[Rule Tuning] Suspicious Web Browser Sensitive File Access

[ar3diu]

Link to rule

detection-rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml

Line 19 in 79f575b

name = "Suspicious Web Browser Sensitive File Access"

Description

Index pattern needs to be changed to logs-endpoint.events.file-* in order to match indices created by Elastic Defend. Otherwise, the following warning will be shown:

This rule is attempting to query data from Elasticsearch indices listed in the "Index patterns" section of the rule definition, however no index matching: ["logs-endpoint.events.file.*"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.

Example Data

N/A

[Samirbous]

@ar3diu thank you for reporting this issue! we pushed a PR to fix it