From 0f2eae31081b5e87163e5686cb5500dfe8fd47eb Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Wed, 19 Jan 2022 20:14:28 -0500 Subject: [PATCH] Fixing missing filter statement --- .../endpoint/potentially_malicious_code_on_commandline.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index 2c779438cc..aed78fecb1 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: Uses machine learning to detect potentially malicious command lines -search: '| tstats count from datamodel="Endpoint.Processes" by Processes.process | `drop_dm_object_name(Processes)` | `potentially_malicious_code_on_cmdline_tokenize_score`' +search: '| tstats count from datamodel="Endpoint.Processes" by Processes.process | `drop_dm_object_name(Processes)` | `potentially_malicious_code_on_cmdline_tokenize_score` | `potentially_malicious_code_on_commandline_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: