File tree

• .ci
  • es-snapshots
    • Jenkinsfile_verify_es
  • jobs.yml
• BUILD.bazel
• api_docs
  • usage_collection.json
  • usage_collection.mdx
• docs
  • developer
    • getting-started
      • building-kibana.asciidoc
      • monorepo-packages.asciidoc
    • plugin
      • migrating-legacy-plugins-examples.asciidoc
  • development/core/public
    • kibana-plugin-core-public.doclinksstart.links.md
  • settings
    • reporting-settings.asciidoc
  • user
    • alerting
      • alerting-troubleshooting.asciidoc
    • reporting
      • index.asciidoc
    • security
      • reporting.asciidoc
• package.json
• packages
  • BUILD.bazel
  • kbn-analytics
    • BUILD.bazel
    • package.json
    • scripts
      • build.js
    • tsconfig.browser.json
    • tsconfig.json
  • kbn-cli-dev-mode
    • package.json
  • kbn-config
    • BUILD.bazel
    • package.json
    • tsconfig.json
  • kbn-docs-utils
    • package.json
  • kbn-optimizer
    • package.json
  • kbn-securitysolution-constants
    • BUILD.bazel
    • README.md
    • jest.config.js
    • package.json
    • src
      • index.ts
    • tsconfig.json
  • kbn-securitysolution-io-ts-utils
    • BUILD.bazel
    • README.md
    • jest.config.js
    • package.json
    • src
      • actions
        • index.ts
      • constants
        • index.mock.ts
        • index.ts
      • created_at
        • index.ts
      • created_by
        • index.ts
      • deafult_version_number
        • index.test.ts
        • index.ts
      • default_actions_array
        • index.ts
      • default_array
        • index.test.ts
        • index.ts
      • default_boolean_false
        • index.test.ts
        • index.ts
      • default_boolean_true
        • index.test.ts
        • index.ts
      • default_empty_string
        • index.test.ts
        • index.ts
      • default_export_file_name
        • index.test.ts
        • index.ts
      • default_from_string
        • index.test.ts
        • index.ts
      • default_interval_string
        • index.test.ts
        • index.ts
      • default_language_string
        • index.test.ts
        • index.ts
      • default_max_signals_number
        • index.test.ts
        • index.ts
      • default_page
        • index.test.ts
        • index.ts
      • default_per_page
        • index.test.ts
        • index.ts
      • default_risk_score_mapping_array
        • index.ts
      • default_severity_mapping_array
        • index.ts
      • default_string_array
        • index.test.ts
        • index.ts
      • default_string_boolean_false
        • index.test.ts
        • index.ts
      • default_threat_array
        • index.test.ts
        • index.ts
      • default_throttle_null
        • index.test.ts
        • index.ts
      • default_to_string
        • index.test.ts
        • index.ts
      • default_uuid
        • index.test.ts
        • index.ts
      • default_version_number
        • index.test.ts
        • index.ts
      • description
        • index.ts
      • empty_string_array
        • index.test.ts
        • index.ts
      • exact_check
        • index.test.ts
        • index.ts
      • format_errors
        • index.test.ts
        • index.ts
      • from
        • index.ts
      • id
        • index.ts
      • index.ts
      • iso_date_string
        • index.test.ts
        • index.ts
      • language
        • index.ts
      • list_types
        • comment
          • index.mock.ts
          • index.test.ts
          • index.ts
        • create_comment
          • index.mock.ts
          • index.test.ts
          • index.ts
        • default_comments_array
          • index.test.ts
          • index.ts
        • default_create_comments_array
          • index.test.ts
          • index.ts
        • default_namespace_array
          • index.test.ts
          • index.ts
        • default_namespace
          • index.test.ts
          • index.ts
        • default_update_comments_array
          • index.test.ts
          • index.ts
        • endpoint
          • entries
            • index.mock.ts
            • index.test.ts
            • index.ts
          • entry_match_any
            • index.mock.ts
            • index.test.ts
            • index.ts
          • entry_match_wildcard
            • index.ts
          • entry_match
            • index.mock.ts
            • index.test.ts
            • index.ts
          • entry_nested
            • index.mock.ts
            • index.test.ts
            • index.ts
          • index.ts
          • non_empty_nested_entries_array
            • index.ts
        • entries_exist
          • index.mock.ts
          • index.test.ts
          • index.ts
        • entries_list
          • index.mock.ts
          • index.test.ts
          • index.ts
        • entries
          • index.mock.ts
          • index.test.ts
          • index.ts
        • entry_match_any
          • index.mock.ts
          • index.test.ts
          • index.ts
        • entry_match_wildcard
          • index.mock.ts
          • index.test.ts
          • index.ts
        • entry_match
          • index.mock.ts
          • index.test.ts
          • index.ts
        • entry_nested
          • index.mock.ts
          • index.test.ts
          • index.ts
        • exception_list_item_type
          • index.ts
        • exception_list
          • index.ts
        • index.ts
        • item_id
          • index.ts
        • lists_default_array
          • index.test.ts
          • index.ts
        • lists
          • index.mock.ts
          • index.test.ts
          • index.ts
        • non_empty_entries_array
          • index.test.ts
          • index.ts
        • non_empty_nested_entries_array
          • index.test.ts
          • index.ts
        • operator
          • index.ts
        • os_type
          • index.ts
        • type
          • index.ts
        • update_comment
          • index.mock.ts
          • index.test.ts
          • index.ts
      • max_signals
        • index.ts
      • meta
        • index.ts
      • name
        • index.ts
      • non_empty_array
        • index.test.ts
        • index.ts
      • non_empty_or_nullable_string_array
        • index.test.ts
        • index.ts
      • non_empty_string
        • index.test.ts
        • index.ts
      • normalized_ml_job_id
        • index.ts
      • only_false_allowed
        • index.test.ts
        • index.ts
      • operator
        • index.ts
      • parse_schedule_dates
        • index.ts
      • positive_integer_greater_than_zero
        • index.test.ts
        • index.ts
      • positive_integer
        • index.test.ts
        • index.ts
      • references_default_array
        • index.test.ts
        • index.ts
      • risk_score_mapping
        • index.ts
      • risk_score
        • index.test.ts
        • index.ts
      • saved_object_attributes
        • index.ts
      • severity_mapping
        • index.ts
      • severity
        • index.ts
      • string_to_positive_number
        • index.ts
      • tags
        • index.ts
      • test_utils
        • index.ts
      • threat_mapping
        • index.test.ts
        • index.ts
      • threat_subtechnique
        • index.ts
      • threat_tactic
        • index.ts
      • threat_technique
        • index.ts
      • threat
        • index.ts
      • throttle
        • index.ts
      • updated_at
        • index.ts
      • updated_by
        • index.ts
      • uuid
        • index.test.ts
        • index.ts
      • validate
        • index.test.ts
        • index.ts
      • version
        • index.ts
    • tsconfig.json
  • kbn-securitysolution-utils
    • BUILD.bazel
    • README.md
    • jest.config.js
    • package.json
    • src
      • add_remove_id_to_item
        • index.test.ts
        • index.ts
      • index.ts
    • tsconfig.json
  • kbn-ui-shared-deps
    • package.json
• src
  • core
    • public
      • doc_links
        • doc_links_service.ts
      • http
        • types.ts
      • public.api.md
    • server/saved_objects
      • migrationsv2
        • actions
          • index.test.ts
          • index.ts
        • integration_tests
          • actions.test.ts
          • archives
            • 8.0.0_migrated_with_outdated_docs.zip
          • outdated_docs.test.ts
        • migrations_state_action_machine.test.ts
        • model.test.ts
        • model.ts
        • next.ts
        • types.ts
      • migrations
        • core
          • document_migrator.ts
          • elastic_index.ts
        • kibana
          • kibana_migrator.test.ts
  • fixtures/telemetry_collectors
    • nested_collector.ts
  • plugins
    • data
      • common/search/search_source
        • search_source.test.ts
      • kibana.json
      • public
        • autocomplete/collectors
          • create_usage_collector.ts
        • public.api.md
        • query/saved_query
          • saved_query_service.test.ts
          • saved_query_service.ts
        • search
          • collectors
            • create_usage_collector.ts
          • search_interceptor
            • search_interceptor.test.ts
            • search_interceptor.ts
            • utils.ts
      • server
        • server.api.md
    • discover/public/application/components
      • discover.tsx
      • doc
        • use_es_doc_search.test.tsx
        • use_es_doc_search.ts
    • inspector/public/views/requests
      • _requests.scss
    • kibana_usage_collection/server/collectors/management
      • schema.ts
      • types.ts
    • presentation_util/common
      • labs.ts
    • telemetry/schema
      • oss_plugins.json
    • usage_collection
      • public
        • components
          • index.ts
          • track_application_view
            • track_application_view.tsx
            • types.ts
        • index.ts
        • plugin.tsx
      • server
        • collector
          • collector.test.ts
          • collector.ts
          • collector_set.test.ts
          • collector_set.ts
          • index.ts
          • types.ts
          • usage_collector.ts
        • index.ts
        • mocks.ts
        • plugin.ts
        • usage_counters
          • index.ts
          • saved_objects.ts
          • usage_counter.ts
• test
  • functional
    • apps/discover
      • _doc_table.ts
    • fixtures/es_archiver/saved_objects_management
      • edit_saved_object
        • mappings.json
      • export_transform
        • mappings.json
      • hidden_saved_objects
        • mappings.json
      • hidden_types
        • mappings.json
      • show_relationships
        • mappings.json
  • scripts
    • jenkins_xpack_build_kibana.sh
• vars
  • kibanaPipeline.groovy
  • tasks.groovy
  • workers.groovy
• x-pack
  • plugins
    • actions/server
      • create_execute_function.test.ts
      • create_execute_function.ts
    • alerting/server/alerts_client
      • alerts_client.ts
      • tests
        • create.test.ts
        • update.test.ts
    • apm
      • ftr_e2e/cypress
        • integration/read_only_user
          • deep_links.spec.ts
          • home.spec.ts
          • service_overview
            • header_filters.spec.ts
            • instances_table.spec.ts
        • support
          • commands.ts
          • types.d.ts
      • public/components
        • app/service_overview/service_overview_instances_table
          • get_columns.tsx
          • index.tsx
        • shared
          • KueryBar/Typeahead
            • Suggestions.js
            • index.js
          • transaction_type_select.tsx
    • canvas
      • canvas_plugin_src/functions
        • browser
          • escount.ts
          • esdocs.ts
          • essql.ts
          • index.ts
        • server
          • escount.ts
      • common/lib
        • constants.ts
        • request
          • build_bool_array.ts
          • build_es_request.js
          • filters.ts
          • format_response.js
          • get_es_filter.ts
          • normalize_type.ts
          • sanitize_name.ts
      • i18n/functions/dict
        • escount.ts
        • esdocs.ts
        • essql.ts
      • public
        • plugin.tsx
        • services
          • context.tsx
          • expressions.ts
          • index.ts
          • search.ts
          • stubs
            • index.ts
            • search.ts
      • server
        • lib
          • essql_strategy.ts
          • query_es_sql.ts
        • plugin.ts
        • routes/es_fields
          • es_fields.ts
      • types
        • index.ts
        • strategy.ts
    • cases/common/api
      • runtime_types.ts
    • data_enhanced/public/search/sessions_mgmt
      • components
        • main.test.tsx
        • table
          • table.test.tsx
      • lib
        • api.test.ts
        • api.ts
        • documentation.ts
      • types.ts
    • enterprise_search
      • public/applications
        • enterprise_search
          • components
            • license_callout
              • constants.ts
              • index.ts
              • license_callout.test.tsx
              • license_callout.tsx
            • product_selector
              • product_selector.test.tsx
              • product_selector.tsx
            • setup_guide
              • setup_guide_cta.tsx
            • trial_callout
              • index.ts
              • trial_callout.test.tsx
              • trial_callout.tsx
          • constants.ts
        • shared
          • licensing
            • licensing_logic.test.ts
            • licensing_logic.ts
          • schema
            • add_field_modal
              • constants.tsx
              • index.test.tsx
              • index.tsx
              • utils.test.ts
              • utils.ts
            • constants.ts
            • errors_accordion
              • constants.ts
              • index.test.tsx
              • index.tsx
              • schema_errors_accordion.scss
            • index.ts
            • schema_add_field_modal.tsx
            • schema_errors_accordion.scss
            • schema_errors_accordion.tsx
        • workplace_search/views/content_sources/components/schema
          • schema_change_errors.test.tsx
          • schema_change_errors.tsx
      • server/routes/app_search
        • search_ui.test.ts
        • search_ui.ts
    • file_upload/public
      • validate_index_name.ts
    • fleet
      • common
        • constants
          • agent.ts
          • routes.ts
        • openapi
          • components/schemas
            • agent.yaml
          • paths
            • agents@{agent_id}@events.yaml
        • services
          • is_agent_upgradeable.test.ts
          • routes.ts
        • types
          • models
            • agent.ts
          • rest_spec
            • agent.ts
      • public/applications/fleet
        • constants
          • index.ts
        • hooks/use_request
          • agents.ts
        • sections/agents
          • components
            • agent_health.tsx
          • enrollment_token_list_page
            • components
              • new_enrollment_key_flyout.tsx
            • index.tsx
        • types
          • index.ts
      • server
        • constants
          • index.ts
        • plugin.ts
        • routes/agent
          • handlers.ts
          • index.ts
        • saved_objects
          • index.ts
          • migrations
            • to_v7_10_0.ts
        • services
          • agents
            • events.ts
            • helpers.ts
            • index.ts
            • saved_objects.ts
            • status.ts
          • hosts_utils.test.ts
          • hosts_utils.ts
          • output.ts
          • settings.test.ts
          • settings.ts
        • types
          • index.tsx
          • models
            • agent.ts
            • package_policy.ts
          • rest_spec
            • agent.ts
    • index_lifecycle_management
      • __jest__/client_integration
        • app
          • app.helpers.tsx
        • edit_policy
          • edit_policy.helpers.tsx
          • features
            • node_allocation.test.ts
            • node_allocation
              • cloud_aware_behavior.helpers.ts
              • cloud_aware_behavior.test.ts
              • cold_phase.helpers.ts
              • cold_phase.test.ts
              • general_behavior.helpers.ts
              • general_behavior.test.ts
              • warm_phase.helpers.ts
              • warm_phase.test.ts
          • init_test_bed.tsx
        • helpers
          • create_enable_phase_action.ts
          • create_form_set_value_action.ts
          • create_form_toggle_action.ts
          • create_node_allocation_actions.ts
          • global_mocks.tsx
          • index.ts
          • save_policy_action.ts
          • set_replicas_action.ts
          • types.ts
      • common/types
        • policies.ts
      • public/application
        • lib/data_tiers
          • get_available_node_roles_for_phase.ts
        • sections/edit_policy/components/phases/shared_fields/data_tier_allocation_field
          • components
            • data_tier_allocation.tsx
            • default_allocation_notice.tsx
            • default_allocation_warning.tsx
            • default_to_data_nodes_notice.tsx
            • default_to_data_tiers_notice.tsx
            • index.ts
            • no_custom_attributes_messages.tsx
            • no_node_attributes_warning.tsx
            • no_tiers_available_notice.tsx
            • no_tiers_available_using_node_attributes_notice.tsx
            • node_allocation.tsx
            • node_role_to_fallback_tier_map.ts
            • types.ts
            • will_use_fallback_tier_notice.tsx
            • will_use_fallback_tier_using_node_attributes_notice.tsx
          • data_tier_allocation_field.tsx
        • services
          • documentation.ts
    • infra
      • common/inventory_models/host/metrics/tsvb
        • host_system_overview.ts
      • public
        • hooks
          • use_http_request.tsx
        • pages/metrics
          • inventory_view/components/waffle
            • group_of_nodes.tsx
            • node.tsx
            • node_context_menu.tsx
          • metric_detail/components
            • page_error.tsx
        • types.ts
      • server
        • index.ts
        • routes/overview/lib
          • create_top_nodes_query.ts
    • lens
      • kibana.json
      • public
        • editor_frame_service/embeddable
          • embeddable.tsx
        • indexpattern_datasource/dimension_panel
          • dimension_editor.tsx
          • dimension_panel.test.tsx
          • field_select.tsx
    • lists/common
      • format_errors.ts
      • schemas
        • common
          • schemas.ts
        • types
          • comment.ts
          • create_comment.ts
          • default_comments_array.ts
          • default_create_comments_array.ts
          • default_namespace.ts
          • default_namespace_array.ts
          • default_string_boolean_false.ts
          • default_update_comments_array.ts
          • empty_string_array.ts
          • endpoint
            • entries.ts
            • entry_match.ts
            • entry_match_any.ts
            • entry_match_wildcard.ts
            • entry_nested.ts
            • non_empty_nested_entries_array.ts
          • entries.ts
          • entry_exists.ts
          • entry_list.ts
          • entry_match.ts
          • entry_match_any.ts
          • entry_match_wildcard.ts
          • entry_nested.ts
          • non_empty_entries_array.ts
          • non_empty_nested_entries_array.ts
          • non_empty_or_nullable_string_array.ts
          • non_empty_string_array.ts
          • string_to_positive_number.ts
          • update_comment.ts
      • test_utils.ts
      • types.ts
    • maps/public
      • embeddable
        • index.ts
        • map_embeddable.tsx
      • index.ts
    • ml/public/application
      • components/ml_embedded_map
        • ml_embedded_map.tsx
      • data_frame_analytics/pages/analytics_management/components/models_management
        • expanded_row.tsx
        • models_list.tsx
    • monitoring/server
      • config.test.ts
      • config.ts
      • routes/api/v1/alerts
        • enable.ts
      • types.ts
    • observability/public/pages
      • alerts
        • alerts_flyout
          • index.tsx
        • index.tsx
      • cases
        • index.tsx
    • osquery/common
      • exact_check.ts
      • format_errors.ts
      • test_utils.ts
    • remote_clusters
      • common/lib
        • cluster_serialization.ts
      • server
        • lib
          • does_cluster_exist.ts
        • plugin.ts
        • routes/api
          • add_route.test.ts
          • add_route.ts
          • delete_route.test.ts
          • delete_route.ts
          • get_route.test.ts
          • get_route.ts
          • types.ts
          • update_route.test.ts
          • update_route.ts
        • shared_imports.ts
        • types.ts
    • security_solution
      • common
        • detection_engine/schemas
          • common
            • schemas.ts
          • types
            • default_actions_array.ts
            • default_array.ts
            • default_boolean_false.ts
            • default_boolean_true.ts
            • default_empty_string.ts
            • default_export_file_name.ts
            • default_from_string.ts
            • default_interval_string.ts
            • default_language_string.ts
            • default_max_signals_number.ts
            • default_page.ts
            • default_per_page.ts
            • default_risk_score_mapping_array.ts
            • default_severity_mapping_array.ts
            • default_string_array.ts
            • default_string_boolean_false.ts
            • default_threat_array.ts
            • default_throttle_null.ts
            • default_to_string.ts
            • default_uuid.ts
            • default_version_number.ts
            • iso_date_string.ts
            • lists.ts
            • lists_default_array.ts
            • non_empty_array.ts
            • non_empty_string.ts
            • normalized_ml_job_id.ts
            • only_false_allowed.ts
            • positive_integer.ts
            • positive_integer_greater_than_zero.ts
            • references_default_array.ts
            • risk_score.ts
            • threat_mapping.ts
            • uuid.ts
        • endpoint
          • index_data.ts
        • exact_check.ts
        • format_errors.ts
        • search_strategy/timeline/events/all
          • index.ts
        • test_utils.ts
      • cypress
        • integration
          • detection_alerts
            • alerts_details.spec.ts
          • timelines
            • notes_tab.spec.ts
            • open_timeline.spec.ts
        • objects
          • rule.ts
        • tasks
          • alerts_details.ts
          • api_calls
            • rules.ts
          • timeline.ts
      • public
        • common/components
          • event_details
            • columns.test.tsx
            • columns.tsx
          • exceptions
            • translations.ts
            • viewer
              • exception_item
                • exception_details.test.tsx
                • exception_details.tsx
                • index.test.tsx
                • index.tsx
              • helpers.test.tsx
              • helpers.tsx
          • navigation/breadcrumbs
            • index.ts
        • management
          • common
            • breadcrumbs.ts
          • components/paginated_content
            • paginated_content.tsx
          • pages
            • endpoint_hosts/view
              • index.test.tsx
            • event_filters
              • index.tsx
              • service
                • index.ts
              • state
                • index.ts
              • store
                • action.ts
                • builders.ts
                • middleware.test.ts
                • middleware.ts
                • reducer.test.ts
                • reducer.ts
                • selector.ts
                • selectors.test.ts
              • types.ts
              • view
                • components/empty
                  • index.tsx
                • event_filters_list_page.tsx
                • hooks.ts
            • index.tsx
            • trusted_apps/view
              • components/trusted_apps_grid/__snapshots__
                • index.test.tsx.snap
              • translations.ts
              • trusted_apps_page.test.tsx
          • state
            • async_resource_builders.ts
            • index.ts
        • timelines/components/timeline/body/renderers/cti
          • helpers.ts
      • scripts/beat_docs
        • build.js
      • server
        • lib
          • detection_engine
            • routes/rules
              • update_rules_route.ts
            • rules
              • prepackaged_rules
                • collection_cloudtrail_logging_created.json
                • collection_microsoft_365_new_inbox_rule.json
                • command_and_control_common_webservices.json
                • command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.json
                • command_and_control_iexplore_via_com.json
                • command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.json
                • command_and_control_port_8000_activity_to_the_internet.json
                • command_and_control_pptp_point_to_point_tunneling_protocol_activity.json
                • command_and_control_proxy_port_activity_to_the_internet.json
                • command_and_control_remote_file_copy_desktopimgdownldr.json
                • command_and_control_remote_file_copy_mpcmdrun.json
                • command_and_control_smtp_to_the_internet.json
                • command_and_control_sql_server_port_activity_to_the_internet.json
                • command_and_control_ssh_secure_shell_from_the_internet.json
                • command_and_control_ssh_secure_shell_to_the_internet.json
                • command_and_control_sunburst_c2_activity_detected.json
                • command_and_control_teamviewer_remote_file_copy.json
                • command_and_control_tor_activity_to_the_internet.json
                • command_and_control_tunneling_via_earthworm.json
                • credential_access_credential_dumping_msbuild.json
                • credential_access_credentials_keychains.json
                • credential_access_domain_backup_dpapi_private_keys.json
                • credential_access_iam_user_addition_to_group.json
                • credential_access_keychain_pwd_retrieval_security_cmd.json
                • credential_access_lsass_memdump_file_created.json
                • credential_access_mimikatz_memssp_default_logs.json
                • credential_access_mitm_localhost_webproxy.json
                • credential_access_persistence_network_logon_provider_modification.json
                • credential_access_tcpdump_activity.json
                • defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.json
                • defense_evasion_base64_encoding_or_decoding_activity.json
                • defense_evasion_clearing_windows_event_logs.json
                • defense_evasion_cloudtrail_logging_deleted.json
                • defense_evasion_cloudtrail_logging_suspended.json
                • defense_evasion_cloudwatch_alarm_deletion.json
                • defense_evasion_code_injection_conhost.json
                • defense_evasion_config_service_rule_deletion.json
                • defense_evasion_configuration_recorder_stopped.json
                • defense_evasion_delete_volume_usn_journal_with_fsutil.json
                • defense_evasion_deleting_backup_catalogs_with_wbadmin.json
                • defense_evasion_disable_windows_firewall_rules_with_netsh.json
                • defense_evasion_ec2_flow_log_deletion.json
                • defense_evasion_ec2_network_acl_deletion.json
                • defense_evasion_encoding_or_decoding_files_via_certutil.json
                • defense_evasion_execution_msbuild_started_by_office_app.json
                • defense_evasion_execution_msbuild_started_by_script.json
                • defense_evasion_execution_msbuild_started_by_system_process.json
                • defense_evasion_execution_msbuild_started_renamed.json
                • defense_evasion_execution_msbuild_started_unusal_process.json
                • defense_evasion_execution_suspicious_explorer_winword.json
                • defense_evasion_execution_via_trusted_developer_utilities.json
                • defense_evasion_gcp_storage_bucket_configuration_modified.json
                • defense_evasion_gcp_storage_bucket_permissions_modified.json
                • defense_evasion_guardduty_detector_deletion.json
                • defense_evasion_hex_encoding_or_decoding_activity.json
                • defense_evasion_iis_httplogging_disabled.json
                • defense_evasion_masquerading_suspicious_werfault_childproc.json
                • defense_evasion_masquerading_trusted_directory.json
                • defense_evasion_modification_of_boot_config.json
                • defense_evasion_modify_environment_launchctl.json
                • defense_evasion_s3_bucket_configuration_deletion.json
                • defense_evasion_suspicious_managedcode_host_process.json
                • defense_evasion_suspicious_scrobj_load.json
                • defense_evasion_system_critical_proc_abnormal_file_activity.json
                • defense_evasion_timestomp_touch.json
                • defense_evasion_unusual_dir_ads.json
                • defense_evasion_unusual_network_connection_via_rundll32.json
                • defense_evasion_unusual_system_vp_child_program.json
                • defense_evasion_via_filter_manager.json
                • defense_evasion_volume_shadow_copy_deletion_via_wmic.json
                • defense_evasion_waf_acl_deletion.json
                • discovery_net_command_system_account.json
                • discovery_post_exploitation_external_ip_lookup.json
                • discovery_post_exploitation_public_ip_reconnaissance.json
                • discovery_process_discovery_via_tasklist_command.json
                • discovery_query_registry_via_reg.json
                • discovery_security_software_grep.json
                • discovery_users_domain_built_in_commands.json
                • discovery_whoami_command_activity.json
                • discovery_whoami_commmand.json
                • execution_command_shell_started_by_powershell.json
                • execution_command_shell_started_by_svchost.json
                • execution_command_shell_started_by_unusual_process.json
                • execution_command_shell_via_rundll32.json
                • execution_from_unusual_path_cmdline.json
                • execution_register_server_program_connecting_to_the_internet.json
                • execution_suspicious_pdf_reader.json
                • execution_via_compiled_html_file.json
                • execution_via_hidden_shell_conhost.json
                • execution_via_net_com_assemblies.json
                • execution_via_xp_cmdshell_mssql_stored_procedure.json
                • impact_cloudtrail_logging_updated.json
                • impact_cloudwatch_log_group_deletion.json
                • impact_cloudwatch_log_stream_deletion.json
                • impact_ec2_disable_ebs_encryption.json
                • impact_gcp_storage_bucket_deleted.json
                • impact_gcp_virtual_private_cloud_route_created.json
                • impact_hosts_file_modified.json
                • impact_iam_deactivate_mfa_device.json
                • impact_iam_group_deletion.json
                • impact_rds_cluster_deletion.json
                • impact_rds_instance_cluster_stoppage.json
                • impact_volume_shadow_copy_deletion_via_vssadmin.json
                • index.ts
                • initial_access_console_login_root.json
                • initial_access_password_recovery.json
                • initial_access_rdp_remote_desktop_protocol_to_the_internet.json
                • initial_access_script_executing_powershell.json
                • initial_access_suspicious_mac_ms_office_child_process.json
                • initial_access_suspicious_ms_exchange_files.json
                • initial_access_suspicious_ms_outlook_child_process.json
                • initial_access_unusual_dns_service_children.json
                • initial_access_unusual_dns_service_file_writes.json
                • initial_access_via_explorer_suspicious_child_parent_args.json
                • lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.json
                • lateral_movement_evasion_rdp_shadowing.json
                • lateral_movement_local_service_commands.json
                • lateral_movement_service_control_spawned_script_int.json
                • linux_mknod_activity.json
                • linux_nmap_activity.json
                • linux_socat_activity.json
                • ml_cloudtrail_rare_error_code.json
                • ml_cloudtrail_rare_method_by_city.json
                • ml_cloudtrail_rare_method_by_country.json
                • ml_cloudtrail_rare_method_by_user.json
                • ml_high_count_network_denies.json
                • ml_high_count_network_events.json
                • ml_rare_destination_country.json
                • ml_spike_in_traffic_to_a_country.json
                • persistence_adobe_hijack_persistence.json
                • persistence_azure_automation_webhook_created.json
                • persistence_credential_access_modify_auth_module_or_config.json
                • persistence_cron_jobs_creation_and_runtime.json
                • persistence_ec2_network_acl_creation.json
                • persistence_evasion_registry_startup_shell_folder_modified.json
                • persistence_gpo_schtask_service_creation.json
                • persistence_iam_group_creation.json
                • persistence_kernel_module_activity.json
                • persistence_local_scheduled_job_creation.json
                • persistence_local_scheduled_task_creation.json
                • persistence_login_logout_hooks_defaults.json
                • persistence_rds_cluster_creation.json
                • persistence_run_key_and_startup_broad.json
                • persistence_services_registry.json
                • persistence_system_shells_via_services.json
                • persistence_user_account_added_to_privileged_group_ad.json
                • persistence_user_account_creation.json
                • persistence_via_application_shimming.json
                • persistence_via_bits_job_notify_command.json
                • persistence_via_telemetrycontroller_scheduledtask_hijack.json
                • persistence_via_wmi_stdregprov_run_services.json
                • privilege_escalation_printspooler_service_suspicious_file.json
                • privilege_escalation_printspooler_suspicious_spl_file.json
                • privilege_escalation_setuid_setgid_bit_set_via_chmod.json
                • privilege_escalation_uac_bypass_diskcleanup_hijack.json
                • privilege_escalation_uac_bypass_event_viewer.json
                • threat_intel_module_match.json
              • update_rules.ts
          • timeline/utils
            • common.ts
        • search_strategy
          • index_fields
            • index.test.ts
          • timeline/factory/events
            • all
              • helpers.test.ts
              • helpers.ts
              • index.ts
            • details
              • query.events_details.dsl.test.ts
              • query.events_details.dsl.ts
        • usage/endpoints
          • endpoint.mocks.ts
          • endpoint.test.ts
          • fleet_saved_objects.ts
          • index.ts
        • utils/beat_schema
          • fields.ts
    • stack_alerts
      • public/alert_types/geo_containment/query_builder/util_components
        • __snapshots__
          • geo_index_pattern_select.test.tsx.snap
        • geo_index_pattern_select.test.tsx
        • geo_index_pattern_select.tsx
      • server/alert_types/geo_containment
        • alert_type.ts
        • geo_containment.ts
        • tests
          • es_sample_response.json
          • es_sample_response_shapes.json
          • es_sample_response_with_nesting.json
          • geo_containment.test.ts
    • telemetry_collection_xpack/schema
      • xpack_plugins.json
    • transform
      • common/utils
        • field_utils.test.ts
        • field_utils.ts
      • public/app
        • hooks
          • use_index_data.ts
        • sections/create_transform/components/step_define/common
          • get_pivot_dropdown_options.ts
      • server/routes/api
        • transforms.ts
    • translations/translations
      • ja-JP.json
      • zh-CN.json
    • triggers_actions_ui/public
      • application
        • lib/action_connector_api
          • connectors.ts
          • create.ts
          • update.ts
        • sections/action_connector_form
          • action_form.test.tsx
          • action_form.tsx
      • types.ts
    • uptime
      • public/state/api
        • utils.ts
      • server
        • lib/adapters/telemetry
          • __snapshots__
            • kibana_telemetry_adapter.test.ts.snap
          • kibana_telemetry_adapter.test.ts
          • kibana_telemetry_adapter.ts
          • types.ts
        • rest_api/telemetry
          • log_page_view.ts
  • tasks
    • build.ts
  • test
    • accessibility/apps
      • transform.ts
    • api_integration/apis/uptime/rest
      • helper
        • make_checks.ts
        • make_ping.ts
      • index.ts
      • telemetry_collectors.ts
      • telemetry_collectors_fleet.ts
    • detection_engine_api_integration
      • security_and_spaces/tests
        • create_ml.ts
        • index.ts
        • update_actions.ts
      • utils.ts
    • encrypted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects
      • mappings.json
    • fleet_api_integration/apis
      • index.js
      • outputs
        • crud.ts
        • index.js
      • package_policy
        • update.ts
      • settings
        • update.ts
    • functional
      • apps/transform
        • cloning.ts
        • creation_index_pattern.ts
        • creation_runtime_mappings.ts
        • editing.ts
      • es_archives
        • dashboard/feature_controls
          • security
            • mappings.json
          • spaces
            • mappings.json
        • data/search_sessions
          • data.json.gz
        • discover/feature_controls
          • security
            • mappings.json
          • spaces
            • mappings.json
        • fleet/agents
          • mappings.json
        • hybrid/kibana
          • mappings.json
        • infra/metrics_anomalies
          • data.json.gz
          • mappings.json
        • kibana_scripted_fields_on_logstash
          • mappings.json
        • lens
          • basic
            • mappings.json
          • reporting
            • mappings.json
          • rollup/config
            • mappings.json
        • maps/kibana
          • mappings.json
        • reporting/nanos
          • mappings.json
        • saved_objects_management/feature_controls/security
          • mappings.json
        • security_solution/anomalies
          • data.json.gz
          • mappings.json
        • security/flstest/kibana
          • mappings.json
        • spaces/disabled_features
          • mappings.json
        • timelion/feature_controls
          • mappings.json
        • uptime/blank_data_stream
          • data.json
          • mappings.json
      • page_objects
        • search_sessions_management_page.ts
      • services/transform
        • wizard.ts
    • plugin_functional/es_archives/global_search/basic
      • mappings.json
    • search_sessions_integration/tests/apps/management/search_sessions
      • sessions_management.ts
    • security_functional/tests/login_selector
      • basic_functionality.ts
    • security_solution_cypress/es_archives/unmapped_fields
      • data.json
      • mappings.json
    • security_solution_endpoint_api_int/apis
      • index.ts
    • security_solution_endpoint/apps/endpoint
      • index.ts
• yarn.lock