diff --git a/packages/ded/changelog.yml b/packages/ded/changelog.yml index 0e77fd7f579..6f8ea04ded9 100644 --- a/packages/ded/changelog.yml +++ b/packages/ded/changelog.yml @@ -1,3 +1,8 @@ +- version: "3.1.1" + changes: + - description: Add threat_tactics and threat_techniques to ML job custom_settings. + type: enhancement + link: https://github.com/elastic/integrations/pull/19220 - version: "3.1.0" changes: - description: Update default index pattern for ML jobs to use the transform-generated index directly diff --git a/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml b/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml index 04240f5b7c8..48cbe5a28ac 100644 --- a/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml +++ b/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml @@ -1,12 +1,12 @@ dest: - index: ml_network_ded_ea-3.1.0 + index: ml_network_ded_ea-3.1.1 aliases: - alias: ml_network_ded_ea.latest move_on_creation: true - alias: ml_network_ded_ea.all move_on_creation: false - pipeline: 3.1.0-ml_ded_ingest_pipeline + pipeline: 3.1.1-ml_ded_ingest_pipeline description: This transform runs every 30 minutes and collects network logs to detect data exfiltration in your environment for the past month up to the runtime. frequency: 30m pivot: @@ -103,5 +103,5 @@ sync: delay: 120s field: "@timestamp" _meta: - fleet_transform_version: 3.1.0 + fleet_transform_version: 3.1.1 run_as_kibana_system: false diff --git a/packages/ded/kibana/ml_module/ded-ml.json b/packages/ded/kibana/ml_module/ded-ml.json index 82744605a5a..039cb8dafe6 100644 --- a/packages/ded/kibana/ml_module/ded-ml.json +++ b/packages/ded/kibana/ml_module/ded-ml.json @@ -87,7 +87,13 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010" + ], + "threat_techniques": [ + "T1041" + ] } } }, @@ -127,7 +133,13 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010" + ], + "threat_techniques": [ + "T1041" + ] } } }, @@ -168,7 +180,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010", + "TA0011" + ], + "threat_techniques": [ + "T1041", + "T1571" + ] } } }, @@ -210,7 +230,13 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010" + ], + "threat_techniques": [ + "T1041" + ] } } }, @@ -251,7 +277,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010" + ], + "threat_techniques": [ + "T1052", + "T1052.001" + ] } } }, @@ -291,7 +324,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010" + ], + "threat_techniques": [ + "T1052", + "T1052.001" + ] } } }, @@ -331,7 +371,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-ded" + "created_by": "ml-module-ded", + "threat_tactics": [ + "TA0010" + ], + "threat_techniques": [ + "T1011", + "T1011.001" + ] } } } diff --git a/packages/ded/manifest.yml b/packages/ded/manifest.yml index ebdb619f4f6..c8c8330d574 100644 --- a/packages/ded/manifest.yml +++ b/packages/ded/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: ded title: "Data Exfiltration Detection" -version: 3.1.0 +version: 3.1.1 source: license: "Elastic-2.0" description: "ML package to detect data exfiltration in your network and file data." diff --git a/packages/dga/changelog.yml b/packages/dga/changelog.yml index b922a4c29f6..caf74daddc6 100644 --- a/packages/dga/changelog.yml +++ b/packages/dga/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.0.1" + changes: + - description: Add threat_tactics and threat_techniques to ML job custom_settings. + type: enhancement + link: https://github.com/elastic/integrations/pull/19220 - version: "3.0.0" changes: - description: Adds new fields for entity resolution with Entity Analytics in Elastic Stack 9.4. Includes a new ML job. diff --git a/packages/dga/kibana/ml_module/dga-ml.json b/packages/dga/kibana/ml_module/dga-ml.json index 5628ef1216c..7ddc868b47f 100644 --- a/packages/dga/kibana/ml_module/dga-ml.json +++ b/packages/dga/kibana/ml_module/dga-ml.json @@ -57,7 +57,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-dga" + "created_by": "ml-module-dga", + "threat_tactics": [ + "TA0011" + ], + "threat_techniques": [ + "T1071", + "T1071.004", + "T1568", + "T1568.002" + ] } } } diff --git a/packages/dga/manifest.yml b/packages/dga/manifest.yml index 2825f46caff..43c6850d0bc 100644 --- a/packages/dga/manifest.yml +++ b/packages/dga/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.4 name: dga title: "Domain Generation Algorithm Detection" -version: 3.0.0 +version: 3.0.1 source: license: "Elastic-2.0" description: "ML solution package to detect domain generation algorithm (DGA) activity in your network data." diff --git a/packages/lmd/changelog.yml b/packages/lmd/changelog.yml index 800b5b5be20..ba93b63c770 100644 --- a/packages/lmd/changelog.yml +++ b/packages/lmd/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.1.2" + changes: + - description: Add threat_tactics and threat_techniques to ML job custom_settings. + type: enhancement + link: https://github.com/elastic/integrations/pull/19220 - version: "3.1.1" changes: - description: Update documentation on ML jobs requirements diff --git a/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml b/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml index 774ac104f27..772d3975800 100644 --- a/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml +++ b/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml @@ -86,5 +86,5 @@ sync: delay: 60s field: '@timestamp' _meta: - fleet_transform_version: 3.1.1 + fleet_transform_version: 3.1.2 run_as_kibana_system: false diff --git a/packages/lmd/kibana/ml_module/lmd-ml.json b/packages/lmd/kibana/ml_module/lmd-ml.json index 81893ce41f6..203d2c08a38 100644 --- a/packages/lmd/kibana/ml_module/lmd-ml.json +++ b/packages/lmd/kibana/ml_module/lmd-ml.json @@ -72,7 +72,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1210", + "T1570" + ] } } }, @@ -110,7 +117,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008", + "TA0009" + ], + "threat_techniques": [ + "T1210", + "T1570", + "T1039" + ] } } }, @@ -148,7 +164,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1210", + "T1570" + ] } } }, @@ -186,7 +209,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1210", + "T1570" + ] } } }, @@ -232,7 +262,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } }, @@ -278,7 +316,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } }, @@ -324,7 +370,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } }, @@ -361,7 +415,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } }, @@ -399,7 +461,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } }, @@ -437,7 +507,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } }, @@ -483,7 +561,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-lmd" + "created_by": "ml-module-lmd", + "threat_tactics": [ + "TA0008" + ], + "threat_techniques": [ + "T1021", + "T1021.001", + "T1210" + ] } } } diff --git a/packages/lmd/manifest.yml b/packages/lmd/manifest.yml index 0f784618a3c..d070e92adcc 100644 --- a/packages/lmd/manifest.yml +++ b/packages/lmd/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: lmd title: "Lateral Movement Detection" -version: 3.1.1 +version: 3.1.2 source: license: "Elastic-2.0" description: "ML package to detect lateral movement based on file transfer activity and Windows RDP events." diff --git a/packages/pad/changelog.yml b/packages/pad/changelog.yml index ea1c10e1526..e0ee27170e7 100644 --- a/packages/pad/changelog.yml +++ b/packages/pad/changelog.yml @@ -1,3 +1,8 @@ +- version: "2.1.1" + changes: + - description: Add threat_tactics and threat_techniques to ML job custom_settings. + type: enhancement + link: https://github.com/elastic/integrations/pull/19220 - version: "2.1.0" changes: - description: Update default index pattern for ML jobs to use the transform-generated index directly diff --git a/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml b/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml index 38e6b75040a..cb6f5b729c4 100644 --- a/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml +++ b/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml @@ -18,7 +18,7 @@ source: - terms: '_tier': [ "data_cold", "data_frozen" ] dest: - index: ml_okta_multiple_user_sessions_pad_ea-2.1.0 + index: ml_okta_multiple_user_sessions_pad_ea-2.1.1 aliases: - alias: ml_okta_multiple_user_sessions_pad_ea.latest move_on_creation: true @@ -70,5 +70,5 @@ sync: delay: 60s field: '@timestamp' _meta: - fleet_transform_version: 2.1.0 + fleet_transform_version: 2.1.1 run_as_kibana_system: false \ No newline at end of file diff --git a/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml b/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml index 222288758ce..e5fa6c84fb0 100644 --- a/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml +++ b/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml @@ -20,7 +20,7 @@ source: - terms: '_tier': [ "data_cold", "data_frozen" ] dest: - index: ml_windows_privilege_type_pad_ea-2.1.0 + index: ml_windows_privilege_type_pad_ea-2.1.1 aliases: - alias: ml_windows_privilege_type_pad_ea.latest move_on_creation: true @@ -70,5 +70,5 @@ sync: delay: 60s field: '@timestamp' _meta: - fleet_transform_version: 2.1.0 + fleet_transform_version: 2.1.1 run_as_kibana_system: false \ No newline at end of file diff --git a/packages/pad/kibana/ml_module/pad-ml.json b/packages/pad/kibana/ml_module/pad-ml.json index 134d9220bc7..65a75f5b453 100644 --- a/packages/pad/kibana/ml_module/pad-ml.json +++ b/packages/pad/kibana/ml_module/pad-ml.json @@ -113,7 +113,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1078.002" + ] } } }, @@ -154,7 +162,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0005" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1134" + ] } } }, @@ -195,7 +212,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1078", + "T1098", + "T1098.007" + ] } } }, @@ -235,7 +261,17 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098", + "T1136" + ] } } }, @@ -274,7 +310,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098" + ] } } }, @@ -314,7 +359,19 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0007", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098", + "T1098.007", + "T1069" + ] } } }, @@ -354,7 +411,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0005" + ], + "threat_techniques": [ + "T1078" + ] } } }, @@ -394,7 +458,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0001" + ], + "threat_techniques": [ + "T1078" + ] } } }, @@ -436,7 +507,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0001" + ], + "threat_techniques": [ + "T1078" + ] } } }, @@ -474,7 +552,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004" + ], + "threat_techniques": [ + "T1078", + "T1548" + ] } } }, @@ -512,7 +597,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004" + ], + "threat_techniques": [ + "T1078", + "T1548" + ] } } }, @@ -551,7 +643,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0005" + ], + "threat_techniques": [ + "T1078", + "T1027" + ] } } }, @@ -592,7 +692,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098" + ] } } }, @@ -633,7 +742,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1078", + "T1098" + ] } } }, @@ -676,7 +793,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098" + ] } } }, @@ -716,7 +842,16 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098" + ] } } }, @@ -756,7 +891,17 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078", + "T1098", + "T1098.007" + ] } } }, @@ -795,7 +940,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0003" + ], + "threat_techniques": [ + "T1068", + "T1078" + ] } } }, @@ -835,7 +988,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0001" + ], + "threat_techniques": [ + "T1078", + "T1078.004" + ] } } }, @@ -876,7 +1037,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0001" + ], + "threat_techniques": [ + "T1078", + "T1078.004" + ] } } }, @@ -915,7 +1084,15 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-pad" + "created_by": "ml-module-pad", + "threat_tactics": [ + "TA0004", + "TA0001" + ], + "threat_techniques": [ + "T1078", + "T1078.004" + ] } } } diff --git a/packages/pad/manifest.yml b/packages/pad/manifest.yml index e0c2aed2c80..09bf3c6f2ae 100644 --- a/packages/pad/manifest.yml +++ b/packages/pad/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: pad title: "Privileged Access Detection" -version: 2.1.0 +version: 2.1.1 source: license: "Elastic-2.0" description: "ML package to detect anomalous privileged access activity in Windows, Linux and Okta logs" diff --git a/packages/problemchild/changelog.yml b/packages/problemchild/changelog.yml index 4529df026ec..307fec5a992 100644 --- a/packages/problemchild/changelog.yml +++ b/packages/problemchild/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.0.2" + changes: + - description: Add threat_tactics and threat_techniques to ML job custom_settings. + type: enhancement + link: https://github.com/elastic/integrations/pull/19220 - version: "3.0.1" changes: - description: Update documentation to clarify supported integrations diff --git a/packages/problemchild/kibana/ml_module/problemchild-ml.json b/packages/problemchild/kibana/ml_module/problemchild-ml.json index 111fefc2d5f..19e53ab7f3f 100644 --- a/packages/problemchild/kibana/ml_module/problemchild-ml.json +++ b/packages/problemchild/kibana/ml_module/problemchild-ml.json @@ -67,7 +67,13 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-problem-child" + "created_by": "ml-module-problem-child", + "threat_tactics": [ + "TA0005" + ], + "threat_techniques": [ + "T1218" + ] } } }, @@ -113,7 +119,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-problem-child" + "created_by": "ml-module-problem-child", + "threat_tactics": [ + "TA0005" + ], + "threat_techniques": [ + "T1036", + "T1218" + ] } } }, @@ -151,7 +164,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-problem-child" + "created_by": "ml-module-problem-child", + "threat_tactics": [ + "TA0005" + ], + "threat_techniques": [ + "T1036", + "T1218" + ] } } }, @@ -190,7 +210,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-problem-child" + "created_by": "ml-module-problem-child", + "threat_tactics": [ + "TA0005" + ], + "threat_techniques": [ + "T1036", + "T1218" + ] } } }, @@ -236,7 +263,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-problem-child" + "created_by": "ml-module-problem-child", + "threat_tactics": [ + "TA0005" + ], + "threat_techniques": [ + "T1036", + "T1218" + ] } } }, @@ -283,7 +317,14 @@ "time_format": "epoch_ms" }, "custom_settings": { - "created_by": "ml-module-problem-child" + "created_by": "ml-module-problem-child", + "threat_tactics": [ + "TA0005" + ], + "threat_techniques": [ + "T1036", + "T1218" + ] } } } diff --git a/packages/problemchild/manifest.yml b/packages/problemchild/manifest.yml index db4e0f3c335..7106625530c 100644 --- a/packages/problemchild/manifest.yml +++ b/packages/problemchild/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: problemchild title: "Living off the Land Attack Detection" -version: 3.0.1 +version: 3.0.2 source: license: "Elastic-2.0" description: "ML solution package to detect Living off the Land (LotL) attacks in your environment. Requires a Platinum subscription."