Update lnx_susp_named.yml

2020-11-29 21:31:54 +01:00
parent 769ef23ccf
commit 871f965109
1 changed files with 4 additions and 4 deletions
@@ -10,10 +10,10 @@ logsource:
    product: linux
    service: syslog
 detection:
-    keywords|contains:
-        - ' dropping source port zero packet from '
-        - ' denied AXFR from '
-        - ' exiting (due to fatal error)'
+    keywords:
+        - '* dropping source port zero packet from *'
+        - '* denied AXFR from *'
+        - '* exiting (due to fatal error)*'
    condition: keywords
 falsepositives:
    - Unknown