From e66bb09cf4e2c067a6b6d2bf47446220cdd04b07 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 7 Jan 2025 12:15:23 -0800 Subject: [PATCH] updating macro --- macros/ms_defender.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/ms_defender.yml b/macros/ms_defender.yml index bed2e5be4f..62b3d7beaa 100644 --- a/macros/ms_defender.yml +++ b/macros/ms_defender.yml @@ -1,4 +1,4 @@ -definition: ( source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational" +definition: source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. name: ms_defender