name: Github Commit Changes In Master Unit Test tests: - name: Github Commit Changes In Master file: detections/endpoint/github_commit_changes_in_master.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - file_name: UPDATE_FILE_NAME data: UPDATE_DATASET_URL source: UPDATE_SPLUNK_SOURCE sourcetype: UPDATE_SPLUNK_SOURCETYPE