Update Lookback Interval for AWS Rules

elastic · Jul 8, 2020 · c577426 · c577426
1 parent 316be47
commit c577426
Show file tree

Hide file tree

Showing 27 changed files with 53 additions and 53 deletions.
diff --git a/rules/aws/collection_cloudtrail_logging_created.toml b/rules/aws/collection_cloudtrail_logging_created.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/10"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/10"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/credential_access_iam_user_addition_to_group.toml b/rules/aws/credential_access_iam_user_addition_to_group.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/04"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/04"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
     rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_cloudtrail_logging_deleted.toml b/rules/aws/defense_evasion_cloudtrail_logging_deleted.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/26"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/26"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_cloudtrail_logging_suspended.toml b/rules/aws/defense_evasion_cloudtrail_logging_suspended.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/10"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/10"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_cloudwatch_alarm_deletion.toml b/rules/aws/defense_evasion_cloudwatch_alarm_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/15"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/15"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_configuration_recorder_stopped.toml b/rules/aws/defense_evasion_configuration_recorder_stopped.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/16"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/16"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_ec2_flow_log_deletion.toml b/rules/aws/defense_evasion_ec2_flow_log_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/15"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/15"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_ec2_network_acl_deletion.toml b/rules/aws/defense_evasion_ec2_network_acl_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/26"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/26"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_guardduty_detector_deletion.toml b/rules/aws/defense_evasion_guardduty_detector_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/28"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/28"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_s3_bucket_configuration_deletion.toml b/rules/aws/defense_evasion_s3_bucket_configuration_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/27"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/27"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/defense_evasion_waf_acl_deletion.toml b/rules/aws/defense_evasion_waf_acl_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/21"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/21"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/exfiltration_ec2_snapshot_change_activity.toml b/rules/aws/exfiltration_ec2_snapshot_change_activity.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/24"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_cloudtrail_logging_updated.toml b/rules/aws/impact_cloudtrail_logging_updated.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/10"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/10"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_cloudwatch_log_group_deletion.toml b/rules/aws/impact_cloudwatch_log_group_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/18"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_cloudwatch_log_stream_deletion.toml b/rules/aws/impact_cloudwatch_log_stream_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/20"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/20"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_ec2_disable_ebs_encryption.toml b/rules/aws/impact_ec2_disable_ebs_encryption.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/05"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/05"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_iam_deactivate_mfa_device.toml b/rules/aws/impact_iam_deactivate_mfa_device.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/26"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/26"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_iam_group_deletion.toml b/rules/aws/impact_iam_group_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/21"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/21"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_rds_cluster_deletion.toml b/rules/aws/impact_rds_cluster_deletion.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/21"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/21"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/impact_rds_instance_cluster_stoppage.toml b/rules/aws/impact_rds_instance_cluster_stoppage.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/05/20"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/05/20"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ false_positives = [
     hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/initial_access_console_login_root.toml b/rules/aws/initial_access_console_login_root.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/06/11"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/11"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
     exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"

diff --git a/rules/aws/initial_access_password_recovery.toml b/rules/aws/initial_access_password_recovery.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/07/02"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/07/02"
+updated_date = "2020/07/07"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     it can be exempted from the rule.
     """,
 ]
-from = "now-20m"
+from = "now-60m"
 index = ["filebeat-*"]
 interval = "10m"
 language = "kuery"