admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1782 from splunk/huskersec_bug

Browse Source 
splunk_usergroups bug - spl update
This commit is contained in:
Michael Haag
2021-11-09 14:23:32 -07:00
committed by GitHub
parent 2181a3de66 5c6c21844e
commit 02001dc4d5
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/attacker_tools_on_endpoint.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 1
date: '2021-06-21'
version: 2
date: '2021-11-04'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.user!=unknown by Processes.dest Processes.user Processes.process_name
Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
process_name OUTPUT description | search description=* | `attacker_tools_on_endpoint_filter`'
process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records process activity from your hosts to populate the endpoint data model
in the processes node. This is typically populated via endpoint detection-and-response