admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding a deployment for 30 days for this detection

Browse Source
This commit is contained in:
d1vious
2022-06-15 14:11:49 -04:00
parent 0cf536acd5
commit 12e2e4ac6b
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deployments/13_hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
+21
View File
@@ -0,0 +1,21 @@
name: Hosts receiving high volume of network traffic from email server
id: a418619d-12cb-42ff-9ddf-65cc127fe271
date: '2022-06-15'
author: Jose Hernandez
description: This configuration file applies to Hosts receiving high volume of network traffic from email server
scheduling:
cron_schedule: 59 * * * *
earliest_time: -30d@d
latest_time: -10m@m
schedule_window: auto
alert_action:
notable:
rule_description: Host $host$ receiving high volume of network traffic from email server
rule_title: Host $host$ receiving high volume of network traffic
nes_fields:
- host
- firstTime
- lastTime
- count
tags:
detection_name: Hosts receiving high volume of network traffic from email server