Justin Ibarra comments

Results 8 comments of


                                            Justin Ibarra

[Rule Tuning] Update rules using NPC integration and non-ECS fields

After chatting more with @efd6, the `header.*` fields will also be updated to be more compatible as: - `http.response.Headers.*` - `http.request.Headers.*` We can await that upstream change, pull in the...

[Rule Tuning] Update rules using NPC integration and non-ECS fields

Due to this [bug](https://github.com/elastic/detection-rules/pull/3194#discussion_r1427514545), this is blocked until #3556 is resolved!

[Meta] Integration Validation Refactoring

This might be a duplicate of (or should be added as `part of` #3556

[New Rule] Searches for sensitive files via Google Workspace Cloud Search

cc: @terrancedejesus

[FR] Add white space checking for KQL parse

This should probably be handled in the grammar instead

Revert "[Bug] Handle formatting empty list"

> Id either make the changes suggested [here](https://github.com/elastic/detection-rules/pull/4086#issuecomment-2356772048) or open a PR that will. Also if you have an example of this, can you share? huh? This isn't for resolving...

[FR] Add Support for Python 3.13

To fix this you should just need to [bump](https://github.com/elastic/detection-rules/blob/e028bf7954b55ae5a44b15775547a0ded6cb4981/pyproject.toml#L38) `python-extenstions` to 4.13.2. The error was fixed upstream in https://github.com/python/typing_extensions/issues/377: >we were creating instances of typing.TypeVar, then trying to monkeypatch __default__...

[FR] Add `source_updated_at` to Rule Schema as a Build Time Field

Hello @jpdjere 👋 , Can you provide more context for this request? We are just trying to understand the reasoning and whether this is the best representation of this information....