From 3a68d044ef448bc06ded970cbdeab78016541ef4 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 22 Dec 2021 10:46:27 +0100
Subject: [PATCH] Update
 linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml

---
 ...ble_append_cronjob_entry_on_existing_cronjob_file.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
index e1ee69373c..ef57ab1fea 100644
--- a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
+++ b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
@@ -3,10 +3,10 @@ tests:
 - name: Linux Possible Append Cronjob Entry on Existing Cronjob File
   file: endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-30d'
   latest_time: 'now'
   attack_data:
   - file_name: sysmon_linux.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon_linux
\ No newline at end of file
+    sourcetype: sysmon_linux