Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Deprecate] LaunchDaemon Creation or Modification and Immediate Loading #4547

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

[Deprecate] LaunchDaemon Creation or Modification and Immediate Loading #4547

wants to merge 6 commits into from
+3 −3

Conversation

DefSecSentinel
Copy link
Contributor

Summary

In my tuning PR (#4546) I updated the LaunchAgent Creation or Modification and Immediate Loading rule to encompass both Launch Daemons and Launch Agents using our newer Persistence event eliminating the need for this rule. The new rule name is Launch Service Creation and Immediate Loading.

@DefSecSentinel DefSecSentinel self-assigned this Mar 19, 2025
@github-actions GitHub Actions
Copy link
Contributor

Rule: Deprecation - Guidelines

These guidelines serve as a reminder set of considerations when recommending the deprecation of a rule.

Documentation and Context

  • Description of the reason for deprecation.
  • Include any context or historical data supporting the deprecation decision.

Rule Metadata Checks

  • deprecated = true added to the rule metadata.
  • updated_date should be the date of the PR.

Testing and Validation

  • A prior rule tuning occurred for the rule where Deprecated - is prepended to the rule name, and the rule has already been released.
  • Rule has be moved to the _deprecated directory.
  • Double check gaps potentially or inadvertently introduced.
  • Provide evidence that the rule is no longer needed or has been replaced (e.g., alternative rules, updated detection methods).

@tradebot-elastic
Copy link

tradebot-elastic commented Mar 19, 2025 •
edited
Loading

⛔️ Tests failed:

  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

shashank-elastic
shashank-elastic reviewed Mar 20, 2025
View reviewed changes
rules/_deprecated/persistence_creation_modif_launch_deamon_sequence.toml
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/02/04"
deprecation_date = "2025/03/19"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to change the name of the rule in the current releae, push and then wait for release cycle before we deprecate. Sample #4537

terrancedejesus
terrancedejesus approved these changes Mar 20, 2025
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pending name change to include Deprecate - suffix and remove final deprecation stages.

@tradebot-elastic
Copy link

tradebot-elastic commented Mar 21, 2025 •
edited
Loading

⛔️ Tests failed:

  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@DefSecSentinel DefSecSentinel mentioned this pull request Mar 24, 2025
Open
@tradebot-elastic
Copy link

tradebot-elastic commented Mar 26, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Mar 28, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 1, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

w0rk3r
w0rk3r requested changes Apr 2, 2025
View reviewed changes
Copy link
Contributor

@w0rk3r w0rk3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pending changes to the rule before the real deprecation. ref

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@w0rk3r w0rk3r w0rk3r requested changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Samirbous Samirbous Awaiting requested review from Samirbous

@Aegrah Aegrah Awaiting requested review from Aegrah

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

Requested changes must be addressed to merge this pull request.

Assignees

@DefSecSentinel DefSecSentinel

Labels
backport: auto OS: macOS Rule: Deprecation removal of a rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@DefSecSentinel @tradebot-elastic @w0rk3r @shashank-elastic @terrancedejesus