Skip to content

Conversation

terrancedejesus
Copy link
Contributor

@terrancedejesus terrancedejesus commented Dec 9, 2024

Pull Request

Issue link(s): As part of double bumps seen in #4289

Summary - What I changed

  • Minstack Github to 8.13.0

For versions v8.13.0 and above

 "related_integrations": [ { "package": "github", "version": "^2.0.0" } ], 

For versions v8.12.0 and below

 "related_integrations": [ { "package": "github", "version": "^1.0.0" } ], 
  • Minstack Okta to 8.15.0

For versions v8.15.0 and above

 "related_integrations": [ { "package": "okta", "version": "^3.0.0" } ], 

For versions v8.14.0 and below

 "related_integrations": [ { "package": "okta", "version": "^2.0.0" } ], 

How To Test

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@terrancedejesus terrancedejesus added Integration: Okta okta related rules Rule: Tuning tweaking or tuning an existing rule Integration: GitHub GitHub integration labels Dec 9, 2024
@protectionsmachine
Copy link
Collaborator

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.
@shashank-elastic shashank-elastic self-assigned this Dec 9, 2024
@shashank-elastic shashank-elastic requested a review from a team December 9, 2024 14:55
@shashank-elastic shashank-elastic marked this pull request as ready for review December 9, 2024 14:55
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Manual review, looks good to me once unit tests pass! 👍

Context PR

@botelastic botelastic bot added the bbr Building Block Rules label Dec 9, 2024
Copy link
Contributor

@shashank-elastic shashank-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with unit test passing we can merge

@shashank-elastic shashank-elastic merged commit 052672b into main Dec 9, 2024
13 checks passed
@shashank-elastic shashank-elastic deleted the rule-tuning-okta-github-major-integration-version-changes branch December 9, 2024 15:28
protectionsmachine pushed a commit that referenced this pull request Dec 9, 2024
…4290) Removed changes from: - rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml - rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml - rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml - rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml - rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_from_single_source.toml - rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml - rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml - rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml - rules/integrations/okta/credential_access_okta_multiple_device_token_hashes_for_single_user.toml - rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml - rules/integrations/okta/credential_access_user_impersonation_access.toml - rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml - rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml - rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml - rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml - rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml - rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml - rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml - rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml - rules/integrations/okta/impact_possible_okta_dos_attack.toml - rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml - rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml - rules/integrations/okta/initial_access_okta_fastpass_phishing.toml - rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml - rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml - rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml - rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml - rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml - rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml - rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml - rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml - rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml - rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml - rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml - rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml - rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml - rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml - rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml (selectively cherry picked from commit 052672b)
protectionsmachine pushed a commit that referenced this pull request Dec 9, 2024
…4290) Removed changes from: - rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml - rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml - rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml - rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml - rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_from_single_source.toml - rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml - rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml - rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml - rules/integrations/okta/credential_access_okta_multiple_device_token_hashes_for_single_user.toml - rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml - rules/integrations/okta/credential_access_user_impersonation_access.toml - rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml - rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml - rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml - rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml - rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml - rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml - rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml - rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml - rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml - rules/integrations/okta/impact_possible_okta_dos_attack.toml - rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml - rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml - rules/integrations/okta/initial_access_okta_fastpass_phishing.toml - rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml - rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml - rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml - rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml - rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml - rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml - rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml - rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml - rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml - rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml - rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml - rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml - rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml - rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml - rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml (selectively cherry picked from commit 052672b)
protectionsmachine pushed a commit that referenced this pull request Dec 9, 2024
protectionsmachine pushed a commit that referenced this pull request Dec 9, 2024
protectionsmachine pushed a commit that referenced this pull request Dec 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport: auto bbr Building Block Rules Domain: Cloud Workloads Integration: GitHub GitHub integration Integration: Okta okta related rules Rule: Tuning tweaking or tuning an existing rule

4 participants