Update splunk_alert.md

2024-12-03 11:24:34 -05:00
parent b51508db2f
commit 8ef4e7b183
1 changed files with 14 additions and 1 deletions
--- a/splunk_alert.md
+++ b/splunk_alert.md
@ -19,3 +19,16 @@ priority="High"
 | convert ctime(indextime) 
 | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority
 ```
+
+# Permissions
+    - Display For: App
+    - Read: Everyone
+    - Write: admin
+
+# Schedule
+    - Schedule: Run on Cron Schedule
+    - */15 * * * *
+    - Time Range: Since date time
+    - Schedule Priority: Default
+    - Schedule Window: Auto
+