.name:taskeng.exe) or (event.code:1 and process.name:svchost.exe and not process.parent.executable: \"C:\\Windows\\System32\\services.exe\" )", - "risk_score": 50, - "rule_id": "a1abd54d-3021-4f21-b2d1-0c6bc5c4051f", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_script_interpreter_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_script_interpreter_connecting_to_the_internet.json deleted file mode 100644 index a700ac0a48bc2..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_script_interpreter_connecting_to_the_internet.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows: Script Interpreter Connecting to the Internet", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows: Script Interpreter Connecting to the Internet", - "query": "(process.name:cscript.exe or process.name:wscript.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16", - "risk_score": 50, - "rule_id": "2cc4597c-b0c9-4481-b1a6-e6c05cfc9f02", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json index 1dc62c7b5db42..cf5135cc490eb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json @@ -1,20 +1,54 @@ { - "description": "Windows Signed Binary Proxy Execution", + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Signed Binary Proxy Execution", + "max_signals": 33, + "name": "Execution via Signed Binary", "query": "event.code:1 and http and (process.name:certutil.exe or process.name:msiexec.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "7edb573f-1f9b-4161-8c19-c7c383bb17f2", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json index 717d99ee7901c..117a40d0fdcee 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json @@ -1,20 +1,54 @@ { - "description": "Windows Signed Binary Proxy Execution Download", + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows Signed Binary Proxy Execution Download", + "max_signals": 33, + "name": "Potential Download via Signed Binary", "query": " event.code:3 and http and (process.name:certutil.exe or process.name:replace.exe)", - "risk_score": 50, + "risk_score": 21, "rule_id": "68ecc190-cce2-4021-b976-c7c846ac0a00", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json index 82733cbb6b21c..3691c59d784fb 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json @@ -1,20 +1,54 @@ { - "description": "Suspicious process started by a script", + "description": "Identifies a suspicious process being spawned from a script interpreter, which could be indicative of a potential phishing attack.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Suspicious process started by a script", + "max_signals": 33, + "name": "Suspicious Process Spawning from Script Interpreter", "query": "(process.parent.name:cmd.exe or process.parent.name:cscript.exe or process.parent.name:mshta.exe or process.parent.name:powershell.exe or process.parent.name:rundll32.exe or process.parent.name:wscript.exe or process.parent.name:wmiprvse.exe) and (process.name:bitsadmin.exe or process.name:certutil.exe or mshta.exe or process.name:nslookup.exe or process.name:schtasks.exe) and event.code:1", - "risk_score": 50, + "risk_score": 21, "rule_id": "89db767d-99f9-479f-8052-9205fd3090c4", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1064", + "name": "Scripting", + "reference": "https://attack.mitre.org/techniques/T1064/" + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1064", + "name": "Scripting", + "reference": "https://attack.mitre.org/techniques/T1064/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json index 768cd65c5e4f5..3618d304dc32a 100644 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json +++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json @@ -1,20 +1,39 @@ { - "description": "Windows whoami command activity", + "description": "Identifies use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.", + "false_positives": [ + "Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual." + ], "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", "winlogbeat-*" ], "language": "kuery", - "name": "Windows whoami command activity", + "max_signals": 33, + "name": "Whoami Process Activity", "query": "process.name:whoami.exe and event.code:1", - "risk_score": 50, + "risk_score": 21, "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", "severity": "low", - "tags": ["Elastic"], + "tags": [ + "Elastic", + "Windows" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], "type": "query", "version": 1 } diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_windump_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_windump_activity.json deleted file mode 100644 index 4f33e95cfe2e9..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_windump_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "WinDump activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "WinDump activity", - "query": "process.name:WinDump.exe", - "risk_score": 50, - "rule_id": "a342cfcb-8420-46a4-8d85-53edc631e0d6", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_wireshark_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_wireshark_activity.json deleted file mode 100644 index 72db4aed03c88..0000000000000 --- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_wireshark_activity.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "description": "Windows Wireshark activity", - "index": [ - "apm-*-transaction*", - "auditbeat-*", - "endgame-*", - "filebeat-*", - "packetbeat-*", - "winlogbeat-*" - ], - "language": "kuery", - "name": "Windows Wireshark activity", - "query": "process.name:wireshark.exe", - "risk_score": 50, - "rule_id": "9af965ed-d501-4541-97f6-5f8d2a39737b", - "severity": "low", - "tags": ["Elastic"], - "type": "query", - "version": 1 -} From 1504e830ac866f9acd7d84683022875c6ce2eaa3 Mon Sep 17 00:00:00 2001 From: Matthias Wilhelm Date: Tue, 28 Jan 2020 05:36:12 +0100 Subject: [PATCH 74/77] Refactor saved object management registry usage (#54155) * Migrate registry to TypeScript * Migrate management code * Migrate SavedObjectLoader services registration to management section * Replace Angular SavedSearchLoader in transform plugin * Migrate saved_visualizations from visualize to visualizations plugin --- src/legacy/core_plugins/kibana/index.js | 1 - .../dashboard/__tests__/saved_dashboards.js | 36 --------- .../kibana/public/dashboard/index.ts | 1 + .../kibana/public/dashboard/legacy.ts | 1 - .../saved_dashboard_register.ts | 46 ----------- .../kibana/public/discover/build_services.ts | 4 +- .../kibana/public/discover/index.ts | 2 +- .../public/discover/saved_searches/index.ts | 1 - .../discover/saved_searches/saved_searches.ts | 2 +- .../saved_searches/saved_searches_register.ts | 43 ---------- .../management/saved_object_registry.js | 32 -------- .../management/saved_object_registry.ts | 80 +++++++++++++++++++ .../management/sections/objects/_objects.js | 2 +- .../management/sections/objects/_view.js | 13 +-- .../sections/objects/breadcrumbs.js | 4 +- .../kibana/public/visualize/index.ts | 3 +- .../visualize/np_ready/editor/editor.js | 1 - .../kibana/public/visualize/plugin.ts | 31 +------ .../core_plugins/timelion/public/app.js | 3 +- .../timelion/public/services/saved_sheets.ts | 9 --- .../visualize_embeddable_factory.tsx | 23 ++---- .../public/np_ready/public/index.ts | 2 + .../public/np_ready/public/mocks.ts | 1 + .../public/np_ready/public/plugin.ts | 27 ++++++- .../saved_visualizations/_saved_vis.ts | 12 +-- .../saved_visualizations/find_list_items.js | 0 .../find_list_items.test.js | 0 .../public}/saved_visualizations/index.ts | 2 +- .../saved_visualization_references.test.ts | 2 +- .../saved_visualization_references.ts | 4 +- .../saved_visualizations.ts | 14 ++-- .../legacy/plugins/transform/public/plugin.ts | 21 +++-- .../legacy/plugins/transform/public/shim.ts | 9 ++- 33 files changed, 164 insertions(+), 268 deletions(-) delete mode 100644 src/legacy/core_plugins/kibana/public/dashboard/__tests__/saved_dashboards.js delete mode 100644 src/legacy/core_plugins/kibana/public/dashboard/saved_dashboard/saved_dashboard_register.ts delete mode 100644 src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches_register.ts delete mode 100644 src/legacy/core_plugins/kibana/public/management/saved_object_registry.js create mode 100644 src/legacy/core_plugins/kibana/public/management/saved_object_registry.ts rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/_saved_vis.ts (92%) rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/find_list_items.js (100%) rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/find_list_items.test.js (100%) rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/index.ts (95%) rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/saved_visualization_references.test.ts (98%) rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/saved_visualization_references.ts (96%) rename src/legacy/core_plugins/{kibana/public/visualize => visualizations/public}/saved_visualizations/saved_visualizations.ts (85%) diff --git a/src/legacy/core_plugins/kibana/index.js b/src/legacy/core_plugins/kibana/index.js index 97729a3fce069..8e0497732e230 100644 --- a/src/legacy/core_plugins/kibana/index.js +++ b/src/legacy/core_plugins/kibana/index.js @@ -64,7 +64,6 @@ export default function(kibana) { 'plugins/kibana/visualize/legacy', 'plugins/kibana/dashboard/legacy', ], - savedObjectTypes: ['plugins/kibana/dashboard/saved_dashboard/saved_dashboard_register'], app: { id: 'kibana', title: 'Kibana', diff --git a/src/legacy/core_plugins/kibana/public/dashboard/__tests__/saved_dashboards.js b/src/legacy/core_plugins/kibana/public/dashboard/__tests__/saved_dashboards.js deleted file mode 100644 index b387467189385..0000000000000 --- a/src/legacy/core_plugins/kibana/public/dashboard/__tests__/saved_dashboards.js +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import ngMock from 'ng_mock'; -import expect from '@kbn/expect'; - -describe('SavedDashboards Service', function() { - let savedDashboardLoader; - - beforeEach(ngMock.module('kibana')); - beforeEach( - ngMock.inject(function(savedDashboards) { - savedDashboardLoader = savedDashboards; - }) - ); - - it('delete returns a native promise', function() { - expect(savedDashboardLoader.delete(['1', '2'])).to.be.a(Promise); - }); -}); diff --git a/src/legacy/core_plugins/kibana/public/dashboard/index.ts b/src/legacy/core_plugins/kibana/public/dashboard/index.ts index 4a8decab6b00e..d0157882689d3 100644 --- a/src/legacy/core_plugins/kibana/public/dashboard/index.ts +++ b/src/legacy/core_plugins/kibana/public/dashboard/index.ts @@ -21,6 +21,7 @@ import { PluginInitializerContext } from 'kibana/public'; import { DashboardPlugin } from './plugin'; export * from './np_ready/dashboard_constants'; +export { createSavedDashboardLoader } from './saved_dashboard/saved_dashboards'; // Core will be looking for this when loading our plugin in the new platform export const plugin = (context: PluginInitializerContext) => { diff --git a/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts b/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts index 068a8378f936a..acbc4c4b6c47f 100644 --- a/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts +++ b/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts @@ -22,7 +22,6 @@ import { npSetup, npStart, legacyChrome } from './legacy_imports'; import { LegacyAngularInjectedDependencies } from './plugin'; import { start as data } from '../../../data/public/legacy'; import { start as embeddables } from '../../../embeddable_api/public/np_ready/public/legacy'; -import './saved_dashboard/saved_dashboard_register'; import './dashboard_config'; import { plugin } from './index'; diff --git a/src/legacy/core_plugins/kibana/public/dashboard/saved_dashboard/saved_dashboard_register.ts b/src/legacy/core_plugins/kibana/public/dashboard/saved_dashboard/saved_dashboard_register.ts deleted file mode 100644 index b9ea49ca4fd44..0000000000000 --- a/src/legacy/core_plugins/kibana/public/dashboard/saved_dashboard/saved_dashboard_register.ts +++ /dev/null @@ -1,46 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -import { i18n } from '@kbn/i18n'; -import { npStart } from 'ui/new_platform'; -// @ts-ignore -import { uiModules } from 'ui/modules'; -// @ts-ignore -import { savedObjectManagementRegistry } from '../../management/saved_object_registry'; -import { createSavedDashboardLoader } from './saved_dashboards'; - -const module = uiModules.get('app/dashboard'); - -// Register this service with the saved object registry so it can be -// edited by the object editor. -savedObjectManagementRegistry.register({ - service: 'savedDashboards', - title: i18n.translate('kbn.dashboard.savedDashboardsTitle', { - defaultMessage: 'dashboards', - }), -}); - -// this is no longer used in the conroller, but just here for savedObjectManagementRegistry -module.service('savedDashboards', () => - createSavedDashboardLoader({ - savedObjectsClient: npStart.core.savedObjects.client, - indexPatterns: npStart.plugins.data.indexPatterns, - chrome: npStart.core.chrome, - overlays: npStart.core.overlays, - }) -); diff --git a/src/legacy/core_plugins/kibana/public/discover/build_services.ts b/src/legacy/core_plugins/kibana/public/discover/build_services.ts index 1fb8b4abb21c4..bc2436ecdf5ea 100644 --- a/src/legacy/core_plugins/kibana/public/discover/build_services.ts +++ b/src/legacy/core_plugins/kibana/public/discover/build_services.ts @@ -30,7 +30,7 @@ import { IndexPatternsContract, DataPublicPluginStart, } from 'src/plugins/data/public'; -import { createSavedSearchesService } from './saved_searches'; +import { createSavedSearchesLoader } from './saved_searches'; import { DiscoverStartPlugins } from './plugin'; import { EuiUtilsStart } from '../../../../../plugins/eui_utils/public'; import { SharePluginStart } from '../../../../../plugins/share/public'; @@ -68,7 +68,7 @@ export async function buildServices( chrome: core.chrome, overlays: core.overlays, }; - const savedObjectService = createSavedSearchesService(services); + const savedObjectService = createSavedSearchesLoader(services); return { addBasePath: core.http.basePath.prepend, capabilities: core.application.capabilities, diff --git a/src/legacy/core_plugins/kibana/public/discover/index.ts b/src/legacy/core_plugins/kibana/public/discover/index.ts index d851cb96a18c4..33b2ad4bf8171 100644 --- a/src/legacy/core_plugins/kibana/public/discover/index.ts +++ b/src/legacy/core_plugins/kibana/public/discover/index.ts @@ -20,7 +20,7 @@ import { PluginInitializerContext } from 'kibana/public'; import { DiscoverPlugin } from './plugin'; -export { createSavedSearchesService } from './saved_searches/saved_searches'; +export { createSavedSearchesLoader } from './saved_searches/saved_searches'; // Core will be looking for this when loading our plugin in the new platform export const plugin = (context: PluginInitializerContext) => { diff --git a/src/legacy/core_plugins/kibana/public/discover/saved_searches/index.ts b/src/legacy/core_plugins/kibana/public/discover/saved_searches/index.ts index 1dd99025b4b70..24832df308a3e 100644 --- a/src/legacy/core_plugins/kibana/public/discover/saved_searches/index.ts +++ b/src/legacy/core_plugins/kibana/public/discover/saved_searches/index.ts @@ -18,4 +18,3 @@ */ export * from './saved_searches'; -import './saved_searches_register'; diff --git a/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches.ts b/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches.ts index abd3d46820c18..0b34652461026 100644 --- a/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches.ts +++ b/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches.ts @@ -20,7 +20,7 @@ import { SavedObjectLoader } from 'ui/saved_objects'; import { SavedObjectKibanaServices } from 'ui/saved_objects/types'; import { createSavedSearchClass } from './_saved_search'; -export function createSavedSearchesService(services: SavedObjectKibanaServices) { +export function createSavedSearchesLoader(services: SavedObjectKibanaServices) { const SavedSearchClass = createSavedSearchClass(services); const savedSearchLoader = new SavedObjectLoader( SavedSearchClass, diff --git a/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches_register.ts b/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches_register.ts deleted file mode 100644 index ab7894fd5e730..0000000000000 --- a/src/legacy/core_plugins/kibana/public/discover/saved_searches/saved_searches_register.ts +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -import { npStart } from 'ui/new_platform'; -// @ts-ignore -import { uiModules } from 'ui/modules'; -// @ts-ignore -import { savedObjectManagementRegistry } from '../../management/saved_object_registry'; - -import { createSavedSearchesService } from './saved_searches'; - -// this is needed for saved object management -// Register this service with the saved object registry so it can be -// edited by the object editor. -savedObjectManagementRegistry.register({ - service: 'savedSearches', - title: 'searches', -}); -const services = { - savedObjectsClient: npStart.core.savedObjects.client, - indexPatterns: npStart.plugins.data.indexPatterns, - chrome: npStart.core.chrome, - overlays: npStart.core.overlays, -}; -const savedSearches = createSavedSearchesService(services); - -const module = uiModules.get('discover/saved_searches'); -module.service('savedSearches', () => savedSearches); diff --git a/src/legacy/core_plugins/kibana/public/management/saved_object_registry.js b/src/legacy/core_plugins/kibana/public/management/saved_object_registry.js deleted file mode 100644 index 978459dea7c2d..0000000000000 --- a/src/legacy/core_plugins/kibana/public/management/saved_object_registry.js +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import _ from 'lodash'; -const registry = []; -export const savedObjectManagementRegistry = { - register: function(service) { - registry.push(service); - }, - all: function() { - return registry; - }, - get: function(id) { - return _.find(registry, { service: id }); - }, -}; diff --git a/src/legacy/core_plugins/kibana/public/management/saved_object_registry.ts b/src/legacy/core_plugins/kibana/public/management/saved_object_registry.ts new file mode 100644 index 0000000000000..0a6ac20502669 --- /dev/null +++ b/src/legacy/core_plugins/kibana/public/management/saved_object_registry.ts @@ -0,0 +1,80 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import _ from 'lodash'; +import { i18n } from '@kbn/i18n'; +import { npStart } from 'ui/new_platform'; +import { SavedObjectLoader } from 'ui/saved_objects'; +import { createSavedDashboardLoader } from '../dashboard'; +import { createSavedSearchesLoader } from '../discover'; +import { TypesService, createSavedVisLoader } from '../../../visualizations/public'; + +/** + * This registry is used for the editing mode of Saved Searches, Visualizations, + * Dashboard and Time Lion saved objects. + */ +interface SavedObjectRegistryEntry { + id: string; + service: SavedObjectLoader; + title: string; +} + +const registry: SavedObjectRegistryEntry[] = []; + +export const savedObjectManagementRegistry = { + register: (service: SavedObjectRegistryEntry) => { + registry.push(service); + }, + all: () => { + return registry; + }, + get: (id: string) => { + return _.find(registry, { id }); + }, +}; + +const services = { + savedObjectsClient: npStart.core.savedObjects.client, + indexPatterns: npStart.plugins.data.indexPatterns, + chrome: npStart.core.chrome, + overlays: npStart.core.overlays, +}; + +savedObjectManagementRegistry.register({ + id: 'savedVisualizations', + service: createSavedVisLoader({ + ...services, + ...{ visualizationTypes: new TypesService().start() }, + }), + title: 'visualizations', +}); + +savedObjectManagementRegistry.register({ + id: 'savedDashboards', + service: createSavedDashboardLoader(services), + title: i18n.translate('kbn.dashboard.savedDashboardsTitle', { + defaultMessage: 'dashboards', + }), +}); + +savedObjectManagementRegistry.register({ + id: 'savedSearches', + service: createSavedSearchesLoader(services), + title: 'searches', +}); diff --git a/src/legacy/core_plugins/kibana/public/management/sections/objects/_objects.js b/src/legacy/core_plugins/kibana/public/management/sections/objects/_objects.js index c9698f6e1f48b..c16e4cb00c2bd 100644 --- a/src/legacy/core_plugins/kibana/public/management/sections/objects/_objects.js +++ b/src/legacy/core_plugins/kibana/public/management/sections/objects/_objects.js @@ -41,7 +41,7 @@ function updateObjectsTable($scope, $injector) { const confirmModalPromise = $injector.get('confirmModalPromise'); const savedObjectsClient = npStart.core.savedObjects.client; - const services = savedObjectManagementRegistry.all().map(obj => $injector.get(obj.service)); + const services = savedObjectManagementRegistry.all().map(obj => obj.service); const uiCapabilites = npStart.core.application.capabilities; $scope.$$postDigest(() => { diff --git a/src/legacy/core_plugins/kibana/public/management/sections/objects/_view.js b/src/legacy/core_plugins/kibana/public/management/sections/objects/_view.js index 540f25c63a861..3205e28fe2314 100644 --- a/src/legacy/core_plugins/kibana/public/management/sections/objects/_view.js +++ b/src/legacy/core_plugins/kibana/public/management/sections/objects/_view.js @@ -49,17 +49,9 @@ uiModules .directive('kbnManagementObjectsView', function(kbnIndex, confirmModal) { return { restrict: 'E', - controller: function( - $scope, - $injector, - $routeParams, - $location, - $window, - $rootScope, - uiCapabilities - ) { + controller: function($scope, $routeParams, $location, $window, $rootScope, uiCapabilities) { const serviceObj = savedObjectManagementRegistry.get($routeParams.service); - const service = $injector.get(serviceObj.service); + const service = serviceObj.service; const savedObjectsClient = npStart.core.savedObjects.client; /** @@ -184,6 +176,7 @@ uiModules return orderIndex > -1 ? orderIndex : Infinity; }); }); + $scope.$digest(); }) .catch(error => fatalError(error, location)); diff --git a/src/legacy/core_plugins/kibana/public/management/sections/objects/breadcrumbs.js b/src/legacy/core_plugins/kibana/public/management/sections/objects/breadcrumbs.js index 49e57a7c40b16..e9082bfeb680d 100644 --- a/src/legacy/core_plugins/kibana/public/management/sections/objects/breadcrumbs.js +++ b/src/legacy/core_plugins/kibana/public/management/sections/objects/breadcrumbs.js @@ -34,9 +34,9 @@ export function getIndexBreadcrumbs() { ]; } -export function getViewBreadcrumbs($routeParams, $injector) { +export function getViewBreadcrumbs($routeParams) { const serviceObj = savedObjectManagementRegistry.get($routeParams.service); - const service = $injector.get(serviceObj.service); + const { service } = serviceObj; return [ ...getIndexBreadcrumbs(), diff --git a/src/legacy/core_plugins/kibana/public/visualize/index.ts b/src/legacy/core_plugins/kibana/public/visualize/index.ts index a39779792b83a..e7170836cf749 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/index.ts +++ b/src/legacy/core_plugins/kibana/public/visualize/index.ts @@ -22,8 +22,7 @@ import { VisualizePlugin } from './plugin'; export * from './np_ready/visualize_constants'; export { showNewVisModal } from './np_ready/wizard'; - -export { createSavedVisLoader } from './saved_visualizations/saved_visualizations'; +export { VisualizeConstants, createVisualizeEditUrl } from './np_ready/visualize_constants'; // Core will be looking for this when loading our plugin in the new platform export const plugin = (context: PluginInitializerContext) => { diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js index 261e3331e4796..2a4fdeb4e4016 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js +++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js @@ -21,7 +21,6 @@ import angular from 'angular'; import _ from 'lodash'; import { Subscription } from 'rxjs'; import { i18n } from '@kbn/i18n'; -import '../../saved_visualizations/saved_visualizations'; import React from 'react'; import { FormattedMessage } from '@kbn/i18n/react'; diff --git a/src/legacy/core_plugins/kibana/public/visualize/plugin.ts b/src/legacy/core_plugins/kibana/public/visualize/plugin.ts index 998fd2e2d9161..26c6691a3613f 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/plugin.ts +++ b/src/legacy/core_plugins/kibana/public/visualize/plugin.ts @@ -27,9 +27,6 @@ import { SavedObjectsClientContract, } from 'kibana/public'; -// @ts-ignore -import { uiModules } from 'ui/modules'; - import { Storage } from '../../../../../plugins/kibana_utils/public'; import { DataPublicPluginStart } from '../../../../../plugins/data/public'; import { IEmbeddableStart } from '../../../../../plugins/embeddable/public'; @@ -44,9 +41,6 @@ import { HomePublicPluginSetup, } from '../../../../../plugins/home/public'; import { UsageCollectionSetup } from '../../../../../plugins/usage_collection/public'; -import { createSavedVisLoader } from './saved_visualizations/saved_visualizations'; -// @ts-ignore -import { savedObjectManagementRegistry } from '../management/saved_object_registry'; import { Chrome } from './legacy_imports'; export interface VisualizePluginStartDependencies { @@ -97,13 +91,6 @@ export class VisualizePlugin implements Plugin { share, } = this.startDependencies; - const savedVisualizations = createSavedVisLoader({ - savedObjectsClient, - indexPatterns: data.indexPatterns, - chrome: contextCore.chrome, - overlays: contextCore.overlays, - visualizations, - }); const deps: VisualizeKibanaServices = { ...__LEGACY, addBasePath: contextCore.http.basePath.prepend, @@ -116,7 +103,7 @@ export class VisualizePlugin implements Plugin { localStorage: new Storage(localStorage), navigation, savedObjectsClient, - savedVisualizations, + savedVisualizations: visualizations.getSavedVisualizationsLoader(), savedQueryService: data.query.savedQueries, share, toastNotifications: contextCore.notifications.toasts, @@ -158,21 +145,5 @@ export class VisualizePlugin implements Plugin { share, visualizations, }; - - const savedVisualizations = createSavedVisLoader({ - savedObjectsClient: core.savedObjects.client, - indexPatterns: data.indexPatterns, - chrome: core.chrome, - overlays: core.overlays, - visualizations, - }); - - // TODO: remove once savedobjectregistry is refactored - savedObjectManagementRegistry.register({ - service: 'savedVisualizations', - title: 'visualizations', - }); - - uiModules.get('app/visualize').service('savedVisualizations', () => savedVisualizations); } } diff --git a/src/legacy/core_plugins/timelion/public/app.js b/src/legacy/core_plugins/timelion/public/app.js index 084e497761e43..e9f8e3496acf4 100644 --- a/src/legacy/core_plugins/timelion/public/app.js +++ b/src/legacy/core_plugins/timelion/public/app.js @@ -43,7 +43,7 @@ import '../../data/public/legacy'; import './services/saved_sheet_register'; import rootTemplate from 'plugins/timelion/index.html'; -import { createSavedVisLoader } from '../../kibana/public/visualize'; +import { createSavedVisLoader, TypesService } from '../../visualizations/public'; require('plugins/timelion/directives/cells/cells'); require('plugins/timelion/directives/fixed_element'); @@ -131,6 +131,7 @@ app.controller('timelion', function( indexPatterns: npStart.plugins.data.indexPatterns, chrome: npStart.core.chrome, overlays: npStart.core.overlays, + visualizationTypes: new TypesService().start(), }); const timezone = Private(timezoneProvider)(); diff --git a/src/legacy/core_plugins/timelion/public/services/saved_sheets.ts b/src/legacy/core_plugins/timelion/public/services/saved_sheets.ts index df3898e3410dd..074431bf28da8 100644 --- a/src/legacy/core_plugins/timelion/public/services/saved_sheets.ts +++ b/src/legacy/core_plugins/timelion/public/services/saved_sheets.ts @@ -19,20 +19,11 @@ import { npStart } from 'ui/new_platform'; import { SavedObjectLoader } from 'ui/saved_objects'; // @ts-ignore -import { savedObjectManagementRegistry } from 'plugins/kibana/management/saved_object_registry'; -// @ts-ignore import { uiModules } from 'ui/modules'; import { createSavedSheetClass } from './_saved_sheet'; const module = uiModules.get('app/sheet'); -// Register this service with the saved object registry so it can be -// edited by the object editor. -savedObjectManagementRegistry.register({ - service: 'savedSheets', - title: 'sheets', -}); - const savedObjectsClient = npStart.core.savedObjects.client; const services = { savedObjectsClient, diff --git a/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx b/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx index 3f29f97afee48..e5836c1372068 100644 --- a/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx +++ b/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx @@ -18,17 +18,14 @@ */ import { i18n } from '@kbn/i18n'; - -import chrome from 'ui/chrome'; - -import { SavedObjectAttributes } from 'kibana/server'; +import { SavedObjectAttributes } from 'kibana/public'; import { EmbeddableFactory, ErrorEmbeddable, Container, EmbeddableOutput, } from '../../../../../plugins/embeddable/public'; -import { showNewVisModal } from '../../../kibana/public/visualize/np_ready/wizard/show_new_vis'; +import { showNewVisModal } from '../../../kibana/public/visualize'; import { SavedVisualizations } from '../../../kibana/public/visualize/np_ready/types'; import { DisabledLabEmbeddable } from './disabled_lab_embeddable'; import { getIndexPattern } from './get_index_pattern'; @@ -61,11 +58,7 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory< > { public readonly type = VISUALIZE_EMBEDDABLE_TYPE; - static async createVisualizeEmbeddableFactory(): Promise { - return new VisualizeEmbeddableFactory(); - } - - constructor() { + constructor(private getSavedVisualizationsLoader: () => SavedVisualizations) { super({ savedObjectMetaData: { name: i18n.translate('visualizations.savedObjectName', { defaultMessage: 'Visualization' }), @@ -111,8 +104,7 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory< input: Partial & { id: string }, parent?: Container ): Promise { - const $injector = await chrome.dangerouslyGetActiveInjector(); - const savedVisualizations = $injector.get('savedVisualizations'); + const savedVisualizations = this.getSavedVisualizationsLoader(); try { const visId = savedObject.id as string; @@ -151,13 +143,10 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory< input: Partial & { id: string }, parent?: Container ): Promise { - const $injector = await chrome.dangerouslyGetActiveInjector(); - const savedVisualizations = $injector.get('savedVisualizations'); + const savedVisualizations = this.getSavedVisualizationsLoader(); try { - const visId = savedObjectId; - - const savedObject = await savedVisualizations.get(visId); + const savedObject = await savedVisualizations.get(savedObjectId); return this.createFromObject(savedObject, input, parent); } catch (e) { console.error(e); // eslint-disable-line no-console diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts index 29ff812b95473..4dffcb8ce995e 100644 --- a/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts +++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts @@ -45,6 +45,7 @@ export function plugin(initializerContext: PluginInitializerContext) { /** @public static code */ export { Vis, VisParams, VisState } from './vis'; export * from './filters'; +export { TypesService } from './types/types_service'; export { Status } from './legacy/update_status'; export { buildPipeline, buildVislibDimensions, SchemaConfig } from './legacy/build_pipeline'; @@ -54,3 +55,4 @@ export { updateOldState } from './legacy/vis_update_state'; export { calculateObjectHash } from './legacy/calculate_object_hash'; // @ts-ignore export { createFiltersFromEvent } from './filters/vis_filters'; +export { createSavedVisLoader } from '../../saved_visualizations/saved_visualizations'; diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts index 2fa85d86a794e..4c1783408708a 100644 --- a/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts +++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts @@ -48,6 +48,7 @@ const createStartContract = (): VisualizationsStart => ({ all: jest.fn(), getAliases: jest.fn(), }, + getSavedVisualizationsLoader: jest.fn(), }); const createInstance = async () => { diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts index cfd22f88167c5..01059044b98c2 100644 --- a/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts +++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts @@ -38,6 +38,11 @@ import { visualization as visualizationFunction } from './expressions/visualizat import { visualization as visualizationRenderer } from './expressions/visualization_renderer'; import { DataPublicPluginStart } from '../../../../../../plugins/data/public'; import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/public'; +import { + createSavedVisLoader, + SavedObjectKibanaServicesWithVisualizations, +} from '../../saved_visualizations'; +import { SavedVisualizations } from '../../../../kibana/public/visualize/np_ready/types'; /** * Interface for this plugin's returned setup/start contracts. * @@ -47,9 +52,9 @@ export interface VisualizationsSetup { types: TypesSetup; } -// eslint-disable-next-line @typescript-eslint/no-empty-interface export interface VisualizationsStart { types: TypesStart; + getSavedVisualizationsLoader: () => SavedVisualizations; } export interface VisualizationsSetupDeps { @@ -79,6 +84,8 @@ export class VisualizationsPlugin VisualizationsStartDeps > { private readonly types: TypesService = new TypesService(); + private savedVisualizations?: SavedVisualizations; + private savedVisualizationDependencies?: SavedObjectKibanaServicesWithVisualizations; constructor(initializerContext: PluginInitializerContext) {} @@ -92,7 +99,7 @@ export class VisualizationsPlugin expressions.registerFunction(visualizationFunction); expressions.registerRenderer(visualizationRenderer); - const embeddableFactory = new VisualizeEmbeddableFactory(); + const embeddableFactory = new VisualizeEmbeddableFactory(this.getSavedVisualizationsLoader); embeddable.registerEmbeddableFactory(VISUALIZE_EMBEDDABLE_TYPE, embeddableFactory); return { @@ -110,12 +117,28 @@ export class VisualizationsPlugin setIndexPatterns(data.indexPatterns); setFilterManager(data.query.filterManager); + this.savedVisualizationDependencies = { + savedObjectsClient: core.savedObjects.client, + indexPatterns: data.indexPatterns, + chrome: core.chrome, + overlays: core.overlays, + visualizationTypes: types, + }; + return { types, + getSavedVisualizationsLoader: () => this.getSavedVisualizationsLoader(), }; } public stop() { this.types.stop(); } + + private getSavedVisualizationsLoader = () => { + if (!this.savedVisualizations) { + this.savedVisualizations = createSavedVisLoader(this.savedVisualizationDependencies!); + } + return this.savedVisualizations; + }; } diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/_saved_vis.ts b/src/legacy/core_plugins/visualizations/public/saved_visualizations/_saved_vis.ts similarity index 92% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/_saved_vis.ts rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/_saved_vis.ts index a0a6f8ea1c8a2..b501c8b68484f 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/_saved_vis.ts +++ b/src/legacy/core_plugins/visualizations/public/saved_visualizations/_saved_vis.ts @@ -28,13 +28,13 @@ import { Vis } from 'ui/vis'; import { SavedObject, SavedObjectKibanaServices } from 'ui/saved_objects/types'; import { createSavedObjectClass } from 'ui/saved_objects/saved_object'; -import { updateOldState } from '../../../../visualizations/public'; +import { updateOldState } from '../index'; import { extractReferences, injectReferences } from './saved_visualization_references'; -import { IIndexPattern } from '../../../../../../plugins/data/public'; -import { VisSavedObject } from '../legacy_imports'; +import { IIndexPattern } from '../../../../../plugins/data/public'; +import { VisSavedObject } from '../embeddable/visualize_embeddable'; -import { createSavedSearchesService } from '../../discover'; -import { VisualizeConstants } from '../np_ready/visualize_constants'; +import { createSavedSearchesLoader } from '../../../kibana/public/discover'; +import { VisualizeConstants } from '../../../kibana/public/visualize'; async function _afterEsResp(savedVis: VisSavedObject, services: any) { await _getLinkedSavedSearch(savedVis, services); @@ -56,7 +56,7 @@ async function _getLinkedSavedSearch(savedVis: VisSavedObject, services: any) { savedVis.savedSearch.destroy(); delete savedVis.savedSearch; } - const savedSearches = createSavedSearchesService(services); + const savedSearches = createSavedSearchesLoader(services); if (linkedSearch) { savedVis.savedSearch = await savedSearches.get(savedVis.savedSearchId!); diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/find_list_items.js b/src/legacy/core_plugins/visualizations/public/saved_visualizations/find_list_items.js similarity index 100% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/find_list_items.js rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/find_list_items.js diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/find_list_items.test.js b/src/legacy/core_plugins/visualizations/public/saved_visualizations/find_list_items.test.js similarity index 100% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/find_list_items.test.js rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/find_list_items.test.js diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/index.ts b/src/legacy/core_plugins/visualizations/public/saved_visualizations/index.ts similarity index 95% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/index.ts rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/index.ts index 62bf106adc0d0..cba68feca81f7 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/index.ts +++ b/src/legacy/core_plugins/visualizations/public/saved_visualizations/index.ts @@ -17,4 +17,4 @@ * under the License. */ -import './saved_visualizations'; +export * from './saved_visualizations'; diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualization_references.test.ts b/src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualization_references.test.ts similarity index 98% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualization_references.test.ts rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualization_references.test.ts index 98f5458d5eecc..6549b317d1634 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualization_references.test.ts +++ b/src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualization_references.test.ts @@ -18,7 +18,7 @@ */ import { extractReferences, injectReferences } from './saved_visualization_references'; -import { VisSavedObject } from '../../../../visualizations/public/embeddable/visualize_embeddable'; +import { VisSavedObject } from '../embeddable/visualize_embeddable'; describe('extractReferences', () => { test('extracts nothing if savedSearchId is empty', () => { diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualization_references.ts b/src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualization_references.ts similarity index 96% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualization_references.ts rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualization_references.ts index 403e9c5a8172d..330f5e2dacd10 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualization_references.ts +++ b/src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualization_references.ts @@ -16,8 +16,8 @@ * specific language governing permissions and limitations * under the License. */ -import { SavedObjectAttributes, SavedObjectReference } from 'kibana/server'; -import { VisSavedObject } from '../../../../visualizations/public/embeddable/visualize_embeddable'; +import { SavedObjectAttributes, SavedObjectReference } from 'kibana/public'; +import { VisSavedObject } from '../embeddable/visualize_embeddable'; export function extractReferences({ attributes, diff --git a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualizations.ts b/src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualizations.ts similarity index 85% rename from src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualizations.ts rename to src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualizations.ts index d51fae7428939..4b2a8e27c0208 100644 --- a/src/legacy/core_plugins/kibana/public/visualize/saved_visualizations/saved_visualizations.ts +++ b/src/legacy/core_plugins/visualizations/public/saved_visualizations/saved_visualizations.ts @@ -22,19 +22,19 @@ import { SavedObjectKibanaServices } from 'ui/saved_objects/types'; // @ts-ignore import { findListItems } from './find_list_items'; import { createSavedVisClass } from './_saved_vis'; -import { createVisualizeEditUrl } from '../np_ready/visualize_constants'; -import { VisualizationsStart } from '../../../../visualizations/public/np_ready/public'; +import { createVisualizeEditUrl } from '../../../kibana/public/visualize'; +import { TypesStart } from '../np_ready/public/types'; -interface SavedObjectKibanaServicesWithVisualizations extends SavedObjectKibanaServices { - visualizations: VisualizationsStart; +export interface SavedObjectKibanaServicesWithVisualizations extends SavedObjectKibanaServices { + visualizationTypes: TypesStart; } export function createSavedVisLoader(services: SavedObjectKibanaServicesWithVisualizations) { - const { savedObjectsClient, visualizations } = services; + const { savedObjectsClient, visualizationTypes } = services; class SavedObjectLoaderVisualize extends SavedObjectLoader { mapHitSource = (source: Record, id: string) => { - const visTypes = visualizations.types; + const visTypes = visualizationTypes; source.id = id; source.url = this.urlFor(id); @@ -72,7 +72,7 @@ export function createSavedVisLoader(services: SavedObjectKibanaServicesWithVisu size, mapSavedObjectApiHits: this.mapSavedObjectApiHits.bind(this), savedObjectsClient, - visTypes: visualizations.types.getAliases(), + visTypes: visualizationTypes.getAliases(), }); } } diff --git a/x-pack/legacy/plugins/transform/public/plugin.ts b/x-pack/legacy/plugins/transform/public/plugin.ts index 5d1c39add4ff6..3b02d07b8c150 100644 --- a/x-pack/legacy/plugins/transform/public/plugin.ts +++ b/x-pack/legacy/plugins/transform/public/plugin.ts @@ -4,11 +4,7 @@ * you may not use this file except in compliance with the Elastic License. */ import { unmountComponentAtNode } from 'react-dom'; - import { i18n } from '@kbn/i18n'; - -import { SavedSearchLoader } from '../../../../../src/legacy/core_plugins/kibana/public/discover/np_ready/types'; - import { PLUGIN } from '../common/constants'; import { CLIENT_BASE_PATH } from './app/constants'; import { renderReact } from './app/app'; @@ -19,6 +15,7 @@ import { documentationLinksService } from './app/services/documentation'; import { httpService } from './app/services/http'; import { textService } from './app/services/text'; import { uiMetricService } from './app/services/ui_metric'; +import { createSavedSearchesLoader } from '../../../../../src/legacy/core_plugins/kibana/public/discover/saved_searches'; const REACT_ROOT_ID = 'transformReactRoot'; const KBN_MANAGEMENT_SECTION = 'elasticsearch/transform'; @@ -36,12 +33,13 @@ export class Plugin { docTitle, uiSettings, savedObjects, + overlays, } = core; const { management, savedSearches: coreSavedSearches, uiMetric } = plugins; // AppCore/AppPlugins to be passed on as React context const AppDependencies = { - core: { chrome, http, i18n: core.i18n, uiSettings, savedObjects }, + core: { chrome, http, i18n: core.i18n, uiSettings, savedObjects, overlays }, plugins: { management: { sections: management.sections }, savedSearches: coreSavedSearches, @@ -77,12 +75,13 @@ export class Plugin { routing.registerAngularRoute(`${CLIENT_BASE_PATH}/:section?/:subsection?/:view?/:id?`, { template, controllerAs: 'transformController', - controller: ( - $scope: any, - $route: any, - $http: ng.IHttpService, - savedSearches: SavedSearchLoader - ) => { + controller: ($scope: any, $route: any, $http: ng.IHttpService) => { + const savedSearches = createSavedSearchesLoader({ + savedObjectsClient: core.savedObjects.client, + indexPatterns: plugins.data.indexPatterns, + chrome: core.chrome, + overlays: core.overlays, + }); // NOTE: We depend upon Angular's $http service because it's decorated with interceptors, // e.g. to check license status per request. legacyHttp.setClient($http); diff --git a/x-pack/legacy/plugins/transform/public/shim.ts b/x-pack/legacy/plugins/transform/public/shim.ts index d739dd2edddcc..758cc90210579 100644 --- a/x-pack/legacy/plugins/transform/public/shim.ts +++ b/x-pack/legacy/plugins/transform/public/shim.ts @@ -9,16 +9,21 @@ import { npStart } from 'ui/new_platform'; import { management, MANAGEMENT_BREADCRUMB } from 'ui/management'; import routes from 'ui/routes'; import { docTitle } from 'ui/doc_title/doc_title'; +import { CoreStart } from 'kibana/public'; // @ts-ignore: allow traversal to fail on x-pack build import { createUiStatsReporter } from '../../../../../src/legacy/core_plugins/ui_metric/public'; import { SavedSearchLoader } from '../../../../../src/legacy/core_plugins/kibana/public/discover/np_ready/types'; +import { DataPublicPluginStart } from '../../../../../src/plugins/data/public'; export type npCore = typeof npStart.core; // AppCore/AppPlugins is the set of core features/plugins // we pass on via context/hooks to the app and its components. -export type AppCore = Pick; +export type AppCore = Pick< + CoreStart, + 'chrome' | 'http' | 'i18n' | 'savedObjects' | 'uiSettings' | 'overlays' +>; export interface AppPlugins { management: { @@ -64,6 +69,7 @@ export interface Plugins extends AppPlugins { uiMetric: { createUiStatsReporter: typeof createUiStatsReporter; }; + data: DataPublicPluginStart; } export function createPublicShim(): { core: Core; plugins: Plugins } { @@ -101,6 +107,7 @@ export function createPublicShim(): { core: Core; plugins: Plugins } { }, }, plugins: { + data: npStart.plugins.data, management: { sections: management, constants: { From 3db8cb34b09f0649e0cba0e5cdf17374f745db5b Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Mon, 27 Jan 2020 21:03:06 -0800 Subject: [PATCH 75/77] [docs] Remove unused callout (#56032) --- docs/api/saved-objects/import.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api/saved-objects/import.asciidoc b/docs/api/saved-objects/import.asciidoc index 5b4c5016be4ed..1a380830ed21a 100644 --- a/docs/api/saved-objects/import.asciidoc +++ b/docs/api/saved-objects/import.asciidoc @@ -57,7 +57,7 @@ Import an index pattern and dashboard: [source,js] -------------------------------------------------- -$ curl -X POST "localhost:5601/api/saved_objects/_import" -H "kbn-xsrf: true" --form file=@file.ndjson <1> +$ curl -X POST "localhost:5601/api/saved_objects/_import" -H "kbn-xsrf: true" --form file=@file.ndjson -------------------------------------------------- The `file.ndjson` file contains the following: From fc10fb6b4fc4d5073a1861577a5d643ff321bb3f Mon Sep 17 00:00:00 2001 From: MadameSheema Date: Tue, 28 Jan 2020 10:04:41 +0100 Subject: [PATCH 76/77] [SIEM] Fields browser readable (#56000) * extracts methods to tasks * uses cypress api for assertions * refactor * removes tag --- .../integration/lib/fields_browser/helpers.ts | 8 +- .../integration/lib/timeline/selectors.ts | 3 + .../fields_browser/fields_browser.spec.ts | 136 +++++++----------- .../cypress/screens/hosts/fields_browser.ts | 2 - .../screens/timeline/fields_browser.ts | 60 ++++++++ .../siem/cypress/screens/timeline/main.ts | 18 +++ .../cypress/tasks/timeline/fields_browser.ts | 61 ++++++++ .../siem/cypress/tasks/timeline/main.ts | 31 ++++ 8 files changed, 227 insertions(+), 92 deletions(-) create mode 100644 x-pack/legacy/plugins/siem/cypress/screens/timeline/fields_browser.ts create mode 100644 x-pack/legacy/plugins/siem/cypress/screens/timeline/main.ts create mode 100644 x-pack/legacy/plugins/siem/cypress/tasks/timeline/fields_browser.ts create mode 100644 x-pack/legacy/plugins/siem/cypress/tasks/timeline/main.ts diff --git a/x-pack/legacy/plugins/siem/cypress/integration/lib/fields_browser/helpers.ts b/x-pack/legacy/plugins/siem/cypress/integration/lib/fields_browser/helpers.ts index 405c8eb34d6fc..b02eda513cba3 100644 --- a/x-pack/legacy/plugins/siem/cypress/integration/lib/fields_browser/helpers.ts +++ b/x-pack/legacy/plugins/siem/cypress/integration/lib/fields_browser/helpers.ts @@ -4,18 +4,14 @@ * you may not use this file except in compliance with the Elastic License. */ -import { - FIELDS_BROWSER_CONTAINER, - FIELDS_BROWSER_FILTER_INPUT, - TIMELINE_FIELDS_BUTTON, -} from './selectors'; +import { FIELDS_BROWSER_CONTAINER, FIELDS_BROWSER_FILTER_INPUT } from './selectors'; import { assertAtLeastOneEventMatchesSearch, executeKQL, hostExistsQuery, toggleTimelineVisibility, } from '../timeline/helpers'; -import { TIMELINE_DATA_PROVIDERS } from '../timeline/selectors'; +import { TIMELINE_DATA_PROVIDERS, TIMELINE_FIELDS_BUTTON } from '../timeline/selectors'; /** Opens the timeline's Field Browser */ export const openTimelineFieldsBrowser = () => { diff --git a/x-pack/legacy/plugins/siem/cypress/integration/lib/timeline/selectors.ts b/x-pack/legacy/plugins/siem/cypress/integration/lib/timeline/selectors.ts index 0ec0c506cbb1a..5515c1f7d58e2 100644 --- a/x-pack/legacy/plugins/siem/cypress/integration/lib/timeline/selectors.ts +++ b/x-pack/legacy/plugins/siem/cypress/integration/lib/timeline/selectors.ts @@ -7,6 +7,9 @@ /** A data provider rendered in the timeline's data providers drop area */ export const DATA_PROVIDER = '[data-test-subj="providerContainer"]'; +export const TIMELINE_FIELDS_BUTTON = + '[data-test-subj="timeline"] [data-test-subj="show-field-browser"]'; + /** Data providers are dropped and rendered in this area of the timeline */ export const TIMELINE_DATA_PROVIDERS = '[data-test-subj="dataProviders"]'; diff --git a/x-pack/legacy/plugins/siem/cypress/integration/smoke_tests/fields_browser/fields_browser.spec.ts b/x-pack/legacy/plugins/siem/cypress/integration/smoke_tests/fields_browser/fields_browser.spec.ts index d1289732b6d7d..2889d78891a06 100644 --- a/x-pack/legacy/plugins/siem/cypress/integration/smoke_tests/fields_browser/fields_browser.spec.ts +++ b/x-pack/legacy/plugins/siem/cypress/integration/smoke_tests/fields_browser/fields_browser.spec.ts @@ -4,27 +4,40 @@ * you may not use this file except in compliance with the Elastic License. */ -import { drag, drop } from '../../lib/drag_n_drop/helpers'; -import { - clearFieldsBrowser, - clickOutsideFieldsBrowser, - openTimelineFieldsBrowser, - populateTimeline, - filterFieldsBrowser, -} from '../../lib/fields_browser/helpers'; +import { HOSTS_PAGE } from '../../lib/urls'; + +import { loginAndWaitForPage, DEFAULT_TIMEOUT } from '../../../tasks/login'; + import { + FIELDS_BROWSER_TITLE, + FIELDS_BROWSER_SELECTED_CATEGORY_TITLE, + FIELDS_BROWSER_SELECTED_CATEGORY_COUNT, FIELDS_BROWSER_CATEGORIES_COUNT, - FIELDS_BROWSER_CONTAINER, - FIELDS_BROWSER_FIELDS_COUNT, - FIELDS_BROWSER_FILTER_INPUT, FIELDS_BROWSER_HOST_CATEGORIES_COUNT, - FIELDS_BROWSER_SELECTED_CATEGORY_COUNT, - FIELDS_BROWSER_SELECTED_CATEGORY_TITLE, FIELDS_BROWSER_SYSTEM_CATEGORIES_COUNT, - FIELDS_BROWSER_TITLE, -} from '../../lib/fields_browser/selectors'; -import { HOSTS_PAGE } from '../../lib/urls'; -import { loginAndWaitForPage, DEFAULT_TIMEOUT } from '../../lib/util/helpers'; + FIELDS_BROWSER_FIELDS_COUNT, + FIELDS_BROWSER_MESSAGE_HEADER, + FIELDS_BROWSER_HOST_GEO_CITY_NAME_HEADER, + FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_HEADER, + FIELDS_BROWSER_HEADER_HOST_GEO_CONTINENT_NAME_HEADER, +} from '../../../screens/timeline/fields_browser'; + +import { + openTimeline, + populateTimeline, + openTimelineFieldsBrowser, +} from '../../../tasks/timeline/main'; + +import { + clearFieldsBrowser, + filterFieldsBrowser, + closeFieldsBrowser, + removesMessageField, + addsHostGeoCityNameToTimeline, + addsHostGeoCountryNameToTimelineDraggingIt, + addsHostGeoContinentNameToTimeline, + resetFields, +} from '../../../tasks/timeline/fields_browser'; const defaultHeaders = [ { id: '@timestamp' }, @@ -41,6 +54,7 @@ describe('Fields Browser', () => { context('Fields Browser rendering', () => { before(() => { loginAndWaitForPage(HOSTS_PAGE); + openTimeline(); populateTimeline(); openTimelineFieldsBrowser(); }); @@ -78,7 +92,7 @@ describe('Fields Browser', () => { filterFieldsBrowser(filterInput); - cy.get(FIELDS_BROWSER_CATEGORIES_COUNT) + cy.get(FIELDS_BROWSER_CATEGORIES_COUNT, { timeout: DEFAULT_TIMEOUT }) .invoke('text') .should('eq', '2 categories'); }); @@ -88,18 +102,13 @@ describe('Fields Browser', () => { filterFieldsBrowser(filterInput); - cy.get(FIELDS_BROWSER_FILTER_INPUT, { timeout: DEFAULT_TIMEOUT }).should( - 'not.have.class', - 'euiFieldSearch-isLoading' - ); - cy.get(FIELDS_BROWSER_HOST_CATEGORIES_COUNT) .invoke('text') .then(hostCategoriesCount => { cy.get(FIELDS_BROWSER_SYSTEM_CATEGORIES_COUNT) .invoke('text') .then(systemCategoriesCount => { - cy.get(FIELDS_BROWSER_FIELDS_COUNT) + cy.get(FIELDS_BROWSER_FIELDS_COUNT, { timeout: DEFAULT_TIMEOUT }) .invoke('text') .should('eq', `${+hostCategoriesCount + +systemCategoriesCount} fields`); }); @@ -120,6 +129,7 @@ describe('Fields Browser', () => { context('Editing the timeline', () => { before(() => { loginAndWaitForPage(HOSTS_PAGE); + openTimeline(); populateTimeline(); openTimelineFieldsBrowser(); }); @@ -130,31 +140,17 @@ describe('Fields Browser', () => { }); it('removes the message field from the timeline when the user un-checks the field', () => { - const toggleField = 'message'; - - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'exist' - ); + cy.get(FIELDS_BROWSER_MESSAGE_HEADER).should('exist'); - cy.get( - `[data-test-subj="timeline"] [data-test-subj="field-${toggleField}-checkbox"]` - ).uncheck({ - force: true, - }); + removesMessageField(); + closeFieldsBrowser(); - clickOutsideFieldsBrowser(); - - cy.get(FIELDS_BROWSER_CONTAINER).should('not.exist'); - - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'not.exist' - ); + cy.get(FIELDS_BROWSER_MESSAGE_HEADER).should('not.exist'); }); it('selects a search results label with the expected count of categories matching the filter input', () => { const category = 'host'; - - filterFieldsBrowser(`${category}.`); + filterFieldsBrowser(category); cy.get(FIELDS_BROWSER_SELECTED_CATEGORY_TITLE) .invoke('text') @@ -163,75 +159,47 @@ describe('Fields Browser', () => { it('adds a field to the timeline when the user clicks the checkbox', () => { const filterInput = 'host.geo.c'; - const toggleField = 'host.geo.city_name'; filterFieldsBrowser(filterInput); + cy.get(FIELDS_BROWSER_HOST_GEO_CITY_NAME_HEADER).should('not.exist'); + addsHostGeoCityNameToTimeline(); + closeFieldsBrowser(); - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'not.exist' - ); - - cy.get(`[data-test-subj="timeline"] [data-test-subj="field-${toggleField}-checkbox"]`).check({ - force: true, - }); - - clickOutsideFieldsBrowser(); - - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`, { + cy.get(FIELDS_BROWSER_HOST_GEO_CITY_NAME_HEADER, { timeout: DEFAULT_TIMEOUT, }).should('exist'); }); it('adds a field to the timeline when the user drags and drops a field', () => { const filterInput = 'host.geo.c'; - const toggleField = 'host.geo.country_name'; filterFieldsBrowser(filterInput); - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'not.exist' - ); - - cy.get( - `[data-test-subj="timeline"] [data-test-subj="field-name-${toggleField}"]` - ).then(field => drag(field)); + cy.get(FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_HEADER).should('not.exist'); - cy.get(`[data-test-subj="timeline"] [data-test-subj="headers-group"]`).then(headersDropArea => - drop(headersDropArea) - ); + addsHostGeoCountryNameToTimelineDraggingIt(); - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`, { + cy.get(FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_HEADER, { timeout: DEFAULT_TIMEOUT, }).should('exist'); }); it('resets all fields in the timeline when `Reset Fields` is clicked', () => { const filterInput = 'host.geo.c'; - const toggleField = 'host.geo.continent_name'; filterFieldsBrowser(filterInput); - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'not.exist' - ); - - cy.get(`[data-test-subj="timeline"] [data-test-subj="field-${toggleField}-checkbox"]`).check({ - force: true, - }); + cy.get(FIELDS_BROWSER_HEADER_HOST_GEO_CONTINENT_NAME_HEADER).should('not.exist'); - clickOutsideFieldsBrowser(); + addsHostGeoContinentNameToTimeline(); + closeFieldsBrowser(); - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'exist' - ); + cy.get(FIELDS_BROWSER_HEADER_HOST_GEO_CONTINENT_NAME_HEADER).should('exist'); openTimelineFieldsBrowser(); + resetFields(); - cy.get('[data-test-subj="timeline"] [data-test-subj="reset-fields"]').click({ force: true }); - - cy.get(`[data-test-subj="timeline"] [data-test-subj="header-text-${toggleField}"]`).should( - 'not.exist' - ); + cy.get(FIELDS_BROWSER_HEADER_HOST_GEO_CONTINENT_NAME_HEADER).should('not.exist'); }); }); }); diff --git a/x-pack/legacy/plugins/siem/cypress/screens/hosts/fields_browser.ts b/x-pack/legacy/plugins/siem/cypress/screens/hosts/fields_browser.ts index f4da73ba5e5f9..252fa7d44a7c7 100644 --- a/x-pack/legacy/plugins/siem/cypress/screens/hosts/fields_browser.ts +++ b/x-pack/legacy/plugins/siem/cypress/screens/hosts/fields_browser.ts @@ -5,8 +5,6 @@ */ /** Clicking this button in the timeline opens the Fields browser */ -export const TIMELINE_FIELDS_BUTTON = - '[data-test-subj="timeline"] [data-test-subj="show-field-browser"]'; /** The title displayed in the fields browser (i.e. Customize Columns) */ export const FIELDS_BROWSER_TITLE = '[data-test-subj="field-browser-title"]'; diff --git a/x-pack/legacy/plugins/siem/cypress/screens/timeline/fields_browser.ts b/x-pack/legacy/plugins/siem/cypress/screens/timeline/fields_browser.ts new file mode 100644 index 0000000000000..aa63aaf89f98b --- /dev/null +++ b/x-pack/legacy/plugins/siem/cypress/screens/timeline/fields_browser.ts @@ -0,0 +1,60 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +export const FIELDS_BROWSER_TITLE = '[data-test-subj="field-browser-title"]'; + +/** Typing in this input filters the Field Browser */ +export const FIELDS_BROWSER_FILTER_INPUT = '[data-test-subj="field-search"]'; + +/** The title of the selected category in the right-hand side of the fields browser */ +export const FIELDS_BROWSER_SELECTED_CATEGORY_TITLE = '[data-test-subj="selected-category-title"]'; + +export const FIELDS_BROWSER_SELECTED_CATEGORY_COUNT = + '[data-test-subj="selected-category-count-badge"]'; + +export const FIELDS_BROWSER_CATEGORIES_COUNT = '[data-test-subj="categories-count"]'; + +export const FIELDS_BROWSER_HOST_CATEGORIES_COUNT = '[data-test-subj="host-category-count"]'; + +export const FIELDS_BROWSER_SYSTEM_CATEGORIES_COUNT = '[data-test-subj="system-category-count"]'; + +export const FIELDS_BROWSER_FIELDS_COUNT = '[data-test-subj="fields-count"]'; + +/** Contains the body of the fields browser */ +export const FIELDS_BROWSER_CONTAINER = '[data-test-subj="fields-browser-container"]'; + +export const FIELDS_BROWSER_MESSAGE_HEADER = + '[data-test-subj="timeline"] [data-test-subj="header-text-message"]'; + +export const FIELDS_BROWSER_MESSAGE_CHECKBOX = + '[data-test-subj="timeline"] [data-test-subj="field-message-checkbox"]'; + +export const FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_HEADER = + '[data-test-subj="header-text-host.geo.country_name"]'; + +export const FIELDS_BROWSER_HOST_GEO_COUNTRY_NAME_CHECKBOX = + '[data-test-subj="field-host.geo.country_name-checkbox"]'; + +export const FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER = + '[data-test-subj="timeline"] [data-test-subj="field-name-host.geo.country_name"]'; + +export const FIELDS_BROWSER_HOST_GEO_CITY_NAME_HEADER = + '[data-test-subj="header-text-host.geo.city_name"]'; + +export const FIELDS_BROWSER_HOST_GEO_CITY_NAME_CHECKBOX = + '[data-test-subj="field-host.geo.city_name-checkbox"]'; + +export const FIELDS_BROWSER_HEADER_DROP_AREA = + '[data-test-subj="timeline"] [data-test-subj="headers-group"]'; + +export const FIELDS_BROWSER_HEADER_HOST_GEO_CONTINENT_NAME_HEADER = + '[data-test-subj="header-text-host.geo.continent_name"]'; + +export const FIELDS_BROWSER_HOST_GEO_CONTINENT_NAME_CHECKBOX = + '[data-test-subj="field-host.geo.continent_name-checkbox"]'; + +export const FIELDS_BROWSER_RESET_FIELDS = + '[data-test-subj="timeline"] [data-test-subj="reset-fields"]'; diff --git a/x-pack/legacy/plugins/siem/cypress/screens/timeline/main.ts b/x-pack/legacy/plugins/siem/cypress/screens/timeline/main.ts new file mode 100644 index 0000000000000..cf3267d2b650e --- /dev/null +++ b/x-pack/legacy/plugins/siem/cypress/screens/timeline/main.ts @@ -0,0 +1,18 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +/** The `Timeline ^` button that toggles visibility of the Timeline */ +export const TIMELINE_TOGGLE_BUTTON = '[data-test-subj="flyoutOverlay"]'; + +/** Contains the KQL bar for searching or filtering in the timeline */ +export const SEARCH_OR_FILTER_CONTAINER = + '[data-test-subj="timeline-search-or-filter-search-container"]'; + +export const TIMELINE_FIELDS_BUTTON = + '[data-test-subj="timeline"] [data-test-subj="show-field-browser"]'; + +/** The total server-side count of the events matching the timeline's search criteria */ +export const SERVER_SIDE_EVENT_COUNT = '[data-test-subj="server-side-event-count"]'; diff --git a/x-pack/legacy/plugins/siem/cypress/tasks/timeline/fields_browser.ts b/x-pack/legacy/plugins/siem/cypress/tasks/timeline/fields_browser.ts new file mode 100644 index 0000000000000..c78eb8f73f650 --- /dev/null +++ b/x-pack/legacy/plugins/siem/cypress/tasks/timeline/fields_browser.ts @@ -0,0 +1,61 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ +import { drag, drop } from '../../integration/lib/drag_n_drop/helpers'; + +import { + FIELDS_BROWSER_FILTER_INPUT, + FIELDS_BROWSER_MESSAGE_CHECKBOX, + FIELDS_BROWSER_HOST_GEO_CITY_NAME_CHECKBOX, + FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER, + FIELDS_BROWSER_HEADER_DROP_AREA, + FIELDS_BROWSER_HOST_GEO_CONTINENT_NAME_CHECKBOX, + FIELDS_BROWSER_RESET_FIELDS, +} from '../../screens/timeline/fields_browser'; +import { DEFAULT_TIMEOUT } from '../../integration/lib/util/helpers'; +import { KQL_SEARCH_BAR } from '../../screens/hosts/main'; + +export const clearFieldsBrowser = () => { + cy.get(FIELDS_BROWSER_FILTER_INPUT).type('{selectall}{backspace}'); +}; + +export const filterFieldsBrowser = (fieldName: string) => { + cy.get(FIELDS_BROWSER_FILTER_INPUT) + .type(fieldName) + .should('not.have.class', 'euiFieldSearch-isLoading'); +}; + +export const closeFieldsBrowser = () => { + cy.get(KQL_SEARCH_BAR, { timeout: DEFAULT_TIMEOUT }).click({ force: true }); +}; + +export const removesMessageField = () => { + cy.get(FIELDS_BROWSER_MESSAGE_CHECKBOX).uncheck({ + force: true, + }); +}; + +export const addsHostGeoCityNameToTimeline = () => { + cy.get(FIELDS_BROWSER_HOST_GEO_CITY_NAME_CHECKBOX).check({ + force: true, + }); +}; + +export const addsHostGeoCountryNameToTimelineDraggingIt = () => { + cy.get(FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER).should('exist'); + cy.get(FIELDS_BROWSER_DRAGGABLE_HOST_GEO_COUNTRY_NAME_HEADER).then(field => drag(field)); + + cy.get(FIELDS_BROWSER_HEADER_DROP_AREA).then(headersDropArea => drop(headersDropArea)); +}; + +export const addsHostGeoContinentNameToTimeline = () => { + cy.get(FIELDS_BROWSER_HOST_GEO_CONTINENT_NAME_CHECKBOX).check({ + force: true, + }); +}; + +export const resetFields = () => { + cy.get(FIELDS_BROWSER_RESET_FIELDS).click({ force: true }); +}; diff --git a/x-pack/legacy/plugins/siem/cypress/tasks/timeline/main.ts b/x-pack/legacy/plugins/siem/cypress/tasks/timeline/main.ts new file mode 100644 index 0000000000000..51026fef757d8 --- /dev/null +++ b/x-pack/legacy/plugins/siem/cypress/tasks/timeline/main.ts @@ -0,0 +1,31 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +import { DEFAULT_TIMEOUT } from '../../integration/lib/util/helpers'; + +import { + TIMELINE_TOGGLE_BUTTON, + SEARCH_OR_FILTER_CONTAINER, + TIMELINE_FIELDS_BUTTON, + SERVER_SIDE_EVENT_COUNT, +} from '../../screens/timeline/main'; + +export const hostExistsQuery = 'host.name: *'; + +export const openTimeline = () => { + cy.get(TIMELINE_TOGGLE_BUTTON, { timeout: DEFAULT_TIMEOUT }).click(); +}; + +export const populateTimeline = () => { + cy.get(`${SEARCH_OR_FILTER_CONTAINER} input`).type(`${hostExistsQuery} {enter}`); + cy.get(SERVER_SIDE_EVENT_COUNT, { timeout: DEFAULT_TIMEOUT }) + .invoke('text') + .should('be.above', 0); +}; + +export const openTimelineFieldsBrowser = () => { + cy.get(TIMELINE_FIELDS_BUTTON).click({ force: true }); +}; From ecc8240dcbc340f8caea961b82cd4748e3bd4726 Mon Sep 17 00:00:00 2001 From: James Gowdy Date: Tue, 28 Jan 2020 09:44:59 +0000 Subject: [PATCH 77/77] [ML] Reseting categorization validation if category field is cleared (#56029) --- .../new_job/common/job_creator/categorization_job_creator.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts index 0ff0ffb6f3bb3..eb2f0f4e368a3 100644 --- a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts +++ b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/common/job_creator/categorization_job_creator.ts @@ -100,6 +100,7 @@ export class CategorizationJobCreator extends JobCreator { delete this._job_config.analysis_config.categorization_field_name; this._categoryFieldExamples = []; this._validationChecks = []; + this._overallValidStatus = CATEGORY_EXAMPLES_VALIDATION_STATUS.INVALID; } }