bc6 rule import april 9 (elastic#63152)

* bc6 rule import april 9 Increased the lookback of the ML rules * re-import with LF chars Co-authored-by: Elastic Machine <[email protected]>
majagrubic · Apr 16, 2020 · 39c491e · 39c491e
1 parent 05c55ec
commit 39c491e
Show file tree

Hide file tree

Showing 23 changed files with 23 additions and 23 deletions.
diff --git a/...server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json b/...server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_activity.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that rarely uses the network could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "linux_anomalous_network_activity_ecs",
   "name": "Unusual Linux Network Activity",

diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json b/...r/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_port_activity.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that rarely uses the network could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "linux_anomalous_network_port_activity_ecs",
   "name": "Unusual Linux Network Port Activity",

diff --git a/.../server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json b/.../server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_service.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that rarely uses the network could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "linux_anomalous_network_service",
   "name": "Unusual Linux Network Service",

diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json b/...er/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_network_url_activity.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "linux_anomalous_network_url_activity_ecs",
   "name": "Unusual Linux Web Activity",

diff --git a/...erver/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json b/...erver/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_process_all_hosts.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "linux_anomalous_process_all_hosts_ecs",
   "name": "Anomalous Process For a Linux Population",

diff --git a/...s/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json b/...s/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_anomalous_user_name.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "linux_anomalous_user_name_ecs",
   "name": "Unusual Linux Username",

diff --git a/...ns/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json b/...ns/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_dns_tunneling.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this signal and such parent domains can be excluded."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "packetbeat_dns_tunneling",
   "name": "DNS Tunneling",

diff --git a/...iem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json b/...iem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_dns_question.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal. Network activity that occurs rarely, in small quantities, can trigger this signal. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "packetbeat_rare_dns_question",
   "name": "Unusual DNS Activity",

diff --git a/...em/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json b/...em/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_server_domain.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "packetbeat_rare_server_domain",
   "name": "Unusual Network Destination Domain Name",

diff --git a/...lugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json b/...lugins/siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_urls.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "packetbeat_rare_urls",
   "name": "Unusual Web Request",

diff --git a/.../siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json b/.../siem/server/lib/detection_engine/rules/prepackaged_rules/packetbeat_rare_user_agent.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Web activity that is uncommon, like security scans, may trigger this signal and may need to be excluded. A new or rarely used program that calls web services may trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "packetbeat_rare_user_agent",
   "name": "Unusual Web User Agent",

diff --git a/.../siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json b/.../siem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_linux.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "rare_process_by_host_linux_ecs",
   "name": "Unusual Process For a Linux Host",

diff --git a/...iem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json b/...iem/server/lib/detection_engine/rules/prepackaged_rules/rare_process_by_host_windows.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "rare_process_by_host_windows_ecs",
   "name": "Unusual Process For a Windows Host",

diff --git a/...s/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json b/...s/siem/server/lib/detection_engine/rules/prepackaged_rules/suspicious_login_activity.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Security audits may trigger this signal. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "suspicious_login_activity_ecs",
   "name": "Unusual Login Activity",

diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json b/...rver/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_network_activity.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that rarely uses the network could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_network_activity_ecs",
   "name": "Unusual Windows Network Activity",

diff --git a/.../server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json b/.../server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_path_activity.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_path_activity_ecs",
   "name": "Unusual Windows Path Activity",

diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json b/...ver/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_all_hosts.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_process_all_hosts_ecs",
   "name": "Anomalous Process For a Windows Population",

diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json b/...rver/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_process_creation.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Users running scripts in the course of technical support operations of software upgrades could trigger this signal. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_process_creation",
   "name": "Anomalous Windows Process Creation",

diff --git a/...ns/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json b/...ns/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_script.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Certain kinds of security testing may trigger this signal. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_script",
   "name": "Suspicious Powershell Script",

diff --git a/...s/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json b/...s/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_service.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_service",
   "name": "Unusual Windows Service",

diff --git a/...siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json b/...siem/server/lib/detection_engine/rules/prepackaged_rules/windows_anomalous_user_name.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_anomalous_user_name_ecs",
   "name": "Unusual Windows Username",

diff --git a/...em/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json b/...em/server/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_runas_event.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_rare_user_runas_event",
   "name": "Unusual Windows User Privilege Elevation Activity",

diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json b/...r/lib/detection_engine/rules/prepackaged_rules/windows_rare_user_type10_remote_login.json
@@ -4,7 +4,7 @@
   "false_positives": [
     "Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration."
   ],
-  "from": "now-16m",
+  "from": "now-45m",
   "interval": "15m",
   "machine_learning_job_id": "windows_rare_user_type10_remote_login",
   "name": "Unusual Windows Remote User",