From 56abcaeb129c968f09fb77b095947e829d5ba513 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Oct 2022 18:07:01 -0700 Subject: [PATCH] new sourcetype --- ...l_number_of_failed_authentications_from_ip.test.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml index e1c7e62df5..4e1569beb3 100644 --- a/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml +++ b/tests/cloud/gcp_unusual_number_of_failed_authentications_from_ip.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE - update_timestamp: true + - file_name: gws_login.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login.json + source: gws_login + sourcetype: gws:reports:login + update_timestamp: true