[Detection Rules] Resolves regression where Elastic Endgame rules wou…

…ld warn about unmapped timestamp override field (#96394) related to elastic/detection-rules#1082 ## Summary Endgame promotion rules in Kibana/7.12 are at version 5 and have timestamp_override defined (which should not be). These same rules are at version 4 in the detection-rules repo 7.12 branch and kibana/master and timestamp_override is not defined. These updates are targeted for 7.12.1 There most likely was an issue with the maze of backports and interlaced updates. To fix the rules, they need to be reconciled across: detection-rules 7.12 & main kibana 7.12.1 and master bump detection-rules/7.12 to v6 -> PR to kibana/master -> backport to 7.12.1 ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
elastic · Apr 8, 2021 · bc14f24 · bc14f24
1 parent 391e92e
commit bc14f24
Show file tree

Hide file tree

Showing 15 changed files with 15 additions and 15 deletions.
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/endgame_adversary_behavior_detected.json b/...ver/lib/detection_engine/rules/prepackaged_rules/endgame_adversary_behavior_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...on/server/lib/detection_engine/rules/prepackaged_rules/endgame_cred_dumping_detected.json b/...on/server/lib/detection_engine/rules/prepackaged_rules/endgame_cred_dumping_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...n/server/lib/detection_engine/rules/prepackaged_rules/endgame_cred_dumping_prevented.json b/...n/server/lib/detection_engine/rules/prepackaged_rules/endgame_cred_dumping_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/endgame_cred_manipulation_detected.json b/...rver/lib/detection_engine/rules/prepackaged_rules/endgame_cred_manipulation_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/endgame_cred_manipulation_prevented.json b/...ver/lib/detection_engine/rules/prepackaged_rules/endgame_cred_manipulation_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...olution/server/lib/detection_engine/rules/prepackaged_rules/endgame_exploit_detected.json b/...olution/server/lib/detection_engine/rules/prepackaged_rules/endgame_exploit_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...lution/server/lib/detection_engine/rules/prepackaged_rules/endgame_exploit_prevented.json b/...lution/server/lib/detection_engine/rules/prepackaged_rules/endgame_exploit_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...olution/server/lib/detection_engine/rules/prepackaged_rules/endgame_malware_detected.json b/...olution/server/lib/detection_engine/rules/prepackaged_rules/endgame_malware_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...lution/server/lib/detection_engine/rules/prepackaged_rules/endgame_malware_prevented.json b/...lution/server/lib/detection_engine/rules/prepackaged_rules/endgame_malware_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...erver/lib/detection_engine/rules/prepackaged_rules/endgame_permission_theft_detected.json b/...erver/lib/detection_engine/rules/prepackaged_rules/endgame_permission_theft_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/endgame_permission_theft_prevented.json b/...rver/lib/detection_engine/rules/prepackaged_rules/endgame_permission_theft_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/endgame_process_injection_detected.json b/...rver/lib/detection_engine/rules/prepackaged_rules/endgame_process_injection_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/endgame_process_injection_prevented.json b/...ver/lib/detection_engine/rules/prepackaged_rules/endgame_process_injection_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...tion/server/lib/detection_engine/rules/prepackaged_rules/endgame_ransomware_detected.json b/...tion/server/lib/detection_engine/rules/prepackaged_rules/endgame_ransomware_detected.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }
diff --git a/...ion/server/lib/detection_engine/rules/prepackaged_rules/endgame_ransomware_prevented.json b/...ion/server/lib/detection_engine/rules/prepackaged_rules/endgame_ransomware_prevented.json
@@ -20,5 +20,5 @@
     "Elastic Endgame"
   ],
   "type": "query",
-  "version": 4
+  "version": 6
 }