Skip to content

[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows #5155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 9 commits into from
Sep 30, 2025
Merged

[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows #5155

merged 9 commits into from
Sep 30, 2025

Conversation

terrancedejesus
Copy link
Contributor

Pull Request

Issue link(s):

Summary - What I changed

Adjusts Azure / M365 rules regarding lookback windows, interval and index scopes. Please see related issue for more details.

How To Test

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@terrancedejesus
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows
33c8207 
<!--
Thank you for your interest in and contributing to Detection Rules!
There are a few simple things to check before submitting your pull request
that can help with the review process. You should delete these items
from your submission, but they are here to help bring them to your attention.
-->
# Pull Request

*Issue link(s)*:
* #5154

<!--
  Add Related Issues / PRs for context. Eg:
    Related to elastic/repo#999
    Resolves #123
  If there is no issue link, take extra care to write a clear summary and label the PR just as you would label an issue to give additional context to reviewers.
-->

## Summary - What I changed
Adjusts Azure / M365 rules regarding lookback windows, interval and index scopes. Please see related issue for more details.

<!--
  Summarize your PR. Animated gifs are 💯. Code snippets are ⚡️. Examples & screenshots are 🔥
-->

## How To Test

<!--
  Some examples of what you could include here are:
  * Links to GitHub action results for CI test improvements
  * Sample data before/after screenshots (or short videos showing how something works)
  * Copy/pasted commands and output from the testing you did in your local terminal window
  * If tests run in GitHub, you can 🪁or 🔱, respectively, to indicate tests will run in CI
  * Query used in your stack to verify the change
-->

## Checklist

<!-- Delete any items that are not applicable to this PR. -->

- [ ] Added a label for the type of pr: `bug`, `enhancement`, `schema`, `maintenance`, `Rule: New`, `Rule: Deprecation`, `Rule: Tuning`, `Hunt: New`, or `Hunt: Tuning` so guidelines can be generated
- [ ] Added the `meta:rapid-merge` label if planning to merge within 24 hours
- [ ] Secret and sensitive material has been managed correctly
- [ ] Automated testing was updated or added to match the most common scenarios
- [ ] Documentation and comments were added for features that require explanation

## Contributor checklist

- Have you signed the [contributor license agreement](https://www.elastic.co/contributor-agreement)?
- Have you followed the [contributor guidelines](https://github.com/elastic/detection-rules/blob/main/CONTRIBUTING.md)?
@terrancedejesus terrancedejesus self-assigned this Sep 26, 2025
@github-actions GitHub Actions
Copy link
Contributor

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@terrancedejesus terrancedejesus linked an issue Sep 26, 2025 that may be closed by this pull request
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows #5154
Closed
@terrancedejesus terrancedejesus marked this pull request as ready for review September 26, 2025 20:20
terrancedejesus and others added 2 commits September 29, 2025 12:23
@terrancedejesus @imays11
Update rules/integrations/azure/initial_access_entra_illicit_consent_…
8c58d99 
…grant_via_registered_application.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
@terrancedejesus
Merge branch 'main' into terrancedejesus/issue5154
3e14e70
w0rk3r
w0rk3r reviewed Sep 29, 2025
View reviewed changes
...ions/o365/initial_access_microsoft_365_illicit_consent_grant_via_registered_application.toml
"""
from = "now-9m"
index = ["logs-o365**"]
index = ["logs-o365.audit-*"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Filebeat?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Screenshot 2025-09-30 at 3 29 27 PM

Nope.

terrancedejesus and others added 3 commits September 30, 2025 12:28
@terrancedejesus @w0rk3r
Update rules/integrations/azure/credential_access_azure_key_vault_exc…
181a6e2 
…essive_retrieval.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
@terrancedejesus
merging main
797d3ba
@terrancedejesus
update dates
f1e488a
@terrancedejesus
Update rules/integrations/o365/initial_access_microsoft_365_illicit_c…
cd86337 
…onsent_grant_via_registered_application.toml
@terrancedejesus
Update rules/integrations/o365/initial_access_microsoft_365_illicit_c…
a2eae29 
…onsent_grant_via_registered_application.toml
@terrancedejesus terrancedejesus merged commit b474a81 into main Sep 30, 2025
11 checks passed
@terrancedejesus terrancedejesus deleted the terrancedejesus/issue5154 branch September 30, 2025 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@w0rk3r w0rk3r w0rk3r approved these changes

@imays11 imays11 imays11 approved these changes

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@Samirbous Samirbous Awaiting requested review from Samirbous

@Aegrah Aegrah Awaiting requested review from Aegrah

Assignees

@terrancedejesus terrancedejesus

Labels
backport: auto Domain: Application Domain: Cloud Workloads Domain: Cloud Domain: Email Domain: Endpoint Domain: Identity Domain: Network Domain: SaaS Domain: Storage Integration: Azure azure related rules Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows
3 participants
@terrancedejesus @w0rk3r @imays11