From 2b2bbca2985391dc76fe9c4ebd676efd38e4e078 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 1 Mar 2022 08:38:15 +0100 Subject: [PATCH] removed priority_id from finding report --- detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 5ca482754b..acdae6b29d 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -33,7 +33,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, "value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), - "priority_id", 0, "rule", create_map("name", "Anomalous usage of Archive Tools", + "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", timestamp, "user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))]) | into write_ssa_finding_events();'