admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_unusual_ntlm_authentication_users_by_source.yml

Browse Source
This commit is contained in:
Steven Dick
2024-03-18 09:16:17 -04:00
committed by GitHub
parent bdc2b1c7e8
commit bcbff276a9
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=*
| `windows_unusual_ntlm_authentication_users_by_source_filter`
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count by src
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
| eval upperBound_unique=(unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
| where isOutlier==1
| `security_content_ctime(firstTime)`