admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removing status field from spl

Browse Source
This commit is contained in:
bpatel
2020-03-02 14:05:04 -08:00
parent 7c4258999a
commit f3a0b8c982
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/remote_registry_modifications.yml
+3 -3
View File
@@ -31,7 +31,7 @@ detect:
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as
registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by
Registry.dest , Registry.status, Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)`'
suppress:
suppress_fields: dest, user,registry_path
@@ -99,7 +99,7 @@ mappings:
nist:
- PR.PT
- DE.CM
modification_date: '2018-05-31'
modification_date: '2020-03-02'
name: Remote Registry Key modifications
original_authors:
- company: Splunk
@@ -109,4 +109,4 @@ references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'
version: '3.0'