From 4d3bbb5e41a99a1bb3d9ac803e342ff9df24dd92 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Dec 2020 13:27:13 +0100 Subject: [PATCH] test file debugging --- .../endpoint/first_time_seen_running_windows_service.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/first_time_seen_running_windows_service.test.yml b/tests/endpoint/first_time_seen_running_windows_service.test.yml index 15fbd395f0..70fb5203bf 100644 --- a/tests/endpoint/first_time_seen_running_windows_service.test.yml +++ b/tests/endpoint/first_time_seen_running_windows_service.test.yml @@ -9,8 +9,8 @@ tests: - name: Previously Seen Running Windows Services - Initial file: baselines/previously_seen_running_windows_services.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-30m@m' - latest_time: '-7m@m' + earliest_time: '-24h' + latest_time: '-10m@m' attack_data: - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/first_time_windows_service/windows-system.log