From 2bacbce8d1df39aa24fbbd6eb87265bb0ef3d324 Mon Sep 17 00:00:00 2001 From: eric-forte-elastic Date: Sat, 18 May 2024 09:53:57 -0400 Subject: [PATCH 1/2] Add custom rules asking for Feedback --- custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml b/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml index 1de00140a4c..3094366d8c4 100644 --- a/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml +++ b/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml @@ -16,7 +16,7 @@ interval = "5m" language = "eql" license = "Elastic License v2" max_signals = 100 -name = "DAC Demo Dev Rule 2 Updated" +name = "DAC Demo Dev Rule 2 Feedback" note = "Test Note" references = ["https://dac-reference.readthedocs.io/en/latest/"] risk_score = 47 From 6be0d62398b5c426257d8b008d32eb836b25f0bc Mon Sep 17 00:00:00 2001 From: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com> Date: Sat, 18 May 2024 09:58:14 -0400 Subject: [PATCH 2/2] Update custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml Co-authored-by: Eric Forte <113808644+eric-forte@users.noreply.github.com> --- custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml b/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml index 3094366d8c4..1c03056b589 100644 --- a/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml +++ b/custom_rules/rules/command_and_control_dac_demo_dev_rule_2.toml @@ -17,7 +17,7 @@ language = "eql" license = "Elastic License v2" max_signals = 100 name = "DAC Demo Dev Rule 2 Feedback" -note = "Test Note" +note = "This rule is part of a demo" references = ["https://dac-reference.readthedocs.io/en/latest/"] risk_score = 47 risk_score_mapping = []