From dbcf0b2e318d987a1ccf2c8925481d055052d803 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 17 Apr 2023 14:53:23 -0500 Subject: [PATCH] properly name generated macro --- ...suspicious_processnames_using_pretrained_model_in_dsdl.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml index 2d24d207df..3c4925b94e 100644 --- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml +++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml @@ -32,7 +32,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | rename predicted_label as is_suspicious_score | rename text as process_name | where is_suspicious_score > 0.5 - | `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`' + | `detect_suspicious_processnames_using_a_pretrained_model_in_dsdl_filter`' how_to_implement: 'Steps to deploy detect suspicious processnames model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep @@ -104,4 +104,4 @@ tags: - Processes.user - Processes.dest risk_score: 45 - security_domain: Endpoint \ No newline at end of file + security_domain: Endpoint