mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 17:59:23 -04:00
[SIEM][Detection Engine] - Update DE to work with new exceptions schema (#69715)
* Updates list entry schema, exposes exception list client, updates tests * create new de list schema and unit tests * updated route unit tests and types to match new list schema * updated existing DE exceptions code so it should now work as is with updated schema * test and types cleanup * cleanup * update unit test * updates per feedback
This commit is contained in:
parent
7a557822f3
commit
f7acbbe7a1
71 changed files with 2528 additions and 2194 deletions
|
@ -157,12 +157,14 @@ And you can attach exception list items like so:
|
|||
{
|
||||
"field": "actingProcess.file.signer",
|
||||
"operator": "included",
|
||||
"match": "Elastic, N.V."
|
||||
"type": "match",
|
||||
"value": "Elastic, N.V."
|
||||
},
|
||||
{
|
||||
"field": "event.category",
|
||||
"operator": "included",
|
||||
"match_any": [
|
||||
"type": "match_any",
|
||||
"value": [
|
||||
"process",
|
||||
"malware"
|
||||
]
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue