Merge branch 'main' into rt_0

Author: w0rk3r

detection_rules/cli_utils.py

@@ -375,7 +375,7 @@ def rule_prompt(  # noqa: PLR0912, PLR0913, PLR0915
         # if failing due to a query, loop until resolved or terminated
         while True:
             try:
-                contents["query"] = click.edit(contents["query"], extension=".eql")
+                contents["query"] = click.edit(contents["query"], extension=".eql")  # type: ignore[reportUnknownArgumentType]
                 rule = TOMLRule(
                     path=Path(path),
                     contents=TOMLRuleContents.from_dict({"rule": contents, "metadata": meta}),

detection_rules/etc/deprecated_rules.json

@@ -359,6 +359,11 @@
     "rule_name": "Potential Persistence via Cron Job",
     "stack_version": "7.14.0"
   },
+  "bc0c6f0d-dab0-47a3-b135-0925f0a333bc": {
+    "deprecation_date": "2025/11/21",
+    "rule_name": "Deprecated - AWS Root Login Without MFA",
+    "stack_version": "8.19"
+  },
   "c6474c34-4953-447a-903e-9fcb7b6661aa": {
     "deprecation_date": "2021/04/15",
     "rule_name": "IRC (Internet Relay Chat) Protocol Activity to the Internet",

detection_rules/etc/integration-manifests.json.gz

@@ -145,7 +145,10 @@
     "kibana.alert.rule.threat.tactic.id": "keyword",
     "kibana.alert.workflow_status": "keyword",
     "kibana.alert.rule.rule_id": "keyword",
-    "kibana.alert.rule.name": "keyword"
+    "kibana.alert.rule.name": "keyword", 
+    "kibana.alert.risk_score": "long",
+    "kibana.alert.rule.type": "keyword",
+    "kibana.alert.rule.threat.tactic.name": "keyword"
   },
   "logs-google_workspace*": {
     "gsuite.admin": "keyword",
@@ -202,7 +205,8 @@
     "azure.activitylogs.properties.resourceDisplayName": "keyword",
     "azure.activitylogs.properties.appDisplayName": "keyword",
     "azure.activitylogs.properties.requestbody.properties.roleDefinitionId": "keyword",
-    "azure.activitylogs.properties.responseBody": "keyword"
+    "azure.activitylogs.properties.responseBody": "keyword",
+    "azure.activitylogs.properties.status_code": "keyword"
   },
   "logs-azure.graphactivitylogs-*": {
     "azure.graphactivitylogs.properties.c_idtyp": "keyword",