diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index f919502db1..ca7d40b790 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -194,8 +194,8 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass search = 'search ' + search kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": earliest_time, - "dispatch.latest_time": latest_time} + "earliest_time": earliest_time, + "latest_time": latest_time} splunk_search = search + ' ' + pass_condition @@ -230,8 +230,8 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, search = 'search ' + search kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} + "earliest_time": earliest_time, + "latest_time": latest_time} splunk_search = search + ' ' + pass_condition test_results = dict() @@ -328,10 +328,7 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index) != 0) : splunk_search = f'search index={index} | delete' - kwargs = { - "exec_mode": "blocking", - "dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} + kwargs = {"exec_mode": "blocking"} #no earliest_time and latest_time so that it defaults to all time try: job = service.jobs.create(splunk_search, **kwargs) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 8befb4691d..6d7f57c7d9 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -99,12 +99,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa #print(target_file) - # Update timestamps before replay - if 'update_timestamp' in attack_data: - if attack_data['update_timestamp'] == True: - data_manipulation = DataManipulation() - data_manipulation.manipulate_timestamp(target_file, attack_data['sourcetype'], attack_data['source']) - #replay_attack_dataset(container_name, splunk_password, folder_name, "test0", attack_data['sourcetype'], attack_data['source'], attack_data['file_name']) + # Update timestamps before replay - ALWAYS update timestamps! + data_manipulation = DataManipulation() + data_manipulation.manipulate_timestamp(target_file, attack_data['sourcetype'], attack_data['source']) + try: service = get_service(splunk_ip, splunk_port, splunk_password) diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml index d2780a45e8..121d7b8090 100644 --- a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml +++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log source: /opt/splunk/var/log/splunk/splunkd.log sourcetype: splunkd - update_timestamp: true diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml index 290bc2758d..5ef35c3780 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml @@ -16,4 +16,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml index 0f73d485d2..4d3b71b906 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml @@ -16,4 +16,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml index 4a498b1b6b..8091771cb0 100644 --- a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml +++ b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_createaccesskey.test.yml b/tests/cloud/aws_createaccesskey.test.yml index 120f78f97f..7273df14fa 100644 --- a/tests/cloud/aws_createaccesskey.test.yml +++ b/tests/cloud/aws_createaccesskey.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_createloginprofile.test.yml b/tests/cloud/aws_createloginprofile.test.yml index 898e1a208d..6b93028c23 100644 --- a/tests/cloud/aws_createloginprofile.test.yml +++ b/tests/cloud/aws_createloginprofile.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml index 5213f6b857..09f3e7b7cf 100644 --- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml +++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml b/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml index f8346d8581..bd06a8fbde 100644 --- a/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml +++ b/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml b/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml index 3178457c5b..5c4d3a2c24 100644 --- a/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml +++ b/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_excessive_security_scanning.test.yml b/tests/cloud/aws_excessive_security_scanning.test.yml index f664288e92..9b2c51201b 100644 --- a/tests/cloud/aws_excessive_security_scanning.test.yml +++ b/tests/cloud/aws_excessive_security_scanning.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml index 9e7a9186a0..1492e960d7 100644 --- a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml +++ b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml index 76e662f11c..bebe8caaf8 100644 --- a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml +++ b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_delete_policy.test.yml b/tests/cloud/aws_iam_delete_policy.test.yml index dc9612fc34..dfa443a204 100644 --- a/tests/cloud/aws_iam_delete_policy.test.yml +++ b/tests/cloud/aws_iam_delete_policy.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_failure_group_deletion.test.yml b/tests/cloud/aws_iam_failure_group_deletion.test.yml index c104d4e620..865c0b836d 100644 --- a/tests/cloud/aws_iam_failure_group_deletion.test.yml +++ b/tests/cloud/aws_iam_failure_group_deletion.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_successful_group_deletion.test.yml b/tests/cloud/aws_iam_successful_group_deletion.test.yml index 9e41765b31..c67f7cd6b5 100644 --- a/tests/cloud/aws_iam_successful_group_deletion.test.yml +++ b/tests/cloud/aws_iam_successful_group_deletion.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_lambda_updatefunctioncode.test.yml b/tests/cloud/aws_lambda_updatefunctioncode.test.yml index bc47b70de1..e04f632975 100644 --- a/tests/cloud/aws_lambda_updatefunctioncode.test.yml +++ b/tests/cloud/aws_lambda_updatefunctioncode.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True diff --git a/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml b/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml index 2527b35388..e51e10ac62 100644 --- a/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml +++ b/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_network_access_control_list_deleted.test.yml b/tests/cloud/aws_network_access_control_list_deleted.test.yml index 734d8feaa6..51fa2e74df 100644 --- a/tests/cloud/aws_network_access_control_list_deleted.test.yml +++ b/tests/cloud/aws_network_access_control_list_deleted.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml index 3232eb0fa2..c3006d117f 100644 --- a/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml +++ b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_saml_update_identity_provider.test.yml b/tests/cloud/aws_saml_update_identity_provider.test.yml index e79d41fb86..f3165e1441 100644 --- a/tests/cloud/aws_saml_update_identity_provider.test.yml +++ b/tests/cloud/aws_saml_update_identity_provider.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_setdefaultpolicyversion.test.yml b/tests/cloud/aws_setdefaultpolicyversion.test.yml index 805fe8cc65..fbbcd8cb4f 100644 --- a/tests/cloud/aws_setdefaultpolicyversion.test.yml +++ b/tests/cloud/aws_setdefaultpolicyversion.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_updateloginprofile.test.yml b/tests/cloud/aws_updateloginprofile.test.yml index 0551991ed5..25e56d6aca 100644 --- a/tests/cloud/aws_updateloginprofile.test.yml +++ b/tests/cloud/aws_updateloginprofile.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml index 1554b96ffa..3ef2f28848 100644 --- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml +++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml index f52b12aa01..6aac7a808c 100644 --- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml index 9964e1d82b..2c346f262d 100644 --- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml +++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml index bcb75a79e1..a1d17ccdeb 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml index 27e1083bf4..9886792502 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml index c5998f919f..5231fda744 100644 --- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml index e1d4a7e3cd..aa6fae707f 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml index 9b32c57e92..806f5e805a 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml index 22095ed888..a3f3f4f2e2 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml index 9f5969eb7d..a9eef91223 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml index 3ef59ba1c6..cc3d4b6bfd 100644 --- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml +++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml index 72ca7c23c9..4216e95c24 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml index 72cf23e6e2..e86c6800ad 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml index 23eb695f11..4252a91ddb 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_new_open_s3_buckets.test.yml b/tests/cloud/detect_new_open_s3_buckets.test.yml index aaf6277c1e..556b54d599 100644 --- a/tests/cloud/detect_new_open_s3_buckets.test.yml +++ b/tests/cloud/detect_new_open_s3_buckets.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml b/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml index 06a32c78fc..851fa32503 100644 --- a/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml +++ b/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_shared_ec2_snapshot.test.yml b/tests/cloud/detect_shared_ec2_snapshot.test.yml index a8c847b576..d563966179 100644 --- a/tests/cloud/detect_shared_ec2_snapshot.test.yml +++ b/tests/cloud/detect_shared_ec2_snapshot.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml index 203ad7d522..6b73632b55 100644 --- a/tests/cloud/o365_new_federated_domain_added.test.yml +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json sourcetype: o365:management:activity source: exchange - update_timestamp: true diff --git a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml index 57c11afd36..6595dd1887 100644 --- a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml +++ b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml b/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml index 678150f5e1..0dd727dfba 100644 --- a/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml +++ b/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml b/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml index 65c11615a4..1e214843ee 100644 --- a/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml +++ b/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml b/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml index 3f147407b0..ce2926769c 100644 --- a/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml +++ b/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml @@ -10,9 +10,7 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/detect_excessive_user_account_lockouts.test.yml b/tests/endpoint/detect_excessive_user_account_lockouts.test.yml index 4abed7735e..211b7e2dcd 100644 --- a/tests/endpoint/detect_excessive_user_account_lockouts.test.yml +++ b/tests/endpoint/detect_excessive_user_account_lockouts.test.yml @@ -10,9 +10,7 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/detect_new_local_admin_account.test.yml b/tests/endpoint/detect_new_local_admin_account.test.yml index eaf5e28fcb..701c6b151a 100644 --- a/tests/endpoint/detect_new_local_admin_account.test.yml +++ b/tests/endpoint/detect_new_local_admin_account.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_registry_tool.test.yml b/tests/endpoint/disable_registry_tool.test.yml index b0693dd04e..7ad4f2334f 100644 --- a/tests/endpoint/disable_registry_tool.test.yml +++ b/tests/endpoint/disable_registry_tool.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_show_hidden_files.test.yml b/tests/endpoint/disable_show_hidden_files.test.yml index 01f66718a6..3f4d0842d0 100644 --- a/tests/endpoint/disable_show_hidden_files.test.yml +++ b/tests/endpoint/disable_show_hidden_files.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_windows_behavior_monitoring.test.yml b/tests/endpoint/disable_windows_behavior_monitoring.test.yml index f9198c5b00..c723645390 100644 --- a/tests/endpoint/disable_windows_behavior_monitoring.test.yml +++ b/tests/endpoint/disable_windows_behavior_monitoring.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_windows_smartscreen_protection.test.yml b/tests/endpoint/disable_windows_smartscreen_protection.test.yml index f4e70f3667..41c2d05446 100644 --- a/tests/endpoint/disable_windows_smartscreen_protection.test.yml +++ b/tests/endpoint/disable_windows_smartscreen_protection.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_cmd_application.test.yml b/tests/endpoint/disabling_cmd_application.test.yml index 24ba75bce5..540feddf07 100644 --- a/tests/endpoint/disabling_cmd_application.test.yml +++ b/tests/endpoint/disabling_cmd_application.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_controlpanel.test.yml b/tests/endpoint/disabling_controlpanel.test.yml index e35dd44e69..efb6f279a5 100644 --- a/tests/endpoint/disabling_controlpanel.test.yml +++ b/tests/endpoint/disabling_controlpanel.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_firewall_with_netsh.test.yml b/tests/endpoint/disabling_firewall_with_netsh.test.yml index 9dac643ad4..2b391a23df 100644 --- a/tests/endpoint/disabling_firewall_with_netsh.test.yml +++ b/tests/endpoint/disabling_firewall_with_netsh.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml index b5252c8271..6853a8c524 100644 --- a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml +++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_norun_windows_app.test.yml b/tests/endpoint/disabling_norun_windows_app.test.yml index ef8ad59d3b..667cbe7893 100644 --- a/tests/endpoint/disabling_norun_windows_app.test.yml +++ b/tests/endpoint/disabling_norun_windows_app.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_systemrestore_in_registry.test.yml b/tests/endpoint/disabling_systemrestore_in_registry.test.yml index 1ae373a5d2..88b456fb33 100644 --- a/tests/endpoint/disabling_systemrestore_in_registry.test.yml +++ b/tests/endpoint/disabling_systemrestore_in_registry.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_task_manager.test.yml b/tests/endpoint/disabling_task_manager.test.yml index 03163501ec..167d5e7e62 100644 --- a/tests/endpoint/disabling_task_manager.test.yml +++ b/tests/endpoint/disabling_task_manager.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml b/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml index 8711c1c859..f3e59b34ba 100644 --- a/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml +++ b/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml index 82084f5c7b..cf3de310dd 100644 --- a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml +++ b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml index b71a857e10..3ae4a95ca7 100644 --- a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml +++ b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml index 0ccedf2ad7..a49c490522 100644 --- a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml +++ b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml index df1569133d..f9646f6fa6 100644 --- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml index 2abcf3d741..e967f73018 100644 --- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log source: WinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: wineventlog - update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/petitpotam_network_share_access_request.test.yml b/tests/endpoint/petitpotam_network_share_access_request.test.yml index 10629b0169..e6c1e6f1ce 100644 --- a/tests/endpoint/petitpotam_network_share_access_request.test.yml +++ b/tests/endpoint/petitpotam_network_share_access_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml b/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml index 8786c00653..1438d89d39 100644 --- a/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml +++ b/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/short_lived_windows_accounts.test.yml b/tests/endpoint/short_lived_windows_accounts.test.yml index 23507c66b0..34c9713d68 100644 --- a/tests/endpoint/short_lived_windows_accounts.test.yml +++ b/tests/endpoint/short_lived_windows_accounts.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/suspicious_computer_account_name_change.test.yml b/tests/endpoint/suspicious_computer_account_name_change.test.yml index 18b1023943..3f9553b3dd 100644 --- a/tests/endpoint/suspicious_computer_account_name_change.test.yml +++ b/tests/endpoint/suspicious_computer_account_name_change.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/suspicious_event_log_service_behavior.test.yml b/tests/endpoint/suspicious_event_log_service_behavior.test.yml index 74537d7506..60bb710a27 100644 --- a/tests/endpoint/suspicious_event_log_service_behavior.test.yml +++ b/tests/endpoint/suspicious_event_log_service_behavior.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml index aaf1852223..9c05b5e4e6 100644 --- a/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml +++ b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml index 3a5d86ad5f..5932aed4c9 100644 --- a/tests/endpoint/suspicious_msbuild_path.test.yml +++ b/tests/endpoint/suspicious_msbuild_path.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml index 6a47ac212a..5a06dfa7ab 100644 --- a/tests/endpoint/suspicious_msbuild_rename.test.yml +++ b/tests/endpoint/suspicious_msbuild_rename.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml index 15545353db..d736988764 100644 --- a/tests/endpoint/suspicious_msbuild_spawn.test.yml +++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml index bb6eae1dfb..bbd486f704 100644 --- a/tests/endpoint/suspicious_mshta_child_process.test.yml +++ b/tests/endpoint/suspicious_mshta_child_process.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml index cc3af5a079..37c19d0eb0 100644 --- a/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml +++ b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/windows_event_log_cleared.test.yml b/tests/endpoint/windows_event_log_cleared.test.yml index 606e84c79b..b967c17bb5 100644 --- a/tests/endpoint/windows_event_log_cleared.test.yml +++ b/tests/endpoint/windows_event_log_cleared.test.yml @@ -10,9 +10,7 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml index d58142a54b..418ed117fd 100644 --- a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml index fd0bca9456..f39173498e 100644 --- a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true