From 22866229000aa1921c855ba67b9fdf4e8cb660fa Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Fri, 10 May 2019 14:39:34 -0600 Subject: [PATCH] going back to hyphens --- baselines/train_smb_traffic_spike.json | 2 +- stories/dhs_report_TA18-074A.json | 2 +- stories/emotet.json | 2 +- stories/hidden_cobra_malware.json | 2 +- stories/ransomware.json | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/baselines/train_smb_traffic_spike.json b/baselines/train_smb_traffic_spike.json index 7ddf4d4d88..c4469d0c6f 100644 --- a/baselines/train_smb_traffic_spike.json +++ b/baselines/train_smb_traffic_spike.json @@ -37,7 +37,7 @@ "search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel", "search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.", "search_id": "df98763b-0b08-4281-8ef9-08db7ac572a9", - "search_name": "Model Builder For SMB Traffic Spike MLTK", + "search_name": "Model Builder For SMB Traffic Spike - MLTK", "search_type": "support", "spec_version": 1, "version": "1.0" diff --git a/stories/dhs_report_TA18-074A.json b/stories/dhs_report_TA18-074A.json index a59ec75b49..d6baa3b0da 100644 --- a/stories/dhs_report_TA18-074A.json +++ b/stories/dhs_report_TA18-074A.json @@ -56,7 +56,7 @@ ], "support_searches": [ "Previously seen command line arguments", - "Model Builder For SMB Traffic Spike MLTK" + "Model Builder For SMB Traffic Spike - MLTK" ] }, "spec_version": 1, diff --git a/stories/emotet.json b/stories/emotet.json index b55fa976f9..b021db0cce 100644 --- a/stories/emotet.json +++ b/stories/emotet.json @@ -53,7 +53,7 @@ "Investigate Web Activity From Host" ], "support_searches": [ - "Model Builder For SMB Traffic Spike MLTK" + "Model Builder For SMB Traffic Spike - MLTK" ] }, "spec_version": 1, diff --git a/stories/hidden_cobra_malware.json b/stories/hidden_cobra_malware.json index 353929d5ce..1d0e12ea13 100644 --- a/stories/hidden_cobra_malware.json +++ b/stories/hidden_cobra_malware.json @@ -55,7 +55,7 @@ "support_searches": [ "Previously seen command line arguments", "Model Builder For DNS Query Length Outliers - MLTK", - "Model Builder For SMB Traffic Spike MLTK" + "Model Builder For SMB Traffic Spike - MLTK" ] }, "spec_version": 1, diff --git a/stories/ransomware.json b/stories/ransomware.json index 78263a06ee..9ca083397d 100644 --- a/stories/ransomware.json +++ b/stories/ransomware.json @@ -69,7 +69,7 @@ "Windows Updates Install Failures", "Windows Updates Install Successes", "Model Builder For Unusually Long Command Line - MLTK", - "Model Builder For SMB Traffic Spike MLTK" + "Model Builder For SMB Traffic Spike - MLTK" ] }, "spec_version": 1,