Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

THREAT-387 Sublime Security Rules #1356

Merged
merged 8 commits into from
Sep 25, 2024
Merged

THREAT-387 Sublime Security Rules #1356

merged 8 commits into from
Sep 25, 2024

Conversation

akozlovets098
Copy link
Contributor

Changes

Added Sublime Security Rules for such logs

  • rules.deactivate
  • rules.delete
  • message_source.deactivate_mailboxes
  • message_source.deactivate
  • message_source.delete

@akozlovets098 akozlovets098 requested a review from a team as a code owner September 17, 2024 14:14
@github-actions GitHub Actions
Copy link

😱
looks like some things could be wrong with the packs

[INFO][root]: ignoring file dependabot.yml

@arielkr256 arielkr256 added the rules Real-time log data detections label Sep 17, 2024
nhakmiller
nhakmiller reviewed Sep 24, 2024
View reviewed changes
Copy link
Contributor

@nhakmiller nhakmiller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Take a peek at the Sublime.Audit log schema in the threat research instance, it's different from the Custom.Sublime.AuditLogs one that we were testing with because we used a custom parser to unwrap that Events field.

rules/sublime_rules/sublime_mailboxes_deactivated.yml Outdated Show resolved Hide resolved
rules/sublime_rules/sublime_mailboxes_deactivated.yml Show resolved Hide resolved
rules/sublime_rules/sublime_message_source_deleted_or_deactivated.yml Outdated Show resolved Hide resolved
rules/sublime_rules/sublime_rules_deleted_or_deactivated.yml Outdated Show resolved Hide resolved
rules/sublime_rules/sublime_mailboxes_deactivated.py Outdated Show resolved Hide resolved
@nhakmiller
Copy link
Contributor

I updated this to use the new log schema format for these rules.

@nhakmiller
Copy link
Contributor

Also added a passthrough detection for the flagged message events.

Nicholas Hakmiller added 2 commits September 24, 2024 15:25
nhakmiller
nhakmiller approved these changes Sep 24, 2024
View reviewed changes
Copy link
Contributor

@nhakmiller nhakmiller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@arielkr256 arielkr256 enabled auto-merge (squash) September 25, 2024 18:00
@arielkr256 arielkr256 merged commit eb6753e into release Sep 25, 2024
8 checks passed
@arielkr256 arielkr256 deleted the THREAT-387-Sublime-Security-Rules branch September 25, 2024 18:04
geoffg-sentry added a commit to geoffg-sentry/panther-analysis that referenced this pull request Oct 10, 2024
@geoffg-sentry
Add AlertTitle to rule_jsonschema.json
29719d1 
panther-labs#1356 added new sublime rules and several had `AlertTitle` defined in their yamls.

Like panther-labs#1306, adding AlertTitle to the schema.
@geoffg-sentry geoffg-sentry mentioned this pull request Oct 10, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@arielkr256 arielkr256 arielkr256 approved these changes

@nhakmiller nhakmiller nhakmiller approved these changes

Assignees
No one assigned
Labels
rules Real-time log data detections
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@akozlovets098 @nhakmiller @arielkr256