admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2625 from splunk/bugfix_2622

Browse Source 
Macro name change in one detection
This commit is contained in:
Bhavin Patel
2023-04-17 16:26:01 -07:00
committed by GitHub
parent 03041105aa febf103b87
commit 290dfde752
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
+2 -2
View File
@@ -32,7 +32,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| rename predicted_label as is_suspicious_score
| rename text as process_name
| where is_suspicious_score > 0.5
| `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`'
| `detect_suspicious_processnames_using_a_pretrained_model_in_dsdl_filter`'
how_to_implement: 'Steps to deploy detect suspicious processnames model into Splunk App
DSDL. This detection depends on the Splunk app for Data Science and Deep
@@ -104,4 +104,4 @@ tags:
- Processes.user
- Processes.dest
risk_score: 45
security_domain: Endpoint
security_domain: Endpoint