Skip to content

Feature/#23299 create malware incidents #402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: development
Choose a base branch
from
Open

Feature/#23299 create malware incidents #402

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f7aa496
Add malware threshold to logstash cookbook
pperezredborder Nov 5, 2025
61e2c73
Pass malware score threshold as int
pperezredborder Nov 6, 2025
f8ac22e
Merge pull request #401 from redBorder/development
rgomezborder Nov 7, 2025
35aff25
Merge branch 'master' into feature/#23299_create_malware_incidents
pperezredborder Nov 7, 2025
eb5a22b
Add malware_incidents_priority
pperezredborder Nov 7, 2025
3c8dec1
Change high to critical
pperezredborder Nov 10, 2025
f3c4324
Fix attribute name
pperezredborder Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions resources/attributes/default.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -313,6 +313,7 @@

default['redborder']['manager']['malware'] = {}
default['redborder']['manager']['malware']['threshold'] = 50
default['redborder']['manager']['malware']['incidents_priority'] = 'critical'

default['redborder']['manager']['loaders']['scores'] = {}
default['redborder']['manager']['loaders']['scores']['hash'] = {}
Expand Down
2 changes: 2 additions & 0 deletions resources/recipes/configure.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -666,6 +666,8 @@
mobility_nodes node.run_state['mobility_sensors_info']
intrusion_incidents_priority_filter node['redborder']['intrusion_incidents_priority_filter']
vault_incidents_priority_filter node['redborder']['vault_incidents_priority_filter']
malware_score_threshold node['redborder']['manager']['malware']['threshold'].to_i
malware_incidents_priority node['redborder']['manager']['malware']['incidents_priority']
logstash_pipelines node.run_state['pipelines']
split_traffic_logstash split_traffic
split_intrusion_logstash split_intrusion
Expand Down