admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-04-17 16:26:28 -07:00
committed by GitHub
parent b297ec0781 290dfde752
commit 9baabe335d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
+2 -2
View File
@@ -32,7 +32,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| rename predicted_label as is_suspicious_score
| rename text as process_name
| where is_suspicious_score > 0.5
| `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`'
| `detect_suspicious_processnames_using_a_pretrained_model_in_dsdl_filter`'
how_to_implement: 'Steps to deploy detect suspicious processnames model into Splunk App
DSDL. This detection depends on the Splunk app for Data Science and Deep
@@ -104,4 +104,4 @@ tags:
- Processes.user
- Processes.dest
risk_score: 45
security_domain: Endpoint
security_domain: Endpoint