admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removed priority_id from finding report

Browse Source
This commit is contained in:
P4T12ICK
2022-03-01 08:38:15 +01:00
parent 94f0108a4b
commit 2b2bbca298
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+1 -1
View File
@@ -33,7 +33,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value",
parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15,
"value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"priority_id", 0, "rule", create_map("name", "Anomalous usage of Archive Tools",
"rule", create_map("name", "Anomalous usage of Archive Tools",
"uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", timestamp,
"user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))])
| into write_ssa_finding_events();'