Branch was auto-updated.

bin/contentctl_project/contentctl_core/application/factory/factory.py

@@ -86,7 +86,7 @@ class Factory():
      def createSecurityContent(self, type: SecurityContentType) -> list[Tuple[pathlib.Path,  ValidationError]]:
           objects = []
           if type == SecurityContentType.deployments:
-               files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name), 'ESCU'))
+               files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name)))
           elif type == SecurityContentType.unit_tests:
                files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, 'tests'))
           else:

bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py

@@ -34,18 +34,26 @@ class SecurityContentBaselineBuilder(BaselineBuilder):
 
         for d in deployments:
             d_tags = dict(d.tags)
+            baseline_dict = self.baseline.dict()
+            baseline_tags_dict = self.baseline.tags.dict()
             for d_tag in d_tags.keys():
-                for attr in dir(self.baseline):
-                    if not (attr.startswith('__') or attr.startswith('_')):
-                        if attr == d_tag:
-                            if type(self.baseline.__getattribute__(attr)) is str:
-                                attr_values = [self.baseline.__getattribute__(attr)]
-                            else:
-                                attr_values = self.baseline.__getattribute__(attr)
-                            
-                            for attr_value in attr_values:
-                                if attr_value == d_tags[d_tag]:
-                                    matched_deployments.append(d)
+                for attr in baseline_dict.keys():
+                    if attr == d_tag:
+                        if isinstance(baseline_dict[attr], str):
+                            if baseline_dict[attr] == d_tags[d_tag]:
+                                matched_deployments.append(d)
+                        elif isinstance(baseline_dict[attr], list):
+                            if d_tags[d_tag] in baseline_dict[attr]:
+                                matched_deployments.append(d)
+
+                for attr in baseline_tags_dict.keys():
+                    if attr == d_tag:
+                        if isinstance(baseline_tags_dict[attr], str):
+                            if baseline_tags_dict[attr] == d_tags[d_tag]:
+                                matched_deployments.append(d)
+                        elif isinstance(baseline_tags_dict[attr], list):
+                            if d_tags[d_tag] in baseline_tags_dict[attr]:
+                                matched_deployments.append(d)
 
         if len(matched_deployments) == 0:
             raise ValueError('No deployment found for baseline: ' + self.baseline.name)

deployments/00_default_anomaly.yml

@@ -14,4 +14,3 @@ alert_action:
     enabled: 'true'
 tags:
   type: Anomaly
-  product: ESCU

deployments/00_default_correlation.yml

@@ -18,4 +18,3 @@ alert_action:
     - dest
 tags:
   type: 'Correlation'
-  product: ESCU

deployments/00_default_hunting.yml

@@ -10,4 +10,3 @@ scheduling:
   schedule_window: auto
 tags:
   type: Hunting
-  product: ESCU

deployments/10_enterprise_security_deployment_configuration.yml

@@ -1,21 +0,0 @@
-name: Enterprise Security deployment configuration
-id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
-date: '2020-04-27'
-author: Bhavin Patel
-description: This configuration file applies to all correlation searches that are
-  used for detection
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-alert_action:
-  notable:
-    rule_description: '%description%'
-    rule_title: '%name%'
-    nes_fields:
-    - user
-    - dest
-    - src
-tags:
-  analytic_story: all

deployments/11_detect_arp_poisoning.yml

@@ -19,4 +19,4 @@ alert_action:
     - lastTime
     - count
 tags:
-  detection_name: Detect ARP Poisoning
+  name: Detect ARP Poisoning

deployments/12_detect_dhcp_poisoning.yml

@@ -20,4 +20,4 @@ alert_action:
     - count
     - message_type
 tags:
-  detection_name: Detect Rogue DHCP Server
+  name: Detect Rogue DHCP Server

deployments/14_credential_dumping_story.yml

@@ -1,20 +0,0 @@
-name: Credential Dumping Story
-id: 52f52a7c-078f-4413-84da-388b61ccac26
-date: '2021-01-13'
-author: Patrick Bareiss
-description: Example for a deployment for a specific Analytics Story
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-alert_action:
-  notable:
-    rule_description: '%description%'
-    rule_title: '%name%'
-    nes_fields:
-    - user
-    - dest
-    - src
-tags:
-  analytic_story: Credential Dumping

deployments/15_detection_access_LSASS_memory_for_dump_creation.yml

@@ -1,20 +0,0 @@
-name: Access LSASS Memory for Dump Creation Deployment
-id: 974c422f-db3f-4538-8f2a-ee5bf8eec0fa
-date: '2021-01-13'
-author: Patrick Bareiss
-description: Example for a deployment for a specific Detection
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-alert_action:
-  notable:
-    rule_description: '%description%'
-    rule_title: '%name%'
-    nes_fields:
-    - user
-    - dest
-    - src
-tags:
-  detection_name: Access LSASS Memory for Dump Creation

deployments/16_splunk_security_analytics_for_aws.yml

@@ -1,15 +0,0 @@
-name: Enterprise Security config for Splunk Security Analytics for AWS customers
-id: bc91a8cd-35e7-4bb2-6140-e756cc46f211
-date: '2021-01-20'
-author: Bhavin Patel
-description: This configuration file applies to all correlation searches that are
-  used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics
-  for AWS searches do not need notable  configurations
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-tags:
-  product: 
-    - Splunk Security Analytics for AWS

deployments/20_baseline_cache_hourly_updates.yml

@@ -10,5 +10,4 @@ scheduling:
   latest_time: -10m@m
   schedule_window: auto
 tags:
-  deployments:
-  - Hourly Cache Updates
+  deployments: Hourly Cache Updates

deployments/21_baseline_cache_daily_updates.yml

@@ -10,5 +10,4 @@ scheduling:
   latest_time: -10m@m
   schedule_window: auto
 tags:
-  deployments:
-  - Daily Cache Updates
+  deployments: Daily Cache Updates

deployments/30_long_running_baseline_searches.yml

@@ -10,5 +10,4 @@ scheduling:
   latest_time: -1d@d
   schedule_window: auto
 tags:
-  deployments:
-  - 90 Day Baseline
+  deployments: 90 Day Baseline

deployments/31_weeky_model_rebuild_90_days.yml

@@ -10,5 +10,4 @@ scheduling:
   latest_time: -1d@d
   schedule_window: auto
 tags:
-  deployments:
-  - Weekly Model Rebuild 90 Day Lookback
+  deployments: Weekly Model Rebuild 90 Day Lookback

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -45770,7 +45770,7 @@ action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
+cron_schedule = 59 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
@@ -45778,9 +45778,9 @@ action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure.
-action.notable.param.rule_title = Detect ARP Poisoning
+action.notable.param.nes_fields = src_interface,firstTime,lastTime,count
+action.notable.param.rule_description = ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$. This may be an indication of a MITM attack.
+action.notable.param.rule_title = ARP Poisoning Detected on $orig_host$
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -46040,7 +46040,7 @@ action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
+cron_schedule = 59 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
@@ -46048,9 +46048,9 @@ action.correlationsearch.label = ESCU - Detect Rogue DHCP Server - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack).
-action.notable.param.rule_title = Detect Rogue DHCP Server
+action.notable.param.nes_fields = src_mac,firstTime,lastTime,count,message_type
+action.notable.param.rule_description = DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$. This may be an indication of a MITM attack.
+action.notable.param.rule_title = Rogue DHCP Server Detected on $orig_host$
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -48234,9 +48234,9 @@ action.escu.creation_date = 2018-05-07
 action.escu.modification_date = 2018-05-07
 action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48256,10 +48256,10 @@ action.escu.creation_date = 2020-09-07
 action.escu.modification_date = 2020-09-07
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
@@ -48278,10 +48278,10 @@ action.escu.creation_date = 2020-08-25
 action.escu.modification_date = 2020-08-25
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window.
@@ -48301,10 +48301,10 @@ action.escu.creation_date = 2020-08-14
 action.escu.modification_date = 2020-08-14
 action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
@@ -48324,10 +48324,10 @@ action.escu.creation_date = 2020-09-07
 action.escu.modification_date = 2020-09-07
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly.
@@ -48346,9 +48346,9 @@ action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48368,9 +48368,9 @@ action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.escu.data_models = ["Network_Resolution"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48390,9 +48390,9 @@ action.escu.creation_date = 2018-05-21
 action.escu.modification_date = 2018-05-21
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48412,9 +48412,9 @@ action.escu.creation_date = 2018-07-17
 action.escu.modification_date = 2018-07-17
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48434,9 +48434,9 @@ action.escu.creation_date = 2018-04-17
 action.escu.modification_date = 2018-04-17
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48456,9 +48456,9 @@ action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48478,9 +48478,9 @@ action.escu.creation_date = 2017-09-13
 action.escu.modification_date = 2017-09-13
 action.escu.analytic_story = ["Asset Tracking"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48500,9 +48500,9 @@ action.escu.creation_date = 2017-09-13
 action.escu.modification_date = 2017-09-13
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48522,9 +48522,9 @@ action.escu.creation_date = 2018-12-03
 action.escu.modification_date = 2018-12-03
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48544,9 +48544,9 @@ action.escu.creation_date = 2017-09-15
 action.escu.modification_date = 2017-09-15
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48566,9 +48566,9 @@ action.escu.creation_date = 2018-04-09
 action.escu.modification_date = 2018-04-09
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48588,9 +48588,9 @@ action.escu.creation_date = 2019-11-14
 action.escu.modification_date = 2019-11-14
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48612,9 +48612,9 @@ action.escu.creation_date = 2019-11-14
 action.escu.modification_date = 2019-11-14
 action.escu.analytic_story = ["Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48636,9 +48636,9 @@ action.escu.creation_date = 2018-04-16
 action.escu.modification_date = 2018-04-16
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48658,9 +48658,9 @@ action.escu.creation_date = 2018-03-16
 action.escu.modification_date = 2018-03-16
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48680,9 +48680,9 @@ action.escu.creation_date = 2018-03-12
 action.escu.modification_date = 2018-03-12
 action.escu.analytic_story = ["AWS Cryptomining"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48702,9 +48702,9 @@ action.escu.creation_date = 2018-03-08
 action.escu.modification_date = 2018-03-08
 action.escu.analytic_story = ["AWS Cryptomining"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48724,9 +48724,9 @@ action.escu.creation_date = 2018-03-15
 action.escu.modification_date = 2018-03-15
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48746,9 +48746,9 @@ action.escu.creation_date = 2018-04-30
 action.escu.modification_date = 2018-04-30
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48768,9 +48768,9 @@ action.escu.creation_date = 2018-04-30
 action.escu.modification_date = 2018-04-30
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48790,9 +48790,9 @@ action.escu.creation_date = 2019-02-14
 action.escu.modification_date = 2019-02-14
 action.escu.analytic_story = ["DNS Hijacking"]
 action.escu.data_models = ["Network_Resolution"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48812,9 +48812,9 @@ action.escu.creation_date = 2018-10-08
 action.escu.modification_date = 2018-10-08
 action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48834,9 +48834,9 @@ action.escu.creation_date = 2017-09-15
 action.escu.modification_date = 2017-09-15
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48856,9 +48856,9 @@ action.escu.creation_date = 2017-09-15
 action.escu.modification_date = 2017-09-15
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48878,9 +48878,9 @@ action.escu.creation_date = 2019-04-01
 action.escu.modification_date = 2019-04-01
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48900,9 +48900,9 @@ action.escu.creation_date = 2017-09-12
 action.escu.modification_date = 2017-09-12
 action.escu.analytic_story = ["Monitor Backup Solution"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48922,9 +48922,9 @@ action.escu.creation_date = 2017-09-12
 action.escu.modification_date = 2017-09-12
 action.escu.analytic_story = ["Monitor Backup Solution"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48944,9 +48944,9 @@ action.escu.creation_date = 2018-06-04
 action.escu.modification_date = 2018-06-04
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48966,10 +48966,10 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
@@ -48988,9 +48988,9 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49010,9 +49010,9 @@ action.escu.creation_date = 2018-01-08
 action.escu.modification_date = 2018-01-08
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49032,10 +49032,10 @@ action.escu.creation_date = 2020-09-03
 action.escu.modification_date = 2020-09-03
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached.
@@ -49054,9 +49054,9 @@ action.escu.creation_date = 2020-09-03
 action.escu.modification_date = 2020-09-03
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49076,7 +49076,7 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 55 * * * *
 enableSched = 1
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
@@ -49098,9 +49098,9 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49120,10 +49120,10 @@ action.escu.creation_date = 2020-10-08
 action.escu.modification_date = 2020-10-08
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances
@@ -49142,9 +49142,9 @@ action.escu.creation_date = 2020-08-12
 action.escu.modification_date = 2020-08-12
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49164,10 +49164,10 @@ action.escu.creation_date = 2020-9-03
 action.escu.modification_date = 2020-9-03
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of previously seen cloud compute instance types
@@ -49186,9 +49186,9 @@ action.escu.creation_date = 2020-9-03
 action.escu.modification_date = 2020-9-03
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49208,10 +49208,10 @@ action.escu.creation_date = 2020-07-29
 action.escu.modification_date = 2020-07-29
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance.
@@ -49230,9 +49230,9 @@ action.escu.creation_date = 2020-07-29
 action.escu.modification_date = 2020-07-29
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49252,10 +49252,10 @@ action.escu.creation_date = 2020-08-19
 action.escu.modification_date = 2020-08-19
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached.
@@ -49274,9 +49274,9 @@ action.escu.creation_date = 2020-08-20
 action.escu.modification_date = 2020-08-20
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49296,10 +49296,10 @@ action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
@@ -49318,9 +49318,9 @@ action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49340,9 +49340,9 @@ action.escu.creation_date = 2019-03-01
 action.escu.modification_date = 2019-03-01
 action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "IcedID"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49362,9 +49362,9 @@ action.escu.creation_date = 2018-04-05
 action.escu.modification_date = 2018-04-05
 action.escu.analytic_story = ["Unusual AWS EC2 Modifications"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49384,10 +49384,10 @@ action.escu.creation_date = 2020-06-23
 action.escu.modification_date = 2020-06-23
 action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This collects the services that have been started across your entire enterprise.
@@ -49406,7 +49406,7 @@ action.escu.creation_date = 2020-06-23
 action.escu.modification_date = 2020-06-23
 action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 55 * * * *
 enableSched = 1
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
@@ -49428,9 +49428,9 @@ action.escu.creation_date = 2018-06-28
 action.escu.modification_date = 2018-06-28
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49450,10 +49450,10 @@ action.escu.creation_date = 2020-05-28
 action.escu.modification_date = 2020-05-28
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.
@@ -49472,9 +49472,9 @@ action.escu.creation_date = 2020-05-28
 action.escu.modification_date = 2020-05-28
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49494,10 +49494,10 @@ action.escu.creation_date = 2020-05-20
 action.escu.modification_date = 2020-05-20
 action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached.
@@ -49516,7 +49516,7 @@ action.escu.creation_date = 2020-05-20
 action.escu.modification_date = 2020-05-20
 action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 55 * * * *
 enableSched = 1
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
@@ -49560,9 +49560,9 @@ action.escu.creation_date = 2018-01-08
 action.escu.modification_date = 2018-01-08
 action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49582,9 +49582,9 @@ action.escu.creation_date = 2017-09-14
 action.escu.modification_date = 2017-09-14
 action.escu.analytic_story = ["Monitor for Updates"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49604,9 +49604,9 @@ action.escu.creation_date = 2017-09-14
 action.escu.modification_date = 2017-09-14
 action.escu.analytic_story = ["Monitor for Updates"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

requirements.txt

@@ -4,7 +4,7 @@ GitPython==3.1.29
 Jinja2==3.1.2
 jsonschema==4.17.0
 mock==4.0.3
-psutil==5.9.3
+psutil==5.9.4
 pycvesearch==1.2
 pydantic==1.10.2
 pytest==7.2.0