From 71a9bed8f4841de28420ada1ca3360f1066bbdd2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Sep 2021 09:15:56 -0600
Subject: [PATCH] Revert "Update windows_event_log_cleared.yml"

This reverts commit 8761bf0f852989440d9729af8c9fac135e716bb5.
---
 detections/endpoint/windows_event_log_cleared.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index 61b6926470..b185e92dbd 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -11,9 +11,9 @@ description: The following analytic utilizes Windows Security Event ID 1102 or S
   triage, based on time of day and user, determine if this was planned. If not planned,
   follow through with reviewing parallel alerts and other data sources to determine
   what else may have occurred.
-search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
+search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
   | stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: It is possible that these logs may be legitimately cleared