From 0a8efb4e8f28d63eeb714ee51fc549dc4479d59e Mon Sep 17 00:00:00 2001 From: Ben Skelker Date: Mon, 13 Jul 2020 09:06:02 +0300 Subject: [PATCH 1/8] updates in-app links --- src/core/public/doc_links/doc_links_service.ts | 4 ++-- .../public/cases/pages/saved_object_no_permissions.tsx | 2 +- .../public/common/components/ml_popover/ml_popover.tsx | 2 +- .../components/rules/pre_packaged_rules/update_callout.tsx | 2 +- .../detection_engine/detection_engine_no_signal_index.tsx | 2 +- .../embeddables/__snapshots__/embedded_map.test.tsx.snap | 2 +- .../public/network/components/embeddables/embedded_map.tsx | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts index 0662586797164..70b25cb78787a 100644 --- a/src/core/public/doc_links/doc_links_service.ts +++ b/src/core/public/doc_links/doc_links_service.ts @@ -111,8 +111,8 @@ export class DocLinksService { }, kibana: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/index.html`, siem: { - guide: `${ELASTIC_WEBSITE_URL}guide/en/siem/guide/${DOC_LINK_VERSION}/index.html`, - gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/siem/guide/${DOC_LINK_VERSION}/install-siem.html`, + guide: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`, + gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/install-siem.html`, }, query: { luceneQuerySyntax: `${ELASTICSEARCH_DOCS}query-dsl-query-string-query.html#query-string-syntax`, diff --git a/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx b/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx index a560f697de415..7129aa04bdf69 100644 --- a/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx +++ b/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx @@ -17,7 +17,7 @@ export const CaseSavedObjectNoPermissions = React.memo(() => { { values={{ mlDocs: ( diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx index 0faf4074ed890..2ccfccba43ec9 100644 --- a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx @@ -29,7 +29,7 @@ const UpdatePrePackagedRulesCallOutComponent: React.FC {i18n.RELEASE_NOTES_HELP} diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx index 59267b5d62a26..32ae585aec191 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx @@ -16,7 +16,7 @@ export const DetectionEngineNoIndex = React.memo(() => { Map configuration help diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx index 81aa4b1671fca..ee1af9a2c1bdd 100644 --- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx +++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx @@ -185,7 +185,7 @@ export const EmbeddedMapComponent = ({ {i18n.EMBEDDABLE_HEADER_HELP} From 4cb9f7962892492e5c26ac81b55a4583850e7d34 Mon Sep 17 00:00:00 2001 From: Ben Skelker Date: Mon, 13 Jul 2020 09:18:44 +0300 Subject: [PATCH 2/8] updates links from prebuilt ML jobs --- .../detection_engine/detection_engine_user_unauthenticated.tsx | 2 +- .../prepackaged_rules/linux_anomalous_network_activity.json | 2 +- .../linux_anomalous_network_port_activity.json | 2 +- .../prepackaged_rules/linux_anomalous_network_service.json | 2 +- .../prepackaged_rules/linux_anomalous_network_url_activity.json | 2 +- .../prepackaged_rules/linux_anomalous_process_all_hosts.json | 2 +- .../rules/prepackaged_rules/linux_anomalous_user_name.json | 2 +- .../rules/prepackaged_rules/packetbeat_dns_tunneling.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_dns_question.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_server_domain.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_urls.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_user_agent.json | 2 +- .../rules/prepackaged_rules/rare_process_by_host_linux.json | 2 +- .../rules/prepackaged_rules/rare_process_by_host_windows.json | 2 +- .../rules/prepackaged_rules/suspicious_login_activity.json | 2 +- .../prepackaged_rules/windows_anomalous_network_activity.json | 2 +- .../prepackaged_rules/windows_anomalous_path_activity.json | 2 +- .../prepackaged_rules/windows_anomalous_process_all_hosts.json | 2 +- .../prepackaged_rules/windows_anomalous_process_creation.json | 2 +- .../rules/prepackaged_rules/windows_anomalous_script.json | 2 +- .../rules/prepackaged_rules/windows_anomalous_service.json | 2 +- .../rules/prepackaged_rules/windows_anomalous_user_name.json | 2 +- .../rules/prepackaged_rules/windows_rare_user_runas_event.json | 2 +- .../windows_rare_user_type10_remote_login.json | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx index a353be80c7239..6123e3740e306 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx @@ -17,7 +17,7 @@ export const DetectionEngineUserUnauthenticated = React.memo(() => { Date: Mon, 13 Jul 2020 09:53:34 +0300 Subject: [PATCH 3/8] updates kibana help window text and link --- .../public/common/components/help_menu/index.tsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx index 56f0c825aa59e..a8eeeef1603e9 100644 --- a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx +++ b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx @@ -14,12 +14,12 @@ export const HelpMenu = React.memo(() => { useEffect(() => { chrome.setHelpExtension({ appName: i18n.translate('xpack.securitySolution.chrome.help.appName', { - defaultMessage: 'SIEM', + defaultMessage: 'Security Solution', }), links: [ { content: i18n.translate('xpack.securitySolution.chrome.helpMenu.documentation', { - defaultMessage: 'SIEM documentation', + defaultMessage: 'Security documentation', }), href: docLinks.links.siem.guide, iconType: 'documents', From aaa7e2a4ca0ac911622de140570fecd3b6b7e154 Mon Sep 17 00:00:00 2001 From: Ben Skelker Date: Mon, 13 Jul 2020 10:13:58 +0300 Subject: [PATCH 4/8] removes problematic terminolgy from prebuilt job descriptions --- .../network_proxy_port_activity_to_the_internet.json | 2 +- .../windows_misc_lolbin_connecting_to_the_internet.json | 2 +- ...dows_register_server_program_connecting_to_the_internet.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json index 35ba1ca806296..a60aabd019683 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json @@ -1,7 +1,7 @@ { "description": "This rule detects events that may describe network events of proxy use to the Internet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically, environments will use an internal IP address for a proxy server. It can also be used to circumvent network controls and detection mechanisms.", "false_positives": [ - "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." + "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. If desired, internet proxy services using these ports can be added to allowlists. Some screen recording applications may use these ports. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." ], "index": [ "filebeat-*" diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json index 361a3e99b4dbd..f61f117c86c10 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json @@ -1,5 +1,5 @@ { - "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation.", "index": [ "winlogbeat-*" ], diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json index f6fc38f963640..ee95ac70dfa1f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json @@ -1,5 +1,5 @@ { - "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", + "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary.", "false_positives": [ "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." ], From eb86e96a12da9ec68a845b46f5415e4df98c2755 Mon Sep 17 00:00:00 2001 From: Ben Skelker Date: Mon, 13 Jul 2020 18:55:24 +0300 Subject: [PATCH 5/8] Revert "removes problematic terminolgy from prebuilt job descriptions" This reverts commit aaa7e2a4ca0ac911622de140570fecd3b6b7e154, as it will be done via the rules repo. --- .../network_proxy_port_activity_to_the_internet.json | 2 +- .../windows_misc_lolbin_connecting_to_the_internet.json | 2 +- ...dows_register_server_program_connecting_to_the_internet.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json index a60aabd019683..35ba1ca806296 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json @@ -1,7 +1,7 @@ { "description": "This rule detects events that may describe network events of proxy use to the Internet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically, environments will use an internal IP address for a proxy server. It can also be used to circumvent network controls and detection mechanisms.", "false_positives": [ - "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. If desired, internet proxy services using these ports can be added to allowlists. Some screen recording applications may use these ports. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." + "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired." ], "index": [ "filebeat-*" diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json index f61f117c86c10..361a3e99b4dbd 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json @@ -1,5 +1,5 @@ { - "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation.", + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.", "index": [ "winlogbeat-*" ], diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json index ee95ac70dfa1f..f6fc38f963640 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json @@ -1,5 +1,5 @@ { - "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary.", + "description": "Identifies the native Windows tools regsvr32.exe and regsvr64.exe making a network connection. This may be indicative of an attacker bypassing whitelisting or running arbitrary scripts via a signed Microsoft binary.", "false_positives": [ "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." ], From 9234481d6d6aa9b945ae7208ad58b75a6121b80a Mon Sep 17 00:00:00 2001 From: Ben Skelker Date: Mon, 13 Jul 2020 18:57:53 +0300 Subject: [PATCH 6/8] Revert "updates links from prebuilt ML jobs" This reverts commit to update links from prebuilt jobs, will be done via the rules repo. --- .../detection_engine/detection_engine_user_unauthenticated.tsx | 2 +- .../prepackaged_rules/linux_anomalous_network_activity.json | 2 +- .../linux_anomalous_network_port_activity.json | 2 +- .../prepackaged_rules/linux_anomalous_network_service.json | 2 +- .../prepackaged_rules/linux_anomalous_network_url_activity.json | 2 +- .../prepackaged_rules/linux_anomalous_process_all_hosts.json | 2 +- .../rules/prepackaged_rules/linux_anomalous_user_name.json | 2 +- .../rules/prepackaged_rules/packetbeat_dns_tunneling.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_dns_question.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_server_domain.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_urls.json | 2 +- .../rules/prepackaged_rules/packetbeat_rare_user_agent.json | 2 +- .../rules/prepackaged_rules/rare_process_by_host_linux.json | 2 +- .../rules/prepackaged_rules/rare_process_by_host_windows.json | 2 +- .../rules/prepackaged_rules/suspicious_login_activity.json | 2 +- .../prepackaged_rules/windows_anomalous_network_activity.json | 2 +- .../prepackaged_rules/windows_anomalous_path_activity.json | 2 +- .../prepackaged_rules/windows_anomalous_process_all_hosts.json | 2 +- .../prepackaged_rules/windows_anomalous_process_creation.json | 2 +- .../rules/prepackaged_rules/windows_anomalous_script.json | 2 +- .../rules/prepackaged_rules/windows_anomalous_service.json | 2 +- .../rules/prepackaged_rules/windows_anomalous_user_name.json | 2 +- .../rules/prepackaged_rules/windows_rare_user_runas_event.json | 2 +- .../windows_rare_user_type10_remote_login.json | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx index 6123e3740e306..a353be80c7239 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx @@ -17,7 +17,7 @@ export const DetectionEngineUserUnauthenticated = React.memo(() => { Date: Mon, 13 Jul 2020 19:02:14 +0300 Subject: [PATCH 7/8] recommits the link correction after revert --- .../detection_engine/detection_engine_user_unauthenticated.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx index a353be80c7239..6123e3740e306 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx @@ -17,7 +17,7 @@ export const DetectionEngineUserUnauthenticated = React.memo(() => { Date: Wed, 15 Jul 2020 17:14:57 +0300 Subject: [PATCH 8/8] changes help window app name to Security --- .../public/common/components/help_menu/index.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx index a8eeeef1603e9..f4477740f7b58 100644 --- a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx +++ b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx @@ -14,7 +14,7 @@ export const HelpMenu = React.memo(() => { useEffect(() => { chrome.setHelpExtension({ appName: i18n.translate('xpack.securitySolution.chrome.help.appName', { - defaultMessage: 'Security Solution', + defaultMessage: 'Security', }), links: [ {