From fc860f80ecae442e90ccb16a9991014b5ade0deb Mon Sep 17 00:00:00 2001 From: kirtisodhi Date: Mon, 6 Jul 2026 14:55:37 -0400 Subject: [PATCH] Migrate packetbeat jobs under security network module --- .../command_and_control_ml_packetbeat_dns_tunneling.toml | 8 ++++---- ...mmand_and_control_ml_packetbeat_rare_dns_question.toml | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/rules/ml/command_and_control_ml_packetbeat_dns_tunneling.toml b/rules/ml/command_and_control_ml_packetbeat_dns_tunneling.toml index 2d1f9b33b62..2fbb11dc76a 100644 --- a/rules/ml/command_and_control_ml_packetbeat_dns_tunneling.toml +++ b/rules/ml/command_and_control_ml_packetbeat_dns_tunneling.toml @@ -2,9 +2,9 @@ creation_date = "2020/03/25" integration = ["endpoint", "network_traffic"] maturity = "production" -min_stack_version = "9.4.0" -min_stack_comments = "Use EA (Entity Analytics) fields" -updated_date = "2026/04/01" +min_stack_version = "9.5.0" +min_stack_comments = "Migrate packetbeat job to security network module" +updated_date = "2026/07/06" [rule] anomaly_threshold = 50 @@ -24,7 +24,7 @@ false_positives = [ from = "now-45m" interval = "15m" license = "Elastic License v2" -machine_learning_job_id = "packetbeat_dns_tunneling_ea" +machine_learning_job_id = "dns_tunneling_ea" name = "DNS Tunneling" setup = """## Setup diff --git a/rules/ml/command_and_control_ml_packetbeat_rare_dns_question.toml b/rules/ml/command_and_control_ml_packetbeat_rare_dns_question.toml index 910acadb855..ca35d79f465 100644 --- a/rules/ml/command_and_control_ml_packetbeat_rare_dns_question.toml +++ b/rules/ml/command_and_control_ml_packetbeat_rare_dns_question.toml @@ -2,9 +2,9 @@ creation_date = "2020/03/25" integration = ["endpoint", "network_traffic"] maturity = "production" -min_stack_version = "9.4.0" -min_stack_comments = "Use EA (Entity Analytics) fields" -updated_date = "2026/04/01" +min_stack_version = "9.5.0" +min_stack_comments = "Migrate packetbeat job to security network module" +updated_date = "2026/07/06" [rule] anomaly_threshold = 50 @@ -27,7 +27,7 @@ false_positives = [ from = "now-45m" interval = "15m" license = "Elastic License v2" -machine_learning_job_id = "packetbeat_rare_dns_question_ea" +machine_learning_job_id = "rare_dns_question_ea" name = "Unusual DNS Activity" setup = """## Setup