Merge branch 'main' into 2700-bug-missing-spaces-between-logic-operators-does-not-raise-error

Author: terrancedejesus

.github/CODEOWNERS

@@ -5,7 +5,6 @@ tests/**/*.py     @mikaayenson @eric-forte-elastic @terrancedejesus
 detection_rules/  @mikaayenson @eric-forte-elastic @terrancedejesus
 tests/            @mikaayenson @eric-forte-elastic @terrancedejesus
 lib/              @mikaayenson @eric-forte-elastic @terrancedejesus
-rta/              @mikaayenson @eric-forte-elastic @terrancedejesus
 hunting/          @mikaayenson @eric-forte-elastic @terrancedejesus
 
 # skip rta-mapping to avoid the spam

.github/paths-labeller.yml

@@ -12,8 +12,6 @@
   - "detection_rules/**/*.py"
   - "kibana/**/*.py"
   - "kql/**/*.py"
-- "RTA":
-  - "rta/**/*"
 - "Hunting":
   - "hunting/**/*"
 

.github/workflows/add-guidelines.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Set environment variable for early exit control
         id: check_label
@@ -57,5 +57,5 @@ jobs:
         uses: mshick/add-pr-comment@v2
         with:
           message-path: ${{ env.GUIDELINES_FILE }}
-          repo-token: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
           message-id: "guidelines-comment"

.github/workflows/attack-coverage-update.yml

@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
       inputs:
         update-coverage:
-          description: 'Update the docs/ATT&CK-coverage.md file'
+          description: 'Update the docs-dev/ATT&CK-coverage.md file'
           required: true
           default: '--update-coverage'
 
@@ -37,25 +37,25 @@ jobs:
           git config --global user.email "[email protected]"
           git config --global user.name "protectionsmachine"
 
-      - name: Update navigator gist files and docs/ATT&CK-coverage.md file.
+      - name: Update navigator gist files and docs-dev/ATT&CK-coverage.md file.
         env:
-          GITHUB_TOKEN: "${{ secrets.NAVIGATOR_GIST_TOKEN }}"
+          GITHUB_TOKEN: "${{ secrets.WRITE_TRADEBOT_GIST_TOKEN }}"
         run: |
          python -m detection_rules dev update-navigator-gists "${{ github.event.inputs.update-coverage }}"
-         git add docs/"ATT\&CK-coverage.md"
+         git add docs-dev/"ATT\&CK-coverage.md"
 
       - name: Create Pull Request
         uses: peter-evans/[email protected]
         with:
           assignees: '${{github.actor}}'
           delete-branch: true
           branch: "update-attack-coverage"
-          commit-message: "Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md"
+          commit-message: "Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md"
           branch-suffix: "short-commit-hash"
           base: main
-          title: 'Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md'
+          title: 'Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md'
           body: |
-            Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md
+            Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md
 
             - Autogenerated from job `attack-coverage-update: pr`.
           labels: "backport: auto"

.github/workflows/backport.yml

@@ -65,16 +65,16 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
-          token: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}
+          token: ${{ secrets.WRITE_TRADEBOT_DETECTION_RULES_TOKEN }}
           ref: main
           fetch-depth: 100
 
       - name: Set github config
         run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
+          git config --global user.email "178941316+tradebot-elastic@users.noreply.github.com"
+          git config --global user.name "tradebot-elastic"
 
       - name: Get branch histories
         run: |
@@ -161,6 +161,6 @@ jobs:
       - name: "Notify slack on failure"
         uses: craftech-io/slack-action@v1
         with:
-          slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          slack_webhook_url: ${{ secrets.EXTERNAL_SLACK_DETECTION_RULES_URL }}
           status: failure
         if: failure()

.github/workflows/branch-status-checks.yml

@@ -22,7 +22,7 @@ jobs:
       with:
         url: "https://api.github.com/repos/elastic/detection-rules/actions/workflows/pythonpackage.yml/runs?per_page=1&branch=${{matrix.target_branch}}"
         method: 'GET'
-        bearerToken: ${{ secrets.READ_ORG_TOKEN }}
+        bearerToken: ${{ secrets.READ_ELASTIC_DETECTION_RULES_ORG_TOKEN }}
 
     - name: Check Backport Status
       uses: actions/github-script@v6

.github/workflows/community.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/github-script@v6
         id: membership
         with:
-          github-token: ${{ secrets.READ_ORG_TOKEN }}
+          github-token: ${{ secrets.READ_ELASTIC_DETECTION_RULES_ORG_TOKEN }}
           result-encoding: string
           script: |
 

.github/workflows/get-target-branches.yml

@@ -14,7 +14,7 @@ jobs:
     outputs:
       matrix: ${{ steps.get-branch-list.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: Set up Python 3.12
         uses: actions/setup-python@v5

.github/workflows/kibana-mitre-update.yml

@@ -2,7 +2,7 @@ name: Check MITRE ATT&CK Version Updates Are Synced
 
 on:
   pull_request:
-    types: 
+    types:
       - opened
     paths:
       - 'detection_rules/etc/attack-v*.json.gz'
@@ -15,11 +15,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Get MITRE Attack changed files
+        if: false
         id: changed-attack-files
         uses: tj-actions/changed-files@v44
         with:
-          files: detection_rules/etc/attack-v*.json.gz 
- 
+          files: detection_rules/etc/attack-v*.json.gz
+
       - name: Extract version from file name
         id: extract_version
         if: steps.changed-attack-files.outputs.any_changed == 'true'
@@ -33,9 +34,9 @@ jobs:
         run: |
           ISSUE_TITLE="[Security Solution] Update MITRE ATT&CK to ${{ steps.extract_version.outputs.version }}"
           ISSUE_BODY="The detection rules MITRE ATT&CK version has been updated to ${{ steps.extract_version.outputs.version }} Please update the MITRE ATT&CK version in Kibana accordingly."
-          
+
           curl -X POST \
-            -H "Authorization: token ${{ secrets.READ_WRITE_KIBANA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.WRITE_KIBANA_DETECTION_RULES_TOKEN }}" \
             -H "Accept: application/vnd.github.v3+json" \
             https://api.github.com/repos/elastic/kibana/issues \
             -d '{
@@ -44,4 +45,4 @@ jobs:
             }'
 
         env:
-          GITHUB_TOKEN: ${{ secrets.READ_WRITE_KIBANA_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.WRITE_KIBANA_DETECTION_RULES_TOKEN }}

.github/workflows/lock-versions.yml

@@ -22,7 +22,7 @@ jobs:
             }
 
       - name: Checkout detection-rules
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0