admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated how to implement

Browse Source
This commit is contained in:
David Dorsey
2020-05-19 20:56:43 -05:00
parent e4339a4259
commit bf80f1cfbf
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/new_zoom_child_processes.yml
+1 -1
View File
@@ -61,7 +61,7 @@ entities:
- dest
- process_id
- src_user
how_to_implement: Endpoint DM compliant EDR data needs to be ingested.
how_to_implement: You should run the baseline search <code>Previously Seen Zoom Child Processes - Initial</code> to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search <code>Previously Seen Zoom Child Processes - Update</code> to keep this table up to date and to age out old child processes.
id: e91bd102-d630-4e76-ab73-7e3ba22c5961
investigations:
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76