Rules

[n2x4]

Just wanted to say thanks for the work you've put in on this project - got it up and running on Elastic 7.15 and it went very smooth! I know there's some plans for adding rules. I've been thinking about some rule use cases and have only thought of two in particular-

• Trigger alert on new Critical Vulnerability finding
• Trigger alert on vulnerability associated with a high risk endpoint

Curious if you had ideas for others.

[nicpenning]

Good rules! Next revamp of the code, I will try to include some of those. Feel free to push out a pull request and I can review and add it in!

[n2x4]

Very much a Github noob - if I figure it out I will definitely get a pull request together, would love to contribute.

Currently looking at a process to pull in the CISA known exploited vulnerabilities CVE list https://www.cisa.gov/known-exploited-vulnerabilities-catalog into Elastic and then run rules where any CVE in the nessus index that shows up on the CISA index generates an alert.

[nicpenning]

Good idea 💡

I hope to do some overhaul and get a basic rule in here so that you can use it as a template to create your own.