admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixing missing filter statement

Browse Source
This commit is contained in:
Michael Hart
2022-01-19 20:14:28 -05:00
parent c3f59cb750
commit 0f2eae3108
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/potentially_malicious_code_on_commandline.yml
+1 -1
View File
@@ -7,7 +7,7 @@ type: Anomaly
datamodel:
- Endpoint
description: Uses machine learning to detect potentially malicious command lines
search: '| tstats count from datamodel="Endpoint.Processes" by Processes.process | `drop_dm_object_name(Processes)` | `potentially_malicious_code_on_cmdline_tokenize_score`'
search: '| tstats count from datamodel="Endpoint.Processes" by Processes.process | `drop_dm_object_name(Processes)` | `potentially_malicious_code_on_cmdline_tokenize_score` | `potentially_malicious_code_on_commandline_filter`'
how_to_implement: UPDATE_HOW_TO_IMPLEMENT
known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
references: