diff --git a/deployments/30_long_running_baseline_searches.yml b/deployments/30_long_running_baseline_searches.yml index 420ceeee7a..aa415cfd6c 100644 --- a/deployments/30_long_running_baseline_searches.yml +++ b/deployments/30_long_running_baseline_searches.yml @@ -4,9 +4,8 @@ date: '2020-06-24' description: This configuration file applies to all baselines with tag deployments Long Running Baseline author: Bhavin Patel scheduling: - cron_schedule: '0 4 * * *' earliest_time: -90d@d - latest_time: -10m@m + latest_time: -1d@d schedule_window: auto tags: deployments: diff --git a/detections/detect_spike_in_network_acl_activity.yml b/detections/detect_spike_in_network_acl_activity.yml index b4d7dcb368..7ef7462caa 100644 --- a/detections/detect_spike_in_network_acl_activity.yml +++ b/detections/detect_spike_in_network_acl_activity.yml @@ -36,6 +36,8 @@ known_false_positives: The false-positive rate may vary based on the values of`d tags: analytics_story: - AWS Network ACL Activity + mitre_attack_id: + - T1562.007 kill_chain_phases: - Actions on Objectives cis20: