From 94f0108a4bdbbb614648209c917e57a62f331c3a Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 16 Feb 2022 17:04:19 +0100 Subject: [PATCH] improved Anomalous usage of Archive Tools based on feedback --- .../endpoint/ssa___anomalous_usage_of_archive_tools.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index a5235ac0aa..5ca482754b 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -32,8 +32,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "role_ids", [4], "type_id", 4, "value", ucast(map_get(input_event, "dest_device_id"), "string", null)), create_map("name", "parent_process_name", "role_ids", [5], "type_id", 15, "value", parent_process_name), create_map("name", "process_name", "role_ids", [6], "type_id", 15, - "value", process_name)], "origin", create_map("device", ucast(map_get(input_event, "dest_device_id"), - "string", null), "product", create_map("name", "Splunk Behavioral Analytics")), "priority_id", 0, "rule", create_map("name", "Anomalous usage of Archive Tools", + "value", process_name)], "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), + "priority_id", 0, "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", timestamp, "user_entities", [create_map("uid", ucast(map_get(input_event, "dest_user_id"),"string", null))]) | into write_ssa_finding_events();'