admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed data model

Browse Source
This commit is contained in:
David Dorsey
2021-11-30 22:23:31 -06:00
parent dd2475c402
commit 87f62f2177
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-11-22'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint_Processes
description: The following detection identifies the usage of archive tools from the command line.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)),
@@ -75,4 +75,4 @@ tags:
- Processes.parent_process
risk_score: 42
security_domain: endpoint