Fixing rules that were failing validation (#1041)

* Fixed rules * Removed deleted rule from pack * Reverted changes * Remove tailscale selectors * Fixed riot basic
panther-labs · Dec 14, 2023 · aea6bb2 · aea6bb2
1 parent 12019bc
commit aea6bb2
Show file tree

Hide file tree

Showing 13 changed files with 0 additions and 205 deletions.
diff --git a/lookup_tables/greynoise/advanced/noise_advanced.yml b/lookup_tables/greynoise/advanced/noise_advanced.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/advanced/riot_advanced.yml b/lookup_tables/greynoise/advanced/riot_advanced.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/basic/noise_basic.yml b/lookup_tables/greynoise/basic/noise_basic.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/basic/riot_basic.yml b/lookup_tables/greynoise/basic/riot_basic.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_asn.yml b/lookup_tables/ipinfo/ipinfo_asn.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_asn_datalake.yml b/lookup_tables/ipinfo/ipinfo_asn_datalake.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_location.yml b/lookup_tables/ipinfo/ipinfo_location.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_location_datalake.yml b/lookup_tables/ipinfo/ipinfo_location_datalake.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_privacy.yml b/lookup_tables/ipinfo/ipinfo_privacy.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_privacy_datalake.yml b/lookup_tables/ipinfo/ipinfo_privacy_datalake.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/tor/tor_exit_nodes.yml b/lookup_tables/tor/tor_exit_nodes.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/packs/netskope.yml b/packs/netskope.yml
@@ -4,7 +4,6 @@ Description: Group of all Netskope detections
 PackDefinition:
   IDs:
     - Netskope.AdminLoggedOutLoginFailures
-    - Netskope.AdminUserChange
     - Netskope.ManyDeletes
     - Netskope.NetskopePersonnelActivity
     - Netskope.UnauthorizedAPICalls

diff --git a/rules/netskope_rules/netskope_admin_user_change.yml b/rules/netskope_rules/netskope_admin_user_change.yml