-
Notifications
You must be signed in to change notification settings - Fork 8.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution] User can make Exceptions for Memory protection alerts #102196
Changes from all commits
906d856
fd6558a
7f64258
d3819a0
ba3307e
708355c
9cdc535
c050bca
e3091e8
5d0484e
3e590c4
e39e7b2
55800eb
25a6e0e
1efeb8e
2e4b21d
f1f968f
571902e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -30,6 +30,8 @@ import { ProcessEcs } from './process'; | |
import { SystemEcs } from './system'; | ||
import { ThreatEcs } from './threat'; | ||
import { Ransomware } from './ransomware'; | ||
import { MemoryProtection } from './memory_protection'; | ||
import { Target } from './target_type'; | ||
|
||
export interface Ecs { | ||
_id: string; | ||
|
@@ -63,4 +65,7 @@ export interface Ecs { | |
// This should be temporary | ||
eql?: { parentId: string; sequenceNumber: string }; | ||
Ransomware?: Ransomware; | ||
// eslint-disable-next-line @typescript-eslint/naming-convention | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Curious: did this really error? I see keys in other areas here starting with Capital letter and including underscores with no eslint disable rules on them There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @paul-tavares can you point me to places where there are keys like this without eslint errors? |
||
Memory_protection?: MemoryProtection; | ||
Target?: Target; | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0; you may not use this file except in compliance with the Elastic License | ||
* 2.0. | ||
*/ | ||
export interface MemoryProtection { | ||
cross_session?: boolean; | ||
feature?: string; | ||
parent_to_child?: boolean; | ||
self_injection?: boolean; | ||
unique_key_v1?: string; | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -37,4 +37,5 @@ export interface ProcessParentData { | |
export interface Thread { | ||
id?: number[]; | ||
start?: string[]; | ||
Ext?: Ext; | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0; you may not use this file except in compliance with the Elastic License | ||
* 2.0. | ||
*/ | ||
|
||
import { ProcessEcs } from '../process'; | ||
|
||
export interface Target { | ||
process: ProcessEcs; | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what does
Pe
suffix mean? Can we spell it out instead of shorten it up (if possible)? (same for other areas below where this suffix is used)There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am not sure what it means, maybe "portable executable". Everywhere inside the indexes is mentioned as PE. @kevinlog do you know?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes it's a Portable Executable file that's found in memory.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@gabriellandau should we change the keys to reflect the fullname?
@paul-tavares perhaps if we use the abbreviation everywhere it might come more confusing if we use the fullname in some place and the short in other. Perhaps better add a comment to explain the full meaning?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think it's necessary.
pe
is an ECS field. I was following that convention with these other field names.