From 63facf9e7879ece11d1ca09a30ea4c09ef4e3873 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 20 Feb 2025 14:47:35 -0800 Subject: [PATCH] updating detection --- detections/application/cisco_ai_defense_security_alerts.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/application/cisco_ai_defense_security_alerts.yml b/detections/application/cisco_ai_defense_security_alerts.yml index fabc3d5c22..374ae41d7f 100644 --- a/detections/application/cisco_ai_defense_security_alerts.yml +++ b/detections/application/cisco_ai_defense_security_alerts.yml @@ -50,7 +50,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Cisco AI Defense Security Alert has been detected for the application id - [$application_id$] + message: Cisco AI Defense Security Alert has been detected for the application name - [$application_name$] risk_objects: - field: application_id type: other @@ -70,5 +70,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense.log source: cisco_ai_defense - sourcetype: cisco:ai:defense - + sourcetype: cisco:ai:defense \ No newline at end of file