name: Detect hosts connecting to dynamic domain providers Unit Test
tests:
  - name: Detect hosts connecting to dynamic domain providers
    file: network/detect_hosts_connecting_to_dynamic_domain_providers.yml
    pass_condition: '| stats count | where count > 0'
    earliest_time: '-24h'
    latest_time: 'now'
    attack_data:
    - file_name: windows-sysmon.log
      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log
      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
      sourcetype: xmlwineventlog
