mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
1 line
2.4 KiB
JSON
1 line
2.4 KiB
JSON
{"deployments": [{"scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Anomaly"}, "name": "ESCU Default Configuration Anomaly", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216", "description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.", "rba": {"enabled": "true"}}, {"scheduling": {"cron_schedule": "10 0 * * *", "earliest_time": "-1450m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Baseline"}, "name": "ESCU Default Configuration Baseline", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "0f7ee854-1aad-4bef-89c5-5c402b488510", "description": "This configuration file applies to all detections of type baseline."}, {"scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Correlation"}, "name": "ESCU Default Configuration Correlation", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "36ba498c-46e8-4b62-8bde-67e984a40fb4", "description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.", "notable": {"rule_description": "%description%", "rule_title": "%name%", "nes_fields": ["user", "dest"]}}, {"scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "Hunting"}, "name": "ESCU Default Configuration Hunting", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b", "description": "This configuration file applies to all detections of type hunting."}, {"scheduling": {"cron_schedule": "0 * * * *", "earliest_time": "-70m@m", "latest_time": "-10m@m", "schedule_window": "auto"}, "tags": {"type": "TTP"}, "name": "ESCU Default Configuration TTP", "author": "Patrick Bareiss", "date": "2021-12-21", "version": 1, "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b", "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.", "notable": {"rule_description": "%description%", "rule_title": "%name%", "nes_fields": ["user", "dest"]}, "rba": {"enabled": "true"}}]} |