admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

changes

Browse Source
This commit is contained in:
patel-bhavin
2022-03-14 15:16:46 -07:00
parent d155b128c0
commit 098115155d
1 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml
+6 -11
View File
@@ -1,17 +1,12 @@
<<<<<<< HEAD:tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml
name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos Unit
Test
=======
name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test
>>>>>>> updates to all ymls with error:tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml
name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test
tests:
- name: Windows Disabled Users Failing To Authenticate Using Kerberos
file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml
- name: Windows Disabled Users Failing To Authenticate Kerberos
file: endpoint/multiple_disabled_users_failing_to_authenticate_from_host_kerberos.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
source: WinEventLog:Security
sourcetype: WinEventLog
sourcetype: WinEventLog