From 3dfd3c6ed68c8d32d31c3549235b0fb62eaa66a3 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 28 Jul 2022 17:17:21 -0700
Subject: [PATCH] Updated search strings from "lockout" to "*locked out*" to
 reflect the string that actually appears in the logs.  Also, removed the
 nodename from the seach since it was not required.

---
 .../detect_excessive_account_lockouts_from_endpoint.yml       | 4 ++--
 .../endpoint/detect_excessive_user_account_lockouts.yml       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
index d9c4aa587a..961f552da7 100644
--- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
@@ -10,8 +10,8 @@ description: This search identifies endpoints that have caused a relatively high
   of account lockouts in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where
-  nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest
-  All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
+  All_Changes.result="*locked out*" by All_Changes.dest All_Changes.result 
+  |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search
   count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`'
 how_to_implement: "You must ingest your Windows security event logs in the `Change`\
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index 2f6f1cbfc6..8edeccc228 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -9,8 +9,8 @@ datamodel:
 description: This search detects user accounts that have been locked out a relatively
   high number of times in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management
-  All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
+  as lastTime from datamodel=Change.All_Changes where  All_Changes.result="*locked out*" 
+  by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
   |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`'
 how_to_implement: ou must ingest your Windows security event logs in the `Change`