admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix one more csv file reference

Browse Source
This commit is contained in:
pyth0n1c
2024-08-15 16:13:56 -07:00
parent 0ea1c6a62b
commit 37dae6fe7b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+1 -1
View File
@@ -27,7 +27,7 @@ how_to_implement: This analytic relies on Sysmon to be properly installed and ut
lookup, as well as a KVStore collection named "remote_software_exceptions"
that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: Known or approved applications used by the organization or
usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv
usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception
lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/