Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Detections] Add support for Value Lists within exceptions to Event Correlation Rules #92347

Closed
spong opened this issue Feb 23, 2021 · 6 comments
Closed

[Security Solution][Detections] Add support for Value Lists within exceptions to Event Correlation Rules #92347

spong opened this issue Feb 23, 2021 · 6 comments
Labels
enhancement New value added to drive a business result Feature:Event Correlation (EQL) Rule Security Solution Event Correlation (EQL) Rule feature Feature:Rule Exceptions Security Solution Rule Exceptions feature Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: correlation Security Solution Advanced Correlation Theme

Comments

@spong
Copy link
Member

spong commented Feb 23, 2021

This enhancement is for adding support for Value Lists within exceptions to Event Correlation Rules.

Related: #84385
@spong spong added enhancement New value added to drive a business result Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Rule Exceptions Security Solution Rule Exceptions feature Feature:Event Correlation (EQL) Rule Security Solution Event Correlation (EQL) Rule feature labels Feb 23, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@peluja1012 peluja1012 added Theme: correlation Security Solution Advanced Correlation Theme Team:Detection Alerts Security Detection Alerts Area Team labels Oct 22, 2021
@kowalczyk-p
Copy link

This would be a great feature. Is there any chance for this in near time?

@twanva
Copy link

twanva commented Jul 26, 2022

Hi,

I'm also interested in this feature, any updates?

@jethr0null
Copy link

Thanks for your inquiry! We have prioritized working on this feature and are actively researching possible implementations.

@marshallmain
Copy link
Contributor

Implemented by #133254

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New value added to drive a business result Feature:Event Correlation (EQL) Rule Security Solution Event Correlation (EQL) Rule feature Feature:Rule Exceptions Security Solution Rule Exceptions feature Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: correlation Security Solution Advanced Correlation Theme
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@peluja1012 @jethr0null @spong @elasticmachine @twanva @marshallmain @kowalczyk-p