name: ProxyShell ProxyNotShell Behavior Detected Unit Test
tests:
- name: ProxyShell ProxyNotShell Behavior Detected
  file: web/proxyshell_proxynotshell_behavior_detected.yml
  pass_condition: '| stats count | where count > 0'
  earliest_time: -24h
  latest_time: now
  attack_data:
  - file_name: proxyshell-risk.log
    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell-risk.log
    source: proxyshell
    sourcetype: stash
    update_timestamp: true