admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed issue inside of where clause

Browse Source
This commit is contained in:
David Dorsey
2019-09-30 16:17:29 -07:00
parent 85e033d0e2
commit aec9dd53f5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/previously_seen_cmd_arguments.json
+1 -1
View File
@@ -6,7 +6,7 @@
"earliest_time": "-30d@d",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = \"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`"
"search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process=\"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`"
}
},
"creation_date": "2018-04-09",