admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update suspicious_event_log_service_behavior.yml

Browse Source 
updating filter name
This commit is contained in:
mvelazco
2021-06-21 16:45:52 -04:00
parent 1b7f966a84
commit 8d0b0caa91
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_event_log_service_behavior.yml
+1 -1
View File
@@ -8,7 +8,7 @@ datamodel: []
description: This search looks for Windows events that indicate the event logging service has been shut down.
search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_event_log_cleared_filter`
| `suspicious_event_log_service_behavior`
how_to_implement: To successfully implement this search, you need to be ingesting
Windows event logs from your hosts.
known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks.