admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into TR-2408_rba_search_improvements

Browse Source
This commit is contained in:
d1vious
2022-09-14 12:02:34 -04:00
parent 439e903c3f 940598b6c2
commit 864ee0cda7
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2
+1 -1
View File
@@ -68,7 +68,7 @@ action.notable = 1
action.notable.param.nes_fields = {{ detection.nes_fields }}
{% endif %}
action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }}
action.notable.param.rule_title = {% if detection.type | lower == "correlation" %}RBA: {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% else %} {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }} {% endif +%}
action.notable.param.rule_title = {% if detection.type | lower == "correlation" %}RBA: {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% else %}{{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% endif +%}
action.notable.param.security_domain = {{ detection.tags.security_domain }}
action.notable.param.severity = high
{% endif %}