[Rule Tuning] Add pfSense support for existing rules

[eric-forte-elastic]

Pull Request

Issue link(s):

Summary - What I changed

Small update to add pfSense coverage to existing rules where applicable. Also integrations manifest update for validation.

pfSense already populates event.category:network and the 5-tuple ECS fields; these rules' existing event.category:(network or network_traffic) branch fires on pfSense data without modification.

command_and_control_accepted_default_telnet_port_connection.toml needed a small query change. The existing exclusion list (not event.action:(flow_dropped or flow_denied or denied or deny or ...)) did not include pfSense's block action, meaning pfSense-blocked telnet flows would have generated false positive alerts.

How To Test

RTAs in elastic/cortado#34

And unit testing.

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ RPC (Remote Procedure Call) from the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RPC (Remote Procedure Call) to the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Accepted Default Telnet Port Connection (kuery)
  • stack_validation_failed: no_alerts - 0 alerts
• ❌ VNC (Virtual Network Computing) to the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ VNC (Virtual Network Computing) from the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ IPSEC NAT Traversal Port Activity (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ SMTP on Port 26/TCP (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[github-actions]

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a new schema feature to the code.

Documentation and Context

• Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
• Include additional context or screenshots.
• Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the enhancement.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
• Validate that any rules affected by the enhancement are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Schema Related Checks

• Verify that the enhancement works across all relevant environments (e.g., different OS versions).
• Link to the relevant Kibana PR or issue provided
• Test export/import flow:
  • Exported detection rule(s) from Kibana to showcase the feature(s)
  • Converted the exported ndjson file(s) to toml in the detection-rules repo
  • Re-exported the toml rule(s) to ndjson and re-imported into Kibana
• Updated necessary unit tests to accommodate the feature
• Incorporated a comprehensive test rule in unit tests for full schema coverage
• Applied min_compat restrictions to limit the feature to a specified minimum stack version
• Executed all unit tests locally with a test toml rule to confirm passing
• Included Kibana PR implementer as an optional reviewer for insights on the feature
• Implemented requisite downgrade functionality
• Cross-referenced the feature with product documentation for consistency
• Confirm that the proper version label is applied to the PR patch, minor, major.

[Copilot]

Pull request overview

This PR tunes several existing network rules to explicitly support pfSense by adding the pfsense integration metadata, including the pfSense index pattern, and tagging pfSense as a data source where applicable. It also updates the rule-validation schema to recognize pfsense as an integration and bumps the package version.

Changes:

• Add pfsense to integration, index, and tags across multiple network rules.
• Update the Telnet rule to include pfSense in data_stream.dataset selection and adjust filtering logic.
• Extend schema definitions to allow pfsense as an integration and bump pyproject.toml version.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/command_and_control_port_26_activity.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/command_and_control_nat_traversal_port_activity.toml	Add pfSense integration metadata, index, and data source tag.
rules/network/command_and_control_accepted_default_telnet_port_connection.toml	Add pfSense integration/index/tag and tune query logic for pfSense coverage.
detection_rules/schemas/definitions.py	Add pfsense to the integration/schema package list used by validation.
pyproject.toml	Bump package version to reflect schema/rule updates.

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ RPC (Remote Procedure Call) from the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RPC (Remote Procedure Call) to the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Accepted Default Telnet Port Connection (kuery)
  • stack_validation_failed: no_alerts - 0 alerts
• ❌ VNC (Virtual Network Computing) to the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ VNC (Virtual Network Computing) from the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ IPSEC NAT Traversal Port Activity (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ SMTP on Port 26/TCP (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta