From 3512cb812cce6b7710cdfbc6417114b3f43cded8 Mon Sep 17 00:00:00 2001
From: peter-cg <682716+peter-cg@users.noreply.github.com>
Date: Fri, 24 Sep 2021 15:23:43 -0500
Subject: [PATCH] Adding some basic body info for unusual lolbas count

---
 .../endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
index b465d6cdec..63ec825a35 100644
--- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
+++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
@@ -41,7 +41,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev
   as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
   window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
   end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
-  lolbas_counter]) | into write_null();'
+  lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
   applications in a short period of time. This might trigger false positives at the