Skip to content

Commit e88bfce

Browse files
terrancedejesusterrancedejesus
authored
Merge branch 'main' into rule-tuning-shared-object-creation
2 parents 5711659 + 40a97f7 commit e88bfce

20 files changed

+56
-37
lines changed

‎.github/workflows/kibana-mitre-update.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ jobs:
1515
uses: actions/checkout@v4
1616

1717
- name: Get MITRE Attack changed files
18+
if: false
1819
id: changed-attack-files
1920
uses: tj-actions/changed-files@v44
2021
with:

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "0.4.22"
3+
version = "0.4.23"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

rules/integrations/cloud_defend/container_workload_protection.toml renamed to rules/_deprecated/container_workload_protection.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/04/05"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/credential_access_aws_creds_search_inside_a_container.toml renamed to rules/_deprecated/credential_access_aws_creds_search_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/06/28"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml renamed to rules/_deprecated/credential_access_collection_sensitive_files_compression_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/05/12"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml renamed to rules/_deprecated/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/05/12"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml renamed to rules/_deprecated/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/06/06"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml renamed to rules/_deprecated/discovery_suspicious_network_tool_launched_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/04/26"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml renamed to rules/_deprecated/execution_container_management_binary_launched_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/04/26"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

rules/integrations/cloud_defend/execution_file_made_executable_via_chmod_inside_a_container.toml renamed to rules/_deprecated/execution_file_made_executable_via_chmod_inside_a_container.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
[metadata]
22
creation_date = "2023/04/26"
33
integration = ["cloud_defend"]
4-
maturity = "production"
5-
updated_date = "2025/02/06"
4+
deprecation_date = "2025/03/14"
5+
maturity = "deprecated"
6+
updated_date = "2025/03/14"
67

78
[rule]
89
author = ["Elastic"]

0 commit comments

Comments
 (0)