Skip to content

Commit a1e4e74

Browse files
jmcarlockjmcarlock
authored
Add elastic-endpoint filter for DGA, LMD, LotL (#16209)
* Add elastic endpoint filters * add pr link
1 parent c5838cd commit a1e4e74

File tree

9 files changed

+34
-5
lines changed

9 files changed

+34
-5
lines changed

‎packages/dga/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.3.4"
3+
changes:
4+
- description: Add filtering for Elastic endpoint agents
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/16209
27
- version: "2.3.3"
38
changes:
49
- description: Remove instructions to change the `default_pipeline` for an index

‎packages/dga/kibana/ml_module/dga-ml.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@
8585
"process.name": [
8686
"elastic-agent.exe",
8787
"elastic-agent",
88+
"elastic-endpoint.exe",
89+
"elastic-endpoint",
8890
"metricbeat.exe",
8991
"metricbeat",
9092
"filebeat.exe",

‎packages/dga/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.4
22
name: dga
33
title: "Domain Generation Algorithm Detection"
4-
version: 2.3.3
4+
version: 2.3.4
55
source:
66
license: "Elastic-2.0"
77
description: "ML solution package to detect domain generation algorithm (DGA) activity in your network data."

‎packages/lmd/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.5.4"
3+
changes:
4+
- description: Add filtering for Elastic endpoint agents
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/16209
27
- version: "2.5.3"
38
changes:
49
- description: Update documentation on configuring data view for dashboards

‎packages/lmd/elasticsearch/transform/pivot_transform/transform.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ source:
77
'user.name':
88
value: system
99
- terms:
10-
'process.name': [ "elastic-agent.exe","elastic-agent","metricbeat.exe","metricbeat","filebeat.exe","filebeat","packetbeat.exe","packetbeat","winlogbeat.exe","winlogbeat" ]
10+
'process.name': [ "elastic-agent.exe","elastic-agent","elastic-endpoint.exe","elastic-endpoint","metricbeat.exe","metricbeat","filebeat.exe","filebeat","packetbeat.exe","packetbeat","winlogbeat.exe","winlogbeat" ]
1111
filter:
1212
- exists:
1313
field: process.Ext.session_info.client_address
@@ -75,5 +75,5 @@ sync:
7575
delay: 60s
7676
field: '@timestamp'
7777
_meta:
78-
fleet_transform_version: 2.4.1
78+
fleet_transform_version: 2.4.2
7979
run_as_kibana_system: false

‎packages/lmd/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.0
22
name: lmd
33
title: "Lateral Movement Detection"
4-
version: 2.5.3
4+
version: 2.5.4
55
source:
66
license: "Elastic-2.0"
77
description: "ML package to detect lateral movement based on file transfer activity and Windows RDP events."

‎packages/problemchild/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.4.4"
3+
changes:
4+
- description: Add filtering for Elastic endpoint agents
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/16209
27
- version: "2.4.3"
38
changes:
49
- description: Update installation instructions

‎packages/problemchild/kibana/ml_module/problemchild-ml.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,8 @@
297297
"process.name": [
298298
"elastic-agent.exe",
299299
"elastic-agent",
300+
"elastic-endpoint.exe",
301+
"elastic-endpoint",
300302
"metricbeat.exe",
301303
"metricbeat",
302304
"filebeat.exe",
@@ -342,6 +344,8 @@
342344
"process.name": [
343345
"elastic-agent.exe",
344346
"elastic-agent",
347+
"elastic-endpoint.exe",
348+
"elastic-endpoint",
345349
"metricbeat.exe",
346350
"metricbeat",
347351
"filebeat.exe",
@@ -387,6 +391,8 @@
387391
"process.name": [
388392
"elastic-agent.exe",
389393
"elastic-agent",
394+
"elastic-endpoint.exe",
395+
"elastic-endpoint",
390396
"metricbeat.exe",
391397
"metricbeat",
392398
"filebeat.exe",
@@ -432,6 +438,8 @@
432438
"process.name": [
433439
"elastic-agent.exe",
434440
"elastic-agent",
441+
"elastic-endpoint.exe",
442+
"elastic-endpoint",
435443
"metricbeat.exe",
436444
"metricbeat",
437445
"filebeat.exe",
@@ -477,6 +485,8 @@
477485
"process.name": [
478486
"elastic-agent.exe",
479487
"elastic-agent",
488+
"elastic-endpoint.exe",
489+
"elastic-endpoint",
480490
"metricbeat.exe",
481491
"metricbeat",
482492
"filebeat.exe",
@@ -522,6 +532,8 @@
522532
"process.name": [
523533
"elastic-agent.exe",
524534
"elastic-agent",
535+
"elastic-endpoint.exe",
536+
"elastic-endpoint",
525537
"metricbeat.exe",
526538
"metricbeat",
527539
"filebeat.exe",

‎packages/problemchild/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.0
22
name: problemchild
33
title: "Living off the Land Attack Detection"
4-
version: 2.4.3
4+
version: 2.4.4
55
source:
66
license: "Elastic-2.0"
77
description: "ML solution package to detect Living off the Land (LotL) attacks in your environment. Requires a Platinum subscription."

0 commit comments

Comments
 (0)