[
    {
        "name": "ESCU Default Configuration Anomaly",
        "id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216",
        "date": "2021-12-21",
        "author": "Patrick Bareiss",
        "description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.",
        "scheduling": {
            "cron_schedule": "0 * * * *",
            "earliest_time": "-70m@m",
            "latest_time": "-10m@m",
            "schedule_window": "auto"
        },
        "rba": {
            "enabled": "true"
        },
        "tags": {
            "type": "Anomaly",
            "product": "ESCU"
        }
    },
    {
        "name": "ESCU Default Configuration Baseline",
        "id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
        "date": "2021-12-21",
        "author": "Patrick Bareiss",
        "description": "This configuration file applies to all detections of type baseline.",
        "scheduling": {
            "cron_schedule": "0 * * * *",
            "earliest_time": "-70m@m",
            "latest_time": "-10m@m",
            "schedule_window": "auto"
        },
        "tags": {
            "type": "Baseline"
        }
    },
    {
        "name": "ESCU Default Configuration Correlation",
        "id": "36ba498c-46e8-4b62-8bde-67e984a40fb4",
        "date": "2021-12-21",
        "author": "Patrick Bareiss",
        "description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.",
        "scheduling": {
            "cron_schedule": "0 * * * *",
            "earliest_time": "-70m@m",
            "latest_time": "-10m@m",
            "schedule_window": "auto"
        },
        "notable": {
            "rule_description": "%description%",
            "rule_title": "%name%",
            "nes_fields": []
        },
        "tags": {
            "type": "Correlation",
            "product": "ESCU"
        }
    },
    {
        "name": "ESCU Default Configuration Hunting",
        "id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b",
        "date": "2021-12-21",
        "author": "Patrick Bareiss",
        "description": "This configuration file applies to all detections of type hunting.",
        "scheduling": {
            "cron_schedule": "0 * * * *",
            "earliest_time": "-70m@m",
            "latest_time": "-10m@m",
            "schedule_window": "auto"
        },
        "tags": {
            "type": "Hunting",
            "product": "ESCU"
        }
    },
    {
        "name": "ESCU Default Configuration TTP",
        "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
        "date": "2021-12-21",
        "author": "Patrick Bareiss",
        "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
        "scheduling": {
            "cron_schedule": "0 * * * *",
            "earliest_time": "-70m@m",
            "latest_time": "-10m@m",
            "schedule_window": "auto"
        },
        "notable": {
            "rule_description": "%description%",
            "rule_title": "%name%",
            "nes_fields": []
        },
        "rba": {
            "enabled": "true"
        },
        "tags": {
            "type": "TTP"
        }
    }
]