From 098115155d5adbc69ae2ad518bb3db26831feace Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 14 Mar 2022 15:16:46 -0700 Subject: [PATCH] changes --- ...rs_failing_to_authenticate_kerberos.test.yml | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml index b7c5eb9e11..930f7b53aa 100644 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml @@ -1,17 +1,12 @@ -<<<<<<< HEAD:tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml -name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos Unit - Test -======= -name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test ->>>>>>> updates to all ymls with error:tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test tests: -- name: Windows Disabled Users Failing To Authenticate Using Kerberos - file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +- name: Windows Disabled Users Failing To Authenticate Kerberos + file: endpoint/multiple_disabled_users_failing_to_authenticate_from_host_kerberos.yml pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now + earliest_time: '-24h' + latest_time: 'now' attack_data: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log source: WinEventLog:Security - sourcetype: WinEventLog + sourcetype: WinEventLog \ No newline at end of file