diff --git a/baselines/previously_seen_cmd_arguments.json b/baselines/previously_seen_cmd_arguments.json index d41c14a3af..3ecff6eee0 100644 --- a/baselines/previously_seen_cmd_arguments.json +++ b/baselines/previously_seen_cmd_arguments.json @@ -6,7 +6,7 @@ "earliest_time": "-30d@d", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = \"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`" + "search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process=\"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`" } }, "creation_date": "2018-04-09",