From aec9dd53f53b60b23cacf4a4fccee353ffb48157 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Mon, 30 Sep 2019 16:17:29 -0700 Subject: [PATCH] Fixed issue inside of where clause --- baselines/previously_seen_cmd_arguments.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/baselines/previously_seen_cmd_arguments.json b/baselines/previously_seen_cmd_arguments.json index d41c14a3af..3ecff6eee0 100644 --- a/baselines/previously_seen_cmd_arguments.json +++ b/baselines/previously_seen_cmd_arguments.json @@ -6,7 +6,7 @@ "earliest_time": "-30d@d", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = \"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`" + "search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process=\"* /c *\" by Processes.process | `drop_dm_object_name(Processes)`" } }, "creation_date": "2018-04-09",