admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-06-08 18:37:00 +00:00
committed by GitHub
parent 332a533302 6f02d19e97
commit 9734ff64bc
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deployments/14_credential_dumping_story.yml
+9 -1
View File
@@ -5,8 +5,16 @@ author: Patrick Bareiss
description: Example for a deployment for a specific Analytics Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -40m@m
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
alert_action:
notable:
rule_description: '%description%'
rule_title: '%name%'
nes_fields:
- user
- dest
- src
tags:
analytic_story: Credential Dumping
deployments/15_detection_access_LSASS_memory_for_dump_creation.yml
+5 -3
View File
@@ -5,14 +5,16 @@ author: Patrick Bareiss
description: Example for a deployment for a specific Detection
scheduling:
cron_schedule: 0 * * * *
earliest_time: -30m@m
latest_time: now
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
alert_action:
notable:
rule_description: '%description%'
rule_title: '%name% Notable'
rule_title: '%name%'
nes_fields:
- user
- dest
- src
tags:
detection_name: Access LSASS Memory for Dump Creation