Branch was auto-updated.

bin/validate.py

@@ -118,6 +118,9 @@ def validate_standard_fields(object, uuids):
     else:
         uuids.append(object['id'])
 
+    if (object['type']) == 'batch' and len(object['name']) > 75:
+        errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name']))
+
     # if object['name'].endswith(" "):
     #     errors.append(
     #         "ERROR: name has trailing spaces: '%s'" %

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -1,4 +1,4 @@
-name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
+name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
 id: c2590137-0b08-4985-9ec5-6ae23d92f63d
 version: 6
 date: '2020-11-06'
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted
   OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name
   Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
-  | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
+  | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Registry node. You must also be
   ingesting logs with the fields registry_path, registry_key_name, and registry_value_name

tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml

@@ -1,7 +1,7 @@
-name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test
+name: Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test
 tests:
-- name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
-  file: endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+- name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
+  file: endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'