admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

improved Anomalous usage of Archive Tools based on feedback

Browse Source
This commit is contained in:
P4T12ICK
2022-02-16 17:04:19 +01:00
parent ccf72b4b6f
commit 94f0108a4b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+2 -2
View File
@@ -32,8 +32,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"role_ids", [4], "type_id", 4, "value", ucast(map_get(input_event, "dest_device_id"), "string", null)),
create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value",
parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15,
"value", process_name)], "origin", create_map("device", ucast(map_get(input_event, "dest_device_id"),
"string", null), "product", create_map("name", "Splunk Behavioral Analytics")), "priority_id", 0, "rule", create_map("name", "Anomalous usage of Archive Tools",
"value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"priority_id", 0, "rule", create_map("name", "Anomalous usage of Archive Tools",
"uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", timestamp,
"user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))])
| into write_ssa_finding_events();'