From f808a4eb4a444f7cfc99f8e665b2aeb39db4bc36 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 13 Jan 2022 17:57:34 +0100
Subject: [PATCH] Update
 linux_possible_append_command_to_profile_config_file.yml

---
 .../linux_possible_append_command_to_profile_config_file.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index 9038d4f07b..71b0a912e0 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -21,7 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. 
-known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed 
+known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
 - https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
 - https://attack.mitre.org/techniques/T1546/004/