Updated tests to remove

update_timestamp and modified
testing code to always update
timestamp.  This will cause some issues
as not all sourcetypes are supported, yet.
We will work to support them all before
merging these changes to develop.

bin/docker_detection_tester/modules/splunk_sdk.py

@@ -194,8 +194,8 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass
         search = 'search ' + search
 
     kwargs = {"exec_mode": "blocking",
-              "dispatch.earliest_time": earliest_time,
-              "dispatch.latest_time": latest_time}
+              "earliest_time": earliest_time,
+              "latest_time": latest_time}
 
     splunk_search = search + ' ' + pass_condition
 
@@ -230,8 +230,8 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str,
         search = 'search ' + search 
 
     kwargs = {"exec_mode": "blocking",
-              "dispatch.earliest_time": "-1d",
-              "dispatch.latest_time": "now"}
+              "earliest_time": earliest_time,
+              "latest_time": latest_time}
 
     splunk_search = search + ' ' + pass_condition
     test_results = dict()
@@ -328,10 +328,7 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa
     while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index) != 0) :
         splunk_search = f'search index={index} | delete'
 
-        kwargs = {
-                "exec_mode": "blocking",
-                "dispatch.earliest_time": "-1d",
-                "dispatch.latest_time": "now"}
+        kwargs = {"exec_mode": "blocking"} #no earliest_time and latest_time so that it defaults to all time
         try:
             
             job = service.jobs.create(splunk_search, **kwargs)

bin/docker_detection_tester/modules/testing_service.py

@@ -99,12 +99,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa
         #print(target_file)
 
 
-        # Update timestamps before replay
-        if 'update_timestamp' in attack_data:
-            if attack_data['update_timestamp'] == True:
-                data_manipulation = DataManipulation()
-                data_manipulation.manipulate_timestamp(target_file, attack_data['sourcetype'], attack_data['source'])
-        #replay_attack_dataset(container_name, splunk_password, folder_name, "test0", attack_data['sourcetype'], attack_data['source'], attack_data['file_name'])
+        # Update timestamps before replay - ALWAYS update timestamps!     
+        data_manipulation = DataManipulation()
+        data_manipulation.manipulate_timestamp(target_file, attack_data['sourcetype'], attack_data['source'])
+        
         
         try:
             service = get_service(splunk_ip, splunk_port, splunk_password)

tests/application/splunk_dos_via_malformed_s2s_request.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log
     source: /opt/splunk/var/log/splunk/splunkd.log
     sourcetype: splunkd
-    update_timestamp: true

tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml

@@ -16,4 +16,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml

@@ -16,4 +16,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_createaccesskey.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_createloginprofile.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_excessive_security_scanning.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_iam_accessdenied_discovery_events.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_iam_delete_policy.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_iam_failure_group_deletion.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_iam_successful_group_deletion.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_lambda_updatefunctioncode.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: True

tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_network_access_control_list_deleted.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_saml_update_identity_provider.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_setdefaultpolicyversion.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/aws_updateloginprofile.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_aws_console_login_by_new_user.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml

@@ -21,4 +21,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_new_open_s3_buckets.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/detect_shared_ec2_snapshot.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
-    update_timestamp: true

tests/cloud/o365_new_federated_domain_added.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json
     sourcetype: o365:management:activity
     source: exchange
-    update_timestamp: true

tests/endpoint/bcdedit_failure_recovery_modification.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true

tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml

@@ -10,9 +10,7 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/detect_excessive_user_account_lockouts.test.yml

@@ -10,9 +10,7 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/detect_new_local_admin_account.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disable_registry_tool.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disable_show_hidden_files.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disable_windows_behavior_monitoring.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disable_windows_smartscreen_protection.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_cmd_application.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_controlpanel.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_firewall_with_netsh.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_folderoptions_windows_feature.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_norun_windows_app.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_systemrestore_in_registry.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/disabling_task_manager.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true

tests/endpoint/excessive_number_of_taskhost_processes.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: True

tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
     source: WinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: wineventlog
-    update_timestamp: True

tests/endpoint/petitpotam_network_share_access_request.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/short_lived_windows_accounts.test.yml

@@ -10,12 +10,10 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/suspicious_computer_account_name_change.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/suspicious_event_log_service_behavior.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/suspicious_msbuild_path.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true

tests/endpoint/suspicious_msbuild_rename.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true

tests/endpoint/suspicious_msbuild_spawn.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true

tests/endpoint/suspicious_mshta_child_process.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true

tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/windows_event_log_cleared.test.yml

@@ -10,9 +10,7 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log
     source: WinEventLog:System
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true

tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml

@@ -10,4 +10,3 @@ tests:
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
-    update_timestamp: true