…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev build-release --update-version-lock
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/home/forteea1/Code/clean_mains/detection-rules/detection_rules/__main__.py", line 34, in <module>
    main()
  File "/home/forteea1/Code/clean_mains/detection-rules/detection_rules/__main__.py", line 31, in main
    root(prog_name="detection_rules")
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/detection_rules/devtools.py", line 98, in build_release
    registry_data = config['registry_data']
                    ~~~~~~^^^^^^^^^^^^^^^^^
KeyError: 'registry_data'

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev deprecate-rule custom_rules/rules/command_and_control_test_potential_protocol_tunneling_via_chisel_client.toml
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Rule has not been version locked and so does not need to be deprecated. Delete the file or update the maturity to `development` instead.

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev update-lock-versions
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Are you sure you want to update hashes for 4 rules without a version bump? [y/N]: Y
Rule changes detected!
 - 0 changed rules
 - 4 new rules
 - 0 newly deprecated rules
Detailed changes:

Updated /home/forteea1/Code/clean_mains/detection-rules/custom_rules/etc/version.lock.json file
No hashes updated

❯ python -m detection_rules dev trim-version-lock 8.15.0
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Loading rules ...
No changes


…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev trim-version-lock 8.9.0
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Loading rules ...
No changes


…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules kibana export-rules -d mikas_folder -s
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

- skipping DAC Demo Dev Rule 1 - also updated - ValidationError
- skipping DAC Demo Dev Rule 13 - ValidationError
- skipping DAC Demo Dev Rule 1 - ValidationError
- skipping TEST Potential Protocol Tunneling via Chisel Client - ValidationError
4 rules exported
0 rules converted
0 saved to mikas_folder
4 errors saved to mikas_folder/_errors.txt

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 2s
❯ python -m detection_rules kibana export-rules -d custom_rules -s
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

- skipping DAC Demo Dev Rule 1 - also updated - ValidationError
- skipping DAC Demo Dev Rule 13 - ValidationError
- skipping DAC Demo Dev Rule 1 - ValidationError
- skipping TEST Potential Protocol Tunneling via Chisel Client - ValidationError
4 rules exported
0 rules converted
0 saved to custom_rules
4 errors saved to custom_rules/_errors.txt

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 2s
❯ cat custom_rules/_errors.txt
───────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: custom_rules/_errors.txt
───────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ - DAC Demo Dev Rule 1 - also updated - {'rule': [ValidationError({'_schema': ['Configuration error: Rule DAC Demo Dev
       │ Rule 1 - also updated - 09ea590e-69d1-44de-a386-3d84d85cc2f2 should not contain rules with `version and revision` set.
       │ ']}), ValidationError({'type': ['Must be equal to esql.'], 'language': ['Must be equal to esql.']}), ValidationError({
       │ 'type': ['Must be equal to threshold.'], 'threshold': ['Missing data for required field.']}), ValidationError({'type':
       │  ['Must be equal to threat_match.'], 'threat_mapping': ['Missing data for required field.'], 'threat_index': ['Missing
       │  data for required field.']}), ValidationError({'type': ['Must be equal to machine_learning.'], 'anomaly_threshold': [
       │ 'Missing data for required field.'], 'machine_learning_job_id': ['Missing data for required field.']}), ValidationErro
       │ r({'type': ['Must be equal to query.']}), ValidationError({'type': ['Must be equal to new_terms.'], 'new_terms': ['Mis
       │ sing data for required field.']})]}
   2   │ - DAC Demo Dev Rule 13 - {'rule': [ValidationError({'_schema': ['Configuration error: Rule DAC Demo Dev Rule 13 - 222e
       │ 1b03-fdc9-42a5-911e-2e3e0533549a should not contain rules with `version and revision` set.']}), ValidationError({'type
       │ ': ['Must be equal to esql.'], 'language': ['Must be equal to esql.']}), ValidationError({'type': ['Must be equal to t
       │ hreshold.'], 'threshold': ['Missing data for required field.']}), ValidationError({'type': ['Must be equal to threat_m
       │ atch.'], 'threat_mapping': ['Missing data for required field.'], 'threat_index': ['Missing data for required field.']}
       │ ), ValidationError({'type': ['Must be equal to machine_learning.'], 'anomaly_threshold': ['Missing data for required f
       │ ield.'], 'machine_learning_job_id': ['Missing data for required field.']}), ValidationError({'type': ['Must be equal t
       │ o query.']}), ValidationError({'type': ['Must be equal to new_terms.'], 'new_terms': ['Missing data for required field
       │ .']})]}
   3   │ - DAC Demo Dev Rule 1 - {'rule': [ValidationError({'_schema': ['Configuration error: Rule DAC Demo Dev Rule 1 - 794d2f
       │ c0-ecd0-4963-99da-fd587666b80d should not contain rules with `version and revision` set.']}), ValidationError({'type':
       │  ['Must be equal to esql.'], 'language': ['Must be equal to esql.']}), ValidationError({'type': ['Must be equal to thr
       │ eshold.'], 'threshold': ['Missing data for required field.']}), ValidationError({'type': ['Must be equal to threat_mat
       │ ch.'], 'threat_mapping': ['Missing data for required field.'], 'threat_index': ['Missing data for required field.']}),
       │  ValidationError({'type': ['Must be equal to machine_learning.'], 'anomaly_threshold': ['Missing data for required fie
       │ ld.'], 'machine_learning_job_id': ['Missing data for required field.']}), ValidationError({'type': ['Must be equal to
       │ query.']}), ValidationError({'type': ['Must be equal to new_terms.'], 'new_terms': ['Missing data for required field.'
       │ ]})]}
   4   │ - TEST Potential Protocol Tunneling via Chisel Client - {'rule': [ValidationError({'_schema': ['Configuration error: R
       │ ule TEST Potential Protocol Tunneling via Chisel Client - e8e3af2a-11b8-4ab7-9ca1-c6db621ea89d should not contain rule
       │ s with `version and revision` set.']}), ValidationError({'type': ['Must be equal to esql.'], 'language': ['Must be equ
       │ al to esql.']}), ValidationError({'type': ['Must be equal to threshold.'], 'threshold': ['Missing data for required fi
       │ eld.']}), ValidationError({'type': ['Must be equal to threat_match.'], 'threat_mapping': ['Missing data for required f
       │ ield.'], 'threat_index': ['Missing data for required field.']}), ValidationError({'type': ['Must be equal to machine_l
       │ earning.'], 'anomaly_threshold': ['Missing data for required field.'], 'machine_learning_job_id': ['Missing data for r
       │ equired field.']}), ValidationError({'type': ['Must be equal to query.']}), ValidationError({'type': ['Must be equal t
       │ o new_terms.'], 'new_terms': ['Missing data for required field.']})]}
───────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules kibana export-rules -d custom_rules/rules -s -sv
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 rules exported
4 rules converted
4 saved to custom_rules/rules

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 3s
❯ python -m detection_rules kibana import-rules -o -d custom_rules/rules/
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 rule(s) successfully imported
 - 794d2fc0-ecd0-4963-99da-fd587666b80d
 - 222e1b03-fdc9-42a5-911e-2e3e0533549a
 - e8e3af2a-11b8-4ab7-9ca1-c6db621ea89d
 - 09ea590e-69d1-44de-a386-3d84d85cc2f2

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 5s
❯ python -m detection_rules import-rules-to-repo /home/forteea1/Code/dac_demo/detection-rules-dac-demo/exports/20240518T115752L.ndjson -s custom_rules/rules --required-only
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[+] Building rule for custom_rules/rules/dac_demo_dev_rule_1_updated.toml
[+] Building rule for custom_rules/rules/dac_demo_dev_rule_2_feedback.toml

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules export-rules-from-repo
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Exported 6 rules into /home/forteea1/Code/clean_mains/detection-rules/exports/20240523T161054L.ndjson

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules view-rule rules/cross-platform/threat_intel_indicator_match_address.toml
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

{
  "author": [
    "Elastic"
  ],
  "description": "This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event.",
  "from": "now-65m",
  "index": [
    "auditbeat-*",
    "endgame-*",
    "filebeat-*",
    "logs-*",
    "packetbeat-*",
    "winlogbeat-*"
  ],
  "interval": "1h",
  "language": "kuery",
  "license": "Elastic License v2",
  "name": "Threat Intel IP Address Indicator Match",
  "note": "## Triage and Analysis\n\n### Investigating Threat Intel IP Address Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.\n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.\n\n> **Note**:\n> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.\n- Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:\n  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n  - Execute a reverse DNS lookup to retrieve hostnames associated with the given IP address.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n  - Analyze the process executable using a private sandboxed analysis system.\n  - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n    - Attempts to contact external domains and addresses.\n      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n      - Examine the DNS cache for suspicious or anomalous entries.\n        - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n    - Examine the host services for suspicious or anomalous entries.\n      - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n      - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n      - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- When a match is found, it's important to consider the indicator's initial release date. Threat intelligence is useful for augmenting existing security processes but can quickly become outdated. In other words, some threat intelligence only represents a specific set of activity observed at a specific time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.\n- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n  - Implement temporary network rules, procedures, and segmentation to contain the malware.\n  - Stop suspicious processes.\n  - Immediately block the identified indicators of compromise (IoCs).\n  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n",
  "query": "source.ip:* or destination.ip:*\n",
  "references": [
    "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html",
    "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html",
    "https://www.elastic.co/security/tip"
  ],
  "required_fields": [
    {
      "ecs": true,
      "name": "destination.ip",
      "type": "ip"
    },
    {
      "ecs": true,
      "name": "source.ip",
      "type": "ip"
    }
  ],
  "risk_score": 99,
  "rule_id": "0c41e478-5263-4c69-8f9e-7dfd2c22da64",
  "setup": "## Setup\n\nThis rule needs threat intelligence indicators to work.\nThreat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration),\nthe [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration),\nor a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).\n",
  "severity": "critical",
  "tags": [
    "OS: Windows",
    "Data Source: Elastic Endgame",
    "Rule Type: Indicator Match"
  ],
  "threat_filters": [
    {
      "$state": {
        "store": "appState"
      },
      "meta": {
        "disabled": false,
        "key": "event.category",
        "negate": false,
        "params": {
          "query": "threat"
        },
        "type": "phrase"
      },
      "query": {
        "match_phrase": {
          "event.category": "threat"
        }
      }
    },
    {
      "$state": {
        "store": "appState"
      },
      "meta": {
        "disabled": false,
        "key": "event.kind",
        "negate": false,
        "params": {
          "query": "enrichment"
        },
        "type": "phrase"
      },
      "query": {
        "match_phrase": {
          "event.kind": "enrichment"
        }
      }
    },
    {
      "$state": {
        "store": "appState"
      },
      "meta": {
        "disabled": false,
        "key": "event.type",
        "negate": false,
        "params": {
          "query": "indicator"
        },
        "type": "phrase"
      },
      "query": {
        "match_phrase": {
          "event.type": "indicator"
        }
      }
    }
  ],
  "threat_index": [
    "filebeat-*",
    "logs-ti_*"
  ],
  "threat_indicator_path": "threat.indicator",
  "threat_language": "kuery",
  "threat_mapping": [
    {
      "entries": [
        {
          "field": "source.ip",
          "type": "mapping",
          "value": "threat.indicator.ip"
        }
      ]
    },
    {
      "entries": [
        {
          "field": "destination.ip",
          "type": "mapping",
          "value": "threat.indicator.ip"
        }
      ]
    }
  ],
  "threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"",
  "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e",
  "timeline_title": "Generic Threat Match Timeline",
  "timestamp_override": "event.ingested",
  "type": "threat_match",
  "version": 1
}

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules view-rule custom_rules/rules/command_and_control_dac_demo_dev_rule_1.toml --api-format
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

{
  "actions": [],
  "author": [
    "DAC User"
  ],
  "description": "Test Rule",
  "enabled": true,
  "exceptions_list": [],
  "false_positives": [],
  "from": "now-9m",
  "index": [
    "logs-endpoint.events.*"
  ],
  "interval": "5m",
  "language": "eql",
  "license": "Elastic License v2",
  "max_signals": 100,
  "name": "DAC Demo Dev Rule 1",
  "note": "Test Note",
  "query": "process where host.os.type == \"linux\" and process.name == \"updated\"\n",
  "references": [
    "https://dac-reference.readthedocs.io/en/latest/"
  ],
  "related_integrations": [
    {
      "package": "endpoint",
      "version": "^8.2.0"
    }
  ],
  "required_fields": [
    {
      "ecs": true,
      "name": "host.os.type",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.name",
      "type": "keyword"
    }
  ],
  "risk_score": 47,
  "risk_score_mapping": [],
  "rule_id": "794d2fc0-ecd0-4963-99da-fd587666b80d",
  "setup": "Test Setup",
  "severity": "medium",
  "severity_mapping": [],
  "tags": [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend"
  ],
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0011",
        "name": "Command and Control",
        "reference": "https://attack.mitre.org/tactics/TA0011/"
      },
      "technique": [
        {
          "id": "T1572",
          "name": "Protocol Tunneling",
          "reference": "https://attack.mitre.org/techniques/T1572/"
        }
      ]
    }
  ],
  "timestamp_override": "event.ingested",
  "to": "now",
  "type": "eql",
  "version": 1
}

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules view-rule custom_rules/rules/command_and_control_dac_demo_dev_rule_1.toml --rule-format
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[metadata]
creation_date = "2024/05/23"
maturity = "production"
updated_date = "2024/05/23"

[rule]
actions = []
author = ["DAC User"]
description = "Test Rule"
enabled = true
exceptions_list = []
false_positives = []
from = "now-9m"
index = ["logs-endpoint.events.*"]
interval = "5m"
language = "eql"
license = "Elastic License v2"
max_signals = 100
name = "DAC Demo Dev Rule 1"
note = "Test Note"
references = ["https://dac-reference.readthedocs.io/en/latest/"]
risk_score = 47
risk_score_mapping = []
rule_id = "794d2fc0-ecd0-4963-99da-fd587666b80d"
setup = "Test Setup"
severity = "medium"
severity_mapping = []
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
to = "now"
type = "eql"

query = '''
process where host.os.type == "linux" and process.name == "updated"
'''


[[rule.related_integrations]]
package = "endpoint"
version = "^8.2.0"

[[rule.required_fields]]
ecs = true
name = "host.os.type"
type = "keyword"

[[rule.required_fields]]
ecs = true
name = "process.name"
type = "keyword"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"



…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules view-rule custom_rules/rules/command_and_control_dac_demo_dev_rule_1.toml --rule-format^C

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev build-release --update-version-lock
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/home/forteea1/Code/clean_mains/detection-rules/detection_rules/__main__.py", line 34, in <module>
    main()
  File "/home/forteea1/Code/clean_mains/detection-rules/detection_rules/__main__.py", line 31, in main
    root(prog_name="detection_rules")
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/click/decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/forteea1/Code/clean_mains/detection-rules/detection_rules/devtools.py", line 101, in build_release
    assert 'registry_data' in config, err_msg
           ^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: No `registry_data` in package config. Please see the /home/forteea1/Code/clean_mains/detection-rules/detection_rules/etc/package.yaml file for an example on how to supply this field in /home/forteea1/Code/clean_mains/detection-rules/custom_rules/etc/packages.yaml.

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev build-release --update-version-lock
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

WARNING: You cannot run this command when the versioning strategy is configured to bypass the version lock. Set `bypass_version_lock` to `False` in the rules config to use the version lock.

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev deprecate-rule custom_rules/rules/command_and_control_test_potential_protocol_tunneling_via_chisel_client.toml
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Rule moved to /home/forteea1/Code/clean_mains/detection-rules/custom_rules/rules/_deprecated/command_and_control_test_potential_protocol_tunneling_via_chisel_client.toml - remember to git add this file

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules dev update-lock-versions
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Are you sure you want to update hashes for 3 rules without a version bump? [y/N]: Y
WARNING: You cannot run this command when the versioning strategy is configured to bypass the version lock. Set `bypass_version_lock` to `False` in the rules config to use the version lock.

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 8s
❯ python -m detection_rules dev trim-version-lock 8.9.0
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

WARNING: Cannot trim the version lock when the versioning strategy is configured to bypass the version lock. Set `bypass_version_lock` to `false` in the rules config to use the version lock.

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules kibana export-rules -d custom_rules/rules -s -sv
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 rules exported
4 rules converted
4 saved to custom_rules/rules

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 4s
❯ python -m detection_rules kibana export-rules -d custom_rules/rules -s
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 rules exported
4 rules converted
4 saved to custom_rules/rules

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 2s
❯ python -m detection_rules kibana import-rules -o -d custom_rules/rules/
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

6 rule(s) successfully imported
 - 794d2fc0-ecd0-4963-99da-fd587666b80d
 - 222e1b03-fdc9-42a5-911e-2e3e0533549a
 - 230e7043-b0fc-44eb-86b8-e9eb1e5e38d4
 - 09ea590e-69d1-44de-a386-3d84d85cc2f2
 - 69b96ef7-f00f-473b-9525-81123329a036
 - e8e3af2a-11b8-4ab7-9ca1-c6db621ea89d

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 8s
❯ python -m detection_rules import-rules-to-repo /home/forteea1/Code/dac_demo/detection-rules-dac-demo/exports/20240518T115752L.ndjson -s custom_rules/rules --required-only
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[+] Building rule for custom_rules/rules/dac_demo_dev_rule_1_updated.toml
[+] Building rule for custom_rules/rules/dac_demo_dev_rule_2_feedback.toml

…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules export-rules-from-repo
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Exported 6 rules into /home/forteea1/Code/clean_mains/detection-rules/exports/20240523T161813L.ndjson

…pport-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte took 2s
❯ python -m detection_rules view-rule custom_rules/rules/command_and_control_dac_demo_dev_rule_1.toml --rule-format
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[metadata]
creation_date = "2024/05/23"
maturity = "production"
updated_date = "2024/05/23"

[rule]
actions = []
author = ["DAC User"]
description = "Test Rule"
enabled = true
exceptions_list = []
false_positives = []
from = "now-9m"
index = ["logs-endpoint.events.*"]
interval = "5m"
language = "eql"
license = "Elastic License v2"
max_signals = 100
name = "DAC Demo Dev Rule 1"
note = "Test Note"
references = ["https://dac-reference.readthedocs.io/en/latest/"]
revision = 0
risk_score = 47
risk_score_mapping = []
rule_id = "52e84641-7483-4a00-a301-13baffa51b5f"
setup = "Test Setup"
severity = "medium"
severity_mapping = []
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
to = "now"
type = "eql"
version = 1

query = '''
process where host.os.type == "linux" and process.name == "updated"
'''


[[rule.related_integrations]]
package = "endpoint"
version = "^8.2.0"

[[rule.required_fields]]
ecs = true
name = "host.os.type"
type = "keyword"

[[rule.required_fields]]
ecs = true
name = "process.name"
type = "keyword"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"



…mited-support-for-version-and-revision-to-baseruledata [!?] is  v0.1.0 via  v3.12.3 (detection-rules-build) on  eric.forte
❯ python -m detection_rules view-rule custom_rules/rules/command_and_control_dac_demo_dev_rule_1.toml --api-format
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

{
  "actions": [],
  "author": [
    "DAC User"
  ],
  "description": "Test Rule",
  "enabled": true,
  "exceptions_list": [],
  "false_positives": [],
  "from": "now-9m",
  "index": [
    "logs-endpoint.events.*"
  ],
  "interval": "5m",
  "language": "eql",
  "license": "Elastic License v2",
  "max_signals": 100,
  "name": "DAC Demo Dev Rule 1",
  "note": "Test Note",
  "query": "process where host.os.type == \"linux\" and process.name == \"updated\"\n",
  "references": [
    "https://dac-reference.readthedocs.io/en/latest/"
  ],
  "related_integrations": [
    {
      "package": "endpoint",
      "version": "^8.2.0"
    }
  ],
  "required_fields": [
    {
      "ecs": true,
      "name": "host.os.type",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.name",
      "type": "keyword"
    }
  ],
  "revision": 0,
  "risk_score": 47,
  "risk_score_mapping": [],
  "rule_id": "52e84641-7483-4a00-a301-13baffa51b5f",
  "setup": "Test Setup",
  "severity": "medium",
  "severity_mapping": [],
  "tags": [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend"
  ],
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0011",
        "name": "Command and Control",
        "reference": "https://attack.mitre.org/tactics/TA0011/"
      },
      "technique": [
        {
          "id": "T1572",
          "name": "Protocol Tunneling",
          "reference": "https://attack.mitre.org/techniques/T1572/"
        }
      ]
    }
  ],
  "timestamp_override": "event.ingested",
  "to": "now",
  "type": "eql",
  "version": 1
}