junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
junk
2024-12-03 11:24:34 -05:00
parent b51508db2f
commit 8ef4e7b183
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
splunk_alert.md
View File

@ -18,4 +18,17 @@ priority="High"
| eval indextime = _indextime | eval indextime = _indextime
| convert ctime(indextime) | convert ctime(indextime)
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority
``` ```
# Permissions
- Display For: App
- Read: Everyone
- Write: admin
# Schedule
- Schedule: Run on Cron Schedule
- */15 * * * *
- Time Range: Since date time
- Schedule Priority: Default
- Schedule Window: Auto