endpoint_adversary_behavior_detected.toml

[metadata]
creation_date = "2020/02/18"
ecs_version = ["1.4.0"]
maturity = "production"
updated_date = "2020/02/18"

[rule]
author = ["Elastic"]
description = """
Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link
in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.
"""
from = "now-15m"
index = ["endgame-*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
name = "Adversary Behavior - Detected - Elastic Endpoint"
risk_score = 47
rule_id = "77a3c3df-8ec4-4da4-b758-878f551dee69"
severity = "medium"
tags = ["Elastic", "Endpoint"]
type = "query"

query = '''
event.kind:alert and event.module:endgame and (event.action:rules_engine_event or endgame.event_subtype_full:rules_engine_event)
'''