[SIEM][Detection Engine] - Update DE to work with new exceptions schema (#69715)

* Updates list entry schema, exposes exception list client, updates tests

* create new de list schema and unit tests

* updated route unit tests and types to match new list schema

* updated existing DE exceptions code so it should now work as is with updated schema

* test and types cleanup

* cleanup

* update unit test

* updates per feedback
This commit is contained in:
Yara Tercero 2020-06-25 09:47:05 -04:00 committed by GitHub
parent 7a557822f3
commit f7acbbe7a1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
71 changed files with 2528 additions and 2194 deletions

View file

@ -157,12 +157,14 @@ And you can attach exception list items like so:
{
"field": "actingProcess.file.signer",
"operator": "included",
"match": "Elastic, N.V."
"type": "match",
"value": "Elastic, N.V."
},
{
"field": "event.category",
"operator": "included",
"match_any": [
"type": "match_any",
"value": [
"process",
"malware"
]