Skip to content

Commit 5b3dc4a

Browse files
Revert "Add new ML detection rules for Privileged Access Detection (#4516)" (#4548)
This reverts commit 2ff8d1b.
1 parent 2ff8d1b commit 5b3dc4a

File tree

26 files changed

+2
-2156
lines changed

26 files changed

+2
-2156
lines changed

.github/workflows/react-tests-dispatcher.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ on:
2222
- '!rules/integrations/o365/*.toml'
2323
- '!rules/integrations/okta/*.toml'
2424
- '!rules/integrations/problemchild/*.toml'
25-
- '!rules/integrations/pad/*.toml'
2625

2726
jobs:
2827
dispatch:
-285 Bytes
Binary file not shown.
-3.25 KB
Binary file not shown.

detection_rules/schemas/definitions.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ def validator(value):
178178
'Use Case: Vulnerability'
179179
]
180180
NonEmptyStr = NewType('NonEmptyStr', str, validate=validate.Length(min=1))
181-
MACHINE_LEARNING_PACKAGES = ['LMD', 'DGA', 'DED', 'ProblemChild', 'Beaconing', 'PAD']
181+
MACHINE_LEARNING_PACKAGES = ['LMD', 'DGA', 'DED', 'ProblemChild', 'Beaconing']
182182
AlertSuppressionGroupBy = NewType('AlertSuppressionGroupBy', List[NonEmptyStr], validate=validate.Length(min=1, max=3))
183183
AlertSuppressionMissing = NewType('AlertSuppressionMissing', str,
184184
validate=validate.OneOf(['suppress', 'doNotSuppress']))

pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "0.4.24"
3+
version = "0.4.23"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml

Lines changed: 0 additions & 99 deletions
This file was deleted.

rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml

Lines changed: 0 additions & 99 deletions
This file was deleted.

0 commit comments

Comments
 (0)