admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating detection

Browse Source
This commit is contained in:
research-bot
2025-02-20 14:47:35 -08:00
parent a7425f0d4f
commit 63facf9e78
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/cisco_ai_defense_security_alerts.yml
+2 -3
View File
@@ -50,7 +50,7 @@ drilldown_searches:
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Cisco AI Defense Security Alert has been detected for the application id - [$application_id$]
message: Cisco AI Defense Security Alert has been detected for the application name - [$application_name$]
risk_objects:
- field: application_id
type: other
@@ -70,5 +70,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense.log
source: cisco_ai_defense
sourcetype: cisco:ai:defense
sourcetype: cisco:ai:defense