admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding references

Browse Source
This commit is contained in:
mvelazco
2021-06-21 17:50:09 -04:00
parent e4f5a3894d
commit 19ea75d969
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_event_log_service_behavior.yml
+2 -1
View File
@@ -12,7 +12,8 @@ search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firs
how_to_implement: To successfully implement this search, you need to be ingesting
Windows event logs from your hosts.
known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks.
references: []
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100
tags:
analytic_story:
- Windows Log Manipulation
detections/endpoint/windows_event_log_cleared.yml
+2 -1
View File
@@ -15,7 +15,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
Windows event logs from your hosts.
known_false_positives: It is possible that these logs may be legitimately cleared
by Administrators.
references: []
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102
tags:
analytic_story:
- Windows Log Manipulation