ESCU 6 Manual Migrations

[ljstella]

Details

Working through rba_upgrade_tracking.json

done so far:

• "Correlation" type searches that did not have entities
• "Multiple non-user entities but no user entities"
• Unbalanced $ in risk message
• Multiple user-type entities
• Messages missing a $ or not referencing a field
• Baselines (see below)

[ljstella]

Baselines:

baselines/dnstwist_domain_names.yml <- flagged because it previously listed a detection that used it, but that detection doesn't exist. However, there are other detections that use it, so it has to stay for now.

modified: baselines/baseline_of_network_acl_activity_by_arn.yml <- dangling
modified: baselines/baseline_of_security_group_activity_by_arn.yml <- dangling
modified: baselines/create_a_list_of_approved_aws_service_accounts.yml <- dangling
modified: baselines/discover_dns_records.yml <- dangling
modified: baselines/previously_seen_command_line_arguments.yml <- dangling

As far as I can tell, these others are "dangling" - they are no longer referenced by any existing detections. Not easy to tell if other folks are still using them for their own purposes, but I'd suggest we follow up post 6.0 launch and mark these for removal.

[ljstella]

contentctl-ng build now successfully builds a package!

[pyth0n1c]

Thanks Lou! All these changes look great!
This has my approval from the SCE Side!

I have also committed updated schemas/ myself. These were updated since the MANUAL_REVIEW content now parses correctly, which means they make it into the enums that make up the schema files.