From f3a0b8c982eef5bbf2ce6d4e763f059afe1604fb Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Mon, 2 Mar 2020 14:05:04 -0800
Subject: [PATCH] removing status field from spl

---
 detections/remote_registry_modifications.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/remote_registry_modifications.yml b/detections/remote_registry_modifications.yml
index 26760fa3ee..d2d8fd0b88 100644
--- a/detections/remote_registry_modifications.yml
+++ b/detections/remote_registry_modifications.yml
@@ -31,7 +31,7 @@ detect:
       search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as
         registry_key_name values(Registry.registry_path) as registry_path min(_time)
         as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="\\\\*"  by
-        Registry.dest , Registry.status, Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+        Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
         | `drop_dm_object_name(Registry)`'
       suppress:
         suppress_fields: dest, user,registry_path
@@ -99,7 +99,7 @@ mappings:
   nist:
     - PR.PT
     - DE.CM
-modification_date: '2018-05-31'
+modification_date: '2020-03-02'
 name: Remote Registry Key modifications
 original_authors:
   - company: Splunk
@@ -109,4 +109,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '2.0'
+version: '3.0'