lookback adjust (elastic#64837) (elastic#64922)

increase lookback to 15 minutes for latency in endpoint signal rules
rylnd · Apr 30, 2020 · 01d40bd · 01d40bd
1 parent 0158546
commit 01d40bd
Show file tree

Hide file tree

Showing 15 changed files with 16 additions and 16 deletions.
diff --git a/...engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json b/...engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...ction_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json b/...ction_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],
@@ -17,4 +17,4 @@
   ],
   "type": "query",
   "version": 2
-}
+}
diff --git a/...tion_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json b/...tion_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/..._engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json b/..._engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json b/...engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/.../detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json b/.../detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json b/...detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/.../detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json b/.../detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json b/...detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...n_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json b/...n_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/..._engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json b/..._engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/..._engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json b/..._engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json b/...engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...tection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json b/...tection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint detected Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],

diff --git a/...ection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json b/...ection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json
@@ -1,6 +1,6 @@
 {
   "description": "Elastic Endpoint prevented Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
-  "from": "now-660s",
+  "from": "now-15m",
   "index": [
     "endgame-*"
   ],