rabbitstack / fibratus

Adversary tradecraft detection, protection, and hunting
https://www.fibratus.io
Other
2.21k stars 189 forks source link

chore(cli): Surface missing labels in rules validation subcommand #353

Closed rabbitstack closed 3 days ago

rabbitstack commented 1 week ago

What is the purpose of this PR / why it is needed?

When the rule definition misses the recommended MITRE labels, declare the warning with the missing label.

What type of change does this PR introduce?

Any specific area of the project related to this PR?

Special notes for the reviewer:

Does this PR introduce a user-facing change?

Users will be able to spot rule validation warnings when any of the recommended tactic/technique labels are missing in the rule definition.