From 824bddc979f314459b51c139e73038453e53e93a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 7 Jun 2021 10:35:08 -0700 Subject: [PATCH] make deployments consistent --- deployments/14_credential_dumping_story.yml | 10 +++++++++- ...detection_access_LSASS_memory_for_dump_creation.yml | 8 +++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/deployments/14_credential_dumping_story.yml b/deployments/14_credential_dumping_story.yml index 86fbc9d80f..3f074dea45 100644 --- a/deployments/14_credential_dumping_story.yml +++ b/deployments/14_credential_dumping_story.yml @@ -5,8 +5,16 @@ author: Patrick Bareiss description: Example for a deployment for a specific Analytics Story scheduling: cron_schedule: 0 * * * * - earliest_time: -40m@m + earliest_time: -70m@m latest_time: -10m@m schedule_window: auto +alert_action: + notable: + rule_description: '%description%' + rule_title: '%name%' + nes_fields: + - user + - dest + - src tags: analytic_story: Credential Dumping diff --git a/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml b/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml index 166bd03f81..d274b9c85b 100644 --- a/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml +++ b/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml @@ -5,14 +5,16 @@ author: Patrick Bareiss description: Example for a deployment for a specific Detection scheduling: cron_schedule: 0 * * * * - earliest_time: -30m@m - latest_time: now + earliest_time: -70m@m + latest_time: -10m@m schedule_window: auto alert_action: notable: rule_description: '%description%' - rule_title: '%name% Notable' + rule_title: '%name%' nes_fields: + - user - dest + - src tags: detection_name: Access LSASS Memory for Dump Creation